Simulating and mitigating threats with IBM Guardium Analytics

IBM Security Guardium protects both structured and unstructured data across databases, big data environments, and file systems against threats while ensuring compliance. Guardium collects monitored data, which is filtered through policy rules and stored as activities, exceptions, policy violations, and more. This data is accessible through Guardium tools, such as reports and dashboards, and can trigger alerts. While this data is beneficial for compliance, achieving real security requires filtering out noise and focusing on genuine threats.

To enhance security, Guardium uses Machine Learning (ML) and Analytics capabilities. The following features are part of Guardium Analytics:

• Active Threat Analytics (ATA): The Active Threat Analytics dashboard shows potential security breach cases based on outlier mining processes and identified attack symptoms. In this dashboard, you can view, investigate, and take actions on individual cases.

• Risk Spotter (RS): A first-of-its-kind technology that changes the security paradigm to an Artificial Intelligence Data Protection Policy. It uses a holistic algorithm to dynamically assess risk factors and a smart algorithm to identify potential risks across your entire system.

• Realtime Trust Evaluator (RTTE): Evaluates the application connections monitored by Guardium. Connections are classified as "untrusted," "evaluated," or "trusted," with trust scores (values from 0 to 100) assigned to each classified connection. Connections that are not classified as trusted or untrusted are classified as evaluated.

To demonstrate these capabilities in a PoC environment or with a customer, we have developed data generation scripts. By running these scripts, one can generate malicious activities with the database, which can be captured by Guardium Data Protection and populate these analytics dashboards.

Prerequisites

• Guardium Data Protection 12.x version with STAP connection from a MySQL 8.x database
• Python 3.9.2

Threat simulation data scripts

The threat simulation scripts cover the following types of attacks:

Failed login attempts

These scripts simulate attempts to log into the database system using either an imaginary user ID and password or a valid user ID with incorrect passwords. The scripts can be configured to run a specified number of times, such as 3, 5, or 10 attempts, allowing Guardium to capture these violations. Failed login attempts can be the initial step in stealing critical production database credentials, potentially leading to unauthorized access to production systems.

High-volume activities

An unusually high volume of activities performed by a user or group of users on a database system is classified as high-volume activities. These activities may indicate a potential data exfiltration attack.

Off-work activities

When high-volume scripts or their subsets are executed late at night or on an unusual day of the week, the analytics engine automatically classifies them as off-work activities due to the timing and volume of these actions. This form of behavioral monitoring helps in identifying potential insider attacks.

Suspicious DDL and DML activities

Suspicious data definition language (DDL) and data manipulation language (DML) activities include actions such as a sudden granting of privileges to a user, the deletion of a user or object, a new user accessing sensitive data, or an existing user accessing a database object they have never accessed before. These activities are captured under Sensitive Objects Access, Select Activities, and New Grants.

Malicious stored procedures

Stored procedures that trigger errors during execution may be classified as malicious stored procedures. These errors could occur due to operations on unavailable database objects, such as executing a SQL statement on a non-existent table or performing delete operations within the stored procedures.

Assessment from Guardium

The following images illustrate various detected activities.

Failed login attempts

Off-work activities

Suspicious DB activities and high-volume activities

New grants

Malicious stored procedures

Summary

By executing these scripts and enabling Risk Spotter, Active Threat Analytics, and security policies in Guardium, these threats are effectively identified and reported, allowing for timely mitigation.

Next steps

The scripts are available in the GitHub folder. The scripts can be extended to include additional test scenarios or used as-is.

For detailed documentation about Guardium Analytics, see IBM Security Guardium Data Protection.