IBM Guardium Review

Provides database activity monitoring. Can discover databases on your network and find their vulnerabilities.

• Monitors database activities of end users who are connected to databases (DBAs and developers)
• Classifies critical objects on the databases
• Discovers databases on your network
• Finds vulnerabilities of your databases
• Blocks critical activities

• Helps us define and monitor critical data in the environment, even when stored in RDBMS, big data, or unstructured files.
• Helps us to pass compliance audits, such as like HIPAA, SOX, and PCI.

The blocking and dynamic data masking features need improvement.

I am working as an IBM partner. We have provided solutions for nearly 50 customers for five years. Most of our customers are banks and telecoms.

IBM Security Guardium is a mature product. Although it needs agents on the server to monitor their database or file traffic, we did not encounter serious issues so far.

IBM has three layers for Guardium support. In critical cases, technical support analyzes the issues very quickly to find a solution.

I did not use another solution before this one.

The setup is straightforward. There is an ISO file that is developed by IBM that contains all of the OS and Guardium application files. All that remains to be done is to configure the post-installation settings.

Licensing is the worst part of the product. This is because IBM uses Processor Value Units (PVUs) to calculate the license. The customers complain about this.

In the latest version of the product, there are four types of licenses:

• DAM (Database Activity Monitoring)
• DAM Advanced
• FAM (File Activity Monitoring)
• FAM Advanced

If you only need database activity monitoring, then DAM is enough.

If you need blocking and masking features, you will need the DAM Advanced license.

I did not evaluate other options. I am an IBM partner.

There are three main steps when implementing a Data Activity Monitor (DAM) solution.

1. Discover and Classify: Find your databases in your environment, and decide which one of them has confidential data that you need to monitor. Classify your data in your database if it includes critical data like personal ID, credit card, or IMEI numbers.
2. Monitor Activities: Monitor all end-user activities while developing your policy rules and critical activities.
3. Block Critical Activities: Define and block critical activities to prevent data leakage.