IBM Security Guardium Data Protection Reviews

This solution is for database security and protecting the core of the data. It allows us to put in controls to make sure that only the right persons access the proper records in the database. It prevents unauthorized access.

For example, a customer may want to restrict the database so that it is accessible only from within a specific application. This means that the database administrator will not be able to access the data from outside of the application, as is normally allowed by their administrative rights. It can prevent the administrator from seeing or modifying any data for which they are not allowed to do so.

It is also possible to set specific permissions, such as restrictions on the field, table, or record level of the database. Only people with explicit permissions can view or modify the data.

One of our clients is a passport authority, and they were able to successfully apply this solution to detect corruption within their organization. There had been some employees who had been illegally changing the status of some residents in return for money. Once this solution was deployed, they detected that somebody was making those changes in the database, caught the people, and stopped it from happening again. It was a big finding.

This solution has a lot of functionality and there are hundreds of use cases for it. We are talking about the database, which is the main business core for the company that holds all of the data. The features used by any one customer are dependent on their requirements and the relevant regulations.

That said, IBM Guardium has a lot of capabilities, even compared to other solutions on the market. It can do everything from detection to prevention, and it provides reports about this as well.

The biggest complaint that I hear from customers and users is that using this solution requires database skills, yet it is a security and monitoring tool. Specifically, it is a tool that is used for monitoring the database administrator. The database expert will not want you to implement control on top of him, so you instead need to utilize a person from security. However, security people do not have a complete set of database skills. So, there is always a gap in the administration and the person who is going to manage this tool. As such, the person using this tool feels that it is complicated, doesn't know where to go and what to do.

I have heard that the latest version has better support, with better access, and a better GUI that is easier to use than before. At the same time, this is still one of the main concerns that I always hear from the customers.

The second most common complaint that I hear is in regards to the support from IBM. Some of the cases are open for a very long time because they do not have local engineers to come and look at the issues. In our region, my company is providing 24/7 support to help close these gaps. This has strengthened our presence in the market, but in other regions, this is still a complaint that customers have.

The feedback that I have heard from customers, and my team, is that the solution is very stable. It does not require a lot of things after it is set up for the first time. Once it is fine-tuned, you do not need to do much other than generate and show reports.

At the same time, I do still hear complaints directly from customers about stability. Specifically, it has to do with making changes. If there is an S-TAP agent installed on the service then sometimes the configuration needs to be changed. This might be by adding a new rule or policy. After this, the server needs to be restarted. It is impossible to frequently stop and restart a service when it is in production.

My team justifies this by saying that it only happens infrequently, at a rate of perhaps once a year. However, the customers still see it as a very difficult task that makes their lives tough. Other than this, I have not heard any complaints about stability.

This is a highly scalable solution, but it requires a lot of resources.

For example, I know of a big bank that has been a long-time user of this solution, but they were looking to replace it because they need forty-four Guardium severs in order to monitor their entire database farm. They feel that this is too much and will cost a lot. They do not have a new solution at the moment, although they are looking at other options.

Before this solution existed, people did not have really have anything in place. It was a new concept and it became critical when people came to understand database risks. In 2011 or 2012, many banks started to use Guardium, and since then, it has been spreading to other sectors such as government, transportation, and healthcare.

The complaints that we have heard are about IBM support in general and are not specific to the Guardium solution. There are gaps because they do not offer local support in every region. 

I cannot recall an instance where a customer switched to this solution from another one that they already had in place.

We have been assisting people with migrating from earlier versions to the current version.

The installation of the database, itself, is very easy and straightforward. 

The initial setup involves configuring the database connection with Guardium so that it monitors it correctly. It also depends whether you want to deploy the protection method or not, which means that you need to deploy the S-TAP agent on the service where the database resides.

Beyond that, most of the configuration is in the policy, itself. This changes based on what you would like to monitor, what you want to prevent, and what kind of queries you want to block. For me, fine-tuning the policy is one of the most important elements of the implementation. It also depends on the customer's knowledge, and whether the customer knows exactly what he needs. Some customers want you to not only deploy the system but also to create the policy. You have to translate their internal policy into a configuration, which can really take a long time.

When you deploy using the basic implementation, it is usually only a week or two before you get complaints from the customer. They don't see the value in the solution because they are overwhelmed. So, fine-tuning the policy takes time, and it should be taken very seriously and with care.

If the customer knows exactly what he needs then the deployment can be done in two weeks.

In terms of maintenance, it does not require a staff member full time. One person can dedicate perhaps three hours a day for monitoring, reporting, and doing a health check of the system. We sometimes offer visits to customer sites daily or weekly. For example, we can assist the customer for two hours per week to monitor the system and ensure that everything is working properly. It really doesn't require much work.

Because we are a distributor, we work between the partner and the vendor. When it comes to implementation, we can either assist the partner or work with the customer directly, based on what the customer wants.

Our Guardian expert is dedicated to that product, and will either visit the customer to perform the implementation himself, or he will align with a partner and they will go together. Most of the implementations are handled by ourselves.

I have not specifically calculated the ROI for any of our customers. However, I have shown them general ROI. For example, one incident of losing one record, either by mistake or intentionally by one of the admins, will cost you a certain amount. Moreover, it is important to consider how much you will pay to not have this happen again. These types of losses in the database may be critical data and can affect the company's reputation.

In general, deploying this solution will cost very little compared to the cost of losing data.

In the past, the pricing of IBM Guardium was very complex. It was dependent on the number of CPUs and other things to support the servers. Nowadays, things have changed. Pricing is dependent on the number of databases and the number of servers.

The licensing fees are paid yearly. One of the deployments that I know of had three databases, and the yearly fees are approximately $50,000 USD.

There are some additional add-ons that are available, but I do not see many people taking them. There is encryption, and there is a Guardium Inspection license, but I am not sure of the costs.

The main competitor in the market is Imperva. They were originally not allowed in the Kingdom because of their country of origin, but they now have a local Saudi team. Some customers were approached by Imperva and did not know of Guardium, and simply went with that solution.

There is also a phenomenon in the market that is quite common when a new technology comes from the outside. Even if people don't have the full picture or details about the existing one, they feel that it is "old". Everybody has it, and they need something new. Because of this, we see a lot of people making the choice to go with Imperva. 

When it comes to implementing this solution, it is important for people to know exactly what they need to do. This includes what they need to monitor, what they need to protect, and what kinds of queries they want to prevent. They shouldn't rely on having this tool teach them what they need to do.

Next, people need to make sure that they are getting proper support. This can be from the vendor, by having an advanced SLA for example, or a strong local partner to help them. If they have any trouble, especially something urgent, then they want to have this support in place.

The third thing is to have somebody who is trained to take care of the system. Assuming that it is easy and that anybody can handle it will be the start of a larger problem. It will not seem too much at the beginning, but after a year they will be unhappy with the product.

It is important to recognize that there are several milestones for any Guardium project. Our consultant, for example, is an expert in that domain. He usually submits a project plan showing the implementation stages for the project. There are prerequisites that have to be put in place and verified, then Guardium deployed on the server. This can be either a physical or virtual server. Then the database configuration begins, which is followed by the fine-tuning phase. Finally, all of the appropriate documentation for these aspects has to be compiled. The length of time required for all of this depends on the requirements.

I would rate this solution an eight out of ten.

As a registered IBM Business Partner, our main interaction is to deploy Guardium at client sites.

• Audit Process Builder – Workflow generator to enhance audit tasks and compliance workflows.
• Compliance Quick Start – Quick, GUI, step-by-step guide to automate compliance and give the customer a quick ROI.

Needs easier integration with custom applications.

I would give the product a score of eight out of 10. This is due to its deep level of granularity and guided process/audit workflow generation.

Guardium is used based on our Manual of Internal Procedures (MPI), and its uses range from creating a rule to generating customized reports. The main use case is the procedure "Investigate Incidents Recorded by Unauthorized Access," with action "notify by electronic message the manager and/or leader of the area."

Improved security through the visibility and control of all access to the databases.

The most valuable feature is using the capture operation mode “S-TAP/K-TAP agent”, because all activities in the database are captured, including direct access to the database server by privileged users. This is useful because, even if the database server logs were deleted, the Guardium Collector has already stored such data to enable traceability of access.

I have already mentioned to IBM that a primary need is to improve the number of records in the reports above 65,535.

Depending on the policy and rules applied, there is a need to increase the minimum requirements (RAM and storage - HD) for better operation and not to experience hardware slowdowns due to the high flow of traffic. IBM brings the "minimums" and "recommendation." From experience in versions 9x and 10x, when installing Guardium, it's important to verify the "recommendation" requirements of IBM for stability. It is worth mentioning that the requirements (minimums or recommendation) are different for Collector and aggregator.

The two major Database Audit and Protection (DAP) solutions are IBM Guardium and Imperva SecureSphere. There are two modes of operation of these solutions: remote agent and sniffer (out-of-band). I recommended using the remote agent to obtain direct access captures on servers. 

Note that in non-mainframe environments, both solutions are scalable. For the mainframe environment, Guardium has updated installation agents with the latest kernels and releases. This makes a big difference in companies with mainframes, so it is necessary to keep the technology pack updated.

Regardless of the mode of operation, when increasing the number of servers monitored it is important to re-evaluate or perform new sizing. The possible number of databases and database servers which can be monitored by Guardium is high. For me, this is a differentiator of IBM.

On a "bad, good, and excellent" scale, I rate it as good.

Initially, there were two solutions to be evaluated: Oracle and Imperva. Oracle DAP was not evaluated because it does not monitor Linux or Windows Server-only environments. 

I evaluated Imperva and got good results. However, there is a delay by Imperva in creating updated agents for Linux and Unix, including for mainframe. For me, this is a problem because it is necessary to always keep the environment up to date. If you update the kernel or release of mainframes and do not have the agent upgraded, the DAP will not monitor.

For those who do not have experience, it is complex. There are several configurations to be made, from the configuration of NTP, IP, Mask, registration of the Collectors in the Central Manager, integration with other tools like storage (backup), LDAP, SIEM, through to the application of the policies and customized rules. Note: There are some pre-set rules that can also be customized.

The price of Guardium is higher than the main competitor, Imperva. In addition, it's complex as the calculation of the licensing is done by Processor Value Unit (PVU).

However, before purchasing a DAP solution, it is important to analyze specific points to evaluate the cost-benefit of each tool. For example: Does the environment to be monitored have mainframes? If so, it's a point for Guardium. If not, a point for Imperva. Note: IBM is looking into a new licensing policy and reducing the price of Guardium.

1. Read important articles related to DAP such as the "2017 Planning Guide for Security and Risk Management."
2. Gather information from the servers (operating system with version and database types with the versions) of the environment to be monitored.
3. Check which DAP solutions can monitor the environment.
4. List the “mandatory requirements” and “non-mandatory requirements.” It is important to have in mind which points will be evaluated.
5. Request PoCs with the main DAP manufacturers (IBM, Imperva, and Oracle).
6. Do the sizing with the topology to get an idea of the requirements and cost of the project.

Database encryption.

• Encryption
• Data activity monitoring
• It has a set of modules.
• I compliment with Optum for a data masking solution.

An integration with Optum. Optum is another solution, but it is a segmenting software, portfolio not security. However, I am selling them together as one solution, Guardium and Optum.

I am dependent on my team for support of this product.

My main solution was Micro Focus voltage data encryption solution, but it was too complicated. 

Encryption is not straightforward, but Guardium made the setup easy for us.

Most important criteria when choosing to partner with a company: I started working with IBM only one year back. When I started a partnership with them, IBM had the security portfolio which covered most of the region where my customers were. IBM has a name with the support along the quality of its products.

Database activity management to ensure compliance audit regulations. It is also to manage risk. It is performing well, but we have a large journey to go.

Previously, we had no monitoring for our databases. Now, we have the ability to  begin to understand how people, applications, and service accounts are interacting with data to better protect it.

We use IBM Guardium to support security initiatives and compliance policies.

We have integrated IBM Guardium with QRadar.

Being able to go back to see what people are touching, and when they are touching it, then look at the risk of who is touching what and how they are touching the data. This will give us a better understanding of how people interact with our data. 

We do not use many of the advance features, but we will soon. We are looking at Sensitive Data and User Behavior Analytics.

It will not go as fast as you want. 

We are about 50 to 60 percent there. A lot of that has to do with us implementing it a little better, and redesigning what we thought would be their protection. We need to do a bit more efficient architecture, as some things are coming down the pipeline for the roadmap of the product.

The scalability is not an issue, though it is not the easiest thing to scale. However, I seen the coming roadmap, where the scalability will be easier.

I would rate technical support as fair. Unfortunately, it takes time to figure out an answer to our issues, because they are unique, not just a standard answer.

It is very complex.

Pushing agents and tabs seems pretty standard from a technical perspective. Once you start interacting with people's databases, they get very hesitant. Then, the amount of social tasks to socialize the solution ensuring people are comfortable with it became a much heavier lift.

There are a lot of things that could be better, but it is performing pretty well.

Take your time and learn each step. Make sure that you understand each step, because if you miss something, it will come back. Then, you have to circle back and figure it out anyway.

Most important criteria when selecting a vendor:

• Price
• Support
• Reliability in the marketplace
• Integration with other systems.

We are monitoring about 1500 or more applications, we have 150 million customers and their PHI/PII data in the repository. We have to protect that data. That is a big challenge because it's a vast environment that we have to protect. That is one of the prime use cases which caused us to select this product.

Initially, we had some challenges, but as we talked with IBM and they provided some good support on it, now we are evolving pretty well. Certainly, everything is not perfect yet, but we are moving into that direction. We are far better than we were two years back.

We use Guardium to support security initiatives and compliance policies within the organization. For example, an audit comes in once every three months or six months. In that case they ask specific questions and they say, "Hey, just check the box if you are doing this stuff or not," and we are providing them all the evidence that we have collected through Guardium.

It helps comply with industry regulations. It's basically the same thing. If somebody wants to know if we are protecting their data or not and, if yes, how? And they ask us to present the definitions of what we are doing, we just go and get the reports that are required. Let's say for a particular application, it says "This database was down last night, who did it, and how?" we provide all that kind of information.

The solution has definitely saved us time, because if you want to monitor this kind of vast environment of different products, it's going to take a lot of time. Let's say one database server has 100 database instances running on it; I don't need to install 100 data instances, I just need to install on the one database server and that will cover all of my instances on that particular database. 

In terms of saving money, today, if you want to monitor and protect your environment, you have to spend money. So, that's not a question.

In terms of advanced features, we are using the Database Activity Monitoring and the Vulnerability Assessment as well. Now we are thinking of using the GDPR because that's going to be a compliance as well. So some but not all of them.

Initially it did not have support external applications like, say, Tableau, ServiceNow, Remedy, and the like. They have started growing into it, but I would like to have more and more integration with outside applications. So that, let's say my one of my application owners has Tableau and wants to directly report on that; if I can just pick and see that report with one click, that would help.

It's stable. When I used this product back in 2007 it was challenging, but now it's it's stable.

The scalability is not that easy to use because, you need a lot of knowledge about it, on data security; basically you need to know where your sensitive data is. We tried to use Guardium for that, to find out with the Discovery feature, but it didn't work, because we had a lot of irregular data. We found it ourselves, but Guardium is protecting it; so that's good for us.

I would say eight and a half out of 10. I've been in this Guardium stuff for the last 10 to 11 years. I have worked with IBM throughout that time. It has improved, but still it is eight and a half out of 10.

It was pretty straightforward.

I would definitely recommend it. It's easy to use and it can save a lot of headaches, by just implementing it and being able to ask at the time of audit. When it comes to audits, every company wants to be safe.

Database monitoring. At the moment, we are using it to do a lot of data discovery from a data classification for structured data.

Its ability to find data. Once I find data, I can leverage it to perform specific select statements against PII data and do smarter controls rather than monitoring the entire database. 

My only negative thing on Guardium would be it is too smart. I am struggling getting through to social. In an ideal world, I would be able to populate every US zip code and have Guardium find the number, then identify it as a zip code. Right now, I have to pull it down and compare it.

It is a stable product. We just finished upgrading to version 10, and had no issues with the upgrade. We are excited about working with the newest version.

It should meet our need going forward as it is a huge product. We have scanned 7000 SQL databases and 1500 Oracle Databases.

We have a strong partnership with IBM. Their tech support is very knowledgeable.

The initial setup was before me.

We are doing what we call a reboot of the product. We are calling it the Guardium reboot project. We are starting back with the classifications to understand what controls we are implementing, thus stepping back to step forward. We are doing this because in the beginning we moved forward by getting everything monitored without being smart about what data was monitored.

We implemented the most recent upgrade in-house.

Most important criteria when selecting a vendor: At the end of the day, it would have to be the support and relationship. There are a lot of smart people out there building products which do things. However, not everyone can use them, and without having someone to call, it is sort of its own disadvantage. 

• Database access monitoring
• Vulnerability assessment
• PCI compliance
• SOX compliance
• GDPR compliance 

• It provides us regulatory compliance proof and evidence for audit. 
• It allows us to find bad actors. 
• It allows us to find people who are doing stupid things, and do it without the intervention and loss of data integrity of the people that we are monitoring manipulating the data.

We have integrate IBM Guardium with ArcSight and Splunk.

The ability to collect the data without database administrators being able to modify it.

• There are some GUI improvements that I have provided to development already.
• Performance and the ability to use resources could be improved. 
• The ability for Central Managers to talk to one another could be improved. I have 26 Central Managers and 26 silos which are independent.
• Some of the data handling or data recording could be improved. We are doing it with external software, components, etc. 

For the most part, it is stable. Depends on the year.

It has scaled. It was pulling teeth, but it does scale. 

We taught IBM about the limits of the product. They did not think there were limits to the product. There were, because we do very extensive testing of performance. We can tell you when a product is going to break. Their development thought this was valuable because they do not have the facilities to do this sort of extensive testing.

Technical support is very knowledgeable now. 

At one time, they were horrible since they were blue washed. After the blue wash and a couple of years on the honeymoon, then they have gotten considerably better. They have had problems understanding that they do not know as much about the company's environment as the employee does. This will result in them downgrading tickets, and they will just do it on the fly. This is not a good thing because they do not understand the issue. This may not look like a sub 1 ticket to IBM support, but it is.

We went in and tested it. We continually test everything that is in the industry. Guardium has significantly gone past the mark of acceptable every single time, as compared to their other competitors.

Overall, it is a very solid product.