IBM Security Guardium Data Protection Reviews

Database logging and audit functions are the most valuable features. In some fields like banking, it's very important to be aware of the actions of database users, and ensure that those without the permission to access information do not access it.

We succeeded at hardening our customer databases by defining policies for alerting and blocking access to prohibited and restricted data.

I would like to be able to upgrade appliances within major versions without needing to rebuild the appliance. Once, I tried to upgrade a Guardium Appliance from v9.5 to v10 and there was no available patch for that. Therefore, the solution was to back up the appliance data, rebuild the appliance with the v10 image and then restore the data. This procedure is highly risky, because you can lose all the data if the restoration does not succeed. Installing a patch is much easier and there is no data loss risk!

I have used it for 2 years.

I have not encountered any stability issues.

I have not encountered any scalability issues.

Technical support is unsatisfactory. IBM Support failed to provide me with the v9-v10 upgrade patch as it is suggested on a upgrade roadmap technote.

Back when I was a developer, I developed an audit trail module in Java/JEE. Obviously, it was not as sophisticated as Guardium.

Initial setup was straightforward.

Before choosing this product, I did not evaluate other options. We implement exclusively IBM products.

At first, IBM Guardium may seem complicated, but once you learn the basics, it becomes simple to use.

• Database Activity Monitoring: Fulfills the international standard security requirements, such as PCI DSS
• It is very transparent on all of the query access controls of the monitored databases

According to my client, it fulfills the PCI DSS standard requirements that are implemented in his bank.

The graphics are so lame. I am sure that the latest version of Guardium, Version 10, would have improved it perfectly.

I see that they have improved the chart and diagram in the latest version of Guardium. However, there are some limitations on how the chart displays the data for analytic needs.

I am not sure if Guardium has the dashboard design to see the information much better.

I have used it for three years.

We did encounter stability issues. Do not upgrade directly to the latest fix pack unless people have confirmed that it is stable.

There were no scalability issues.

Technical support is always available for you. I suggest the following:

• Call IBM and make a Severity 2 request instead of Severity 3 request.
• Ask them to provide remote access to your system right away.
• Prepare the log files that they usually request.

They have changed the way of licensing. It is no longer according to your core. It is now based on how many servers you use. The price should be way less expensive.

• Monitors database activities of end users who are connected to databases (DBAs and developers)
• Classifies critical objects on the databases
• Discovers databases on your network
• Finds vulnerabilities of your databases
• Blocks critical activities

• Helps us define and monitor critical data in the environment, even when stored in RDBMS, big data, or unstructured files.
• Helps us to pass compliance audits, such as like HIPAA, SOX, and PCI.

The blocking and dynamic data masking features need improvement.

I am working as an IBM partner. We have provided solutions for nearly 50 customers for five years. Most of our customers are banks and telecoms.

IBM Security Guardium is a mature product. Although it needs agents on the server to monitor their database or file traffic, we did not encounter serious issues so far.

IBM has three layers for Guardium support. In critical cases, technical support analyzes the issues very quickly to find a solution.

I did not use another solution before this one.

The setup is straightforward. There is an ISO file that is developed by IBM that contains all of the OS and Guardium application files. All that remains to be done is to configure the post-installation settings.

Licensing is the worst part of the product. This is because IBM uses Processor Value Units (PVUs) to calculate the license. The customers complain about this.

In the latest version of the product, there are four types of licenses:

• DAM (Database Activity Monitoring)
• DAM Advanced
• FAM (File Activity Monitoring)
• FAM Advanced

If you only need database activity monitoring, then DAM is enough.

If you need blocking and masking features, you will need the DAM Advanced license.

I did not evaluate other options. I am an IBM partner.

There are three main steps when implementing a Data Activity Monitor (DAM) solution.

1. Discover and Classify: Find your databases in your environment, and decide which one of them has confidential data that you need to monitor. Classify your data in your database if it includes critical data like personal ID, credit card, or IMEI numbers.
2. Monitor Activities: Monitor all end-user activities while developing your policy rules and critical activities.
3. Block Critical Activities: Define and block critical activities to prevent data leakage.

All the features are useful for the customer and they have many use cases, especially for DB protection.

They have a module called Redaction. For query rewriting, it can protect some data stored in the table by the DB admin to return the masked data, in case he tries to view our customer personal information such as phone numbers,names, account number etc.

In some cases it blocked the bad user from deleting or copying data , For example, in use cases to block creation of the users on the DB without filing forum/ following the company policy.

It provides the customer to help secure the DB, especially for the multi-DB environments. It also provides visibility for the DB activity, secures the customer information in the DB, from any privilege misuse by an insider.

The FAM module needs to be improved. This module is for file activity monitoring and here if IBM would focus on marketing this part, it will be good as the end-user can monitor any configuration file in servers and not only the DB.

I have used this solution for around six years.

Some issues have been experienced but no big issues as such. The solution is 90% stable.

We have not encountered any scalability issues.

I would give the technical support a 9/10.

The setup was very easy. It took us around one day to set it up and running.

You should make sure of the DB size before you buy the product. It is also important to define the requirement very carefully as it could affect the sizing. You should make sure of the monitoring mode that they would like to apply.

We looked at the Oracle and Imperva solutions.

Take care of the scope and the monitoring mode. Also, if the size of the DB is high then do not do it over virtual.

Heterogeneous support for data activity monitoring. I have not been able to find any other product that can monitor as many platforms from one application. Guardium can monitor Windows servers, Linux, Unix, mainframe, and big data environments from one policy. Guardium captures data access activity across networks and local connections.

We now have one go-to application for all data monitoring. This has decreased the number of skills needed and enabled a faster route to compliance. Reporting is automated and activity alerts are routed to the appropriate responders.

While Guardium is great at structured monitoring (DAM), the product is lacking features on the file activity side (FAM). We would also like to see tighter integration with Active Directory and Exchange monitoring.

I have been using Guardium for seven years.

We had some minor issues with earlier versions around agent compatibility. These were solved through support.

Guardium scales easily. Simply add another collector appliance and the system will balance the load across all available appliances.

IBM support has been responsive and we rarely need to escalate.

Previously, we were using home grown scripts and native database tools. The issue with this approach is the need for expertise on every platform and ending up with dozens of tools to manage.

Guardium is an enterprise class product and, with that, does require some training. I would suggest any enterprise looking to implement Guardium to purchase some amount of services. There is an option for Quickstarts. Once you understand how the agents work and have setup the first few, the rest are relatively simple. The real work is aligning your business goals with the Guardium policies you create. We often know we need to monitor a system but are not exactly sure what policy is needed. There has to be collaboration between IT, business owners, and compliance.

Previously, Guardium fell under the IBM PVU license model. This was complicated to license and costly. The new license structure is per server and includes all features. Now we simply count the number of servers to monitor and purchase accordingly.

Besides native database auditing, which is very resource intensive, and homegrown tools, there are not a lot of options out there. The closest competitor is Imperva. Imperva is a close second. We chose Guardium over Imperva based on the ability for greater custom reporting, more platform support, and better integration with other IT tools.

Buy services. You do not need to have services for the entire implementation, but, at a minimum, invest in the Quickstart option to get up and running and to provide knowledge transfer. Once Guardium is installed on a few systems, it is very easy to add and manage.

It captures all data requests regardless of the source and consolidates them for analysis.

The ability to audit across multiple data environments led to a greater understanding of the data traffic and the potential weaknesses in the access controls. This eased the creation of audit trails for customers.

Reporting has always been a weakness, but it has improved across the versions. In early versions, the reporting always seemed like a late add-on, and the graphics were poor. This has improved over the years and the reporting is a lot better now, with greater filtering and display options.

I have used this solution with various clients for ten years.

There were issues with stability of the agent software in previous versions, but it is less of an issue now.

The only issues are when users have not maintained the collection policies or the archiving and aggregation policies correctly. Units can fill up if not maintained and managed.

Over the years, it has changed many times, but the US support is very good.

I have often replaced internal database auditing features with Guardium. The main reason for the switch was to segregate the auditing from the database administrators.

It is very dependent on the environment in which it is being installed. It can be complex if users do not take the time to build their policies carefully.

Take your time. Think about the elements you want to audit. Don't just audit everything. Understand the normal traffic, so you can focus on the abnormal traffic.

The main features are database activity monitoring and firewall feature blocking.

I'm working as a consultant for security products. I'm not a user of this product. Guardium is helping customers to get insights into who is accessing company data, when they are doing it, and from which location.

Guardium can block malicious connections to the databases. For example, if someone is accessing sensitive data in a production database during non-working hours, Guardium can block this connection.

I would like to see a better GUI. IBM is working on GUI improvements with every new release.

I have used this solution for five years.

I did not encounter any issues with stability.

The system is scalable.

Technical support is fast and responsive. The typical response time is less than two hours.

The initial setup is relatively simple. It depends on how many collectors and aggregators are in the setup and the number of databases included in the monitoring solution.

After the initial setup, the level of complexity depends on the customer’s needs.

Ask for a PoC project and then decide.

It’s available as a hardware appliance as well as software. This provides flexibility as to how you want to deploy the tool.

It can automatically locate DBs, as well as discover and classify sensitive data.

Data Activity Monitor covers what appears to be every DB imaginable, even data warehouses and file shares.

It allows administrators to enforce trigger alerts built around predefined policies, so that any access to sensitive data can be tracked and blocked if necessary.

It helped control excessive administrator rights to databases and automated the compliance auditing process.

It located/discovered unknown databases and the sensitive data that existed in those databases.

There was a slight performance tax on the system and load balancing could be better. We would also like more robust reporting.

I have used Guardium for six months.

Once it was installed and implemented, it seemed to be a very stable product.

This is definitely a scalable product. You can build out a basic stand-alone architecture with one collector all the way to enterprise wide architecture that covers multiple datacenters and continents.

I never interacted with tech support.

No previous or different solution was used.

If I remember correctly, the setup was a bit complex; not so much the installation, but a lot of tweaking and tuning of policies, setting up traffic filters, whitelisting the traffic, and so on.

I was not privy to this information.

I wasn’t part of the evaluation for the tool.

Try to have a dedicated team. There are a lot of moving parts and you need take a hands-on approach. It doesn’t come configured out of the box.