Imperva SecureSphere Database Security Reviews

I have worked with IBM before, and I prefer its ease of deployment and management. Imperva SecureSphere Database Security has tricky deployment, whereas IBM's deployment is straightforward because of the UI.

I have been using the solution for three years.

The tool's pricing is flexible and affordable for small and medium enterprises.

I rate the product an eight out of ten.

We are system integrators, so we mostly work on implementing projects. We don't handle maintenance or administration. Our focus is on implementation.

We use it for database security, vulnerability analysis, discovery, and handling requests from applications and users.

It's not just one feature because the whole process is important, starting from discovery to protection and prevention. If we use agent-based functionality instead of a gateway, the solution becomes more feature-rich.

Mostly in areas like data masking since they previously had a product called "camouflage," but it was dropped. It would be better to have something similar to that. 

Additionally, improvements can be made in data enrichment, aggregation of data from different perspectives, and enhancing the GUI (Graphical User Interface) for a better user experience.

We have experience in implementing the solution. It has been almost four years.

I would rate the stability of this solution a seven out of ten. There's some room for improvement in terms of stability.

I would rate the scalability of this solution as seven out of ten. It's scalable, but further implementation and development would make it even better.

We have been able to handle everything on our own. As partners, we are technical savvy.

The initial setup is actually quite easy. It's not something hard to do, but having some experience with the product is helpful.

If it's only the deployment, it takes around two to three days. But if we consider tuning and ongoing processes, the time for deployment varies.

ROI depends on the use case. Most companies use it for security and compliance. So, it varies based on the specific use cases.

It's not a cheap solution.

I would recommend considering Imperva. It's important to conduct a proof of concept (POC), include a list of potential different vendors or products, and make an informed decision.

Overall, I would rate the solution an eight out of ten. 

Reporting is the most valuable aspect. It's very fast, even versus IBM. IBM could take three, or four days to get a report. In Imperva, everything is online, and you get the reports very fast. 

It is very easy to configure the new dashboards, and reporting is easy to do. It takes maybe an hour to do it. 

The solution is very stable. 

We'd like better compliance with cyber security and legal as well as other areas. 

I'd like to see some sort of solution for storage. For example, if someone in the company is doing some backup, I cannot reach that information in the discovery and in the protection. I only can protect the information, the databases that I use that are in developer or Q&A, and not those databases that are in the backups. It's a limitation.

I've been using the solution for three years. 

This is a stable, reliable product. It never fails. There are no bugs or glitches. 

There are six areas that are using the solution, and each area has maybe three or four users, at least. Risk, compliance, operations, and internal security, for example, are some areas that use it and get reports. 

I'm not sure if we have plans to increase usage. I am covering all the databases right now. I have no other space to do it. Of course, if we are going to grow and use more databases, I'm going to use this solution. That said, right now, all the databases are covered.

We pay for the solution on a yearly basis. There are no additional costs or extra fees beyond the license itself. 

Have compared the solution to IBM. Previously, I was an IBM customer, and IBM would take maybe a week to have a good configuration. 

With Imperva, it's very easy to configure. It's very easy to get the reports. The reports are coming fast, and you are saving a lot of money if you send the logs to Splunk since Splunk charges per alert. In the Imperva solution, instead of sending tons of alerts, it is consolidating everything. It helps me save money with Splunk. 

I am a consultant. 

I have been working with the previous version of the product. Right now, the latest one is the Data Security Fabric.

It is very easy to use, and it helps us to discover the databases. In some cases, the shadow IP or the business areas are not reporting that they are using other databases. With the Imperva solution, I can find the other databases that are not reported to IT, and it's very easy to know where they are, where the information is, and what kind of information it is, if we are talking about the personal data or if we are talking about a financial data, et cetera. It's very easy to find the databases, and to know what kind of information is in each one of those databases. It's so helpful.

It helps a lot to have a consultant as they have the knowledge and experience a company can use. Even if a solution is very easy to implement, it helps to have the knowledge and experience of partners. 

I'd rate the solution ten out of ten.

I use SecureSphere to monitor our core databases and privilege operations by administrators, and to provide compliance reports.

In terms of regulatory compliance, one of the key requirements is to ensure that our core databases are monitored. SecureSphere allows us to generate details to prove that we're compliant with all requirements.

The most valuable feature is the automatic reports on new databases, which gives us up-to-date inventory management.

Sometimes the reports are cumbersome, and you have to drill down to get more information. SecureSphere also sometimes needs a lot of maintenance to keep the agents running on the database. In the next release, Imperva should include a preventative solution that will stop an attack before it happens or read the behavior of particular accounts and act on it. They should also make SecureSphere available on mobile so that if an administrator isn't on-prem, he can access the solution via the internet wherever he may be.

I've been using this solution for almost three years.

SecureSphere has been very stable until recently, due to the addition of new source databases causing performance issues.

SecureSphere is very scalable.

Imperva's technical support has been good. In the past, it sometimes took a long time to resolve an issue, but more recently, the responsiveness has been very impressive.

Neutral

Previously, we used Oracle Audit Vault, but its reports were a little complex, and their support was not so impressive.

The initial setup was straightforward, and the deployment took between one and two weeks.

Our deployment was done in-house.

SecureSphere has resulted in us receiving audit exceptions, especially from the final details, which is a big deal to my organization since we have to be compliant.

I would recommend SecureSphere to other users and advise making a dedicated team available to work on the solution and configure the correct set of policies so they can get value for their money. I'd give SecureSphere a rating of eight out of ten.

The use case is for database services, security purposes, and access capabilities. In DAM, we cannot use inline mode due to the blocking that is there. Details can be shared and accessed to see, for example, information about the DB, who's using it, its applications, et cetera. There are all kinds of reporting that can be accessed. We submit reports to the customer.

The audit feature is great. It is totally encrypted. Nobody can tamper with the details. For example, a DB admin can change the audit, however, if they are using the DAM product, that is totally different infrastructure so that the log, since it is an agent-based solution, whatever the activity will be done in the server regarding the database audit will be captured by the audit and that agent. The communication is totally encrypted and nobody can tamper with that data.

The initial setup is not overly complex.  

Some cloud versions are not supported by the agent. For example, we had a client that wanted to move to the cloud and wanted to use AWS, however, it was not possible. Imperva should have every kind of agent.

I've used the solution for around three years. I've used it for a while now. 

The solution is stable. It's very reliable and the performance is good.

It's a scalable solution. It's good. If we can just change the gateway or if it is a VM right now, we can upgrade the resources, or we can install many more agents in the server, in other servers, and we can take more servers behind it so that we can capture all the data for any of the server.

Technical support is good. Sometimes we have to raise a ticket and we get good, proper support. There's no issue.

The the setup itself is not too complex, it's conceptual. You have to understand at least the basics of the database. That's it. You don't have to be a DB admin, however, as a security engineer, you just need some small knowledge of a database, for example, what the database is, what the table is, et cetera.

We are partners. 

I'd recommend the solution. If a company has a plan for the Imperva DAM solution, it can, while still not using the Imperva WAF solution. The WAF solution is also good. We can use the WAF as well as DAM. We have a box, a gateway, or management that is used for both cases.

If an organization wants to do both the cases like I have a database, I have a web server, I want to secure both the infrastructures, I know I can strictly go for the Imperva, and Imperva will give management of two gateways for two different solutions, and that's it. It can be a complete package.

I'd rate the solution nine out of ten.

We primarily use the solution  just to monitor database activity on all the in-house databases.

I like almost everything about the solution. That includes sensitive data scanning, which is what is the most important. The data discovery is great as well. 

I like the activity monitoring. That was the main reason we purchased the tool.

The integration is great.

They do quite a lot of feature updates. 

The solution needs local support.

They need to do a little bit more knowledge-sharing with the tool. Knowledge-sharing is not what you normally get with Microsoft, Symantec, or any other tools that are leaders in their respective spaces. This is more of a closed-group type of solution only, whereby the information is only accessible to certain groups, or maybe in certain countries. It needs a broader, more accessible knowledge base. 

There could be more on the monitoring side of things. They need more monitoring tools within the tool itself. Although it does a good job monitoring databases, in terms of the health of its agent gateways to verify communication and all that, there are basically no utilities available within the tool.

I've used the solution for a little over three years. 

The stability is average. I'd rate it three and a half out of five in terms of stability. It's not too bad. 

This is a highly scalable product. I'd rate it four out of five in terms of its ability to scale. 

We have 15 people using the solution.

Local companies have limited exposure to the tool There's professional support and support from the providers, however, if they don't know too much about it, they cannot provide adequate help. 

Positive

While I didn't handle the initial deployment myself, from the training I have done, it is my understanding that the implementation process would not be that hard. 

I'm not sure how many people were involved in the deployment. 

I handle any maintenance myself with the sales provider. There might be six people available to maintain the product. There would be about three from the customer side and two from the service provider's side.

We did have a third party assist with the initial setup. They were from the vendor. 

I am not sure how much the licensing is exactly. that said, my understanding is that it is expensive. 

We're customers and end-users.

We are using the latest version of the solution. 

It's pretty good in terms of capabilities. I'd rate it eight out of ten. 

I'm the product manager for Imperva in Africa for a distributor. I manage it every day, but I don't personally use it. We sell Imperva to customers in 17 countries. 

Its deployment depends on the customer. Some customers have their databases in the cloud, and if they have them in the cloud, we give them the cloud database security of Imperva. If their database is on-premises, then we deploy it on-premises, and the reseller implements the solution on-premises.

There are three major main use cases of this solution. The first one is to fulfill compliance regulations. Customers—especially the banks, health sector, and manufacturing—need to comply with the regulations in different countries. They have to fulfill compliance regulations around the privacy of data. In order to fulfill those requirements, they're using Imperva. It helps them to fulfill these requirements, and they are not fined by the regulators. That is the first use case why people buy Imperva.

The second one is for security itself. They don't want a cybercriminal to have access to the data. Imperva is a security solution, and you can use it to block unauthorized access to your data. 

The third one is related to rightful access to the data. They want to know:

• Who has access to the data internally?
• What queries were being issued on the database?
• What time did they log in?
• What is going on within the environment?
• Who is touching the data?
• What are they doing with the data internally? 

Customers or organizations want to have access or have visibility into all these.

They can maybe look at its pricing model. Its pricing could be cheaper for the African countries or developing economies.

I have been using this solution for three years.

It is very scalable. If a customer wants it for five database servers, he gets licenses for five database servers. Tomorrow, if they want licenses for two extra databases, they can just buy the extra two licenses. It is very scalable and very straightforward.

Their support is fantastic. It is 24/7. You raise a ticket, and you get someone assigned to you immediately.

I would rate them a five out of five. In a worst-case scenario, it would be a four, but it's always very straightforward. We get a very quick response.

It is very easy and very straightforward. There are no complications.

Its pricing could be cheaper for the African countries or developing economies. The British pound is valued way more than the currency of most African countries. A better or cheaper pricing model for Nigerian and African customers would be better.

It has a per-year subscription model. You pay exactly for what you need. That's all. You don't have to buy what you don't need.

It is very straightforward. It is probably the best solution out there in terms of data security. About 90% to 95% of the banks in Nigeria use Imperva. When you have such a success story in Nigeria, Ghana, and of course, many other African countries, you can be sure that you are getting a very good solution. 

I would rate it a nine out of 10.

We use it for database activity monitoring. We use it to monitor all the traffic that comes to the database to know about the operations that are happening on the database. 

At the moment, it is on-premises, but we eventually would like to go to the cloud.

It serves as a way and means to see if any unauthorized person is trying to access the database. It helps to implement specific rules to ensure that only authenticated people have access to the database.

The beauty of it is that it provides segregation of duties. Typically, in the traditional environment, DBAs administer the database, and they have too much access. We are in the process of implementing other Oracle solutions, and it brings some kind of segregation. Just because someone is a DBA does not mean that he or she should have access to all of the data. Some of the data can be masked so that privacy and security are enhanced, especially when it is customer data for an institution like a bank.

It is quite expensive. I would prefer a lower price. 

In terms of features, I started using it this month. I need more time to explore it.

It has not been long. We implemented it this month. 

We are currently doing a PoC, and there are a few issues that we are trying to resolve. When all of those issues are sorted out, we can start measuring the stability of the solution.

We haven't scaled it yet.

We are working with their technical support. They have been good so far.

It is straightforward, but it depends on the organizational policies and rules in terms of the infrastructure. For example, when you deploy it in an environment like Oracle, it is probably fine, but in other environments like Cisco, there could be some issues that you have to troubleshoot. It is more of an infrastructural or environmental issue.

We started with the PoC. It was implemented within two days. We are now doing monitoring to ensure everything is still fine.

It is quite expensive. We wanted it in my former organization, but the price was very high. So, we couldn't purchase it. I moved to a different organization, and this organization has purchased it.

It is a fantastic solution. It is very good, but the only issue is that if you don't have enough money, you cannot use this solution.

I would rate it an eight out of 10 for now. After exploring it more, I might rate it higher.