Hedgehog Enterprise 2.2 provides a comprehensive view of database activity

Database security is one of the vital parts of a network administrator’s job, and one of the most difficult. Tracking activity on a database that can grow to thousands of requests a second made by hundreds of users can be daunting. Reading often cryptic database log files can be time-consuming, to say the least. And the database programs do little to help anyone trying to catch suspicious activity as it happens. Combined, those factors can turn a hard job into a well-nigh impossible one.

Hedgehog Enterprise Version 2.2 by Sentrigo can help lighten the load. Hedgehog can monitor activity involving SQL requests of all of your databases, instantly block anything that is explicitly proscribed, and isolate and report on activity that looks suspicious. It can also give you an overview of who is using which databases, allowing an administrator to optimize a network’s data flow.

Administrators can set up the central software on any computer running a Windows, Sun Solaris or Linux operating system. In addition, they must install a sensor program on each database server that runs Oracle or Microsoft SQL Server. The sensor runs in a dedicated operating system and monitors all traffic to and from its assigned database server, which can have any number of databases running. This method can significantly improve database performance, although it does make setup more time-consuming because you must install the sensor software on each database server.

After you install all the software and licensing information and the central administration software detects the sensors, things go rather smoothly. The Web-based administration interface is well laid out. The first tab, Alerts, shows you unresolved alerts, color-coded by severity level. Each entry on the table shows an affected database, date and time, the actual SQL request used, and possible actions you can take. Your options include terminating the session, resolving the alert and creating a new rule based on the alert.

The dashboard gives you an overall look at databases covered by Hedgehog. It shows the percentage of unresolved alert severity levels, number of alerts by time, sensor status and quarantine status, and available updates. The placement of those items, which are the ones you'll need most urgently, is convenient and easy to understand.

The backbone of Hedgehog is its collection of rules that govern how it reacts to intrusive activity. A rule can pertain to a specific database, a database object such as a table or field, specific commands in a SQL statement, or an individual source IP address or range of addresses, to name a few. It will even recognize string patterns, such as credit card numbers or wild card characters.

Hedgehog’s sensor compares all incoming activity with the rules for that database and, if there is a match, performs the prescribed action. Sentrigo provides a set of predefined vPatch rules that provide a good level of general protection. You tailor more specific Custom Rules to your database’s situation. For instance, if one of your databases contains payroll or other confidential information, you can set up rules to ensure that only certain computers can access it.

We were impressed by the ability to import a rules set that conforms to one or more established international standards, such as Sarbanes-Oxley, the Payment Card Industry Data Security Standard, the Statement on Auditing Standards No. 70 (SAS-70), and the Health Insurance Portability and Accountability Act. With these rules in place, compliance becomes that much less of a hassle.

The reports available are varied and flexible, covering nearly any aspect of database traffic in practically any format. We found the Dynamic Reports to be a valuable feature. With it, we could set how a report is filtered, which fields are included and sorted on, and even when it should be scheduled to run. It will even e-mail a report once it has run, provided you set up an outgoing e-mail account.

Hedgehog’s performance in the field was impressive. With the basic rules set in play, the system dealt with all suspicious activity that we instigated, such as anything that resembled a SQL injection attack. At the least, it generated an alert, and sometimes our session was cut, depending on which rule we had violated.

Sentrigo sets the pricing of Hedgehog Enterprise 2.2 on a per-processor core basis, meaning it charges for every core of every processor on each database server on which you will be installing a sensor — a dual-core processor would cost twice as much as a single-core, for instance. That's a typical pricing model for database server applications, so it makes sense that this database security software would be priced the same way. The pricing starts at $2,400 per core, but there are volume discounts available. The price includes all of the downloadable content, such as compliance modules. We found this price to be good considering how much time and effort it can save.

For the already overtaxed network administrator who also has to keep an eye on the busy traffic of several large databases, this software is just the ticket.

Sentrigo, 650-212-2979, www.sentrigo.com