DB Networks Applies Machine Learning and Behavioral Analysis to Immediately Identify Credential Abuse

RSA Conference 2016, Booth No. 607 South Hall — DB Networks®, a leader in database cybersecurity, today announced industry-first capabilities to non-intrusively identify compromised credentials in real-time by uniquely applying machine learning and behavioral analysis to every database communication. This powerful new feature is now available in its DBN-6300 and Layer 7 Database Sensor products.

Many high profile database breaches have resulted from the abuse of legitimate logon credentials. Identifying these apparent “insider threats” requires a new approach. Those who were once considered trustworthy may have lost their credentials to an attacker and are now posing an insider threat. This is why identifying compromised credentials in real-time has proven elusive until now. The situation has changed, and so must the mechanisms to mitigate the risk.

Rather than inherently trusting specific clients, servers or users, the new approach identifies normal business flows and evaluates the risk and business context of any deviation. Doing this accurately and in real-time requires deep protocol analysis on large amounts of database communications to detect when an entity demonstrates a new behavior – indicative of an attacker using stolen credentials.

The cyber criminals’ primary goal is to obtain privileged logon to gain access to sensitive and valuable data. Once the attacker has obtained the proper credentials they can pose as the privileged insider and breach the databases. At that point they can access sensitive assets and setup a channel to exfiltrate an entire data set to an off-site server.

“Databases are the organizations ‘crown jewels’ and compromised database credentials are essentially the ‘keys to the kingdom’ for attackers,” said DB Networks’ Chairman and CEO Brett Helm. “Through the unique application of machine learning and behavioral analysis, DB Networks is now able to immediately identify stolen credentials so that a data breach can be stopped in its tracks.”

Once a compromised credential is identified it’s critical to understand the scope of the incident. DB Networks assists security professionals with a security search tool to enable them to easily investigate any suspicious activity in the database tier. This powerful capability is extremely useful to understand the scope of activity that resulted from compromised credential.