Guardium Architecture

Scalable for the enterprise

The Guardium architecture can easily be scaled up to meet any mix of workload and distributed monitoring criteria.

In smaller environments or where only a subset of database traffic must be audited, a single Guardium appliance is typically sufficient. For high-availability implementations, Guardium also offers appliance models with redundant power supplies and RAID-1 internal storage, as well as redundant appliances with automatic fail-over capabilities.

In enterprise data centre environments, multiple appliances can be deployed in a multi-tier topology. In this case, a central management appliance aggregates and normalises audit data, applies advanced database-focused analytics, distributes reports and manages enterprise-wide security policies.

For maximum flexibility in distributed environments, Guardium offers "software taps" (S-TAPs) that monitor both network and local database traffic at the OS level. These lightweight software probes can be installed on database servers anywhere on the network - even outside the corporate firewall. They eliminate the need for available SPAN ports in the data centre or dedicated appliances in remote locations such as outsourcing facilities, and minimise any effect on performance by simply relaying traffic, not processing it.

Zero impact on business processes

Unlike traditional database logging solutions, Guardium's non-invasive solution has virtually zero impact on performance and does not require any changes to databases or applications. Their scalable, multi-tier architecture is network-based and database-independent. It continuously monitors a mirrored network stream - via SPAN ports, network taps, host-resident software probes or a combination that best fits the environment - and analyses all database traffic for suspicious or unauthorised activities. The system also monitors privileged local traffic at the operating system IPC layer (such as console access, SSH, shared memory, Oracle Bequeath and named pipes).

Easy integration with existing infrastructure

Guardium provides a cross-platform, database security solution that's ideal for heterogeneous environments. It supports all major database platforms (Oracle, Microsoft SQL Server, IBM DB2 and Informix, Sybase) running on all major operating systems (UNIX, Linux, Windows, and z/OS ).

The solution also integrates with LDAP and Kerberos to share information about users and groups; supports SMTP, SNMP, and Syslog for integration with security frameworks; delivers audit data in standard formats (browser, PDF, CSV, XML): allows users to define custom responses to real-time alerts in Java, supports standard offline or near-line storage devices for archiving audit data (EMC Centera, IBM TSM, NAS, etc.), works in tandem with media encryption appliances such as NetApp DataFort; and provides strong authentication via RSA SecurID©.