Database Security

Moraph resells, implements and runs Imperva database activity monitoring for the databases that hold customer, account and transaction data. Imperva records the queries run against those databases, applies the policies you approve, and raises alerts on activity such as unusually large reads of sensitive tables. Moraph tunes the policies, triages the alerts with your security team, and produces the audit evidence your examiners and auditors ask for.

The problem it solves

Customer data sits in a handful of databases that many people and applications can reach: database administrators, developers with production access, reporting tools and service accounts. Native database logging is often turned off for performance or kept where the administrators who generate it can also change it. When a large extract happens, nobody may notice until the data appears somewhere it should not. Monitoring tools that are installed but not tuned produce so many alerts that the important ones are missed.

Who it’s for

• CISOs and information security officers at banks, credit unions, broker-dealers and lenders
• Database and infrastructure teams who run the databases behind core banking and lending
• Security operations teams who investigate data access
• IT audit and compliance teams responsible for database access controls
• Institutions that own Imperva but need it tuned and operated

1. Discover and classifyMoraph uses Imperva's discovery and classification to find the databases in scope and the tables that hold sensitive data, and agrees the list with your data owners.
2. MonitorImperva agents or gateways capture database activity independently of the database's own logging, and audit policies record the access your policy requires, including privileged users and sensitive tables.
3. Triage and respondMoraph reviews Imperva alerts, sets aside activity explained by approved jobs or changes, and escalates the rest to your security team with the query, user, source and volume involved.
4. Evidence and reviewMoraph produces the reports your auditors expect, such as privileged user activity and access to sensitive data, and reviews coverage and tuning with you each month.

Independent activity capture

Imperva records database activity through its own agents or gateways, separate from the database's native logs, so administrators cannot alter the record of their own actions.

Sensitive data discovery

Imperva scans databases for tables and columns holding customer identifiers, account numbers and similar data, and Moraph reviews the results with your data owners.

Bulk extraction alerts

Security policies raise alerts when a user or account reads an unusually large volume from sensitive tables, or reads them from an unexpected source or at an unexpected time.

Privileged user monitoring

Activity by database administrators and other privileged accounts is audited in full, including schema changes, permission changes and direct reads of sensitive data.

Application profiling

Imperva learns the normal queries of known applications and service accounts, so departures from that profile can be flagged.

Optional blocking

Where your institution chooses, Imperva can be configured to block specific activity, such as a defined query pattern from an unapproved source. Moraph enables blocking only on policies you approve.

User rights review

Imperva reports who holds which permissions on each database, and Moraph runs periodic reviews of those rights with data owners.

Policy tuning

Moraph adjusts audit and security policies as alerts are reviewed, so noise is reduced and each change is approved and documented.

Alert triage

Moraph reviews alerts against approved jobs and changes and passes those needing a decision to your security team with the details attached. Automated suggestions may help sort alerts; people make the decisions.

Coverage and health monitoring

Moraph watches agent and gateway health and reports databases that are not being monitored, for example after a server rebuild.

Audit reporting

Scheduled reports on privileged activity, sensitive data access and policy changes, prepared for auditors and examiners.

Change management

Every policy, agent and configuration change goes through a change request your team approves, with the result verified.

Information security officer

Owns the monitoring policy, approves changes and decides on escalated alerts

Security operations analyst

Investigates escalated alerts alongside other security signals

Data owner

Confirms which data is sensitive and reviews who has rights to it

Database administrator

Supports agent installation and explains database activity, while being monitored themselves

Moraph service engineer

Deploys, tunes and operates Imperva and triages alerts under approved changes

Auditor or examiner (read-only)

Reviews reports, policies and evidence within a granted scope

Databases

Imperva agents or gateways monitor the database platforms it supports, such as Oracle, Microsoft SQL Server, IBM Db2 and others, confirmed against your versions during design.

SIEM

Alerts and selected audit events forwarded to your security information and event management system for correlation.

Identity provider and directory

Console users sign in through your identity provider, and directory data helps attribute database activity to real people.

IT service management

Approved changes and scheduled jobs from your service management tool are used to explain expected activity during triage.

Privileged Access Management

Where you also use Moraph's managed CyberArk service, privileged sessions can be matched to the database activity they produced.

Moraph service portal

Alerts, change requests, coverage and monthly service reviews tracked in Moraph's service portal, available to your team through single sign-on.

Single sign-on

Your staff sign in to the Imperva console and Moraph's service portal through your identity provider, so your password and multi-factor policies apply.

Role-based access

Who can view audit data, change policies or see captured query values follows their role, and database administrators do not administer the monitoring of their own activity.

Sensitive values masked

Imperva can mask sensitive values captured in queries and results, so reviewers see the activity without seeing customer data where it is not needed.

Moraph staff access

Moraph engineers work through role-based access you approve, and cannot use keys to your data without explicit, time-bound authorization.

Complete audit trail

Changes to Imperva policies and settings are logged, and Moraph's service portal records every change request, approval and triage decision.

Audited operations

Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Agents in your environment

Imperva agents on database servers and management components in your data center or cloud account, operated by Moraph.

Network gateways

Gateways on the network path to databases where installing agents is not possible, with the coverage trade-offs documented.

Existing Imperva estate

If you already own Imperva, Moraph can take over operations after a baseline review of coverage and policies.

Scoping and design

We agree which databases are in scope, how activity will be captured, and the audit, alert and retention policy. We need your database inventory and contacts for each database team.

Discovery and classification

Imperva discovery and classification run against the databases in scope, and results are confirmed with your data owners.

Deployment

Management servers, gateways and agents are deployed under your change process, starting with the databases that hold the most sensitive data.

Learning and baseline

Policies run in alert-only mode while normal application and administrator activity is profiled and expected jobs are recorded.

Tuning

Alerts from the learning period are reviewed with your security team, and policies adjusted until what is raised is worth reviewing.

Transition to managed service

The service moves to steady-state triage, coverage monitoring, change management and monthly service reviews.

• Moraph is not Imperva. Moraph resells, implements and operates the platform; Imperva develops it and is responsible for its software and any services it hosts.
• Imperva's own service commitments, product roadmap and any outages of its services apply. Moraph does not change them.
• Licences are subject to Imperva's terms, which you accept as part of the purchase.
• Monitoring covers the databases and platforms Imperva supports and where agents or gateways are deployed. Databases outside that coverage are reported as gaps.
• Alerting detects activity as it is captured; it does not by itself stop an extraction. Blocking is available only for policies you approve and can affect legitimate activity if set too broadly.
• Moraph triages alerts but does not replace your security operations center, and does not decide whether an event is a reportable incident.
• Encrypted database connections may need additional configuration for activity to be captured, depending on the method used.
• Audit data retention is limited by the storage you provide or license.

• Pick one sensitive database and review what would be captured and how
• Ask how a bulk read by a service account is told apart from misuse
• Review a sample escalated alert and decide whether it gives your team enough to act
• Measure monitoring overhead on a test system with your own workload
• Confirm who can change monitoring policies, and that database administrators cannot alter the record of their own activity
• Read the responsibilities table with your vendor management team