About Database Firewall Deployment Modes and Policies

Learn about Database Firewall deployment modes and corresponding policy types.

Database Firewall can be deployed in the following modes:

1. Monitoring (Out-of-Band)

2. Monitoring (Host Monitor)

3. Monitoring / Blocking (Proxy)

Monitoring (Out-of-Band) or Monitoring (Host Monitor) deployment modes can be used for monitoring only and to alert on potential policy violations.

Monitoring / Blocking (Proxy) mode can be deployed to block certain SQL activities, in addition to monitoring and alerting. For example, policy rule can be defined to block SQL statements that violate the policy guidelines.

Some scenarios to define Database Firewall policies are listed below:

Scenario	Description
Monitoring privileged users	Configure the Database Firewall policy to monitor and capture all the SQL statements run by privileged users. Create a list of privileged users and use this list in Session Context rule. This provides all SQL statements run by them over the network for a specific target database. Deploy Database Firewall in any of the three modes and use Session Context rule.
Block DBA access to sensitive application database objects	Deploy Database Firewall in Monitoring / Blocking (Proxy) mode. Create a list of DBA (Database Administrator) users, configure Database Object rule to block any SQL statement run by these users on a list of sensitive objects.
Monitoring sensitive data and access over the network	Configure the Database Firewall policy to monitor user access and their operations on sensitive data by using Database Object rule. Provide a list of sensitive objects (table or views) while configuring the Database Object rule. Database Firewall can be deployed in any of the three modes in this scenario.
Blocking unauthorized access	Deploy Database Firewall in Monitoring / Blocking (Proxy) mode and use the Database Object rule. Create a profile of users, configure allow operations on a specific sensitive data (table or views). Block all other access and operations by creating a second Database Object rule. Ensure the blocking rule is the last one in the rule list.
Allow SQL statements from trusted IP addresses and applications	Deploy Database Firewall in Monitoring / Blocking (Proxy) mode. Configure the Session Context rule to allow SQL traffic from an allow list of client applications and their host IP addresses. Any other access must be monitored, alerted, or blocked by the Database Firewall using the Default rule. To enforce this database access pattern, create allow list in Session Context rule and configure the Default rule to alert or block other SQL statements.
Prevent SQL injection threats or zero day exploits	Deploy Database Firewall in Monitoring / Blocking (Proxy) mode. Configure the Database Firewall to capture SQL statements from trusted set of applications and database users. This is the allow list of SQL statements. Database Firewall uses a SQL grammar based engine to parse and group similar SQL statements into clusters. Create a list of such clusters and configure SQL Statement rule to all SQL statements matching the list for a specific target and alert or block SQL statements that have clusters not matching the list.
Detect potential data exfiltration attempts	Configure the Database Firewall policy to identify potential data exfiltration attempts by capturing the number of rows returned by the database in response to SELECT SQL queries using Database Object rule. For example, raise an alert if the number of returned rows exceeds a specific expected threshold on a specific sensitive table.