IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Guardium Data Protection Blocking Policy

    Posted 03/26/22 05:02 AM
    dear all,
    anybody has experiences on blocking policy:
    - how many percent of latency or  impact on performance drops?
    - any idea to optimize the policy to reduce the dropped performance

    thx

    #mur​

    ------------------------------
    Murdjoko ...
    ------------------------------


  • 2.  RE: Guardium Data Protection Blocking Policy

    Posted 04/04/22 02:05 PM
    Hi Murdjoko, 
    One commonly used approach is to keep the STAP firewall in hybrid mode:
    firewall_installed=1
    firewall_default_state=0

    identify your "safe", latency-sensitive application sessions like multi-user applications and create a group with these sessions. 
    Client IP/Source Program/DB User/ Server IP/Service Name
    Configure a rule to "S-GATE attach" for any session that is not one of these "safe" sessions 
    You can then create the rule that terminates any of these other sessions that attempt to write to sensitive objects

    This should keep your application server sessions out of the firewall and eliminate latency for these critical sessions.
    You have to be very careful in identifying the safe sessions though. Always best to test it first with an alert rule before implementing blocking

    Regards

    ------------------------------
    ----------------------------
    Olufemi "Femi" Adalemo
    ----------------------------
    ------------------------------



  • 3.  RE: Guardium Data Protection Blocking Policy

    Posted 04/04/22 10:06 PM
    ok
    thanks

    ------------------------------
    Murdjoko ...
    ------------------------------

    Original Message


Related Content