IBM Security Guardium Data Protection Reviews

The Data Activity Monitor is the most valuable feature of this product.

It has the capability to capture database queries and is using policies to feed SIEM tools for deeper correlation and for analysis of cyber security concerns on monitored databases.

It provides our organization with an integrated and tamper-proof audit of logged data to ensure that the database activities are checked and operating according to the industrial best practices.

The maintenance and support aspects of the product need improvement.

Probably, it should be more related to the product patching method. Even though the support service was great, the resolution doesn't comes quick enough to address the client's issue. We understand those resolutions only exist in the next patch version after quality testing. However, till that release comes out, we have to suffer in silence with the bug issues.

I have used this solution for around two and half years.

We have encountered issues with stability.

We have encountered issues with scalability.

I would give the technical support a 7/10 rating.

We were not using any other product prior to this one.

The setup was not straightforward. There was some level of complexity in setting it up.

Ensure what you want to protect, since it is charged as per the database instances.

We evaluated a couple of other options.

I would not like to discuss this much as it affects the other companies' image and integrity. The competitive products have their own good and bad.

You need to know what you want to protect very well.

It's a security product that works across multiple platforms, in our case it's the mainframe and the midrange. We use it to detect when somebody accesses restricted data and report on it.

So far it has performed quite well, we're happy with it.

We used to use cobbled-together scripts, different products and different pieces on different platforms. This is one consolidated tool so one report comes out for each director and it's clean and easy. There is some scripting involved to tell it what is important and what is not important - which is important to us.

In terms of security initiatives and compliance policies within our organization, that's basically what we use it for: the reporting of who touches what data. And that goes up to the directors and they approve or get mad at you and ask you why you did something.

IBM Guardium probably helps us comply with industry regulations like SOX, PCI, or GDPR, but the big driver was more internal and audit-related, rather than industry-related.

We haven't integrated Guardium with other systems we have.

It has saved us time and money. As I mentioned, we had a bunch of cobbled-together scripts that were manually maintained for different platforms. This solution automated all that and made it such that the security administrators can run it themselves and not involve us. So there is less "people effort." Senior management is aware of the savings.

It makes the auditors happy.

It does not require our involvement to run it. It runs in the background and the people that do the reporting do so. The reports go to the directors who are in charge of the various data areas. It's pretty clean. Clearly there is some setup, but after you get it set up it just goes.

I have no idea what the advanced features are, so we're probably not using them.

Lower pricing would always be good but apparently we're getting our money's worth or we wouldn't be using it.

I'm pretty impressed with the stability. There was medium-sized initial effort getting it configured and set up and doing what we wanted it to do, but it just runs and we don't have to deal with it.

We run it on the mainframe and on the midrange platforms and we haven't had any performance issues of any kind. We haven't really had to scale it. We pick and choose what's important to us, so we don't monitor everything. If we were going to monitor everything it would probably be an issue, something we would have to address.

I have not used tech support personally. We did have some support help at the beginning, learning it and getting it set up.

We were previously using homegrown scripts. We decided to switch primarily because this is a multi-platform solution that consolidates everything and centralizes support for it.

When selecting a vendor, we reviewed two other products, but the main reason was that this is a multi-platform solution and it worked well in our environment.

I was not directly involved but I was involved somewhat since I had worked with some of the systems in the past, so maybe some requirements gathering.

The setup seemed pretty straightforward to me.

We're very happy with it. It depends on what your needs are, but it meets our needs.

Heterogeneous support for data activity monitoring. I have not been able to find any other product that can monitor as many platforms from one application. Guardium can monitor Windows servers, Linux, Unix, mainframe, and big data environments from one policy. Guardium captures data access activity across networks and local connections.

We now have one go-to application for all data monitoring. This has decreased the number of skills needed and enabled a faster route to compliance. Reporting is automated and activity alerts are routed to the appropriate responders.

While Guardium is great at structured monitoring (DAM), the product is lacking features on the file activity side (FAM). We would also like to see tighter integration with Active Directory and Exchange monitoring.

I have been using Guardium for seven years.

We had some minor issues with earlier versions around agent compatibility. These were solved through support.

Guardium scales easily. Simply add another collector appliance and the system will balance the load across all available appliances.

IBM support has been responsive and we rarely need to escalate.

Previously, we were using home grown scripts and native database tools. The issue with this approach is the need for expertise on every platform and ending up with dozens of tools to manage.

Guardium is an enterprise class product and, with that, does require some training. I would suggest any enterprise looking to implement Guardium to purchase some amount of services. There is an option for Quickstarts. Once you understand how the agents work and have setup the first few, the rest are relatively simple. The real work is aligning your business goals with the Guardium policies you create. We often know we need to monitor a system but are not exactly sure what policy is needed. There has to be collaboration between IT, business owners, and compliance.

Previously, Guardium fell under the IBM PVU license model. This was complicated to license and costly. The new license structure is per server and includes all features. Now we simply count the number of servers to monitor and purchase accordingly.

Besides native database auditing, which is very resource intensive, and homegrown tools, there are not a lot of options out there. The closest competitor is Imperva. Imperva is a close second. We chose Guardium over Imperva based on the ability for greater custom reporting, more platform support, and better integration with other IT tools.

Buy services. You do not need to have services for the entire implementation, but, at a minimum, invest in the Quickstart option to get up and running and to provide knowledge transfer. Once Guardium is installed on a few systems, it is very easy to add and manage.

• Detailed and customizable reports with real-time alerts for the full vision of database/files activity.
• Versatile rules for access control in real-time including blocking, masking, etc.: These rules are really helpful to fulfill enterprise security specifications. With them, you could divide roles, creating safe access zones; manage credentials; and access rules. The rules are easy to develop and customize.

• UI: Version 10 of Guardium was introduced with a new UI that was completely redesigned. Some fast-access functions and options are not easy to find in the new UI.
• Real-time masking is a bit simple and doesn't allow you to create complex masking rules.

I have about one year of hands-on experience.

I have not encountered any stability issues.

I have not encountered any scalability issues.

Technical support is 9/10. I participated in communication with tech support only once.

I did not previously use a different solution.

Initial setup is straightforward. All the commands are simple to understand. The installation guide is simple and comprehensive.

Before choosing this product, I evaluated Imperva products.

This product could by easily used with other security products; for example, SIEM products such as IBM QRadar and ArcSight.

The database activity monitoring and firewall features of Guardium address our database security requirements. The combination of policies, alerts, baselines, reports, and query rewrite functions are easy to use and provide enough room for customization.

It provides us more visibility and control of our business functions. The query rewrite and redaction functions also provide flexible/dynamic control of our data, which is indeed helpful for complex scenarios.

The backend database requires improvement for faster searching. This makes it easier for analysts to investigate older data.

I have been using Guardium since mid-2013.

I did not encounter any major stability issues in the last three years, except a couple of minor issues with S-TAP agents.

The solution is easily scalable.

I mostly get quick support although I did not encounter any complex error yet. I rate technical support at 7/10.

The installation and configuration of a collector is simple and straightforward. The ease of deployment is dependent on whether you choose agent-based monitoring or network traffic, SPAN-based monitoring.

The Guardium licensing is based on PVU and as a result, the solution became a bit costly. I am not aware of the licensing and pricing model of its competitors. But if the focus is pricing, then one can consider other options as well.

We were considering DbProtect but at that time, DbProtect had no support for Teradata.

If you have enough budget for database security, you must evaluate this product for your use cases.

We have implemented it on an industrial network to monitor the production of medicines. This is something that is very controlled by Brazilian regulations and we have to keep an audit trail for this data. Trying to enable it on SQL Server - that was our client's main server - the load would go so high that they couldn't use the application anymore. They are using Guardium now so they can produce that audit trail for audit compliance.

We have integrated IBM Guardium with IBM Watson Curator. They access Curator to identify and correlate other actions the user is doing to determine if this is a legitimate action or not.

In terms of advanced features, our clients are starting to implement it on an order basis so they can get to GDPR and the like; those Accelerators. They also use it a lot for PCI, to get access to credit cards.

Guardium has saved us time and money, mainly on the discovery process and senior management is aware of this, of course.

The Audit Trail.

They could improve the Data Masking a little.

Stability is quite good. We had some problems, but support is very effective so we were able to solve them very quickly.

We had instability with reports, they were giving some errors. I don't know exactly what had happened because I wasn't the one involved, but we couldn't access reports.

Tech support is very good.

We knew we needed to switch because of that problem with the audit trail, that SQL couldn't keep up with what we needed to do for auditing. That's why we had to search for a new solution.

It's very easy.

I would rate it an eight out of 10 because it is very stable; we had some problems but they were solved, and we can do what we need to do.

• Monitors database activities of end users who are connected to databases (DBAs and developers)
• Classifies critical objects on the databases
• Discovers databases on your network
• Finds vulnerabilities of your databases
• Blocks critical activities

• Helps us define and monitor critical data in the environment, even when stored in RDBMS, big data, or unstructured files.
• Helps us to pass compliance audits, such as like HIPAA, SOX, and PCI.

The blocking and dynamic data masking features need improvement.

I am working as an IBM partner. We have provided solutions for nearly 50 customers for five years. Most of our customers are banks and telecoms.

IBM Security Guardium is a mature product. Although it needs agents on the server to monitor their database or file traffic, we did not encounter serious issues so far.

IBM has three layers for Guardium support. In critical cases, technical support analyzes the issues very quickly to find a solution.

I did not use another solution before this one.

The setup is straightforward. There is an ISO file that is developed by IBM that contains all of the OS and Guardium application files. All that remains to be done is to configure the post-installation settings.

Licensing is the worst part of the product. This is because IBM uses Processor Value Units (PVUs) to calculate the license. The customers complain about this.

In the latest version of the product, there are four types of licenses:

• DAM (Database Activity Monitoring)
• DAM Advanced
• FAM (File Activity Monitoring)
• FAM Advanced

If you only need database activity monitoring, then DAM is enough.

If you need blocking and masking features, you will need the DAM Advanced license.

I did not evaluate other options. I am an IBM partner.

There are three main steps when implementing a Data Activity Monitor (DAM) solution.

1. Discover and Classify: Find your databases in your environment, and decide which one of them has confidential data that you need to monitor. Classify your data in your database if it includes critical data like personal ID, credit card, or IMEI numbers.
2. Monitor Activities: Monitor all end-user activities while developing your policy rules and critical activities.
3. Block Critical Activities: Define and block critical activities to prevent data leakage.

It captures all data requests regardless of the source and consolidates them for analysis.

The ability to audit across multiple data environments led to a greater understanding of the data traffic and the potential weaknesses in the access controls. This eased the creation of audit trails for customers.

Reporting has always been a weakness, but it has improved across the versions. In early versions, the reporting always seemed like a late add-on, and the graphics were poor. This has improved over the years and the reporting is a lot better now, with greater filtering and display options.

I have used this solution with various clients for ten years.

There were issues with stability of the agent software in previous versions, but it is less of an issue now.

The only issues are when users have not maintained the collection policies or the archiving and aggregation policies correctly. Units can fill up if not maintained and managed.

Over the years, it has changed many times, but the US support is very good.

I have often replaced internal database auditing features with Guardium. The main reason for the switch was to segregate the auditing from the database administrators.

It is very dependent on the environment in which it is being installed. It can be complex if users do not take the time to build their policies carefully.

Take your time. Think about the elements you want to audit. Don't just audit everything. Understand the normal traffic, so you can focus on the abnormal traffic.