COI Report – Part VII
Page
360 of
425 1044. DAM solutions possess the following capabilities a) Monitoring of database. These tools
audit database activity on a 24/7 basis in real-time. DAM monitors the activity of i) Privileged users (including database administrators and system administrators, to ensure that data is not accessed or modified without authorisation ii) Users, to check for unusual or malicious activity and iii) User accounts, to check if the accounts are dormant or inactive. b) Attack prevention. DAM also helps to prevent attacks by i) Providing alerts in real-time to notify security personnel of suspicious activity detected and ii)
Blocking attacks in real-time, based on recognition of known database exploits and unusual patterns of activity. c) Auditing for forensic investigations. DAM solutions are able to track the source of data leaks by recording the who, what, when, where and how of every query and identifying which records exactly have been exposed.
1045. Following the Cyber Attack, IHiS procured a DAM solution. This solution is capable of detecting
anomalous database activity, like bulk queries, and can automatically trigger alerts or block the activity. IHiS is still testing it before rolling it out fully, as there are concerns about whether the implementation of the DAM solution will negatively affect the
performance of the IT systems, either by causing lag or by triggering too many false positive alerts. Although there
