Vulnerability Assessment and Security Scanning for Oracle and Microsoft Databases  Per Database Instance License. 

           By Red Database Security

With more than 3000 security verifications scanning Oracle and Microsfot databases and applications, Repscan™ by Red-Database-Security is the most comprehensive vulnerability assessment solution available.  

 

Based on real-world Oracle Experience 

Developed by one of the world’s foremost authorities on Oracle security – Alexander Kornbrust of Red-Database-Security – Repscan provides a crystal clear picture of Oracle and Microsoft's security level with simple remediation  instructions - at your fingertips.  

Why Repscan?

Repscan is the only tool that can deliver 360 degree reporting on the security posture of your Oracle and Microsoft databases. Repscan can detect database modifications, can test 100s of databases for neglected patches, insecure system configurations, weak and default passwords (database/APEX/OID/OVS passwords) and even insecure PL/SQL code and forensic traces.

Product Highlights

• Detects insecure PL/SQL-Code
• Shows the patch level of all your databases in one-click
• Finds security problems such as SQL Injections, hardcoded passwords, deprecated functions
• Detects weak or default passwords
• More than 115 Oracle/Microsoft tables checked for password information
• Detects changed database objects including root kits
• Detects altered data (including modifications of privilege and user tables)
• Discovers forensic traces from common security and hacker tools
• Complements and integrates with Sentrigo’s Hedgehog family of database activity monitoring software

Download your free limited trial-version of Repscan now! The free limited trial-version is a great introduction to Repscan. This includes: 

• Scanning 2 databases at a time

• Checking 50% of insecure passwords

  The full-version of Repscan with complete features and functionality includes:   

• Testing of known vulnerabilities
• Testing of known backdoors
• Creating Hedgehog rules (Granular user-defined policies)
• Generating SQL Fix scripts
• Various reports (PCI, Installed Software, Forensic, Findbackdoor)   To find out more about the full version, contact us: sales@sentrigo.com

 

Repscan further provides: 

• Small XML-based reports that can be easily integrated into 3rd party reporting tools
• Database browser allows interactive review by security personnel without deep database knowledge
• Discovery tools identify databases and tables with sensititive information
• Security updates allowing you to remain current and identify recently discovered vulnerabilities and weaknesses. (Requires subscription) 
• Quick, easy installation: import database connections from tnsnames.ora files or adding database names manually.
• Scalability: scan simple, single database installations - up to hundreds of databases from a single location.

Your Introduction to Database Activity Monitoring

Hedgehog Standard™ is perfect for growing organizations that require activity monitoring for a handful of mission critical databases. Hedgehog Standard brings enterprise-level security to the database. It's completely free to download and use. Using the same ground-breaking technology as Hedgehog Enterprise, it provides visibility in real-time into all database activity and alerts on suspicious activity.

Product Highlights:

 

• Granular user-defined rules, inspecting activity based on SQL statements, database objects being accessed, IP address, user, date & time ranges, application used to access the database, and more
• Real-time monitoring and alerting - available for one database at a time, with sorting and filtering by severity level, time, rule triggers, etc.
• Audit trail of generated alerts and events, facilitates regulatory database compliance with PCI DSS, SOX, HIPAA and privacy notification laws
• Free web-based support (phone support is available as an option) For a comparison of the two products, click here.

Imagine patching the database with no downtime, no backups.  

To date, there are hundreds of known vulnerabilities in DBMSs across different vendors and versions. Databases are complex applications. This complexity makes them particularly susceptible to many security vulnerabilities that provide an entry point for intruders and unauthorized users. Exploits published on the Web enable even rookie hackers to get into the database and own it by using privilege escalation, and attack vectors such as SQL injection and buffer overflow. Severe vulnerabilities even allow remote access by unauthenticated users, for example, those who are on remote IP addresses and have no database login credentials at all. With so many known risks for DBMSs across so many vendors and versions, it seems unthinkable that databases would be left unpatched. Critical databases are left unpatched for months or even years, vulnerable to attacks that result in data theft, breaches of privacy and non-compliance with regulatory requirements.

Why aren't vendor-issued security patches being deployed?

While Sentrigo recommends timely, regular deployment of vendor-issued security patches as the best way to protect corporate databases, due to the following reasons, many organizations do not patch their databases in a timely manner: 

• Patching is an update to the DBMS kernel and requires database downtime. This is often not an option in 24x7 environments, or is extremely difficult to coordinate.
• Patching requires regression testing of all applications running on top of the database.
• Many application vendors only certify their applications to run on top of specific releases of DBMSs - updates not included.
• Older, yet still used database versions are not supported by new security patches.

 

What Is Virtual Patching?

Virtual patching is a way to protect the database against exploits without actually patching the DBMS kernel. This creates a security layer around the database that, unlike vendor patching, does not require downtime or application testing.

Hedgehog vPatch protects databases in real-time against known vulnerabilities using unique virtual patching capabilities

  By monitoring all actions in the database and matching them against rules that detect known exploits and vulnerabilities, virtual patching detects attempted exploits. When a match occurs, an alert is issued and the suspicious session can be terminated and the originating user quarantined for specified period, until the nature of the suspected attack is investigated.

Downloadable, Easy to Deploy Across Multiple Databases

Hedgehog vPatch is a subscription-based offering that includes two components:

• Host-based software that uses sensors to protect the DBMS with a set of protections (virtual patches) to detect and prevent attempted exploits of DBMS vulnerabilities.
• Ongoing updates for newly discovered and existing vulnerabilities, courtesy of Sentrigo's "Red Team" — a team of security researchers who are constantly finding DBMS vulnerabilities and exploits, and devising ways of stopping them.

  Hedgehog vPatch is non-intrusive, does not use native DBMS auditing or API functions and is not part of the DBMS - it directly monitors the database memory cache and has full visibility into all database activity.

Hedgehog vPatch™ Advantages

• No database downtime is required both during the initial installation as well as during the ongoing deployment of security updates.
• No impact on the application layer
• Support for older DBMS versions (e.g., Oracle 8i, 9i)

 

More details

• License/subscription and pricing
• Product comparison
• System requirements