Comments on: DB Data Forensics

By: khair

khair — Thu, 12 Mar 2009 17:56:55 +0000

can we use also the same logic for package bodies, function or procedures. We are using tripwire but we are not satisfied from the operation point of view

Thank you
khair

By: Paul Wright

Paul Wright — Mon, 02 Mar 2009 16:49:17 +0000

Thanks for the interesting update Danny. I have made a note to revisit Fidelis’ feature set in future. It would be interesting to know what versions of TNS FIdelis supports as I have had experience of IDS/IPS not implementing TNSv9 (10g) properly as it had not updated from TNSv8 (9i)?

By: dannyl

dannyl — Mon, 02 Mar 2009 16:36:20 +0000

Paul
Great stuff! We’ve been using Fidelis XPS Internal for almost a year now and we’ve been able to do some interesting things tracking data as it leaves the DB server -
A couple things to correct you though – a. XPS parses TNS pretty well and you get a lot of useful data from the TNS session in the XPS advanced forensics. b. SSH is an interesting nut to crack – we’re working with a telco client on a project involving SSH interception – when it finally works – I imagine it will be quite interesting.

Best regards
Danny Lieberman
http://www.software.co.il – Buggy software, risky software