Audit Vault and Database Firewall for nationalized bank in India

Tech Stack

The Client

The Client

The client is one of the largest banks of India; with the government owning 90% of its share capital. It is listed on the Forbes 2000, and has assets worth US$13.45 billion. This bank has around 4,300 branches, with four overseas branches in Hong Kong, Dubai, Antwerp, and Sydney.

The Objective

The client requirement was to track database activity from the network, while complying with bank’s security policy. The Oracle Audit Vault and Database Firewall tool was chosen for the purpose. It enabled easy compliance reporting and alerting. Oracle Audit Vault and Database Firewall (Oracle DAM) provides a first line of defense for databases and consolidates audit data from databases, operating systems, and directories. A highly accurate SQL grammar-based engine monitors and blocks unauthorized SQL traffic before it reaches the database.

The Objective

The HIPL Edge

With Oracle DAM, auditing and monitoring controls can be easily tailored to meet enterprise security requirements. Database activity data from the network is combined with detailed audit data for easy compliance reporting and alerting.

  • Installation of Audit Vault Server and Database Firewall (12.2.6)
  • Configuration of AV Servers in HA mode
  • Configuration of DF Servers in HA mode
  • Configuration of Secured Targets and Audit Trail
  • AV Reports Setup
  • Backing up AV and DF Server
  • Failover testing of AV and DF Server
  • Adding AVDF components in OEM and configure rules for alert notifications
  • VA/PT of the Application
  • Testing Report of UAT / QAT with used Test Cases
  • Approval Note of IT strategy
  • Product Evaluation / ORMC Approval Note
  • Third Party Vendor Risk Assessment
  • Onsite Vendor Risk Assessment
  • Compliance of RBI Advisories
  • Compliance of IT Examination observed
  • Updated Inventory (UAT / Development / Production)

The Outcome

Implementation of Oracle DAM at the client site, proved advantageous and valuable. Few of the significant ones are listed below:
  • Client was able to achieve compliance quickly with packaged and customizable reports.
  • Meet both security and compliance requirements with a single deployment.
  • Lower cost of ownership with highly accurate SQL analysis, out-of-the-box reports, and proactive alerts.
  • Customer was able to monitor database activities and blocking on the network and consolidates audit data from Oracle, MySQL, Microsoft SQL Server, SAP Sybase, and IBM DB2 databases.
  • Whitelist, blacklist, and exception list-based enforcement on the network.
 

More Case Studies