Imperva Cyber Community

communities_1.jpg
 View Only
  • 1.  SecureSphere Configurations

    Posted 10-17-2019 12:04
    I am interested in hearing other's solutions and best practices when leveraging SecureSphere. What best practices can you share regarding the confirgurations?  
     
    #On-PremisesWAF(formerlySecuresphere)
    #AllImperva

    ------------------------------
    Phan Tahn Long
    MiSoft JSC
    ------------------------------


  • 2.  RE: SecureSphere Configurations

    Posted 10-17-2019 13:34
    Phan, was there a deployment you were most interested in - DAM or WAF


  • 3.  RE: SecureSphere Configurations

    Posted 10-18-2019 10:37
    Phil,

    I think, it will be better if you can share both of WAF and DBF.

    ------------------------------
    cezmi çal
    technical expert
    Barikat Cyber Security
    ------------------------------



  • 4.  RE: SecureSphere Configurations

    Posted 10-18-2019 10:46
    I will begin with best practices for a DAM deployment - hope this is helpful

    Preparing to deploy DAM and multiple Agents, what are the important factors in doing this deployment.

    • Sizing
      • Probably the most important factor is proper sizing.
      • Sizing has two main factors – HPS and Throughput
      • HPS – hits per second – are the number of SQL hits/sec the GW can accept and process
        • Every GW model has its own maximum HPS that it can support, so its important to know what model of GW is being deployed
      • Throughput, is the amount of raw data that can be accepted by the GW
        • The throughput is the total data being sent by all agents that are connected to the GW
      • Audit requirements
        • It is critical to know what the auditors require to be audited
        • Most of the time the requirements are based on compliance but can be defined internally
      • Audit best practices
        • Only audit DB's that are in scope
        • Only use the default policy for a short period of time
          • The default policy is intended to provide a snapshot of the type of DB activity occurring so proper audit policies can be configured
          • Due to the amount of data generated by the default policy it is not recommended to run this policy an extended period of time
        • Use Agent Monitoring rules to exclude data that is not required to be audited
          • For example DB maintenance jobs are typically excluded
          • If DB maintenance jobs do need to be audited this will dramatically impact sizing and should be discussed in detail with the account team
        • Archive the audit daily
          • Archive data from the GW if possible
        • Purge audit data weekly
          • The may vary depending on the amount of data being collected
          • The more data collected the more frequent purge should be done
        • Deployment
          • Agents can be connected to a dedicated GW or a GW cluster
          • The proper decision will depend on the size and activity of the deployment
        • Reports
          • Audit requirements often include reporting
          • Request internally for report requirements