GuardDuty now watches for data exfiltration and destruction in your databases!
Hi, it's Shii-chan! Some good news for database security, so let me introduce it.
AWS What's New
aws.amazon.com
What was announced?
AWS What's New announced an expansion of Amazon GuardDuty RDS Protection. Beyond login anomalies, it can now detect data exfiltration and data destruction attacks targeting Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL. The new capability is called "RDS Protection for data activity".
The story so far
RDS Protection used to stop at detecting login anomalies. But attackers can get valid credentials through phishing, social engineering, or misconfiguration, and then exfiltrate or destroy data. Their malicious queries can look just like legitimate application behavior, which made them hard to spot.
What changes
Monitoring now extends to what queries do after login. GuardDuty builds a behavioral baseline of normal query patterns and detects deviations, catching threats that traditional tools can miss.
Dive Deep
The key points of how it works and how to enable it:
- ML-based anomaly detection and integrated threat intelligence continuously monitor database query patterns
- No agents, additional infrastructure, or database configuration changes are needed
- It's an add-on to RDS Protection for login activity
- Enable it for your whole organization in one click in the GuardDuty console, or via APIs, SDKs, the CLI, or CloudFormation
- Targets are Aurora PostgreSQL and RDS for PostgreSQL
On pricing, a 30-day free trial is available per account per Region. It's available in all AWS commercial Regions and AWS GovCloud (US) Regions.
Wrap-up
- GuardDuty RDS Protection now detects data exfiltration and destruction
- It covers Aurora PostgreSQL and RDS for PostgreSQL
- It finds anomalies against a query baseline without agents or config changes
- A 30-day free trial is available
It's a great fit for security folks running PostgreSQL who also worry about what happens after credentials are stolen.
