Home Security Guardium Data Protection
IBM Guardium Data Protection

Automate compliance auditing and reporting, discover and classify data and data sources, monitor user activity and respond to threats in near real time

Book a live demo

Modernizing data security—A comprehensive roadmap for IBM Guardium | IBM TechXchange Conference

Read the press release

IBM Guardium® Data Protection is data security software in the Guardium family of IBM Security® products. It is comprehensive data protection software that guards on-premises and cloud data stores through features such as data activity monitoring and analytics, near real-time threat response workflows, and automated compliance auditing and reporting.

Data security for a cloud-driven world

IBM Guardium Data Protection supports a modern, zero-trust approach to data security. No matter where your data resides you can have comprehensive security.

  • Discover and classify sensitive data across major data repositories, from AWS, DBaaS, and unstructured data in files to on premise mainframes and structured data environments.

  • Comprehensive activity monitoring and flexible deployment options for quick and intelligent response to advanced threats.

  • Streamline and automate data compliance workflows using prebuilt templates for regulations including PCI DSS, SOX, HIPAA, GDPR, CCPA and many more.

Data security and compliance

Guardium Data Protection's latest release (v 12.1) introduces several enhancements to streamline data compliance, reduce false positives, and accelerate the detection of security incidents.

Special report

Get the 2024 Cost of a Data Breach Report

Learn more from the Guardium Data Protection solution brief
Why Guardium Guardium Data Protection delivers meaningful results. Read the IBM-commissioned 2023 Forrester Consulting Total Economic Impact™ study to learn more about the benefits our clients have realized. Read the 2023 Forrester TEI study 406%

The study found a 406% ROI with benefits of USD 5.86 million over 3 years.

70%

The study revealed a 70% reduction in time spent on auditing.

25%

The study calculated that 25% of data security analysts’ time was saved.

Benefits Get faster compliance

Preinstalled capabilities enable faster compliance and data security​. Compliance tagging, prebuilt policies, easy-to-use workflows and long-term data retention help speed time to value, so you can meet various compliance requirements such as PCI DSS, GDPR and CCPA in a shorter amount of time.

Centralize visibility and control

A data protection strategy with centralized policy management and enforcement across hybrid multicloud environments helps organizations break down silos, accelerate response, and reduce risk to the business with actionable intelligence from a central location. 

Reduce noise to security operations centers

Actionable, high-priority events are automatically shared with SIEM and SOAR solutions to reduce response times, remove the need for manual action and improve the quality of the data being analyzed, significantly reducing the cost of your SIEM.

Enforce security policies in near real time

Enable your team to quickly discern and focus on the most significant threats with actionable intelligence. Quickly monitor security policies and sensitive data access control, privileged user actions, change control, application user activities and security exceptions for faster remediation.

Reduce costs and overhead​ with modernized infrastructure

Containerized orchestration supports elastic scalability and flexible deployment options​. Evolve your data security as your data and IT infrastructure change and grow—while reducing costs.

Features
Dynamic risk assessment The Risk Spotter implements a dynamic risk assessment, which considers multiple risk factors, to identify risky users. Each user's overall risk score is calculated daily based on the audited data, which you can use to prioritize mitigating actions.

Active threat analytics The Active Threat Analytics dashboard shows potential security breach cases, based on an outlier mining process and identified attack symptoms. In this dashboard you can view and investigate cases, and also act on individual cases.
Smart assistant The Smart Assistant is a low-touch, guided, 4-step workflow feature. It helps you get up and running on compliance monitoring by defining custom policies, workflows and reports for global regulations such as PCI DSS, SOX, GDPR, CCPA, Basel, HIPAA and others. Learn more
Universal connector The Universal Connector is a lightweight open-source framework. It is used to develop plug-ins for Guardium to monitor cloud and on-premises data sources by using native audit logs. Customers and partners are encouraged to build their own plug-ins by using the Universal Connector framework.
Agentless or agent-based monitoring

For agent-based monitoring, Guardium supports S-TAPs (installed at the data source) and External S-TAPs (installed inline for containerized and cloud data sources). Supported agentless options include Universal Connector plug-ins and cloud event streams (for example, AWS Kinesis and Azure Event Hubs).

Vulnerability assessment

The IBM Guardium® Vulnerability Assessment scans data infrastructure such as databases, data warehouses and big data environments—both on premises and in the cloud—to detect vulnerabilities and suggest remedial actions based on benchmarks from STIG, CIS, CVE and other configurations.

Learn more
Centralized, agile platform

IBM Guardium Data Protection is built to scale seamlessly from one data source to tens of thousands with little to no impact on performance. To support this immense scalability and facilitate better management of load balancing, the platform automatically adapts to changes in the data center, an ideal feature when you need to support large deployments and frequent changes.

Guardium Data Protection integrations
Identity and access management solutions

Guardium Data Protection can integrate with IBM Verify and other identity management solutions (such as AWS Secrets Manager and CyberArk) for security automation use cases such as securely storing, provisioning and auditing your Guardium data source credentials.

Case management and threat response solutions

Guardium helps surface data-level security threats and can improve security operations with integrations to ServiceNow and to SIEM solutions such as Splunk and IBM QRadar® SIEM. It also enables security orchestration and response with IBM QRadar® SOAR.

Unite data security and data governance

Guardium agents are available on the IBM Cloud Pak® for Data for proactive monitoring of hosted containerized database services and data sources external to the cloud pak. These agents also provide separation of duties between database access and the processes responsible for monitoring behavior. 

IBM Guardium Discover and Classify

IBM Guardium Discover and Classify provides automated, near real-time discovery, network mapping and tracking of sensitive data. Combined with the robust data monitoring provided by Guardium Data Protection, it can help your organization boost operational efficientcy, significantly reduce risk and lower costs. 

Use Guardium Data Protection with your choice of data sources Databases

Guardium Data Protection for Databases provides automated data discovery and classification, near real-time activity monitoring, and machine learning analytics to discover unusual activity around sensitive data stored in databases, data warehouses and other structured data environments. The solution supports data on IBM Db2®, Oracle, Teradata, Sybase, Microsoft® SQL Server, Windows®, UNIX®, Linux®, AS/400 and z/OS®, and Hadoop NoSQL. It also supports key enterprise resource planning, CRP and custom applications.

Big data

Guardium Data Protection for Big Data provides full visibility on data activity, detecting unusual activity around sensitive data with near real-time data monitoring and machine learning analytics. The solution learns user access patterns to detect suspicious activity, giving administrators the option to block access or quarantine users to defend against internal and external threats. It accelerates compliance workflows through a prebuilt regulation template and supports both Hadoop and NoSQL environments.

Files

Guardium Data Protection for Files provides automated discovery and classification of unstructured data in files and file systems, including NAS, SharePoint, Windows, Unix and Linux, to help you better understand and control unstructured data risks. Machine learning analytics detect unusual activity around sensitive data with intelligent access management and file activity monitoring across files and file systems.

Mainframes

Guardium Data Protection for z/OS enables you to deploy on-premises mainframes, including IBM z Systems®  with data protection built in. The solution protects against threats by automating data discovery and classification, with near real-time activity monitoring and machine learning analytics. Alerts are sent to SIEM solutions for correlating threats and streamlining response. You can also proactively assess vulnerabilities and misconfigurations in your Db2, information management system and data sets.

DBaaS

Guardium Data Protection for Database Services is optimized to provide automated data discovery and classification, near real-time activity monitoring, and machine learning analytics to sensitive data stored in database-as-a-service (DBaaS) platforms and cloud-native platforms, such as IBM Cloud Pak for Data. The solution supports databases consumed as a service from the cloud, including AWS RDS and Azure Database-Platform-as-a-Service.

AWS

Guardium Data Protection enables you to scale and innovate in AWS while safeguarding sensitive data. You will quickly achieve smarter, more unified data protection across your hybrid AWS cloud environment with a unified set of powerful security controls, including discovery and classification, vulnerability and risk assessments, near real-time monitoring and alerting, security policy controls, advanced analytics, and integration across the security stack.

Use cases

Data protection across the hybrid cloud Whether you recently experienced a breach or you're in need of stronger controls, data security should be top of mind and simple to execute. With Guardium Data Protection, you can discover and classify sensitive data and protect data in real time with dynamic masking, redaction, quarantining and blocking​. It provides centralized visibility and control so you can protect modern and legacy data environments simultaneously, apply policies from a single location, and understand how users are accessing data. Enforce a least privileged access approach so that data is accessed only on a need-to-know basis.

Flexible database monitoring As most organizations are moving IT infrastructure to the cloud, they must the protect structured and unstructured data that’s multiplying across public clouds, data warehouses and popular SaaS apps​. Guardium Data Protection is built on a scalable architecture that provides full visibility into all data types and their data activity across all major data repositories. Organizations have the option to use at-source monitoring for sensitive data by using Guardium agents and can also monitor non-sensitive and internal data sources through Universal Connector plug-ins, making it fast and easy to connect Guardium to modern, cloud-based data environments.

Find and respond to threats faster Should an organization need to respond to threats, Guardium can block access and redact data in real time, open tickets efficiently and share insights with other security tools. It also provides detailed threat and user insights through at-a-glance risk views with click-through and drill-down features to investigate further. These views are powered by AI and machine learning algorithms that detect advanced attack vectors such as SQL injection, data leakage, service account abuse, denial of services, account takeover and more.

Simplify compliance Manual audits are time-consuming and new regulatory compliance requirements make it difficult to keep track of what data needs to be protected, especially in the cloud. Guardium Data Protection helps to address security and privacy regulatory compliance with preinstalled and customizable policies, streamlined audit workflows and fast reporting. Take advantage of predefined templates for policies, groups and reports to meet various compliance requirements such as PCI DSS, GDPR and CCPA in a short amount of time.

Pricing
Contact us for more details and pricing in your environment

Visit the AWS Marketplace to learn more about using Guardium on AWS

Visit AWS Marketplace
Resources Guardium Data Protection V12 updates

Find threats faster by enhancing data security across complex environments with Guardium Data Protection V12.

KuppingerCole Leadership Compass for Data Security Platforms

Get an overview of the Data Security Platforms market, along with guidance and recommendations for finding the sensitive data protection and governance products that best meet clients’ requirement.

Overcoming data security challenges in a hybrid multicloud world

Learn more about how to protect your data wherever it resides with the IBM Guardium platform.

The Need for Data Compliance in Today's Cloud Era

Read a senior analyst's perspective on the importance of data compliance.

Guardium products IBM Guardium Vulnerability Assessment

Scan your data to detect vulnerabilities, threats and security gaps.

IBM Guardium® Data Security Center

Protect your data from current and emerging risks, including AI and cryptographic attacks, through a unified experience.

IBM Guardium® DSPM

Discover, classify, and secure your enterprise data across cloud and SaaS environments.

IBM Guardium Discover and Classify

AI-powered solution for rapid discovery and precise classification of sensitive data, wherever it resides. Delivering data discovery with 98,6% accuracy in structured data and 100% accuracy in unstructured data.

IBM Guardium® Key Lifecycle Manager

Deliver centralized, secured key management with reduced costs and greater operational efficiency.

IBM Guardium® Data Encryption

Encrypt sensitive data in all states and across environments, including your files, databases and applications. Address data security and privacy regulations, and control encryption keys for cloud-based data.

Get a live demo from an expert for any Guardium product

Frequently asked questions

What groups and users can use Guardium Data Protection?

Data security is everyone's business. While security and compliance teams are primary users, the implications of data security is now beyond IT. Data, privacy, lines of business, risk and legal teams all have use cases that are supported by Guardium Data Protection.

What challenges does Guardium Data Protection address for security teams?

Guardium can help address the challenges of having visibility into sensitive data, whether on premises or in the cloud, detecting risky users and suspicious data access and activity, and simplifying data security and data privacy compliance.

How does Guardium Data Protection align to a zero-trust framework?

Guardium Data Protection wraps security around data with context through data activity monitoring to learn when, where, how and who is accessing data to detect anomalous and non-compliant activity—and dynamically adjust controls and access rights.

How does Guardium Data Protection enable customers to address data privacy?

Guardium can help accelerate your ability to address data privacy compliance with easy-to-set-up compliance policies and monitoring, a data access audit trail, entitlement reporting and other compliance reports.

What types of data discovery methods does Guardium Data Protection provide?

Guardium supports data discovery using a policy-based approach. Prebuilt and custom classifier policies can be defined to perform catalog or metadata discovery using sensitive data regexes and patterns. It can also be used to perform exact data match and unstructured data discovery.

Can Guardium Data Protection deploy in the cloud?

Yes, Guardium supports deployment on several cloud platforms. Get more information about deploying Guardium on Amazon AWS, Google, IBM Cloud, Microsoft Azure and Oracle OCI.

What do I need to run Guardium Data Protection? What types of data activity monitoring methods does Guardium Data Protection provide?

Guardium Data Protection provides both agent-based and agentless methods to monitor data sources. It supports multiple monitoring methods under each of these categories based on the type of data source and where it is located—in the cloud or in your data center.

What data collection and monitoring connectors are available?

For agent-based monitoring, Guardium supports S-TAPs (installed at the data source) and External S-TAPs (installed in-line for containerized and cloud data sources). Supported agentless options include Universal Connector plug-ins and cloud event streams (for example, AWS Kinesis and Azure Event Hubs).

What compliance reports can Guardium Data Protection generate?

Guardium provides prebuilt report templates to get started with compliance monitoring for various regulations and standards such as PCI DSS, SOX, HIPAA, GDPR and CCPA. It also offers Workflow Builder to define custom audit workflows and reports that can be tailored to the needs of various teams.

Does Guardium Data Protection address data loss prevention (DLP)?

Guardium Data Protection does not directly prevent data loss, but visibility of sensitive data and knowing where it resides is an important part of DLP. The discover and classification capabilities of Guardium help to address those challenges.

Take the next step

Get started with a click-through demo of Guardium Data Protection or review your options with a Guardium expert in a free, 30-minute call.

Guardium Data Protection demo
More ways to explore Documentation IBM Security Learning Academy Thought leadership Community