EnterpriseDB Releases New Postgres Plus Security Tools

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

EnterpriseDB is out this week with Postgres Plus Standard Server version 9, updating their commercially supported version of the open source PostgeSQL database. The open source community version of PostgreSQL 9 debutedin September 2010, adding new database replication and scalability features.

In addition to the new PostgreSQL Plus Standard Server release, EnterpriseDB is delivering new commercial tools to help PostgreSQL users to secure their databases and their code.

“The EnterpriseDB Postgres Plus Standard Server 9 release includes all of the patches that have come out since September,” Robin Schumacher, director of product strategy at EnterpriseDB told InternetNews.com. “We also package a number of ancillary pieces of software and make it all available in one place for customers.”

Beyond the core database, EnterpriseDB is making available a trio of database tools to PostgreSQL users. The SQL/Protect module is all about reducing the risk of SQL injection attacks.

SQL injection attacks are among the most common type of database attack. Typically the approach taken by security vendors to secure against SQL injection is to implement some form of input sanitation procedure. IBM recently announced a new SQL injection technology that can help developers mitigate issues at the coding level.

Schumacher explained that the way EnterpriseDB’s SQL/Protect works is by first analyzing a PostgreSQL database installation to see what is considered to be normal behavior. He added that there is a role based setup that can enable an administrator to watch a set of users and then monitor the SQL activities from certain users or roles.

“It learns what is normal for your server and once it learns those patterns you can set either a passive or active mode,” Schumacher said. “Passive mode issues warnings but won’t stop SQL from executing while the active mode will actually block a SQL injection attack.”

In addition to SQL injection protection, EnterpriseDB is delivering the PL/Secure module that is designed to protect application logic as well.

“Postgres has a very rich stored procedure language and often people want to build application logic into the database,” Schumacher said.

He added that if a PostgreSQL database administrator has some sensitive application logic that doesn’t need to be seen by everybody, that can become a problem if the database logic can be seen by anybody.

“What PL/Secure basically does is it encrypts the application logic that people write, that runs at the database layer,” Schumacher said. “Therefore users can’t just simply pull up a stored procedure and look at the code, as it’s completely encrypted.”

Additionally EnterpriseDB is providing a new tool for heterogenous database replication with the xDB Replication Server.

“xDB is designed to handle replication from one Postgres server to another and it can also do Oracle to Postgres,” Schumacher said. “So if people are interested in replicating Oracle into a Postgres server, this enables an administrator to point and click their way though the process.”

Sean Michael Kerner is a senior editor at InternetNews.com, the news service of Internet.com, the network for technology professionals.