IDUG NA 2026

Security is often treated as an afterthought—apps launched without proper controls, cloud environments spun up outside organizational standards, third-party vendors granted excessive access to sensitive data. These missteps vary in form, but they all share a common denominator: data. And for attackers, data is the only thing that truly matters.
Regardless of how strong your perimeter defenses are, once an attacker gets inside, your ability to detect and respond quickly becomes critical. That’s where Guardium Database Activity Monitoring (DAM) comes in. DAM helps organizations understand what “normal” looks like—enabling real-time detection of anomalies, suspicious behavior, and potential breaches before serious damage is done.
In this session, we’ll explore how implementing IBM Guardium can reduce risk, improve incident response, and stop data leaks before they happen. Because when everything else can be bypassed, your best defense is knowing your data patterns.
Key scenarios we’ll examine include:- Privilege escalation and misuse- High-volume data extraction- Cross-site scripting (XSS) via database inputs- OS command injection through vulnerable queries- Abuse of privileged accounts- Unauthorized access to restricted or sensitive data- Password spraying and brute-force attempts- Anomalous behavior outside of baseline operations- Change reconciliation failures (e.g., Guard App event correlation)
For each use case, we’ll analyze:- What the attack looks like in terms of raw database activity- How DAM tools can be tuned to detect these patterns- Alerting and response workflows for containment and remediation