[Solution Review] DBSAFER AI Assistant Links Logs, Permissions, and Policies With Natural Language

As enterprises expand their use of AI and deploy more cloud and hybrid infrastructure, the scope of systems they manage continues to grow, control boundaries broaden, log and policy volumes increase, and relationships among users, resources, and other elements become more complex. At the same time, the time available for security teams to detect and respond to threats has shrunk, while humans are still responsible for interpreting logs, policies, and relationships, creating a need for a way to reduce the complexity of security operations.

In response, PNP SECURE introduced the "DBSAFER AI Assistant." Built on a conversational interface, the tool allows users to handle tasks in natural language. AI interprets the intent of the question, searches logs and policies, then provides a summary of the results as well as chart and relationship visualizations. This article examines how security operations workflows change after adopting DBSAFER AI Assistant.

Against the backdrop of AI expansion, concerns on the security operations front are intensifying. The complexity of IT environments is rising rapidly, and the scope of system interconnections is also expanding. As AI, cloud, and other externally linked systems and services increase, both the complexity of the security operations environment and the range of management responsibilities are growing.

As systems expand in this way, the number of management points for administrators has also increased significantly. Permission management issues are also emerging as systems expand. In particular, as developers, analysts, and operators hold permissions across multiple systems and data during AI service development, data analysis, and training, a single user's access scope is widening.

As a result, the relationship between systems and permissions is becoming more complex. The scope of control, which was centered on people, is also expanding into non-human domains. With more AI agents autonomously accessing systems and data to perform tasks, the nature of what must be managed is changing as well.

Non-human accounts and AI are also being brought under management. But unidentified non-human accounts are becoming blind spots. These invisible accounts are emerging as a new vulnerability point.

Attackers can launch automated attacks against unidentified non-human account points. In this environment, DBSAFER AI Assistant supports a scope that integrates detection, analysis, and response procedures.

As the time between vulnerability disclosure and real-world exploitation has shortened, the time security teams have to respond to threats has decreased. At the same time, the volume of logs and policies that security teams must review has increased, adding to the burden on security personnel.

On top of that, the difficulty of understanding relationships among users, resources, permissions, and actions has also risen. This relationship analysis depends on personnel, and the need for people to interpret it directly is making security response even more difficult.

PNP SECURE unveiled "DBSAFER AI Assistant" as a way to ease this complexity in security operations. The company also presented a comparison between legacy security operations and an environment with DBSAFER AI Assistant deployed.

"DBSAFER AI Assistant" provides a conversational interface, allowing administrators to handle work by asking only natural-language questions about the information they need or the tasks they want to perform. AI interprets the intent of the query and provides a summary of the results along with visualizations. Photo courtesy of PNP SECURE.

Previously, administrators had to navigate management console menus, enter search conditions such as time period, user, and service, search logs, compare multiple results, and determine policy application relationships and root causes on their own. The administrator was also the one responsible for critical decision-making.

With an AI assistant in place, the burden of remembering menu structures or searching for information is reduced, and administrators can focus more on the work they are trying to resolve. Based on existing security policies and operational data, AI searches and organizes information, suggests possible actions, and integrates analysis results with the operational flow of the management screen so that the outcome of a question can be connected to management tasks.

In this process, AI responses are delivered in a form tailored to actual security operations data and tasks. Responses are generated based on managed entities such as sessions, commands, accounts, objects, and policies, while the intent of the question is interpreted in a security operations context and arbitrary searches of external information are excluded.

However, the role of reviewing the analysis results remains with the administrator, and final approval for policy changes is also handled by the administrator. Accordingly, AI is responsible for suggesting possible actions, while final judgment and approval of policy changes continue to be performed by the administrator.

The photo shows DBSAFER AI Assistant providing natural-language log search capabilities.

DBSAFER AI Assistant supports log searches through natural-language question-and-answer interactions. Users can query related logs simply by asking a natural-language question, without separately entering conditions such as search period, user, or service into a dedicated search screen.

An administrator can ask, for example, for the number of database connection failures over the past week. When the question is processed, related data such as session logs, command logs, and statistical logs are searched.

Search results are provided in summary and chart formats. Administrators can then ask follow-up questions to check whether failures are concentrated around a specific user or service, narrowing the scope of analysis.

If it is difficult to make a judgment from summary information alone, users can move to the web manager's detailed screen. On that screen, they can review the raw logs directly. This kind of conversational analysis is linked with existing management functions and extends all the way to verification of actual evidence after the conversation-based analysis.

Previously, administrators had to spend time searching logs and repeatedly entering conditions.

This function reduces the time administrators spend searching logs and repeatedly entering conditions. As a result, administrators can focus more on interpreting the meaning of anomalies.

In addition, the core of access permission reviews is understanding what each subject can access and what permissions are held. However, in operating environments, information about users, services, databases, servers, and policies can be scattered across multiple management screens.

DBSAFER AI Assistant supports functionality that improves visibility into objects and permissions. It also enables users to query and visualize relationships between users and resources based on questions.

One example query is asking to show all services and permissions accessible to User A. Through this, administrators can confirm allow policies and block policies by user and resource, as well as command-level permissions.

By integrating permissions and management status into a relationship diagram, it becomes possible to review dispersed information in a single relational view. This improves the speed of checking excessive permissions and blind spots in management. During periodic permission reviews and audit response, it also reduces the burden of comparing multiple screens and materials.

In security policy work, the main challenge is often not adding new policies but determining their relationship to existing ones. In particular, when target scope, time, commands, and policy priority overlap, policy conflict factors arise. Such overlapping policies may lead to unintended allowances or blocks.

In this context, DBSAFER AI Assistant's policy simulation function was introduced. This function organizes administrator requests into policy conditions. It also analyzes in advance the possibility of conflicts with existing policies and the expected impact, and suggests how to apply them.

As an example, a case was presented in which an administrator requests blocking nighttime access to a financial database. At that point, AI first checks the target service, user scope, and application time. It then builds a policy proposal based on the confirmed conditions.

After building the policy proposal, AI checks whether it conflicts with existing policies. It also presents any conditions that require additional confirmation to the administrator. In this process, the possibility of conflicts with existing policies and the expected impact are analyzed in advance.

After that, the policy proceeds to the application stage following the administrator's review and approval. This flow assumes a process in which the request is organized into a policy proposal and the possibility of conflicts and their impact are analyzed in advance. In the end, the structure leads to implementation after the administrator confirms and approves it.

This AI is not designed to replace the administrator or make policy decisions on its own. Instead, it is focused on checking impact before application and supporting the administrator's final judgment. In that sense, it is aimed at reducing errors and trial-and-error in manual policy priority calculations.

It also supports repetitive policy and object configuration tasks in actual operations through natural language. It includes support for unsupervised-learning-based anomaly detection. In addition, through a conversational UI, it provides support for adding objects, starting and stopping services, changing security account passwords, and locking security accounts.

However, an AI tool for administrators is not sufficient on convenience alone. Adding new features to a security system can affect the stability of existing services. New risks can also arise if internal logs and policy information used for analysis are transmitted outside the organization.

Accordingly, DBSAFER AI Assistant separates AI functions into a separate middleware layer. It also adopts a structure that distinguishes the core access control area from the AI processing area. This reflects a direction of operating the core functions of the existing security system separately from AI capabilities.

The purpose of this structure is to reduce system impact from adding or changing AI functions. At the same time, it allows flexible configuration for each customer environment. The design reflects an approach aimed at applying AI functions without compromising existing service stability or data security.

PNP SECURE said it designed the solution so it can be used in CPU-based environments as well, with the goal of easing the burden of high-spec AI infrastructure. This offers a way to use the solution even in environments that lack high-spec infrastructure.

PNP SECURE also announced support for a private LLM configuration that can operate independently within customer environments, including air-gapped networks. It explained that in a private environment, log and policy data are not transmitted to external AI services and can be processed inside the customer's environment.

The company also said it supports MCP(Model Context Protocol) integration to expand functionality. MCP is a standardized interface for connecting AI with external systems and tools.

PNP SECURE said MCP can be used to link the customer's private LLM with the AI assistant. It also explained that it can be used to connect internal business systems with the AI assistant.

PNP SECURE said it conducted advance validation with major domestic customers. As a result, it confirmed reductions in repetitive log lookup procedures and policy verification procedures. The photo shows the company's proposed approach to addressing security complexity in the AI era.

One customer adopted the solution. Before adoption, the company had to set conditions across multiple menus and aggregate the results in order to handle existing log and statistical lookup tasks. It also had to gather information from multiple screens to prepare for audit response.

After adoption, the way log and statistical lookup tasks were initiated changed to natural-language questions. As a result, for some repetitive lookup tasks, users could check the initial results through natural-language questions instead of gathering data across multiple menus. Audit preparation, which previously required collecting information from multiple screens, also became more focused on the necessary scope of information. A company representative who participated in the test said that even employees unfamiliar with the product could confirm the logs and policies they needed through questions, that it helped reduce operational variation depending on staff expertise, and that it simplified audit-response material preparation.

The effects on response time and work reduction varied depending on the customer environment and query scope. A company representative said the pre-validation confirmed key changes. He added that administrators spent less time learning the menu structure and search methods, and that the consistency of how needed information was checked also improved.

If repeated searching and material aggregation are reduced, administrators' working time can be reallocated. As a result, administrators can focus on interpreting the meaning of anomalies and determining whether policies are appropriate. The share of work that requires human expertise also increases.

The image description says that DBSAFER AI Assistant's main value is shown in the photo, and that the photo is courtesy of PNP SECURE. AI has a dual nature as both a new risk factor and a means of supporting security operations. At the same time, the number of managed entities and threats is also continuing to rise.

In this environment, security administrators do not need more screens. Security administrators do not need longer manuals either. Instead, what they need is a workflow that asks key questions, understands analysis results, and connects them to appropriate actions.

To do this, DBSAFER AI Assistant links natural-language queries, log analysis, policy analysis, and follow-up actions into a single workflow. It is a structure that connects the process from question to analysis to response.

It also considers the stability of existing systems and internal data protection by separating AI functions into middleware and supporting a private LLM configuration.

Lee Jin-wook, head of PNP SECURE's DevOps team, said AI cannot replace an administrator's judgment. He explained that AI's role is to quickly search vast amounts of data for the information needed to make decisions and present complex permission relationships and policy impacts in an easy-to-understand form.

Based on that, he said a shift in the center of gravity for security operations is necessary. He explained that "search" means tracking information and "judgment" means interpreting and deciding on risk, and said security operations must move from "search" to "judgment." He presented the approach offered by DBSAFER AI Assistant as a new form of security operations for the AI era.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242274

References

• https://www.itdaily.kr/news/articleView.html?idxno=242274