We're half way through day one at the  IANS security conference in NY. This is my second time speaking at the IANS conference; the first was about a month ago in DC. I continue to be impressed with IANS, they are well managed, have great attendees, and interesting topics. Thus far, most of my conversations in the hallways have been around tracking user sessions through the Web application, into the database, and back out.

Many people really want to address the nuts and bolts of simply finding out "who" did "what" on an application and in turn, what that means in terms of accessing sensitive data within the database. Bringing the worlds of Web applications and databases together is a key differentiator for Imperva and very critical for a data security in general, so this is a topic I'm spending a great deal of time on during my presentation.

I find it interesting that no matter how much security matures, and attacks continue to increase in complexity - the fundamentals like "who" seem to be a consistent theme through the ages.