Disclaimer - Alliance Digital Repository

23
making sure their servers, especially those exposed to the Internet, are properly patched
(Westman, 2002; Alapati, 2003, sec. 1, par. 27).
Given that many businesses use databases for the storage of critical information,
and new requirements of both laws and governments require increased security of this
data, it is important to take the necessary actions to ensure security (Fernandez-Medina &
Piattini, 2005). Beynon-Davies (2004) suggests that the primary way of securing
database systems is by defining a set of authorized users of the entire system, or more
commonly, parts of the database. In order to prevent hacking attempts on default user
accounts of the RDBMS, Oracle Corporation recommends that all default user accounts
are locked and expired, with the exception of the SYS and SYSTEM account (Alapati,
2003, sec. 1, par. 3). Alapati (2003, sec. 1, pars. 4, 5, 7, 27) also suggests the following
to secure a database:
• Do not hard-code user passwords in scripts, but rather use a password file.
• Force users to change passwords in a timely fashion.
• Perform frequent checks of the audit trail for signs of logins as SYSDBA and
unsuccessful attempts to log in to the database.
• Keep current on new security vulnerabilities and patch accordingly.
While securing the perimeter of a network with a firewall will protect the database
from external threats, using these suggestions is a good step in protecting the database
from risks from the network inside the firewall (Alapati, 2003, sec. 1, par. 1, 22).