Proceedings

CRITICAL SUCCESS FACTORS FOR THE ORACLE
DATABASE AUDIT
Simona Felicia UNCHIASU 1 & Pavel NASTASE
Bucharest Academy of Economic Studies, Romania
ABSTRACT
The increased use of Internet, portable devices, mobile and wireless technologies has
enhanced and eased the access to information and expanded the risk of unauthorized
disclosure of confidential personal, customers and business related information. All the
aforementioned factors have facilitated the corporate espionage, privacy breach, data
leakage and terrorism, therefore the information security topic was brought in the forefront of
information technology concerns for many organizations. Expectations in terms of
confidentiality, integrity and availability of the information are high, since shareholders,
employees, customers and business partners demand a real-time access and accurate data.
Risks associated with such information systems need to be addressed. An effective approach
must consider the risks introduced by all components of an information system, like
application, operating system, network and telecommunication, databases, interfaces with
other legacy systems and by the physical environment. In the past, many IT audits were
performed just at the application or at the network level and quite frequently the database
was overlooked, even though it is the repository for critical data and therefore a key
component of any information system. Loosing data confidentiality, integrity and availability
can cost a company not only in terms of sales but in reputation and litigation costs also.
Currently, the interest in auditing databases has increased due to the growing legal and
regulatory frameworks as well. Having this in our mind, we tried to propose in this article an
audit plan that best covers the ORACLE databases vulnerabilities and hardening issues. The
audit plan is based on literature review, COBIT framework and our own practical
experiences with databases. We analyzed the COBIT framework and we selected the
processes and the relevant control objectives that are critical for the database control and we
translated them into audit steps.
KEYWORDS: IT Governance, COBIT, Data breach, Database vulnerabilities, Database
audit program
INTRODUCTION
The increased use of Internet, portable computer devices, mobile and wireless
technologies has enhanced and eased the access to information and expanded the risk
of unauthorized disclosure of confidential personal, customers and business related
information. All the aforementioned factors have facilitated the corporate espionage,
privacy breach and terrorism, therefore the information security topic was brought in
the forefront of information technology concerns for many organizations. The new
technological developments have provided new opportunities for the occurrence of
information systems related problems such as data leakage, identity theft, malicious
1 Correspondence address: Simona Felicia UNCHIASU, CISA, CRISC, Ph.D. student, Bucharest
Academy of Economic Studies, Romania; email: simonaunchiasu@yahoo.com
~ 287 ~