Proceedings

These four domains are interrelated; while “Plan and Organise” provides direction to
solution delivery and service delivery, “Acquire and Implement” provides the
solutions and passes them to be transformed into services, “Deliver and support”
receives the solutions and makes them usable for the end users and “Monitor and
Evaluate” monitors all processes to ensure that the direction provided is followed.
Across the four domains, 34 processes are identified, each one having a number of
control objectives.
The principle that COBIT framework relies on, depicted in Figure 3, is that IT
resources are managed by IT processes in order to achieve IT goals that respond to the
business requirements.
Figure 3: The COBIT Cube
(Source: COBIT 4.1 Excerpt, IT Governance Institute, 2007: 25)
It is worth mentioning that the level of security and controls implemented for the
information systems should be correlated with the risk the respective system poses to
the overall organization, therefore controls may vary depending on the level of risk
identified for that particular system.
3. RESEARCH APPROACH AND METHODOLOGY FOR THE ORACLE
DATABASE AUDIT
In the following pages we tried to propose an audit plan that best covers the databases
vulnerabilities and hardening issues. The audit plan is based on literature review,
COBIT framework and on our own practical experiences with databases. We analyzed
the COBIT framework and we selected the processes and the relevant control
objectives that are critical for the database control and we translated them into audit
steps.
~ 293 ~