Proceedings

• Export files
The auditor should check for the existence of the export file. Attackers might
either export the database’s data including users’ passwords or be able to read a
legitimate export which could facilitate the database attack.
• Archive log files
The data usually archived in the log files are precious and should be protected.
The auditor should locate the archive log files and check that no user except the
legitimate ones can read them.
• Access to native PL/SQL compiler in production environment
The access to native PL/SQL compilation in production should be removed. The
access to this functionality would allow the execution of other binary files and to
wrap existing packages with the attackers’ own code.
• Vulnerability scan
The auditor should review the OS vulnerabilities scan report.
Oracle database audit tests
During the fieldwork, the auditor will test the database implemented controls. Listed
below are the critical audit tests that should be performed:
• Oracle database support
The auditor should check if the database version running on the servers is
currently supported by the vendor and if not, to look for additional agreements
between organization and vendor.
• Patch management process
The auditor should assess the process for reviewing and applying databases and
operating system patches. The entire patch management process and the respective
procedures should be checked. Evidence must be provided related to a sample of
patches chosen by the auditor.
• Promotion to production process
All promotions to production (patches, updates, new functionalities, bug fixes)
should be thoroughly tested before bringing them into production environment. A
severe control process must be in place for promotion to production activities.
• Database change control process
The auditor should review the change control process to ensure that all database
changes are performed in a controlled manner. Evidence for a sample of recent
database changes should be obtained and analysed.
• Incident management process
The auditor should review the incident management process. All incidents must be
recorded in a history log and reports on the respective incidents must exist. In a
later stage of the organization’s maturity level, all the solutions used for solving
incidents could be gathered to organize a knowledge database. A sample of
database incidents should be reviewed.
~ 297 ~