Proceedings

� business continuity plan;
� testing plans and results of the last disaster recovery test.
• Physical security
Physical access to database systems should be restricted to authorised personnel
only. The auditor should visit the data centre to ensure that database systems are
stored in secured environments, like equipments are connected to an alternative
power source, there are smoke detectors, fire extinguishers, there are no pipes
crossing the data room, etc and that password-protected screen savers are in place.
Once all of the aforementioned audit steps will be covered, the results will be captured
in the audit report.
CONCLUSIONS
Today’s threat landscape has evolved toward targeted attacks aimed at specific
companies, specially the financial services ones. Stealing digital money, payment card
information, personal data and customers databases became the top priority for
attackers. And all these data are stored in the databases.
Oracle is used worldwide to house business database applications. If not well
protected, the databases become a very attractive target for the attackers. Oracle has
enhanced the security features of the database but if not properly configured, is almost
useless. Hardening measures that are at no cost and easy to implement should be
known by all database administrators and IT auditors. It was proven that 64% of the
breaches could be easily prevented by the implementation of simple and cheap
controls. Clearly there is a strong need for improving and enforcing the accountability
management. The simple goal is to ensure that users do not have more privileges than
they need and all access is monitored. The practices of using generic accounts and
username sharing should be discontinued. Even if everybody agrees that it shouldn’t
be there, there are still active default accounts or default passwords.
The audit of the databases has become a critical challenge for organizations. Any
deficiency in the database security can nullify all the controls that have been
implemented at the application level. Moreover, the regulatory environment has
increased over the last years, international and national regulations have evolved in
detailed frameworks covering the internal control system and special data aspects, like
preserving confidentiality, integrity and availability. All these regulatory constraints
have been translated into the activation of audit trails mechanisms within the
information systems and into the growth of the storage capacity, all this having a
serious impact on the performance of the information systems. Nowadays, the IT
management faces a new challenge that is to find the right balance between the risk
level introduced by the information systems and the mitigating controls with a direct
impact on the systems’ performance.
~ 300 ~