IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.48 Procedures in case of a loss of database
integrity
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator, IT users
In the event that the database system behaves in a manner for which there is
no obvious explanation (e.g. undefined system behaviour, tables or data
records going missing, modified table contents, inexplicably long response
times), a loss of database integrity may have occurred. This can result from
misuse of the system, for example, as a result of changes to the system settings
or exceedance of the maximum number of permitted connects.
Users should observe the following procedure in this case:
- Keep calm.
- Inform the Database Administrator.
- Do not use the database any longer.
The Database Administrator should take the following steps:
- Inform all affected users.
- Shut down the database system.
- Start up the database system in the exclusive mode (if this is supported by
the database system).
- Back up all files which could provide information on the nature and cause
of the problem (for example, whether an intrusion has taken place, and if
so, how penetration was effected), i.e. it is especially important to back up
all the relevant log files.
- Check and, if necessary, reset the access rights for system tables.
- Check the database software for any visible changes, for example, to the
date of creation and size of the corresponding files. As these attributes can
be reset to their original values by an intruder, the integrity of the files
should be tested using checksum procedures.
- If necessary, delete the executable files and reinstall the original files from
write-protected data media (cf. S 6.21 Backup copy of the software used).
Programs should not be restored from data backups as these could already
contain the error.
- Check the log files for irregularities (in co-operation with the Auditor).
- Change all the passwords.
- Ask users to check their domains for irregularities.
Once all the passwords have been changed, they must be notified to the users
concerned. No password or password derivation scheme which is known to all
the users should be used here. It is better to generate the passwords randomly
and notify the users by a reliable route, e.g. in sealed envelopes. These
passwords should be changed immediately after logging on for the first time.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Misuse
Do not panic!
Back up log files
Check software for
modifications
Reload original files
Generate new
passwords using
randomisation