2. Oracle environments should
have a separation of
responsibilities between
systems administrators,
network administrators,
DBAs, security officers,
operators, developers and
other users.
Through discussions with the
DBA, verify the responsibilities
are separated between those
functions. Note: It is
acceptable for the application
administrator to act as the
system administrator if the
database is used by only one
application.
3. The auditing function in the
database should be turned
on upon installation.
Review the INIT.ORA to
determine if AUDIT_TRAIL
has been set to TRUE.
4. The system auditing should
be used to audit some of the
following information:
connect, resource, DBA,
and not exists.
Obtain the
DBA_SYS_AUDIT_OPTS
Data Dictionary view from the
DBA and determine if the level
of auditing that is turned on is
appropriate.
5. Object auditing should be
used to audit tables and
views. Specific functions
which should be audited
include alter, insert, audit,
lock, comment, rename,
delete, select, grant, update,
index, and all.
Obtain the
DBA_TAB_AUDIT_OPS Data
Dictionary view from the DBA
and determine if the level of
auditing that is turned on is
adequate.
6. The audit trail should be
reviewed on a regular basis.
Discuss with the DBA the
process for reviewing the audit
trail (DBA_AUDIT_TRAIL)
and determine the adequacy of
events being logged.
7. The audit trail table in the
Data Dictionary
(SYS.AUD$) should be
purged on a regular basis.
Discuss with the DBA the
schedule for purging the audit
trail table. Determine its
adequacy.
Change Control in RDBMS
8. Appropriate change controls
should exist over the
database and objects
including approval;
unit/user acceptance testing,
separate test environment,
and adequate parameters set
in the INIT.ORA file.
Discuss with the DBA the
change control process and
verify adequate controls are
present including approval, test,
and appropriate version control.
Controls within Oracle Tools
9. Access to
Obtain/ review the