Introduction to Database Auditing (2024)

See Also:

Oracle Database Security Guide for detailed information about configuring database auditing.

1.1 Security Challenges

Database auditing is performed to protect and preserve privacy for the information stored in databases. Businesses leverage database auditing to address the following issues:

• Insider Threats

• Identity Theft

• Corporate Governance and Compliance

1.2 Need for Database Auditing

Auditing can help compliance and security auditors to perform the following tasks:

• Determining the actions that occur within a system

• Detecting attempts of unauthorized individuals to access the system

• Detecting attempts by authorized users to misuse the system

• Verifying regulatory compliance

You typically use auditing to:

• Investigate suspicious activity

  For example, if a user is deleting data from tables, then a security administrator might decide to audit all connections to the database and all successful and unsuccessful deletions of rows from all tables in the database.

• Notify an auditor of unauthorized actions by users

  For example, the unauthorized user could be manipulating or deleting data. The user might have more privileges than expected, and it might be time to reassess user authorizations.

• Monitor and gather data about specific database activities

  For example, the database administrator can gather statistics about which tables are being updated or how many concurrent users connect at peak times.

• Detect problems with an authorization or access control implementation

  For example, you can create audit policies that you expect will never generate an audit record because the data is protected in other ways. However, if these policies do generate audit records, then controls are not properly implemented.

• Address auditing requirements for compliance

  Regulations such as the Sarbanes-Oxley Act, Health Insurance Portability and Accountability Act (HIPAA), International Convergence of Capital Measurement and Capital Standards: a Revised Framework (Basel II), Japan privacy law, and the European Union Directive on Privacy and Electronic Communications have common auditing-related requirements.

1.3 Overview of Oracle Audit Vault

Businesses use a wide variety of systems, databases, and applications that produce vast quantities of audit log data, and they must consolidate and monitor this data for a holistic view of enterprise data access. Auditors must analyze the audit log data in a timely fashion across disparate and heterogeneous systems. To facilitate the process, it is essential that audit data from multiple systems reside in a single audit data warehouse that is secure, scalable, reliable, and highly available.

Oracle Audit Vault solves these security and audit problems by:

• Consolidating audit information from multiple systems across the enterprise

• Detecting data changes associated with regular and privileged users

• Protecting audit data from modification and tampering

Figure 1-1 shows an overview of the Oracle Audit Vault architecture. The architecture consists of a set of services and its collection system working within an enterprise. This set of services helps to facilitate storage management, policy enforcement, alerting, analysis, reporting, and activities. The collection infrastructure enables the utilization of audit collectors that function as adaptors between an audit source and Oracle Audit Vault Server.

Oracle Audit Vault Components

Oracle Audit Vault consists of:

• Audit Vault Server

• Audit Vault Agents

Audit Vault Server

Audit Vault Server consists of:

• Audit Data Store

• Audit Vault Console

• The following services:

  • Collector management and monitoring

  • Report management

  • Alert management

  • Audit settings management to establish your policy management

  • Published data warehouse that can be used with reporting tools like Oracle Business Intelligence Publisher to create customized reports

  • Audit data collection and storage management

  Configuration services assist in defining information about what sources are known to Oracle Audit Vault. Oracle Audit Vault stores information (metadata) about the sources of audit data and policy information (database audit settings).

Audit Vault Agents

An Audit Vault Agent provides run-time support for audit data collection by Audit Vault collectors. It also contains the audit data collectors for Oracle Database sources. The following collectors are provided in Oracle Audit Vault 10g release 2 (10.2.2):

• DBAUD

• OSAUD

  Note:

  XML files are not supported in the OSAUD collector.

• OSAUD for Windows (EVTLOG)

• REDO

1.4 Using Oracle Audit Vault Dashboard

Oracle Audit Vault Dashboard, also called Overview, is the home page for auditors to view alert summaries, drill down to reports, and view agent and collector status. It is shown in Figure 1-2.

When an audit record is generated, it is classified into a category. Audit event activity is monitored by the event category to which the audit record belongs. For example, a logon event belongs to the user session event category.

An alert is raised when data in a single audit record matches a predefined alert rule condition. For example, an alert rule condition might be defined for a logon event when three failed logon attempts by a user to gain access to a particular source of data are detected over a 5-minute period. When that rule condition is met, the audit event is evaluated and, because it matches the rule condition, an alert is raised. Alerts are grouped by the sources with which they are associated, by the event category to which the event belongs, and by the severity level of the alert (warning or critical).

From the Dashboard page, you can:

• Select an event start time and end time in which to view Audit Vault event data.

• View five types of graphical summaries (pie charts and bar graphs) of alert activity and event activity over the specified time period. Time periods are specified by either a month, week, or day time span or the period between a specified begin and end date. These graphical summaries include:

  • Alert Severity Summary (pie chart)

    Click a section in this pie chart to drill down to a more detailed Alert Report Page to see what sources are showing a particular severity level.

  • Summary of Alert Activity (pie chart)

    Click a section in this pie chart to drill down to an Alert Report Page to see the affected sources for all alert activity.

  • Top Five Audit Sources by Number of Alerts (bar graph)

    Click a bar in this bar graph to drill down to see a more detailed Alert Report Page showing the alerts for a severity level for a particular source.

  • Alerts by Audit Event Category frequency (number of alerts) (bar graph)

    Click an event category link in this bar graph to drill down to see a more detailed Alert Report Page showing all alerts for that event category.

  • Activity by Audit Event Category frequency (number of events) (bar graph)

    Click an event category link in this bar graph to drill down to see events for that event category. You can generate activity reports for the following audit event categories:

    • Account Management Activity

    • Application Management Activity

    • Audit Command Activity

    • Data Access Activity

    • Exception Activity

    • Invalid Audit Record Activity

    • Object Management Activity

    • Peer Association Activity

    • Role and Privilege Management Activity

    • Service and Application Access Activity

    • System Management Activity

    • Uncategorized Activity

    • User Session Activity

• Click a pie section or bar chart y-axis event category label to drill down to a more detailed report level.

1.5 Viewing Collectors and Agents

As an Audit Vault auditor, you can use the Audit Vault Console Dashboard to view Audit Vault agents and collectors. To view collectors, click the Audit Status tab on the dashboard, then click Collectors on the upper left to reach the Collectors Page.

To view agents, click the Audit Status tab on the dashboard, then click the Agents tab on the upper left to reach the Agents Page.