Oracle Database Auditing

Transcription

1 By Craig Moir August 2012 Version 1

2 WHY AUDIT? Allows organizations to enforce the trust-but-verify security principle. Satisfying compliance regulations. Enables accountability for actions. Monitor access to sensitive data. Deterrent to insider fraud. Capture before and after values for sensitive data changes. Raise alerts to suspicious activity and insider threat. Early Data Breach Detection and Recovery thereby reducing the financial impact. Accelerate incident response and forensic investigation.

3 AUDIT IDEALS The audit process should be independent from the database system being audited. Contain enough detail to be useful. Audit trail should be separated from the database i.e. audit to an external file or repository on a separate secured server. Support Separation of Duties (SoD) Administrators should not have access to audit trail.

4 AUDITING TIPS Only Audit what needs to be audited. There is a performance overhead for auditing. Unnecessary auditing increases this performance overhead. Unnecessary auditing consumes unnecessary storage space. Unnecessary auditing makes audit reporting and breach detection harder as large volumes of unneeded data can swamp reportable audit events. Don t audit authorized or normal user activity. Focus on auditing abnormal or unauthorized user activity to reduce volumes and overheads.

5 WHAT SHOULD GET AUDITED? All SYS activity. All DDL activity. Granting of privileges. Logins - both successful and failed. Access to sensitive data/columns (Fine Grained Auditing). All Schema changes. Any database structure changes.

6 AUDIT TRAIL REPORTING Produce regular audit reports. Develop a set of standard audit reports. Should have flexible and custom reporting capabilities. Should have near real-time breach detection and notification. Should have suspicious activity alerting. Centralized repository for cross-system reporting and checking. Audit trail should be retained for the same duration as the retention of the data/transaction being audited i.e. adhere to legislation.

7 TYPICAL ENVIRONMENT WITHOUT AUDITING Example 1 PAYROLL DATABASE update Employee set Salary = Salary * 2 where Employee_Id = 2399; Unauthorized salary change will go unnoticed. Commit; Example 2 CLIENT DATABASE Select CLIENT_NAME, ACC #, BANK_DETAILS, REVENUE from CLIENT_DETAILS; Unauthorized access to CLIENT information will go unnoticed.

8 TYPICAL ENVIRONMENT WITH AUDITING Example 1 PAYROLL DATABASE update Employee set Salary = Salary * 2 where Employee_Id = 2399; Audit Event Capture Commit; Unauthorized salary change gets recorded in the Audit Trail. Audit Trail Example 2 CLIENT DATABASE Select CLIENT_NAME, ACC #, BANK_DETAILS, REVENUE from CLIENT_DETAILS; Audit Event Capture Unauthorized access to CLIENT information gets recorded in the Audit Trail. Audit Trail

9 AUDITING OVERHEADS 1 NO AUDITING 2 Buffer Cache 1 2 Query checks if row is already cached. If row is not cached then read block with row into cache. Database Redo Logs Archive Logs 1 Buffer Cache 1 2 Query checks if row is already cached. If row is not cached then read block with row into cache. AUDITING Auditing causes an audit event capture which inserts into audit table. If no blocks of audit table are cached, then read audit table block into cache and insert audit row. Audit row then gets written to redo logs for PITR. 5 Checkpoint causes audit row to be written to disk. Database Redo Logs Archive Logs 6 Audit row in redo log gets archived.

10 MINIMUM EXPECTED AUDIT OVERHEAD Audit Trail Setting Additional Throughput Time Additional CPU Usage OS 1.39% 1.71% XML 1.70% 3.51% XML, Extended 3.70% 5.26% DB 4.50% 8.77% DB, Extended 14.09% 15.79% Parameter Value OS (recommended) XML DB Extended Meaning Enables database auditing and directs all audit records to an operating system file Directs audit records to an operating system files in XML format. Enables database auditing and directs all audit records to the database audit trail (SYS.AUD$), except for records that are always written to the operating system audit trail Additionally captures SQL bind variables and SQL text

11 BASIC ORACLE AUDITING RECOMMENDATIONS AUDIT COMMAND Audit alter any table by access; Audit create any table by access; Audit drop any table by access; Audit create any procedure by access; Audit drop any procedure by access; Audit alter any procedure by access; Audit create external job by access; Audit create any job by access; Audit create any library by access; Audit alter database by access; Audit alter system by access; Audit audit system by access; Audit create public database link by access; Audit exempt access policy by access; Audit alter user by access; Audit create user by access; Audit role by access; Audit create session by access; Audit drop user by access; Audit grant any privilege by access; Audit grant any object privilege by access; Audit grant any role by access; Audit alter profile by access; Audit drop profile by access; WHAT DO YOU AUDIT Database schema or structure changes Database access and privileges

12 AUDIT MAINTENANCE Have an archiving strategy for databases with local audit trails. Have a purging strategy for databases with local audit trails. Automate the maintenance tasks.

13 MyDBA CREDENTIALS

14 MyDBA CONSULTING SERVICES For more information on MyDBA s Database Security services please contact us on: security@mydba.co.za DBA Disclaimer: This document is provided for information purposes only. While MyDBA has taken care to ensure that the content on this document is accurate, the information is provided "as is" and is not warranted to be error-free. Your use of and reliance on the information is entirely at your own risk. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the prior written permission of MyDBA.