{"id":6848,"date":"2021-01-07T13:21:38","date_gmt":"2021-01-07T07:51:38","guid":{"rendered":"https:\/\/www.varutra.com\/?p=6848"},"modified":"2022-12-02T14:41:12","modified_gmt":"2022-12-02T09:11:12","slug":"database-configuration-audit-for-security-and-compliance-part-1","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/database-configuration-audit-for-security-and-compliance-part-1\/","title":{"rendered":"Database Configuration Audit for Security and Compliance [Part-1]"},"content":{"rendered":"


\nDatabase Configuration Audit is the latest buzz word everyone is talking about and every organization wants to revamp their databases to produce and store a prioritized list of security improvements to the concept, requirements, design, or implementation.<\/p>\n

 <\/p>\n

Overview<\/strong><\/h3>\n

Configuration Audit of a database includes noticing a database in order to know about the activities of its users. Database administrators and consultants frequently set up auditing for security purposes, for instance, to guarantee that those without the consent to access the data do not access it.<\/p>\n

 <\/p>\n

Database Auditing is the New Frontlines<\/strong><\/h3>\n

Database Audit is a procedure of checking access to and modification of particular database objects and assets inside operational databases and holding a point-by-point record of the access where it very well may be utilized proactively to trigger activities and can be recovered and analyzed as required. Database audits are one of the significant compliance modules that should be set up appropriately yet rapidly so that the organization doesn’t pass up business scope requiring the storage of user information.<\/p>\n

\"Traditional<\/p>\n

 Fig: 1.0 Traditional Database <\/em><\/pre>\n
When DB auditing is empowered, each audited DB activity delivers an audit trail of data including, for example, what information DB object was affected, who played out the activity, and when.<\/p>\n
\u00a0<\/strong><\/p>\n
Factors that Drive Requirements for Database Auditing<\/strong><\/h3>\n
    \n
  1. \u00a0<\/strong>Cost of Breach<\/strong><\/li>\n<\/ol>\n
    Attackers are focusing on the database where records can be collected in mass on a worldwide scale. Around 88% of all cases in the current year’s investigation included insider negligence. Source: IOUG Data Security Report 2019, Joe McKendrick, Research Analyst.<\/p>\n
    \"Database<\/p>\n
    Fig: 1.1 Database target Records<\/pre>\n
    \u00a0<\/strong><\/p>\n
      \n
    1.  Regulatory Compliance<\/strong><\/li>\n<\/ol>\n
      Database surveillance is a key prerequisite in executing better security setups and to prevent losses from happening. The number of compliance issues is directly interrelated to the amount of data stored in the database i.e. Volume of information – > Increased availability of information – > Regulatory Compliance – > Increased number and kind of threats.<\/p>\n
      \"Correlation<\/p>\n
      Fig: 1.2 Correlation Graph<\/pre>\n
       <\/p>\n
        \n
      1. Database Leak Prevention<\/strong>Configuration audit of a database assists with addressing questions like “Who got to or changed information?” and “When was it really changed?” and “What was the old content preceding the change?” Your ability to react to such requests can reflect the deciding moment of a compliance audit. Sometimes it may be imperative to review certain audit data more precisely to decide how, when, and who changed the data.\"Database\n
        Fig: 1.3 Database Leak Scenario\r\n\r\n<\/pre>\n
        There can be numerous users who may have permission to manipulate information, and it is significant that all classified and confined information should not be altered by other unauthorized users.<\/li>\n
      2. Open Accessibility<\/strong><\/li>\n<\/ol>\n
        Data today is additionally enormous and portable. You may have something on-premises just as some in the public cloud, which may request a lot of networking. Keeping up the availability of data will assist you with understanding plentiful volumes of data and furthermore distinguish the network asset requirement for better setup of your network framework.<\/p>\n
        \"Data<\/p>\n
        Fig: 1.4 Data Availability<\/pre>\n
         <\/p>\n
        Database Configuration Audit Points<\/strong><\/h3>\n
        \u00a0<\/strong>There are a few well-known strategies that can be implemented to audit your database structures. Although each Database offers various auditing properties, some basic items that can be audited at the configuration level include:<\/p>\n