OracleSarbanes-Oxley (SOX)
Auditing Training Course
© 2008-2010 by Burleson Consulting
* Understand the legal
requirements for SOX auditing.
* See internals of Oracle auditing solutions.
* Employ system-level triggers to audit important Oracle
events.
* Understand Virtual Private Databases.
* Use role-based security to ensure access rules.
* Learn about security exposures inside Oracle.
* Understand Oracle "Grant Execute" security.
* Learn how to plug backdoor access holes.
* See techniques for
managing SOX audit trails.
* Learn the best practices
for SOX auditing for Oracle.
|
|
Oracle SOX
Auditing is an intensive three-day course designed to provide
auditing professionals with an in-depth understanding of how to
audit all areas of Oracle databases for Sarbanes-Oxley
compliance.
Designed by a
world-leading Oracle auditing professional and author of
HIPAA Auditing
for Oracle Database Security, this course teaches all areas of
SOC auditing for Oracle systems.
 |
|
Oracle Privacy Security
Auditing
Includes Federal Law
Compliance with HIPAA, Sarbanes-Oxley & The Gramm-Leach-Bliley
Act GLB
Donald K. Burleson & Arup
Nanda
Rampant TechPress, ISBN:
0-9727513-9-4
|
This course is designed for practicing
Oracle professionals who have basic experience with Oracle. Prior
experience with Oracle is not required, but experience using Oracle
database is highly desirable.
|
This course is
designed by Donald K. Burleson, an acknowledged leader in Oracle
auditing techniques. Burleson was chosen by Oracle Press to
write four of the authorized Oracle Press editions on Oracle
database management. Burleson has 23 years of full-time
DBA experience, is the author of 18 books, and serves as
Editor-in-chief of Oracle Internals. Burleson Consulting instructors offer decades of
real world DBA experience in Oracle features, and they will share
their Oracle secrets in this intense Oracle
training.
.Learning
Objectives
By the end of this course the student
will be able to describe the methods for controlling security
within an Oracle database, and understanding the concepts behind
Oracle SOX auditing for regulatory compliance.
Oracle Sarbanes-Oxley (SOX)
Auditing Training Course
3-Day Syllabus
Copyright © 2008-2010 by
Donald K. Burleson
1.
Day 1 - Course Introduction
-
Review Course topics.
-
Goals of Course
2.
Introduction to Sarbanes-Oxley (might want a lawyer to write
an interpretation here)
-
What does the law say?
-
What does it mean?
-
Implications for Liability.
3.
Introduction to Oracle SQL*Plus
-
Writing data dictionary queries.
-
Spooling output.
-
Editing SQL Statements
-
Exercise – write a basic SQL query on the data
dictionary.
4.
Writing audit scripts with SQL*Plus
-
Reading external files as Oracle tables.
-
Writing complex queries.
-
Exercise – Read alert log as an external table.
5.
Introduction to Unix security/privileges
-
Unix file privileges.
-
Grep command
-
Vi editor
-
Ls command options
-
Outputting OS data to text file for Oracle access.
6.
Basic areas of SOX auditing.
-
Oracle grant security auditing.
-
Oracle grant execute security auditing.
-
Oracle Virtual private database (fine grained access control)
auditing.
-
Auditing Oracle recoverability
-
Auditing oracle disaster recovery
-
OS file protections
-
Minimum grants
-
Exercise – audit privileges on a directory.
7.
Oracle grant auditing.
-
Overview of relational grant security.
-
Review of Oracle data dictionary.
-
Minimum grants.
-
Exercise – Audit grant privileges.
DAY 2 – Advanced Oracle SOX
auditing
1.
Auditing grant execute security.
-
Overview of dba_objects and dba_source views.
-
Dictionary views for grant execute security.
-
Exercise – audit grant execute access on packages,
procedures, and functions
2.
Oracle role based security
-
Introduction to roles.
-
Recursive roles
-
Assigning roles to users.
-
Exercise audit role based security.
3.
Problems with grant security.
-
System and object privileges
-
Overlapping data access
-
Using views with grant security
4.
OS level auditing – advanced.
-
File owners.
-
DBA Group
-
Oracle UMASk
-
Oracle owner?
5.
OS Level – Oracle installation.
-
Oratab
-
Executables/libs
6.
OS level – Oracle database.
-
Data files
-
Init.ora file
-
Init.ora settings, why and how
-
Tkprof
7.
OS level – sqlnet
-
Listener.ora privileges
-
Creating a local_listener.
-
Privileges on listener log
-
Privileges on sqlnet.ora
8.
OS Level – Others.
-
Trace files
-
Password files
-
Shell/sql Script files
-
Crontab
9.
Windows specific issues
-
Unnecessary services.
-
Unnecessary protocol stacks.
-
Well known names.
-
Windows directory permissions
10.
Good Oracle practices are part of Sox audit.
-
Practice backups.
-
Checksum pl/sql code
-
Avoid ad-hoc queries in production.
-
Verify media integrity
-
Separate develop and production.
Day 3 –Checklist
1.
Tablespace settings
-
Default temporary tablespace
-
Default user tablespace
2.
Profile settings.
-
Standard privilege users
-
Privileged users
-
All users
3.
Table/view privileges
-
Sys. Tables to restrict
-
Perfstat tables to restrict
-
Restrict/prevent access to dba views.
-
Restrict access to v$ views.
-
Restrict access to *_priv_views.
-
Application access.
4.
Roles to restrict
-
Any *catalog* role
-
Limit granting any create privilege.
-
Limit alter system privilege/become user priv.
5.
Well known users/passwords.
-
Sys/system
-
Sysman/dbsnmp
-
Application users.
6.
Public dissemination of configuration information.
-
Oracle sid.
-
Server names
-
Listener names
This is a BC Oracle SOX audit
training course (c) 2008-2010
|
