Oracle Security Auditing Horror Stories
Burleson is the co-author of the bestselling
Privacy Security Auditing: Includes Federal Law Compliance with
HIPAA, Sarbanes-Oxley & The Gramm-Leach-Bliley Act GLB", by Rampant
We need not look far to see the public cases of
computer security violations and the liability suffered by the
custodian of the data. With millions of dollars at stake, there are
many resourceful people waiting for you to make a mistake and expose
your confidential information. These attacks on your information
take many forms, from malicious hackers, dishonest employees and
honest mistakes. Let’s look at some specific ways that companies
lose control of their information.
Security breaches, hacks (outside-in)
Threats from hacker’s remain a major concern,
especially threats from overseas countries in Eastern Europe and
Asia. Some companies report access attempts by automated hacker
“bots” every few minutes as these rogue programs constantly sweep
the Internet looking for ports with access vulnerabilities.
These automated bots contain very sophisticated
logic and are designed by criminals to identify and exploit
weaknesses in online computer systems. Some of the common exploits
Tipping the user ID – This is where a telnet or
FTP access attempt tells you that you have entered a valid ID, but
provided an improper password.
No password disabling – Hacker routines love
systems that do not disable a user ID after repeated password
attempts and run bots to try hundreds of thousands of password until
they gain entry.
Man-in-the middle attacks – Hackers can gain
access to computer systems by guessing the IP address of a connected
user and sending a TCP/IP packet with that users IP information.
Injection threats – Many database system have
vulnerabilities where access to confidential data can be gained via
a SQL injection, a technique where a “1=1” string is added to a
sign-on string. For example, this query might return the “real”
password for a user named Jane:
userid = ‘jane’
password = ‘xxx’
Buffer Overflow attacks – In these attacks, the
web cache buffer is deliberately overloaded to gain unauthorized
entry to the system.
Hacker attempts for web-enabled systems are
constant and many companies report thousands of attempts every day.
A comprehensive auditing system will record all illegal access
attempts and include the time, referrer IP address and all other
relevant information. Let’s take a look at a real-world case.
Internal fraud (inside jobs)
IT managers report that internal fraud is the
most common type of threat and special auditing mechanisms must be
used to audit all access by authorized employees. Inside job
threats include the following:
Root kit attacks – In a root kit attack, the
operating system is compromised. I once fixed a client site with a
rootkit that had installed a daemon process that was constantly
accessing confidential information and e-mailing it to a
competitor. This attack went undiscovered for more than a year and
virtually all of the company’s proprietary information was lost.
Fire-me attacks – Internal IT personnel have
been know to write routines that trigger a data extraction on the
day when their user ID is removed from the computer system. Because
most IT procedures required pulling the user ID before notifying the
employee, these hackers will return home to find all of the
confidential information waiting for them in their in-box.
Trojan Horse – Once an employee gets the
internal IP address of another employee, they can map-out phony
sign-on screens to their boss and get a privileged password. These
attacks are usually easy using tools such as X-Windows that allow
screen images to be redirected onto other screens.
PC Privacy Tools – Common tools such as PC
Anywhere can be used to look-over the shoulder of a co-employee,
snooping into their activities and passwords.
Here are many documented cases of data
disclosure by disgruntled employees, especially “privileged users”
who were given unaudited access privileges. Let’s look at some
specific real-world horror stories. These are not fictional
stories. They actually happened, and they serve to show what happens
when a slack IT manager entrusts their access and auditing controls
to a Systems Administrator or Database Administrator.
Oracle auditing book, click here
excellent Oracle auditing product, click here