18CSE455T - Database Security and Privacy

Prepared by
Dr. B. Muruganantham
Assistant Professor
Department of
Computer Science and
Engineering
SRMIST, Chennai
References :

1) Hassan A. Afyouni, “Database Security and Auditing”, Third Edition,

Cengage Learning, 2009
2) Charu C. Aggarwal, Philip S Yu, “Privacy Preserving Data Mining”:
Models and Algorithms, Kluwer Academic Publishers, 2008
3) Ron Ben Natan, ”Implementing Database Security and Auditing”,
Elsevier Digital Press, 2005.
4) http://adrem.ua.ac.be/sites/adrem.ua.ac.be/files/securitybook.pdf
5) www.docs.oracle.com

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
UNIT IV-AUDITING DATABASE ACTIVITIES

 Introduction
 Using Oracle Database Activities
 Creating DLL Triggers with Oracle
 Auditing Database Activities with Oracle Auditing
 Server Activity with SQL Server 2000
 Security and Auditing Project Case Study

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Introduction

 Security is the buzzword of this decade

 It’s on everyone’s mind
 Today , crime brings to a mind a whole new set of risks to privacy and
confidentiality
 Security requires action
 Many private and public Institutions / Organizations are taking
serious action against security risks
 These actions encompass not only the establishment and enforcement
of new security measure, but also the reinforcement of those measures
through tough audit controls

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Introduction

Auditing is the responsibility of developers,

DBA, and Business Managers

SECURITY

AUDITING
The auditing mechanism would enable
users to trace changes to sensitive data

As DBA , you might be summoned to yours

manager’s incident that left the DB is
unavailable for hours.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Overview
Definitions
 In general, an audit examines the documentation that reflects the action, practices
and conduct of business or individual.
 Database auditing follows this general definitions

 The list that follows contains general auditing and database auditing definitions.
 Audit / Auditing - The process of examining and validating
documents, data, processes, systems, or other activities to
ensure that the audited entity complies with its
objective

 Audit log – A document that contains all activities that are being audited
ordered in a chronological manner.

 Audit objectives – A set of business rules, system controls, government

regulations or security policies against which the
audited entity is measured to determine compliance
10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Overview
Definitions …
 Auditor – A person with proper qualifications and ethics, who is authorized to examine, verify,
and validate documents, data, processes, systems, or activities and to produce an
audit report
 Audit procedure – A step-by-step instructions for performing auditing process

 Audit report – A document that contains the audit findings and is generated by an
individual(s) conducting the audit
 Audit trail – A chronological record of document changes, data changes, system activities, or
operational events
 Data audit – A chronological record of data changes stored in a log file or a database table
object
 Database auditing - A chronological record of database activities , such as shutdown, startup,
logons, and data structure changes of database objects
 Internal auditing – Auditing activities conducted by the staff members of the organization.

 External auditing - Auditing activities conducted by the staff members outside of the
organization.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Activities
 Auditing activities are performed as a part of an audit, audit process or audit plan
 The following list presents the auditing activities
(Note : Activities are not listed in any specific order)
 Evaluate and apprise the effectiveness and adequacy of the audited entity
according to the auditing objectives and procedures
 Ascertain and review the reliability and integrity of the audited entity
 Ensures the organization being audited is in compliance with the policies,
procedures, regulations, laws, and standards of the government and the
industry.
 Establish plans , policies, and procedures for conducting audits.

 Keep abreast of all changes to the audited entity.

 Keep abreast of updates and new audit regulations, laws, standards, and
policies set by industry, government, or the company itself.
 Provide all audit details to all company employee involved in the audit. These
details include : resources requirements, audit plans, and audit schedules.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Activities…
 Publish audit guidelines and procedures to the company itself and its partners
and clients when appropriate.
 Act as liaison between the company and the external audit team.
 Act as a consultant to architects, developers and business analysts to ensure
that the company being audited is structured in accordance with the audited
objectives
 Organize and conduct internal audits
 Ensure all the contractual items are met by the organization being audited.

 Identify the audit types that will be used

 Work jointly with the Security Department to identify security issues that
must be addressed
 Provide consultation to the Legal Department to identify regulations and laws
with the company must comply

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Environment
Components of Auditing Environment
 Objectives
 An audit without objectives is useless
 To conduct audit you must know what the audit you must know what the audited entity is
to be measured
 Usually , the objectives are set by the organization , industry standards, or government
regulations and laws
 Procedures
 To conduct an audit, step-by-step instructions and tasks must be documented ahead of
time.
 In the case of government conducted audit, all instructions are available public
 In the case of organizational audit, specialized personal document the procedure to be
used not only for the business itself, but also for the audit
 People
 Every auditing environment must have an auditor , even in the case of automatic audit
 Other people involved in the audit are employees, manager, and anyone being audited
 Audited entities
 This includes people, documents, processes, systems, activities or any operation that are
being audited

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Environment …
 The following figure shows the four major components of the auditing
environment

M O
M ee BJ

rs
di y
ai t

E
EC

au rit
to
nt O

PL
rg

nd ecu
a i
or n a n TI

sa ,S
m do iz VE
PE

or e r
ee cu at
t s m io S
at ga
ys en n p
is an
in M te t o
m ac lic
tr
m ff.
go cu ie
Ad Sta

al rac s,
s y,

AUDITING
EINVIRONMENT

Em
pl

io ,
s l at s e s
ns
oy

CE law egu ces

s y ee s
AU st , d

nd s, r pro
em o
D s, cum

io ep

ES
IT an e

ct St
ED

n
ru y-
d nt

R
s t -b
ac s,

U
tiv pr In tep

a
EN

D
iti o c
S

es es
T IT s es
IE ,
O
PR
S

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Database Auditing Environment …
 The following figure shows the five major components of the auditing
environment
M
O BJ
E
M ee
ai t O EC
ity rs nt TI
PL Securudito ai rga
or n d ni VE
O z
PE nagers and
m oc at
, a ee u
t s me oni S
a or ys n po
. M trat te t a lic
ff m cc ie
a s
St ini go ur s,
al ac
m s y,
Ad

laws
Database
Em

ation ses,
s and
AUDITING
plo stems

RES
ns, r p proces
AU

EINVIRONMENT
yee
sy
DIT

s, d

EDU
egul
ocu d activ

te
, an

Instr tep-by_S
ED

m en

C
PRO
uctio
E

ts, p s
NT

S
itie
roce
ITI

sses
ES

a Changes, Data
,

DB activities, Dat
es and OS
Accuracy, Data fil

DATABASE

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Process

 Database applications widely used by major corporate companies, mostly large

financial and online trading companies.

 The Quality Assurance (QA) team retested every database application function
and try to find bugs.

 This type of auditing resembles QA or even performance monitoring

 The purpose of QA process in software engineering to make sure that the system
is bug free and that the system is functioning according to its specification.

 The auditing process ensures that the system is working and complies with the
policies, standards, regulations or laws set forth by organization, industry or
government.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Process …
 Another way to distinguish between QA and Auditing Process is by examining
the timing of each

 QA – during development phase, before the implementation of the system.

 Auditing Process – After the system is implemented and in production.

 Auditing is also not the same as performance monitoring

 Auditing objectives are totally different

 Performance Monitoring is to observe the degradation in performance

 Auditing validates compliance to policy not performance

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Process …
 Differences in QA , Auditing and Performance Monitoring processes

PROCESS ACTIVE TIMING OBJECTIVES

QA During development and Test the product to make sure it is

before the product not working properly and is not
commissioned into defective
production

Auditing After the product Verify that the product or system is

commissioned into working and complies with the
production policies, standards, regulations or
laws

Performance After the product Monitor Performance in terms of

Monitoring commissioned into Response time,
production

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Process …
 The below figure illustrates the auditing process flow
Ensures that Identify the
auditing changes and
objectives are provide
met according feedback to the
to business system
Make sure all policies and development
objectives are specifications phase
well defined

System Development Life Cycle

Planning, Analysis,
Design, Development, UNDERSTAND REVIEW, VERIFY & REPORT &
PRODUCTION OBJECTIVE VALIDATE DOCUMENT
Testing, and
Implementation

Policies , Laws ,
Regulations and
Industry standards
must be
incorporated as the
part of System
requirements and
Specification

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Objectives
 Auditing objectives are established as a part of the development process of the entity to be
audited

 For example , when a software application is being coded, the developers include in their
software development design objectives the capability to audit the application

 Auditing objectives are established and documented for the following reasons:

 Complying – Identify all company policies , government regulations, laws and the
industry standards with which your company comply.

 Informing – All policies, regulations, laws and standards must be published and
communicated to all parties involved in the development and
operation of the audited entity.

 Planning – Knowing all the objectives enables the author to plan and document
procedures to asses the audited entity.

 Executing – Without auditing objectives, the person conducting the audit

cannot evaluate, verify, or review the audited entity and cannot
determine if the auditing objectives have been met
10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Objectives
 The top ten database auditing objectives

 Data Integrity – Ensure that data is valid and in full referential integrity
 Applications Users and roles – Ensures that users are assigned roles that
correspond to their responsibilities and duties
 Data Confidentiality – Identify who can read data and what data can be read
 Access Control – Ensures that the application records times and duration when a
user logs onto the database or application
 Data changes – Create an audit trail of all data changes
 Data Structure Changes – Ensures that the database logs all data structure changes
 Database or application availability – Record the number of occurrences and
duration of application or database shutdowns all the startup times . Also, record
all reason for any unavailability.
 Change Control – Ensure that a change control mechanism is incorporated to
track necessary and planned changes to the database or application.
 Physical Access – Record the physical access to the application or the database
where the software and hardware resides.
 Auditing Reports – Ensure that reports are generated on demand or
automatically , showing all auditable activities

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Classification and Types
Audit Classifications
 Every industry and business sector uses different classifications of audits.
 Definition of each classification can differ from business to business.
 Will discuss most generic definition of audit classifications.

Internal Audit
 An internal audit is an audit that is conducted by a staff member of the company
being audited
 The purpose and intention of an internal audit is to :

 Verify that all auditing objectives are met by conducting a well-planned and
scheduled audit
 Investigate a situation that was promoted by an internal event or incident.
This audit is random , not planned or scheduled.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Classification and Types …

External Audit
 An external audit is conducted by a party outside the company that is being
audited.
 The purpose and intention of an External audit is to :

 Investigate the financial or operational state of the company . This audit is

initiated at will by the government or promoted by suspicious activities or
accusations.
 The person conducting this audit is usually employed and appointed by the
government.
 Verify that all objectives are met. This audit is typically planned and
scheduled.
 Ensure objectivity and accuracy.
 This audit is typically performed to certify that the company is complying
with standards and regulations.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Classification and Types …
 Automatic Audit

 An automatic audit is promoted and performed automatically.

 Automatic audits are mainly for systems and DB systems.

 Some systems that employ this type of audit to generate reports and logs.

 Manual Audit

 Completely performed by humans

 The team uses various methods to collect audit data, including interviews, document
reviews and observation.

 The auditors may even perform the operational task of the audited entity.

 Hybrid Audit

 Combination of Automatic and Manual Audits

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Classification and Types …

Audit Types
Financial Audit – Ensures that all financial transactions are accounted for an
comply with law.
Ex : Companies save all trading transactions for a period of time
to comply with government regulations
Security Audit – Evaluates if the system is as secure as it should be.
The audit identifies security gaps and vulnerabilities
Ex: Company might ask a hacker to break the company’s
network system to determine how secure or vulnerable the
network is.
Compliance Audit – Verifies that the system complies with industry standards,
government regulations, or partner and client policies
Ex: All pharmaceutical companies must keep paper trails of all
research activities to comply with industry standards as well
government regulations

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Classification and Types …

Operational Audit –Verifies if an operation is working according to the policies of the

company
Ex: When a new hire starts work, the HR department provides ID
Card, Sign disclosure , Confidentiality papers, tax forms , etc.,
Investigative Audit – Performed in response to an event, request, threat, or incident to
verify the integrity of the system.
Ex: Employee might have committed a fraudulent activity
Product Audit – Performed to ensure that the product complies with industry
standards. This audit sometimes confused with testing, but it
should not be.
A product audit does not include auditing of its functionality but
entails how it was produced and who worked on its development.
Preventive Audit – Performed to identify problems before they occur.
Ex: Company should conduct both random and routine audits to
verify that the business operations are being performed
according to specifications.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Benefits and Side Effects of Auditing
 Benefits
 Enforces company policies, government regulations and laws

 Lowers the incidence of security violations

 Identifies the security gaps and vulnerabilities

 Provides an audit trail of activities

 Provides another means to observe and evaluate operations of the audited entity
 Provides the sense or state of security and confidence in the audited entity

 Identifies or removes doubts

 Makes the organisation being audited more accountable

 Develops controls that can be used for purposes other than auditing

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Benefits and Side Effects of Auditing
 Side Effects

 Performance problems due to preoccupation with the audit instead of the

normal work activities
 Generation of many reports and documents that may not be easily or quickly
disseminated
 Disruption to the operations of the audited entity

 Consumption of resources, and added costs from downtime

 Friction between operators and auditor

 From a DB perspective

• Could degrade the performance of the system

• Also generate a massive number of logs, reports, and that require a system
purge

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models
Action
Start
 Before auditing models, it is more Yes

important that , understand how

Get Username and Credentials
audit is processed for data and DB
activities
Is action
 The flowchart presents data auditing registered
for
current
 The flowchart shows what happens Check if user?
user is
when a user perform an action to a registered
in audit
DB object repository?

 Specific checks occur to verify if the

Yes
action , the user or the object are
registered in auditing repository
No
 If they are registered the followings Is action
are recorded registered
for
No current
 State the object before the user?

action was taken along with the

time of action No

Yes
 Description of the action that
was performed Get Previous value and record it in
the database
 Name of the user or userid who
performed the action Action
Continue with action
Completed

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
Simple Auditing Model 1

 The first auditing model is The given figure illustrates this SIMPLE MODEL 1
called ‘SIMPLE” because it is APP_ENTITY
APP_ACTION _TYPE
APP_AUDIT _ACTION
easy to understand and ENTITY_ID ACTION_TYPE_ID
AUDIT_ACTION_ID
develop. ENTITY_NAME ACTION_TYPE_DESC
ENTITY_TYPE ENTITY_ID (FK) CTL_REC_STAT
CTL_REC_STAT ACTION_TYPE_ID (FK)
AUDIT_START_DATE
 This model registers audited AUDIT_EXPIRE_DATE
CTL_INS_DTTM
entities in the audit model CTL_UPD_DTTM
repository to CTL_UPD_USER
CTL_REC_STAT
chronologically track
activities performed on or by
these entities.

APP_AUDIT _DATA
 An entity can be a user, AUDIT_DATE_ID
table, column, and an
AUDIT_ACTION_ID (FK)
activity can be a DML AUDIT_DATA
transaction and logon and AUD_INS_DTTM
AUD_UPD_DTTM
logoff times. AUD_UPD_USER
AUD_REC_STAT

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
Simple Auditing Model 2
The given figure illustrates this Simple auditing
model 2
 In this model , only column
value changes are stored for
APP_AUDIT_TABLE
audit purposes.
TABLE_ID

TABLE_NAME
 The audit data table TABLE_DESCRIPTION
APP_AUDIT_DATA contains APP_AUDIT_DATA AUDIT
ARCHIVE
chronological data on all AUDIT_DATA_ID ARCHIVE_COUNT
changes on column that are TABLE_ID (FK) PURGE
AUDIT_DATA PURGE_COUNT
registered in CTL_INS_DTTM COLUMNS
APP_AUDIT_TABLE. CTL_UPD_DTTM COLUMNS_COUNTSR
CTL_UPD_USER START_DATE
CTL_REC_STAT END_DATE
CTL_INS_DTTM
 There is a purging and archiving CTL_UPD_DTTM
mechanism is used to help CTL_UPD_USER
CTL_REC_STAT
reduce the amount of data
stored in DB.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …

Advanced Auditing Model

 This Model is called “advanced” because of its flexibility

 More flexible than simple models

 Used as an auditing application with a user interface

 Of course the repository for tis model is more complex than previous models

 It contains data stores to register all entities that can be audited

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
The following figure presents the flow of the user interface
Audit Table
Audit User
Interface
Table
Data
Table
Name
Populate
Table Request Table
4 Table Name User
Perform Data
Name Name
audit
check

3 5
Table 6 7
1 Set Set
Name View Build
Populate tables Users
Audit Audit
tables for for
Data View
audit Audit

2
Perform
Audit
Audit
Table
Data Audit
Audit Name Table
Data User
Data Table Name Table Data
Column Table Data
Name
Name Name

Columns Audit Data Objects Audit Table Audit User

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
 Data model of the repository for an Advanced Auditing Model
APP_TABLES APP_USERS
APP_COLUMNS
ENTITY_ID ENTITY_ID
ENTITY_ID TABLE_ID USER_ID
COLUMN_NAME TABLE_NAME TABLE_NAME
TABLE_ID (FK) CTL_REC_STAT CTL_REC_STAT
CTL_REC_STAT

APP_AUDIT_ACTION
AUDIT_ACTION_ID

ENTITY_ID (FK)
ENTITY_TYPE
ACTION_TYPE_ID (FK)
AUDIT_START_DATE
AUDIT_EXPIRE_DATE
CTL_INS_DTTM APP_AUDIT_DATA
CTL_UPD_DTTM AUDIT_DATA_ID
CTL_UPD_USER
CTL_REC_STAT AUDIT_ACTION_ID
APP_ACTION_TYPE
(FK)
ACTION_TYPE_ID AUDIT_DATA
CTL_INS_DTTM
ACTION_TYPE_DESC CTL_UPD_DTTM
CTL_REC_STAT CTL_UPD_USER
CTL_REC_STA

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
Historical Data Model
 This model is used for applications that require a record of the whole row
when a DML transaction is performed on the table
 Typically used in most financial applications
 With this model , the whole row is stored in the HISTORY table, before it is
changed or deleted
 The following figures illustrates this model

APP_DATA_TABLE
APP_DATA_TABLE _HISTORY
PRIMARY_KEY_COLUMN
PRIMARY_KEY_COLUMN
DATA_COLUMN_01 DATA_COLUMN_01
DATA_COLUMN_02 DATA_COLUMN_02
……………………………. …………………………….
……………………………. …………………………….
……………………………. …………………………….
DATA_COLUMN_n DATA_COLUMN_n
CTL_INS_DTTM CTL_INS_DTTM
CTL_UPD_DTTM CTL_UPD_DTTM
CTL_UPD_USER CTL_UPD_USER
CTL_REC_STAT CTL_REC_STAT

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
Auditing Application Actions Model
 There may be a requirement for an application to audit specific operations or
actions
 The following figure represents a Data Model of a repository for auditing
application actions

APP_AUDIT_ACTIONS APP_AUDIT_TRAIL APP_DATA_DICTIONARY

ACTION_ID ACTION_TRAIL_ID ACTION_ID

ACTION_DESC OBJECT_ID ACTION_DESC

CTL_INS_DTTM CLASS_ID (FK) CTL_INS_DTTM
CTL_UPD_DTTM ACTION_ID (FK) CTL_UPD_DTTM
CTL_UPD_USER REASON CTL_UPD_USER
CTL_REC_STAT CTL_INS_DTTM CTL_REC_STAT
CTL_UPD_DTTM
CTL_UPD_USER
CTL_REC_STAT

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …

C2 Security

 C2 security is a type of security rating that evaluates the security framework for
computer products used in government and military organizations and institutes.

 The standard was conceived by the U.S. National Computer Security Center (NCSC)
to create a minimum security benchmark for all computing products and applications
that process confidential government and military information.

 The National Security Administration has given a C2 security rating to Microsoft SQL
Server 2000.

 This means that the server passes requirements set by the Department of Defence
and is typically implemented in military and government applications

 When configured as C2 system, SQL Server utilizes DACLs (Discretionary Access

Control to manage security and audit activity

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Models …
 Requirements for enabling C2 auditing in SQL Server include the following :

 The Microsoft Windows Server must be configured as C2 system

 Windows Integrated Authentication is supported, but SQL native security
is not supported
 Only transactional replication is supported

 The following SQL Server services are not included in a C2 evaluation

• SQL Mail

• Full Test Search

• English Query

• DTC

• Meta Data Services

• Analysis Services (OLAP)

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers

 Trigger is an event driven program

 Executed automatically based on event occurs

 It is a PL/SQL procedure

 ORACLE has six DML events also known as trigger timings

 Trigger mainly used for the following purposes

 Performing audits (Primary use)

 Preventing invalid data from being inserted into the tables

 Implementing business rules ( Not highly recommended if the business rule is

complex)
 Generating values for columns

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
 ORACLE trigger timings or events for DML events

Application

User

INSERT UPDATE DELETE

Statement Statement Statement

BEFORE INSERT BEFORE UPDATE BEFORE DELETE

TRIGGER TRIGGER TRIGGER
PL/SQL Code PL/SQL Code PL/SQL Code

TABLE ROW

BEFORE INSERT BEFORE UPDATE BEFORE DELETE

TRIGGER TRIGGER TRIGGER
PL/SQL Code PL/SQL Code PL/SQL Code

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
Trigger Syntax

CREATE [ OR REPLACE ] TRIGGER <trigger_name>

Trigger Timing
[BEFORE | AFTER | INSTEAD OF ]

Trigger Event
[INSERT | UPDATE | DELETE......]

ON<name of underlying object>

Row Level
[FOR EACH ROW]
Conditional Clause
[WHEN<condition for trigger to get execute> ]

DECLARE <Declaration part>

BEGIN <Execution part> Error Handling Mechanism

EXCEPTION <Exception handling part>

END;

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
The given syntax shows the different optional statements that are present in trigger
creation.

 BEFORE/ AFTER will specify the event timings.

 INSERT/UPDATE/LOGON/CREATE/etc. will specify the event for which the
trigger needs to be fired.
 ON clause will specify on which object the above-mentioned event is valid. For
example, this will be the table name on which the DML event may occur in the
case of DML Trigger.
 Command "FOR EACH ROW" will specify the ROW level trigger.
 WHEN clause will specify the additional condition in which the trigger needs to
fire.
 The declaration part, execution part, exception handling part is same as that of
the other PL/SQL blocks. Declaration part and exception handling part are
optional.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
ORACLE Trigger Execution
 A trigger can be in either of two distinct modes:
 Enabled - An enabled trigger executes its trigger action if a triggering statement is
issued and the trigger restriction (if any) evaluates to TRUE.
 Disabled - A disabled trigger does not execute its trigger action, even if a triggering
statement is issued and the trigger restriction (if any) would evaluate
to TRUE.
 For enabled triggers, Oracle automatically
 executes triggers of each type in a planned firing sequence when more than one
trigger is fired by a single SQL statement
 performs integrity constraint checking at a set point in time with respect to the
different types of triggers and guarantees that triggers cannot compromise integrity
constraints
 provides read-consistent views for queries and constraints
 manages the dependencies among triggers and objects referenced in the code of the
trigger action
 uses two-phase commit if a trigger updates remote tables in a distributed database
 if more than one trigger of the same type for a given statement exists, Oracle fires
each of those triggers in an unspecified order

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
 The following figure gives the Order of trigger execution

3 BEFORE Trigger
Row
4 AFTER Trigger level

1 BEFORE Trigger
ROW

Statement

level
2 AFTER Trigger

TABLE

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
Example : Row level Trigger

CREATE OR REPLACE TRIGGER customers_update_credit_trg

BEFORE UPDATE OF credit_limit
ON customers
FOR EACH ROW
WHEN (NEW.credit_limit > 0)
BEGIN
-- check the credit limit
IF :NEW.credit_limit >= 2 * :OLD.credit_limit THEN
raise_application_error(-20101,'The new credit ' || :NEW.credit_limit ||
' cannot increase to more than double, the current credit ' || :OLD.credit_limit);
END IF;
END;

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
Example : Statement level Trigger

CREATE OR REPLACE TRIGGER customers_credit_trg

BEFORE UPDATE OF credit_limit
ON customers
DECLARE
l_day_of_month NUMBER;
BEGIN
-- determine the transaction type
l_day_of_month := EXTRACT(DAY FROM sysdate);

IF l_day_of_month BETWEEN 28 AND 31 THEN

raise_application_error(-20100,'Cannot update customer credit from 28th to 31st');
END IF;
END;

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Oracle Triggers …
 User can view all triggers created on a table by using USER_TRIGGERS data
dictionary view.
 The structure of USER_TRIGGERS view is as follows

SQL > DESC USER_TRIGGERS

Name Null? Type
----------------- ------ -------------
TRIGGER_NAME VARCHAR2(30)
TRIGGER_TYPE VARCHAR2(16)
TRIGGERING_EVENT VARCHAR2(227)
TABLE_OWNER VARCHAR2(30)
BASE_OBJECT_TYPE VARCHAR2(16)
TABLE_NAME VARCHAR2(30)
COLUMN_NAME VARCHAR2(4000)
REFERENCING_NAMES VARCHAR2(128)
WHEN_CLAUSE VARCHAR2(4000)
STATUS VARCHAR2(8)
DESCRIPTION VARCHAR2(4000)
ACTION_TYPE VARCHAR2(11)
TRIGGER_BODY LONG

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
SQL Server Triggers

SQL Server Triggers

 Similar to ORACLE, SQL Server provides a trigger mechanism that fires
automatically when a DML statement occurs
 The CREATE TRIGGER statement allows you to create a new trigger that is
fired automatically whenever an event such as INSERT, DELETE,
or UPDATE occurs against a table.
 The following illustrates the syntax of the CREATE TRIGGER statement:

CREATE TRIGGER trigger_name

ON table_name
AFTER {[INSERT],[UPDATE],[DELETE]}
[NOT FOR REPLICATION]
AS
{sql_statements}

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
SQL Server Triggers…
In this syntax:

 The schema_name is the name of the schema to which the new trigger belongs.
The schema name is optional.

 The trigger_name is the user-defined name for the new trigger.

 The table_name is the table to which the trigger applies.

 The event is listed in the AFTER clause. The event could be INSERT, UPDATE,
or DELETE. A single trigger can fire in response to one or more actions against
the table.

 The NOT FOR REPLICATION option instructs SQL Server not to fire the trigger
when data modification is made as part of a replication process.

 The sql_statements is one or more Transact-SQL used to carry out actions once
an event occurs.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE

 ORACLE provides the mechanism for auditing everything:

 From tracking who is creating and modifying the structure

 Who is granting privileges to whom

 The activities are divided into two types based on the type of SQL command
statement used :
 Activities defined by DDL (Data Definition Language)

 Activities defined by DCL (Data Control Language)

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE
Auditing DDL Activities

 ORACLE uses a SQL-based audit command

 The following figure presents the audit syntax diagram ( ORACLE 10g)

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
Audit command syntax Where :
AUDIT Statement option – Tells ORACLE to audit the specified
{ DDL or DCL statement
{ { statement_option | ALL } DDL – CREATE, ALTER, DROP and TRUNCATE
[,{statement_option | ALL }] …… DCL – GRANT , REVOKE
|,{syetem_privilege | ALL
System privilege – Tell ORACLE to audit the specified
PRIVILEGES }
privilege such as SELECT, CREATE ANY, or ALTER ANY
}
[BY { proxy [,proxy]….. Object_option – Specifies the type of privileges for the
| user [,user]….. specified object to be audited
]
BY SESSION – Tells ORACLE to record audit data once
|
per session even if the audited statement issued multiple
{Object_option [, object_option ] …… | times in session
ALL }
ON { [ schema. ] object BY ACCESS - Tells ORACLE to record audit data every
|DIRECTORY directory_name time audited statement is issued.
|DEFAULT
WHENEVER SUCCESSFUL – Tells ORACLE to capture
} audit data only when the audited command is successful
}
[ BY {SESSION | ACCESS } } WHENEVER NOT SUCCESSFUL- Tells ORACLE to
[WHENEVER [NOT] SUCESSFUL ] ; capture audit data only when the audited command fails

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
DDL activities Example :

 Suppose you want to audit a table named CUSTOMER every time it is altered or
every time a record from a table deleted.
 The following steps show you how to do this.
 Before perform , drop are disable all triggers associated with CUSTOMER table.

Step 1 : Use any user other than SYS or SYSTEM to create the CUSTOMER

SQL> CREATE TABLE CUSTOMER

2 (
3 ID NUMBER ,
4 NAME VARCHAR2 (20),
5 CR_LIMIT NUMBER
6 );

Table created

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …

Step 2 : Add three rows into the CUSTOMER table and commit changes

SQL > INSERT INTO CUSTOMER VALUES (2, ‘BMNANTHA’, 200);

1 row created

SQL > INSERT INTO CUSTOMER VALUES (3, ‘MURUGAN’, 300);

1 row created

SQL > INSERT INTO CUSTOMER VALUES (1, ‘GANESH’, 100);

1 row created

SQL > COMMIT;

Commit complete

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
Step 3 : Log on as SYS or SYSTEM to enable auditing , as specified in this example
the first statement for ALTER and the next is for DELETE

SQL > CONNECT SYSTEM @ SEC

Enter password : ******
Connected.
SQL > AUDIT ALTER ON DBSEC.CUSTOMER BY ACCESS WHENEVER
2 SUCCESSFUL;

Audit succeeded.

SQL > AUDIT DELETE ON DBSEC.CUSTOMER BY ACCESS WHENEVER

2 SUCCESSFUL;

Audit succeeded.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
Step 4 : Login as the owner of CUSTOMER table, DBSEC delete a row and modify
the structure of the table, as specified in the following code

SQL > CONNECT DBSEC@ SEC

Enter password : ******
Connected.
SQL > DELETE FROM CUSTOMER WHERE ID = 3;

1 row deleted.

SQL > ALTER TABLE CUSTOMER MODIFY NAME VARCHAR2(30);

Table altered

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
In this step you will see the audit records stored in the auditing tables caused by the DELETE
and ALTER statements issued in step 4.
Step 5 : Login in as SYSTEM and view the DBA_AUDIT_TRAIL
Two records will be available as shown in the figure below

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
 When audit process got over of a specific object or command, you may turn it
off by using the NO AUDIT statement.

 The following step turns off auditing on the two statements issued in step 3.

SQL > NOAUDIT ALTER ON DBSEC.CUSTOMER;

Noaudit succeeded.

SQL > NOAUDIT DELETE ON DBSEC.CUSTOMER;

Noaudit succeeded.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
DCL Activities Example:
 You are auditing the GRANT privilege issued on a TEMP table owned by DBSEC.
 The following steps shows how to audit the DCL statements audited.
 The same steps to be followed for all DCL Commands.

Step 1 : Log on as SYSTEM or SYS and issue an AUDIT statement as follows

SQL> CONN SYSTEM

Enter password : ******
Connected

SQL> DELETE SYS.AUD$;

1 row deleted.

SQL> COMMIT;
Commit complete.

SQL> AUDIT GRANT ON DBSEC.TEMP;

Audit succeeded

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Database Activities with ORACLE …
Step 2: Log on as DBSEC and grant SELECT and UPDATE privileges to SYSTEM on
TEMP table
SQL> CONN DBSEC
Enter password : *****
Connected.

SQL> GRANT SELECT ON TEMP TO SYSTEM;

Grant succeeded.

SQL> GRANT UPDATE ON TEMP TO SYSTEM

Grant succeeded.

Step 3: Log on as SYSTEM and display the contents of DBA_AUDIT_TRAIL.

SQL> SELECT USERNAME, TIMESTAMP, OWNER, OBJ_NAME FROM

2 DBA_AUDIT_TRAIL;
USERNAME TIMESTAMP OWNER OBJ_NAME
------------------- --------------- --------------- ---------------
DBSEC 20-Jan-20 DBSEC TEMP
DBSEC 20-Jan-20 DBSEC TEMP

2 rows selected

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server 2000

 Microsoft SQL Server 2000 provides auditing as a way to track and log activity for
each SQL Server occurrence
 User must be a member of the sysadmin fixed server role to enable or modify
auditing
 Every modification of an audit is an auditable event

 There are two types of auditing in SQL Server 2000

 Auditing

 C2Auditing

 Auditing can have significant impact on performance

 The audit trail analysis can also be costly in terms of system

 It is recommended that SQL profiler be run on a server separate from the

production server

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
Implementing SQL Profiler
 One of the tools that accompanies SQL Server 2000 is SQL Profiler
 This tool provides the user interface for auditing events.
 You can audit several types of events using SQL Profiler

EVENT DESCRIPTION For each event, you can

audit
End user events All SQL commands, LOGIN/LOGOUT,  Date and time of the
enabling event
DBA events DDL (other than security events),  User who caused the
event to occur
Configuration (DB or Server)
 Type of Event
Security events GRANT/REVOKE/DENY/ LOGIN USER  Success or failure of
ROLE/ADD/REMOVE/CONFIGURE the event
Utility events BACKUP/RESTORE/BULK INSERT/ BCP/  Origin of the request
DBCC Commands  Name of the object
accessed
Server events SHUTDOWN , PAUSE, START  Text of the SQL
statement (Passwords
Audit events ADD AUDIT, MODIFY AUDIT, STOP AUDIT replace with *****)

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …

 Security audit should be enable first

 This is done by setting the security auditing level under the SQL server
properties in Enterprise Manager
 Security events can be audited on success, failure or both

 Follow these steps

1. Open the Enterprise Manager
2. Expand the appropriate SQL Server group
3. Right click on the desired server
4. Click properties
5. On the security tab, select the desired security level as shown in the
figure in slide no 61

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
 SQL Server configuration

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
 After the audit level is set, you can then use SQL Profiler to monitor security
events.
 The following events can be audited

 ADD DB USER  LOGIN CHANGE PASSWORD

 ADD LOGIN TO SERVER ROLE  LOGIN CHANGE PROPERTY
 ADD MEMBER TO DB ROLE  LOGIN FAILED
 ADD ROLE  Login GDR ( GRANT, DENT, REVOKE )
 APP ROLE CHANGE PASSWORD  Object Derived Permissions
 BACKUP / RESTORE  Object GDR
 CHANGE AUDIT  Object Permissions
 DBCC  Server Start and Stop
 LOGIN  Statement GDR
 LOGOUT  Statement Permission

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
 You can start SQL Profiler by selecting it from the program group on the Start menu or from the
tools menu in Enterprise.
 To start a new Audit Trace from the file menu, Click New , then Trace
 It is shown in the below figure

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
The new trace dialog box appears,
as shown in the figure

On the general tab, you provide:

 A name for the trace

 The server you want to audit
 The base template to start with
 Where to save the audit data, either to
a file or to a DB
 A stop time, if you don’t want the trace
to run indefinitely

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
 On the events tab, you specify
events to be audited and in which
category they belong

 As shown in the figure

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …
Add the Login Change Password
security event to the trace by
performing following steps

 Expand the Security Audit node

under Available event classes

 Click Audit Login Change

Password Event

 Click the Add button

Audit Login Change Password Event

should now appear under security
Audit in Selected event classes, as
shown in the figure

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …

Data Definition Auditing

 To audit DDL statements, on the
Events tab of your trace, you select
Object:Created and Object:Deleted
under the objects Category
 These two events audit all CREATE
and DROP statements.
 It is shown in the figure

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …

Database Auditing with SQL Server

 To audit operations to the database files,

select events under the Database
category as shown in the figure

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Auditing Server Activity with SQL Server
2000 …

Database errors auditing with SQL

Server

 To audit errors that occur within

the database, select the events
under the Errors and Warnings
category on the Events tab of your
trace, as shown in the figure

Dr.B.Muruganantham
10/25/2023 AP / CSE /SRMIST
Security and Auditing Project Case Study

Introduction

 A DB developer is assigned to new database application project and is asked to

develop an auditing scheme to comply with the industry standards
 Developers often face this problem

 DBA are often asked to provide an effective data security and auditing design
 The case studies follow require you to use these concepts, methods, and
techniques to solve data accessibility
 This cases can be implemented in either ORACLE or SQL Server

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

CASE 1 : Developing an Online Database

 A new dot-com has decided to launch an affiliated Web site, specifically for
individuals interested in database issues.

 The main mission of the Web site is to provide a forum for database
technical tips, issues, and scripts.

 The CIO and his technical team held a meeting to draft the requirements
for the new web site and decided that it would include the following.

 Technical documents
 A forum where members can exchange ideas and share experiences
 Online access
 A tips section
 Technical support for error messages

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

 Immediately after the meeting, the newly appointed project manager asks you to
implement security for the site.
 The manager mentions that the security of a public database is so important that
the CIO himself / herself has outlined the security requirements, as follows
 The online DB will have 10 public host database accounts that allow multiple
sessions
 The password of a public host account must be reset to its original setting whenever
disconnects or logoffs occur
 The maximum duration for a session is 45 minutes

 Allocations will be set on memory and CPU

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

 Storage for each public host account must be limited to 1 MB

 The public host accounts will have privileges to create the most common
database objects
 All newly created database objects must be removed before logoff

 The database must have the default human resources user account enabled.

 When number of logs onto the database, all session information, such as IP
address, terminal , user session information must be recorded for future
analysis.

Note : You may add other security auditing features, as long as you do not
overlook any of the requirements in this list

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

Case 2 : Taking Care of Payroll

 Acme Payroll Systems is a small payroll services company that has been in
business for two years and has had only one major customer
 Suddenly, it lands a contract with another large corporation

 If the company hired you as Database consultant to design and implement a

virtual private database for the existing payroll application.
 The main objective of the virtual private database feature is allow each client to
administer his own payroll data without violating the privacy of other clients.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study
The given figure represents the payroll application model for case 2
EMPLOYEE COMPANY PAYROLL_PERIOD
EMPLOYEE_ID COMPANY_ID PP_ID
COMPANY_ID (FK) PP_ID (FK) PP_DESCRIPTION
TAX_ID CONTACT_NAME
FIRST_NAME STREET_NAME
LAST_NAME CITY
HOURLY_SALARY STATE
FED_CODE ZIPCODE COMPANY_ADMINISTRATORS
STATE_CODE PHONE CA_ID
MEDICAL_ELECTION FAX
FOUR01_ELECTION EMAIL COMPANY_ID (FK)
MEDICAL_DEDUCTION URL FIRST_NAME
OTHER_DEDUCTION STATUS LAST_NAME
SICK_DAYS SYSTEM_USERNAME
VACATION_DAYS

TIMESHEET
TS_ID DAILY_WORK_HOURS

EMPLOYEE_ID (FK) DWH_ID

START_DATE TS_ID (FK )
END_DATE WORK_DAY
WORK_HOURS WORK_HOURS
SICK_HOURS SICK_HOURS

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

Case 3 : Tracking Town Contracts

 A small town has hired you as a database specialist on contract

 Your job is to develop a new database application to keep track of the jobs
awarded to different contractors

 All town hall employees will use the application

 After several interviews with clerks and managers , you found out that a prior
attempt at application development by a consulting company resulted in a
draft of an entity – relationship ( ER ) diagram

 The ER diagram depicts all the required information about the contractors and
the awarded jobs.

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study
The given figure presents Contractor job data model for case 3
CONTRACTOR JOB
CONTRACTOR_ID JOB_ID
TAX_ID
CONTRACTOR_ID ( FK )
CONTRACTOR_TYPE_ID ( FK )
JOB_TYPE_ID ( FK )
CONTRACTOR_NAME
JOB_DESRIPTION
STREET_ADDRESS_01 JOB_CLASSIFICATION
STREET_ADDRESS_02 JOB_RATE
CITY START_DATE
STATE
COMPLETION_DATE
ZIPCODE
DAILY_PENALTY
CONTACT_NAME
PAYMENT_AGREEMENT
PHONE
FAX
MOBILE_PHONE
EMAIL
URL
CONTRACTOR_STATUS

CONTRACTOR JOB_TYPE
CONTRACTOR_TYPE_ID JOB_TYPE_ID
CONTRACTOR_TYPE_DESCRIPTION JOB_TYPE_DESCRIPTION

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study
 During your meeting with the project manager for this application , you are
asked to design an application with the following capabilities

 Track all changes made to the application data

 Obtain the approval of project manager before accepting any contract job
for more than $10,000
 Alert the project manager whenever an awarded job is modified to a value
greater than $10,000
 Implement three levels of security

 The DEPARTMENT CLERK level allows clerks to add and update records

 The DEPARTMENT MANAGER level allows clerks to add, update, delete

and approve records
 The EXTERNAL CLERK level allows employees outside the department
only to view data.
10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

Case 4 : Tracking Database Changes

 A friend recommended you to the company he/she works for

 The need your help to solve a series of database and application violations

 When you meet with the hiring manager, he/she explains that there has been
a series of inexplicable, suspicious activities on the applications and
production databases
 The company wants to know

 Who accessed these databases?

 Who modified data?
 Who changed the data structure?

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

 Also the company want to have an audit trail for all these activities but that
company was not interested in historical changes trail
 As a consultant, your job is to design an audit model to meet these
requirements
 The following is the summary of the project requirements

 Audit of database connections

 Audit trail of users that are performing DML operations

 Audit trail of users that are modifying structures of the application schema
tables

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study
Sample data model for case 4
 You may use two tables illustrated in the given figure as sample of application
schema tables.

PHYSICIAN ALERT_SCHEDULE
PHYSICIAN_ID ALERT_ID
FIRST_NAME PHYSICIAN_ID ( FK )
LAST_NAME ALERT_TIMESTAMP
MOBILE_NUMBER ALERT_STATUS
PAGER_NUMBER ALERT_COUNT
RESPONSE

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

Case 5 : Developing a Secured Authorization Repository

 A small retail company has asked you to provide them with database security
services
 The main requirement of this project is to create a security data model that
will be used for by the central authorization module
 This model should include an auditing repository

 This model will store

 Application users

 Roles

 Applications

 Application Modules

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study
 Your mission is to create an authorization data model with a relevant auditing repository
 The following is a summary of the project security requirements
 There must be one database user account for the application schema owner
 Database – assigned roles are not followed
 There must be application roles only
 Each application use is assigned to application modules
 Each application user is assigned a security level that indicates the type of operations the
user can perform within the application.
 Operations are READ,WRITE, DELETE and ADMINISTER
 Passwords must be stored within the designed security module
 Each user has a logon identification number to the application
 The security model should have the flexibility to logically lock, disable and remove
accounts
 Application accounts must have an activation date and expiry date

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST
Security and Auditing Project Case Study

 The security module must be coupled with an auditing module that meets these
auditing requirements
 It must have an audit trail of the date and time a user connects and
disconnects from application
 It must have an audit trail of application operations that includes the date
and time operations were performed by the application user
 It must have an audit trail of all activities and operations performed on the
security module
 The auditing module must be coupled with the security module

Note : You are provide only a design solution , not an implementation

10/25/2023 Dr.B.Muruganantham
AP / CSE /SRMIST