Oracle Database Security Auditing Training Course

Synopsis

This two-day practical training course is designed to deepen the knowledge of IT/IS auditors, IT security managers and other information risk assurance professionals on how to perform security audit of Oracle database including identifying security flaws in the database and countermeasures required to address the flaws for the overall security of the enterprise Oracle database.

Research has shown that most vulnerabilities in Oracle database are due to poor security configuration of the Oracle database, unchanged vendor default parameters, and lack of good security practices by users and administrators alike.

Attackers including malicious insiders leverage on these security flaws and misconfigurations in the Oracle database or the supporting operating system infrastructure to breach the confidentiality, integrity and availability of the database. This results in undesirable situations such as theft of personal identifiable information (PII), alteration or deletion of PIIs, transaction data or audit trails to conceal malicious activities or denial of service attack to the targeted organization. Hence, it is pertinent for information risk assurance practitioners to have good understanding of Oracle database and how to perform security audit.

Course Objectives

The participants will:

• Understand the principle of relational database management system (RDBMS) as well as the Oracle database as an object-relational database management system software.
• Understand Oracle database security architecture, configurations files and table structure.
• Understand Common security flaws/vulnerabilities and threats associated with Oracle database.
• Effectively perform security assessment of their Oracle databases
• Prepare for audit engagement and gather the right requirements/data to aid the audit exercise.
• Understand steps and techniques used in auditing Oracle database.
• Improve the organizations security policies, procedures and standards after this course.
• Adopt a suitable security baseline/hardening standard for their Oracle database after this course.
• Get Free access to scripts that will help extract the configuration files and data for the audit.
• Get free access to the best Oracle database security audit program/checklist after this course.
• Documenting audit observations and communicate effectively/impactfully with stakeholders (including the Board Audit Committee and management).

Course Outline

• Module 01: Introduction to Oracle database security

  - Background on key Oracle database concepts, files, table structures, configurations

  - Why audit an Oracle database (internal & external threats, abuse of privileged access, DBAs, bugs, etc.)

• Module 02: Security policies, risk assessment & Reconnaissance

  - Common Oracle database security flaws/vulnerabilities, configuration gaps, segregation of duty issues, etc. (exploits, attack vectors, SQL injection)

  - Using Information security policies and best practice standards to drive Oracle database security (The foundation)

• Module 03: Oracle database audit planning & requirement/information gathering

  - Planning an audit

  - Information & requirement gathering

  - Preparing an environment and organizing connections

  - Audit tools and scripts required

• Module 04: Audit execution

  - Logical access controls (user enumeration, password security controls and least privilege principles)

  - Segregation of duties, privileges and role base access control (RBAC)

  - Understanding operating system security for Oracle database (UNIX, Linux & Windows)

  - File and directory permissions, OS security parameters, data leakage, access control

  - Auditing Oracle networking files (listener, protocol, TNS, SQLNET)

  - Auditing Oracle database security configurations (roles, profiles, resources, permission on objects, privileges, security parameters)

  - Oracle database audit trail assurance (log access, archiving, Oracle audit facilities & configurations

• Module 05: Audit documentation, reporting and process improvement

  - Audit work programme (AWP) and test of control (TOC) documentation

  - Audit findings documentation, reporting and executive summary

  - Process improvement measures (security policy review and improvement, Oracle database security baseline documentation, Audit program and checklists documentation)

Course Duration = 2 Days

Course Fee per participant (Onsite delivery) = USD 650

Course Fee per participant (Virtual Delivery) = USD 550