Using Default Auditing for Security-Relevant SQL Statements and Privileges

When you use Database Configuration Assistant (DBCA) to create a new database, Oracle Database configures the database to audit the most commonly used security-relevant SQL statements and privileges. It also sets the AUDIT_TRAIL initialization parameter to DB. If you decide to use a different audit trail type (for example, OS if you want to write the audit trail records to operating system files), then you can do that: Oracle Database continues to audit the privileges that are audited by default. If you disable auditing by setting the AUDIT_TRAIL parameter to NONE, then no auditing takes place.

Oracle Database audits the following privileges by default:

`ALTER ANY PROCEDURE`	`CREATE ANY LIBRARY`	`DROP ANY TABLE`
`ALTER ANY TABLE`	`CREATE ANY PROCEDURE`	`DROP PROFILE`
`ALTER DATABASE`	`CREATE ANY TABLE`	`DROP USER`
`ALTER PROFILE`	`CREATE EXTERNAL JOB`	`EXEMPT ACCESS POLICY`
`ALTER SYSTEM`	`CREATE PUBLIC DATABASE LINK`	`GRANT ANY OBJECT PRIVILEGE`
`ALTER USER`	`CREATE SESSION`	`GRANT ANY PRIVILEGE`
`AUDIT SYSTEM`	`CREATE USER`	`GRANT ANY ROLE`
`CREATE ANY JOB`	`DROP ANY PROCEDURE`

Oracle Database audits the following SQL statement shortcuts by default:

`ROLE`	`SYSTEM AUDIT`	`PUBLIC SYNONYM`
`DATABASE LINK`	`PROFILE`	`SYSTEM GRANT`

To individually control the auditing of SQL statements and privileges, use the AUDIT and NOAUDIT statements.

Oracle strongly recommends that you audit the database. Auditing is an effective method of enforcing strong internal controls so that your site can meet its regulatory compliance requirements, as defined in the Sarbanes-Oxley Act. This enables you to monitor business operations and catch any activities that may deviate from company policy. Doing so translates into tightly controlled access to your database and the application software. By enabling auditing by default, you can generate an audit record for audit and compliance personnel.

Note: If your applications use the default audit settings from Oracle Database 10g Release 2 (10.2), then you can revert to these audit settings until you modify the applications to use the Release 11g audit settings. To do so, run the undoaud.sql script.

After you have modified your applications to conform to the Release 11g audit settings, then you can manually update your database to use the audit configuration that suits your business needs, or you can run the secconf.sql script to apply the Release 11g default audit settings.

The undoaud.sql and secconf.sql scripts are in the $ORACLE_HOME/rdbms/admin directory. The undoaud.sql script affects audit settings only, and the secconf.sql script affects both audit and password settings. They have no effect on other security settings.

Using Default Auditing for Security-Relevant SQL Statements and Privileges

Related Topics