Specialized Auditing Matters - Access Controls

Access controls in the database subsystem have the function of denying unauthorized access and data manipulation. In the case of discretionary access control, DAC, users can specify who can access data they own and what action they have with respect to that data. Conversely, mandatory access control, MAC, requires an administrator to assign security attributes, such as object classifications and employee clearances. These classifications are fixed and cannot be changed by database users.

Discretionary Access Controls
With discretionary access controls, a typical user may be authorized to perform the following functions within the database:

Create a schema.

Create, modify, or delete views associated with a schema.

Create, modify, or delete relations associated with the schema.

Create, modify, or delete tuples in relations associated with the database schema.

Retrieve data from tuples in relations associated with the schema.

These are privileges granted to users who are designated as the owners of a particular schema along with its related views. There is an important type of privilege, that of a user granting their privileges, or a portion of them, to another user. Privilege propagation is the case of a user granting privileges to another user, who in turn grants privileges to another user.

In the propagation of privileges, it is important for an auditor to determine the allowable degree of privilege propagation. It is equally important for an auditor to examine the degree of privilege revocation. For example, if it is discovered a user has abused her privileges, what affirmative steps were taken to revoke her access privileges?

Mandatory Access Controls
In MAC, database user access to a resource is governed by a strict security policy. Database resources in the way of data-objects/attributes and record/relations are assigned classification levels. It is also a common practice to assign a classification level to each record/relation equal to the highest classification level assigned to a data/item/attribute in the record/relation. When differing levels of classification are present in the database, users are not allowed to view all the data present in the database. They may view only those items they care cleared to see.

Managing access control rules are often done through the operating system and the database management system. For example, the operating system permits only authorized users to access the database subsystem, while the database management system restricts access and the degree of user data manipulation. Auditors must be aware this is somewhat of a redundant security procedure, but one that safeguards database contents.

When a database is distributed, it is even more difficult to ensure that database access and integrity are maintained and that complete and consistent access rules are enforced throughout the enterprise. It does not matter if the database is replicated at multiple sites, or if a different database is distributed to different sites from a central location, auditors should collect evidence that multiple access control mechanisms are implemented and are universal in supporting replication.

In any processing subsystem, the issue of data integrity is one of the primary audit concerns. In database management systems, the application software directly accesses and updates the database, however, the database management system depends on the application software to pass across the correct sequence of commands and update parameters taking appropriate actions when certain types of exceptions arise.

Software Controls and Update Protocols
Application software update protocols ensure that changes to the database reflect changes to entities and associations in data the database is supposed to reflect.

Ensure all records are processed correctly. If a master file is in sequential order, correct end of file protocols must be followed in an update program to make certain records are not lost from either a transaction or master file. Designing and implementing correct end of file protocols can be complex if multiple sequential transaction files and multiple sequential files are concurrently processed. Auditors should collect evidence that these protocols have been designed where they can detect, prevent, and correct end of file errors.

Sequence check transaction and master files. During batch update processes, the transaction file is often sorted prior to the update of the database master file or the database tables. There are times when the master file or tables, intended to be updated, might be sorted in a particular order. It may seem duplicitous for the update program to check the sequence of the transaction as it processes each record. Regardless, there are situations that occur resulting in records on the transaction or master file that are out of sequence.

Single-record multiple-transaction processing order. Database programs frequently receive multiple transactions targeting a single master record, also known as a tuple. The order in which transactions are processed against the master record is important. Different types of transactions must be given transaction codes resulting in them being sorted in correct order before being processed against the master record.

Suspense accounts. Suspense accounts are essentially a file for monetary transaction where a master record could not be located at the time the update was attempted. Monetary transactions, for which a master record cannot be located, must be charged to a suspense account. If they are lost because someone fails to correct their mismatch, someone may receive a product rebate payment to which they were not entitled. Auditors must be mindful that suspense accounts, relating to data mismatches, must exist and any suspense accounts with more than a zero balance show there are processing errors needing correction.

Specialized Auditing Matters - Auditing Databases

Today's database subsystems are applications providing functions related to defining, creating, deleting, modifying, and reading data in an information system. By way of review, the principal components of a database subsystem are the database management system, DBMS, used to manage data; the application programs performing operations on the data, central processor in which operations are performed and the storage media maintaining copies of the database. The database subsystem is also called a knowledge base reflecting the power of the data maintained in the database.

As in all auditing practices, the overarching controls design stem from CIA, confidentiality, integrity, and availability.

Auditing database subsystems is an examination of the controls governing the database, beginning with policies and procedures where access to the database is controlled preventing unauthorized access. Auditors must examine the implementation of the various types of integrity controls. There are many good texts about database design and implementation. Before an auditor attempts to engage a review of database operations, it is strongly suggested she have sufficient training and experience. As in all audit practices, auditors should not audit areas where they do not possess expertise.

Database Definitions
Before the discussion travels too much farther, here are some definitions that may be needed by an auditor engaged in database subsystem examination:

Accountability is achieved with two types of access restricting mechanisms, user identification and user authentication controls. Compliance with these controls is achieved through auditing. Major auditing concerns for databases are directed to information security events including logins, granting and revoking access privileges to relations, user activity logs, etc.

Several years ago a government worker, having broad access to databases containing extremely sensitive information, decided to illicitly sell his knowledge and services. He was aware that his database activities were logged, but he was equally aware those logs were infrequently reviewed. The database was configured in such a fashion that anyone with access to the database was capable of viewing and copying information outside the their assigned duties. Over a period of years, he accessed information for which he did not have a need to know and sold it. The employee was discovered through exterior means and subsequently prosecuted for his criminal activities.

These are a few definitions that should help the auditor in database assessments:

Aggregation: The result of combining distinct units of data when handling information. Aggregation of data at one level may result in the total amount of data being designated at a higher privilege level.

Data manipulation: Populate and modify the contents of a database by adding, modifying, deleting, and creating rows and columns.

Discretionary Access Control: DAC is a method by which access to objects is restricted to authorized users or groups of users. Access is discretionary in that access privileges may be passed to users either directly or indirectly by the object's owner.

Inference: Derivation of new information from known information. An inference problem refers to derived information that may be classified at a level for which the user does not have privileges and a need to know. The inference problem is that of users deducing unauthorized information from information they have legitimately acquired. The problem of database inference has significant consequences. For example, physicians specialize in the treatment of specific diseases. It is possible for healthcare provider staffs to infer a patient's ailment by identifying the attending doctor. This type of information could be easily gleaned by viewing the patient information accompanied by the doctor's name. Drugs are also generally associated with a particular disease consequently; it is possible for staff members to infer a patient's ailment by identifying prescriptions.

Mandatory Access Control: MAC is a procedure of established access controls relating to resources assigned a classification level and users are assigned clearance levels. For example, users are not allowed to read a resource classified at a certain level, unless their clearance level is equal or greater than the resource's classification.

Referential integrity: A database has referential integrity if all foreign keys reference existing primary keys.

Schema definition: Used to define the structure of the database, integrity constraints, and access privileges.

Schema manipulation: Modify the database structure, integrity constraints, and privileges associated with the tables and views within the database.

Transaction management: The ability to define and manage database transactions.

Vulnerability Self-Assessments

Audits are generally very time consuming and require a great degree of planning and coordination before they can be successfully completed. Comprehensive audits consist of thorough review controls detailed in policies, procedures, standards, and vulnerability testing. These steps are expensive and for this reason audits are generally performed annually at best. Many organizations need to design more expedient methods by which they can assess their risks, enter the self-assessment. Self-assessments can be used as checklists helping senior managers address vulnerability elements during systems design phases and after the system goes into production, before they become findings in the next audit.

In the perfect world, application vulnerability assessments actually begin in the planning stages of the Systems Development Life Cycle. When the system design phase begins, vulnerabilities should be identified and addressed before the system goes through the acquisition and implementation phases.

Vulnerability Self-Assessment

It is important in vulnerability self-assessments that all steps document policies and procedures addressing risk-elements. It is also important that if system vulnerabilities are identified during the course of the self-assessment, they should be made part of the company's risk management and audit processes.

The following discussion is a checklist that can be used in system vulnerability self-assessment.

Hardware

Describe the system infrastructure. Is there a diagram illustrating the topology? Is there an organizational chart reflecting job description and hardware responsibilities?

Document and describe the data outlets for servers, workstations, printers, modems, video cameras, CSU/DSU (network interface equipment), switches, hubs, load balancing, routers, firewalls, gateways, VPN appliances, etc.

Document and describe the cabling between the major hardware components.

Describe the location, organization, and person responsible for the relevant hardware documentation.

When was the date of the last hardware inventory? Was all hardware accountable? Were there any instances of unauthorized hardware installed?

Is all hardware authorized?

Is there a policy addressing official use of personal equipment?

Document and describe all pertinent hardware components that have software installed with default configurations. Why?

Document and describe access control lists, ACLs, for the firewall configurations including interior and exterior firewalls.

Document and describe perimeter router filtering policies, rules, and enforcement.

Document and describe the standard software installation policies and procedures for each hardware platform.

Document workstation access measures such as: BIOS passwords, Screensaver Passwords, Tokens, Biometrics, and Smart Card requirements.

Physical Security

Document and describe the location of fire suppression equipment.

Document any and all equipment that is not physically secure. Why?

Describe server and workstation boot processes. Do these equipment configurations have floppy drives (A) disabled for booting processes?

Are there BIOS, Basic Input/Output Information System, passwords? Do workstations have screensaver passwords? Are hard drives of mobile computing devices encrypted? Does mobile equipment have antitheft devices?

Are hard drives and removable media, containing sensitive information, secured in approved receptacles during idle periods?

Describe safeguards protecting equipment/media from theft.

Describe the location and safeguards of all publicly accessible equipment, including mobile units, e.g., laptops, PDAs, cellular telephones, PBX (Telephone Branch Exchange) equipment.

Emergency Power Management

Are there sufficient resources in the form of auxiliary power generators, uninterruptible power supplies, and electrical power conditioners for all user needs?

Is there individual hardware protection for power surges and voltage spikes?

Environmental Conditions

Are specific environmental needs met for employees, data, and equipment?

Are heating, air conditioning, and ventilation equipment in conformity with building and safety codes?

Is the employee work environment safe?

Configuration Management

Describe hardware and software configuration management. Who is responsible for configuration approval?

Are the protected interior systems connected to systems, through modems, terminal equipment, or PBX equipment having weak security procedures?

Are IP or IPX addresses accountable? When was the last inventory?

Are telephone numbers accountable? When was the last inventory?

Is information, within the organization, classified relative to its sensitivity?

Does information have an owner?

What is the means by which access is granted to information resources?

Network Protocols

Have all nonessential network services been disabled or removed on all relevant equipment?

Can any system be accessed by telephone, and if so, why?

Can any system be accessed wirelessly, and if so, why?

What security precautions have been implemented in wireless environments? Is there adequate supporting documentation?

Are wireless security precautions adequate for the traffic?

Are cabling cabinets/closets secured? Who has access, and why?

Are rooms containing networking equipment secured with restricted access? Who has access, and why?

Document all network equipment with remote configuration. Why?

Is network equipment accessible from consoles other than those located immediately next to the equipment? Why?

Have Web services been placed in a DMZ?

Are interior networks protected by firewalls?

Are sensitive interior networks partitioned by firewalls?

In the case of sensitive information, what is the justification of having open-ended networks connected?

Has intrusion detection technology been installed at the network and host levels?

Is there a procedure to respond to IDS alarms?

Disaster Recovery and Business Resumption

Have critical assets been identified and prioritized?

Has there been a risk management program implemented? Has this risk plan been thoroughly tested in the past 12 months?

Do employees know of shut-off procedures for water, electricity, and gas?

Is there a business resumption program? Has it been tested in the past 12 months?

Is there a critical incident management program?

Is there a Critical Incident Response Team?

Is there a business resumption plan? Has it been tested in the past 12 months?

Are there application and network transaction logs? With what frequency are they reviewed?

Software

Is there a list of authorized software to be installed on systems? Document authorized software lists.

Is there a policy regarding employees authorized to install software?

When was the last software inventory? Did this inventory include version numbers?

Is there a policy that addresses personally owned software?

Is there a standard configuration procedure for all authorized software installations?

What are the procedures for remote access to network/applications/workstations?

Are nonessential ports and services disabled?

Has antivirus software been installed and updated? How often is it run?

Have all applications and operating systems been updated with appropriate security patches?

Are software licenses audited regularly? When?

Are applications/operating systems protected by access control procedures?

Who are the employees having access to data? Why?

Who are the employees having access to production systems? Why?

Who is capable of accessing production code/applications/operating systems?

Do engineers/programmers/help desk employees have access to data? Why?

Are there system maintenance accounts? Who has access?

What justification is needed for user accounts?

Are departing employees' accounts audited before exiting? Are former employees' accounts disabled appropriately?

Media

Are media containing sensitive information appropriately secured during use and in idle periods?

Is there a policy regarding the use of personally owned media?

Is there a policy regarding scanning all media antivirus software?

Are media regularly backed up with copies secured offsite?

Is there a test of the integrity of backed-up media?

Is backed-up media tested for systems recovery? How long do recovery steps take?

Is printer output protected?

Is media, containing sensitive information, appropriately labeled?

Is there a procedure for media destruction and disposal?

Are there efforts requiring passwords to be changed regularly, minimum length, and containing special characters and capital letters? Are passwords required for application and operating system access? Are biometrics used to grant system access? Are Tokens/Smart Cards required for system access?

Are there documents showing that user authentication mechanisms are installed to limit system, building, and workspace access?

Are procedures requiring employee background investigations in place? Have the professional and personal references of all employees been verified? Have the professional qualifications of all employees been verified?

Is there appropriate separation of duties and least privilege?

Employee Security Awareness Training

Have employees been trained relative to risks and their management?

Is security awareness training mandatory for all employees? Are there documented attendance records?