In order to avoid fraudulent or malicious acts on sensitive data in a database
(DB) , how do we segregate the duties of high privileged employees like DBA
and/or DB Security Administrator. What controls need to be established to
prevent an undesirable change or transaction from a highly privileged employee,
with out being noticed.
Should the DBA and DB security admin be separate personal? For e.g.: The DBA
has rights to modify tables or data, but only security admin can change DB
access control and system/transaction logs. In case if the DBA conducts some
malicious activates, it will be there in the logs which the DBA cannot delete.
On the other side, the DB security admin does not have permission to create
tables and access core data. But then again, the security admin can change his
permissions, do fraudulent acts, and then deleted the logs.. and hence go
un-noticed.
How to deal with the above? Making sure that no one person with high access
rights and can go un-noticed after committing a fraud. Particularly looking for
suggestion for the Database Environment.
Thanks...
Regards,
-Nabil.
DISCLAIMER:
Bu elektronik posta ve ekleri, sadece yukarida ismi yazili alicinin dikkatine
gonderilmistir. Mesajin muhatabi degilseniz, icerigini ve varsa ekindeki
dosyalari kimseye aktarmayiniz ya da kopyalamayiniz. Boyle bir durumda
gondereni uyarip, mesaji imha ediniz. KUVEYT TURK E.F.K. A.S bu e-postanin ve
eklerinin icerdigi bilgilerin size degisiklige ugrayarak ulasmasindan veya gec
ulasmasindan, butunlugunun ve gizliliginin korunamamasindan veya icerigine
güvenilerek yapilacak islemlerden dolayi sorumlu tutulamaz.
This e-mail & its content have been sent to the attention of the receiver named
above. If you are not the intended recipient (or have received this e-mail in
error), Please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this e-mail
is strictly forbidden. Kuwait Turkish Evkaf Finance House shall not be held
liable for the arrival of this e-mail & its content as modified or late, the
protection of integrity and secrecy and shall not be liable to any person who
acts or omits to do anything in reliance upon it.
