Re: Oracle Auditing Recommendations

From: Rodd Holman <Rodd.Holman_at_gmail.com>
Date: Tue, 08 Aug 2006 11:04:56 -0500
Message-ID: <44D8B628.8010703@gmail.com>

I'll agree with you for the most part. However, when an auditor comes in and reports a discrepancy in that the DBA's have the SYS password as a problem, I have to say that's "putting a stamp". How else do you create the database if you don't know and give it the sys password.

Yes, this was a real life audit example. The auditor who was clueless about what a DBA was or did, had this checklist of items and just lumped DBA's in as users and since we knew how to get at the base level of the DB we were considered an audit risk. We all volunteered to give up the password and go home. Our boss wasn't impressed.

Niall Litchfield wrote:
> On 8/7/06, Rodd Holman <Rodd.Holman_at_gmail.com> wrote:

>>
>> Also remember, auditors are hired to find things wrong.  If everything
>> they find comes up good, then their supervisors question their diligence
>> in their jobs.  So every auditor needs to find something they can report
>> just to show that they were doing their job.  No auditor wants to be
>> found eligible for the Enron audit team.

>
>
> Not true. Auditors are hired to verify and evidence that things are as
> people say they are. This is different from being hired to find things
> wrong. Or to use another analogy, this statement is equivalent to saying
> that DBAs are hired to prevent people from accessing data or code from
> being
> put into production. If a DBA allows people access or puts code into
> production without finding it lacking then their supervisors question their
> diligence.
>
> For sure Auditors are picky, beauracratic and irritating. This is a good
> thing given their role. They aren't out to find mistakes though. They are
> out to verify and evidence.
>

--
http://www.freelists.org/webpage/oracle-l

Received on Tue Aug 08 2006 - 11:04:56 CDT