I was made aware of two new books on the subject of Oracle security by Stephen Kost a couple of days ago and thought I would mention them here. I will be adding them to my books page when time allows along with details of every other Oracle security book or book that includes something about Oracle security either as a complete section or chapters.
The books are published by http://www.isaca.org - (broken link) Information Systems Audit and Control Association and are directed squarely at the audit market. I have not seen the books yet, I have ordered them but in the mean time I can tell you about what the web site says about them.
The first book is http://www..org/Template.cfm?Section=Browse_By_Category&Template=/Ecommerce/ProductDisplay.cfm&Productid=517 - (broken link) Oracle database security, audit and control features. This was written by Price Waterhouse consultants and it provides guidance on understanding the IT environment and developing a strategy to plan an Oracle audit. It also suggests a security framework for Oracle, talks about general control and application level security. It includes a list of frequently asked questions / answers and a list of audit tools and a control questionnaire and audit program linked to COBIT.
The second book is http://www.isaca.org/Template.cfm?Section=Browse_By_Category&Template=/Ecommerce/ProductDisplay.cfm&Productid=499 - (broken link) Security, audit and control features - Oracle applications - A technical and risk management reference guide, wow what a title! - This book is aimed at risk professionals and auditors (IT and non IT) to evaluate the risks in ERP implementations. This book will aid implementation and aid better design and controls. This is the second book in a series covering the major ERP systems, SAP R3 audit, Oracle Financials and Peoplesoft. There is some commonality in the three systems. The book sounds useful and covers how to adopt a risk based audit approach to ERP, an overview of Oracle authorisation, how to test the security etc. The COBIT framework is also covered.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Frank Nimphius talks about JAAS and declarative J2EE security"] [Next entry: "Writing to the alert log"]
October 2004
- find_all_privs.sql : A script to find all privileges allocated to a user or role - 10/02/2004 by 10/02/2004
- PeteFinnigan.com Tools page updated - 10/03/2004 by 10/03/2004
- who_has_role.sql : A script to find which users and roles have been granted a role - 10/05/2004 by 10/05/2004
- Howard Rogers writes about Virtual Private databases - 10/06/2004 by 10/06/2004
- Tools page has been updated again - 10/07/2004 by 10/07/2004
- who_has_priv.sql : script to find user who have been granted a system privilege - 10/09/2004 by 10/09/2004
- Oracle remids all customers to apply Patches for alert #68 - 10/10/2004 by 10/10/2004
- preventing password leakage with SQL*Loader - 10/11/2004 by 10/11/2004
- which special characters can be used in Oracle database passwords - 10/12/2004 by 10/12/2004
- expired passwords, ORA-01045 and password changes - 10/13/2004 by 10/13/2004
- SQL Injection papers - 10/14/2004 by 10/14/2004
- where is the next monthly patch? - 10/15/2004 by 10/15/2004
- computerworld have also picked up the patch quickly story - 10/16/2004 by 10/16/2004
- Listener security guide - 10/17/2004 by 10/17/2004
- A tuning book and security? - 10/18/2004 by 10/18/2004
- An interesting SQL Injection paper - 10/19/2004 by 10/19/2004
- Internetnews article : "Customers Gripe About Oracle's Patch Plan" - 10/20/2004 by 10/20/2004
- Auditing DBA's? - 10/21/2004 by 10/21/2004
- You can search inside the SANS Oracle security step-by-step guide - 10/22/2004 by 10/22/2004
- Is setting trace a security risk? - part 1 - 10/23/2004 by 10/23/2004
- technewsworld.com says "Oracle's Security Luck Runs Out" - 10/24/2004 by 10/24/2004
- Another issue with alert 68 on AIX 32 bit - 10/25/2004 by 10/25/2004
- Writing to the alert log - 10/26/2004 by 10/26/2004
- more info on DBMS_SYSTEM.KSDWRT - 10/27/2004 by 10/27/2004
- massive data theft from a database in California - 10/28/2004 by 10/28/2004
- Can I connect to the database as the user PUBLIC? - 10/29/2004 by 10/29/2004
- Interesting question about Sarbanes-Oxley on Oracle 7.3.3 - 10/30/2004 by 10/30/2004
- Howard Rogers new paper on secure application roles - 10/31/2004 by 10/31/2004
Archives
Syndication
Powered by gm-rss 2.0.0
