The increasing frequency of database attacks is driving federal and state legislation that requires virtually every organization to deploy more robust audit mechanisms to protect sensitive data. To meet this requirement, some organizations attempt to use the built-in auditing tools supplied with database software platforms. This practice of setting up a “self-auditing” database is based upon several false assumptions and violates the fundamental audit requirement for independence.
There are several false assumptions implicit in the use of built-in audit tools. The first is that the audit tool is the only element of the database that is not vulnerable to attack. In September 2005, Imperva discovered a MS-SQL Server vulnerability which proves that this is not the case. By preceding the client login message with NULL characters, an attacker can avoid MS-SQL’s built in audit tools. This and other similar vulnerabilities illustrate the flaw in assuming that built-in database audit tools are not vulnerable. Audit mechanisms are just as likely to be vulnerable as any other database element.
Even more flawed is a second assumption that an attacker will not turn off auditing, or tamper with audit records once a server is compromised. An attacker may, for example, gain database administrative privileges and immediately disable auditing mechanisms. Similarly, a rogue administrator or developer may abuse legitimately acquired administrative privileges to delete audit records in order to hide an attack.
To further illustrate the point, consider a car with a “built-in” video tape security feature. In the event that the door locks fail, a thief could be identified after the fact using the “built-in” video tape. Does this make sense? The video tape would be stolen along with the car! Perhaps the considerate thief will leave the camera on and mail the tape to police after the theft? This is an absurd system, but it’s directly analogous to “built-in” database auditing and it illustrates the obvious flaws in self-auditing security systems.
A keyword in the audit business is “independence”. Any audit professional will tell you that audit mechanisms should be independent of the system being audited. Therefore, any legitimate database audit mechanism should be independent of database server and users.