Database intrusion detection by transaction signature

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

“…As established by Principle 1, a clear functional separation of concerns [17] is required in order to prevent potential changes in audit records whilst avoiding overlapping functional responsibilities. Although the administrator role (DBA) is normally in charge of managing audit functions [18], a explicit forensic role and a corresponding forensic database should be created for preventing discretionary violations of administrative functions, such as disabling audit mechanisms on convenience [19].…”

Bring Your Own Disclosure: Analysing BYOD Threats to Corporate Information

“…For instance, a naive employee, ignoring company security policies becomes an internal threat [13], if installing an unauthorised application in his mobile device introduces malware that was not specifically targeting the organisation, but may create the perfect opportunity for an undetected and unknown outsider to access corporate information assets [22] [25]. Meanwhile, databases may be tampered with by a reckless highly-trusted employee who is trying to deceive the organisation [26] by misusing his access credentials [27]. Hence, although these illegal actions may be investigated if proper auditing is enabled, in the BYOD context, it is more difficult to audit and control trusted insiders' actions [12] because digital investigations might be challenged by the following internal threat contexts.…”