securitywing

wing

Database Security Issues and Countermeasures

One of the least prioritize part in data base security is not taking countermeasures against database access. Some solid measures that you can take to secure the access methods in your database are:

  • Whether you use Oracle database or Microsoft SQL database, both the organization releases their security patch almost regular basis. So, make sure that you visit the security patch pages of your vendor’s website and apply the recommended patch as soon as they are released. Remember to test the patch in a test environment before applying in the production environment.  [Read more…] about Database Security Issues and Countermeasures

Oracle Audit Setting Commands

An auditor needs to check the Oracle database in order to gather some useful and important information to conduct his audit. In fact, an auditor will ask the system administrator to run the commands and collect the information on behalf of him. The following are the basic commands that you need to know before starting the proper audit of the audit trail.

To get a list of all users in the database:

SQL. Select *from all_users;

Another useful command is to check the list of privileges assigned to a user. You have to run this command after logging in with the user that you want to audit for privileges.

SQL> select username, privilege from user_sys_privs;

Note: all the commands used in this article works with Oracle 10g.

Normally, you need to enable oracle audit in order to audit an Oracle object (e.g. table, users). Here, the term “audit” means to generate logs for users’ activities such as running a query or creating a table. So, to get audit data you need to enable it at the first hand. But, there are some activities that generate log files regardless of you have enabled the audit or not and those activities are:

  • When an administrator log in to the database
  • When Oracle starts up
  • When oracle shutdown.

[Read more…] about Oracle Audit Setting Commands

Risk Management Process Simplified

Risk is the possibility of happening unknown or known events that can affect the main objectives of a project. It is not necessary that all the risk will cause disruption in achieving objectives of a goal because a risk can come in the form of a threat or an opportunity. If it comes as an opportunity that it will help the project to get benefit out of it. If you want to keep the risk to a controllable and manageable level, you need to follow the five processes and those are: [Read more…] about Risk Management Process Simplified

Audit Charter Explained

What is an Audit charter? An audit charter is the base of an audit because every auditor starts his audit with an audit charter. In simple words, an audit charter defines the responsibilities, authority and accountability of an auditor along with the scope of the audit. Normally, a charter also specify the management’s responsibility and their delegation of authority to the IS auditor or audit function to conduct the audit. [Read more…] about Audit Charter Explained

Apache Server Features with Vulnerabilities

Apache is one of the prevalent web servers because of its expandability with features, support community and cost. If you consider using Apache as a solution to your web server and want to implement the most basic security requirements, then you need to have clear understanding of some of the most ubiquitous features of Apache and those features are:

11 Essential Skills of an IT Auditor

Without proper knowledge of the information technology and systems that you are going to assess, it is almost impossible  to  audit IT systems.to find the flaws in a system you must know, at least, how it works and its potential vulnerabilities. So, the essential skills an IT auditor need are database, operating systems, web technologies, networking and business processes. The other essential thing an IT auditor always need to remember is the to continuously check the  best practices in IT security industries and the international and local standards.The following are the list of skills that are essentials to an IT auditor.

[Read more…] about 11 Essential Skills of an IT Auditor

Acunetix Web Vulnerability Scanner to Detect your Website’s Security Loopholes

Acunetix web vulnerability scanner help to find vulnerability in a website so as you can make your site or blog as secure as possible. Acunetix has a free version that you can use to find some of the common vulnerabilities of a website.In this article I will show you how you can use the free version of acunetix to figure out how much secure you blog is.Although Acunetix has a robust web vulnerability scanner that is capable of give you a detail report of your website’s security loopholes, you can use their free version to learn about this software if you are a new to the blogging world. [Read more…] about Acunetix Web Vulnerability Scanner to Detect your Website’s Security Loopholes

Domain Name Registration Law:You cannot Choose any Trademark name

Literally you can buy any domain name that is available for registration. But that does not mean that you can legally have that domain because if there is any trademark registered for that domain name then you have to give it to that company’s owner when they claim for that domain name. Though most of the new companies try to buy a domain name first before choosing their company name so as they can keep the exact match of their brand name in their web domain.  [Read more…] about Domain Name Registration Law:You cannot Choose any Trademark name

Google Analytics for IT Security Professionals

What is Google Analytics? In short Google analytics is a website statistics tracking tool that you can use to track how your users are interacting with your WebPages such as which pages are being visited the most and  where the visitors came from or what keywords he used to find your pages.

Who should use Google Analytics? IT professionals( both in operation and security) involved in managing websites for business purposes can be hugely benefited using analytic type of tools for analysis and monitoring how outside world is interacting with their sites or blogs. Since Google analytics is a free service offered by Google, anyone with a website can use it to track his web visitors’ behavior. If you want to implement analytics in your website you can find useful information at: analytics.google.com   [Read more…] about Google Analytics for IT Security Professionals