Is it possible for Oracle database administrator to make direct changes in data contained in a row, for example, changing an amount of 50 to 500 either by typing into the database cell or by executing an update query? If so, how could it be restricted so that data changes could only input through ERP application?
1 Answer
If you have Enterprise Edition you can purchase the Database Vault option, which can be used to lock the DBA and SYSDBA accounts out of specific schemas. Otherwise there is no way to prevent a DBA or SYSDBA user (or anyone with the [INSERT|UPDATE|DELETE] ANY TABLE privileges or the ability to login to the application schema) from bypassing the application and modifying data directly. Generally speaking, your DBAs must be trusted individuals.
-
Thanks for clearing things up. On a side note, if database vault is not setup, is there any logging option to track such changes?– itsec80Aug 23 at 10:35
-
Auditing can be configured - but also disabled - by the DBA. It is important to audit changes to auditing and the audit trail itself, in addition to the data. There are several excellent checklists out there for hardening your database (CIS, DISA STIG, etc.) that include basic auditing setups.– pmdbaAug 23 at 11:07
-
Is it possible to create a trigger to fire if a direct input to a database value is detected, so that it only allows such data changes to be affected through application input?– itsec80Aug 24 at 5:28
-
Yes, this could be done, but a DBA could easily disable any trigger. A robust auditing solution is also critical here: DDL changes (like altering triggers, for example) should be captured, and possibly (depending on overall activity and your specific data) possibly actual DML operations that change specific data. You may not be able to stop a DBA from changing data, but you should be able to capture a record of what was done and prevent the DBA from erasing that audit record. In the end, it still comes down to the DBA needing to be a trusted individual.– pmdbaAug 24 at 10:00
-