Auditing: a relevant contribution to trusted database management systems

Abstract

Summary form only given. An ongoing study of audit issues in the context of trusted database management systems (TDBMSs) is discussed. The study consists of a survey of the state of the art, an analysis of issues raised, and an assessment of future relevant research. The scope of the study is broad, and includes a variety of security policies and TDBMS architectures intended for commercial and defense applications. Issues of interest have included those associated with capture, storage, protection, reduction, and analysis of audit data. The study is based on extensive interviews with a number of researchers and product development groups and an examination of audit in its historical and trusted systems contexts. The authors have found that little guidance is provided for either what needs to be audited in TDBMS contexts or when, how, or even where audit data should be captured or recorded. They have found that audit objectives and implied requirements may be specific to each application and security policy. It has also been found that surprisingly little attention has been given in practice to the analysis of TDBMS audit data. >