Recording who did what.
WHAT TO AUDIT
Privilege changes Schema changes Access to sensitive tables Administrative connections Failed authentication
WHY SCHEMA CHANGES SPECIFICALLY
They explain a great many incidents, and are otherwise unattributable.
WHAT OPTIONS EXIST
Audit plugins provided by the database Application-level logging Triggers recording changes to specific tables
WHAT TRIGGERS PROVIDE
A history table recording before and after values.
WHAT THAT COSTS
Write performance, and storage.
WHERE IT IS WORTH IT
Tables holding money, permissions or anything disputed.
WHAT TO RECORD IN A HISTORY TABLE
What changed The previous value Who When
WHAT MAKES THE WHO DIFFICULT
Applications connecting with one shared account.
WHAT TO DO ABOUT IT
Have the application record the acting user, and pass it through.
WHAT TO PROTECT
The audit records themselves.
WHY
An attacker with write access removes their traces.
WHAT TO CONSIDER
Writing audit data where the application cannot delete it.
WHAT TO RETAIN
Records for as long as obligations require.
WHAT TO REVIEW
Privilege changes, periodically.
