The impact of triggers on forensic acquisition and analysis of databases

An aspect of database forensics that has not received much attention in the academic research community yet is the presence of database triggers. Database triggers and their implementations have not yet been thoroughly analysed to establish what possible impact they could have on digital forensic analysis methods and processes. This paper firstly attempts to establish if triggers could be used as an anti-forensic mechanism in databases to potentially disrupt or even thwart forensic investigations. Secondly, it explores if triggers could be used to manipulate ordinary database actions for nefarious purposes and at the same time implicate innocent parties. The database triggers as defined in the SQL standard were studied together with a number of database trigger implementations. This was done in order to establish what aspects of a trigger might have an impact on digital forensic analysis. It is demonstrated in this paper that certain database forensic acquisition and analysis methods are impacted by the possible presence of non-data triggers. This is specific to databases that provide non-data trigger implementations. Furthermore, it finds that the forensic interpretation and attribution processes should be extended to include the handling and analysis of all database triggers. This is necessary to enable a more accurate attribution of actions in all databases that provide any form of trigger implementations.“The Role of Triggers in Database Forensics”, by Werner Hauger and Martin Olivier which appeared in the Proceedings of Information Security South African (ISSA) 2014, Johannesburg, 13 & 14 August 2014.http://www.saiee.org.za/DirectoryDisplay/DirectoryCMSPages.aspx?name=Publications#id=1588&dirname=ARJ&dirid=337am2016Computer Scienc

Methodology of optimization of data flow effects based on integration structural systems analysis and risk

У докторској дисертацији истраживан је проблем оптимизације ефеката протока података код информационих система и развој методологије за ефикасно управљања процесима протока података. Методолошки процес за оптимизацију ефеката протока података чине: идентификација процеса протока података, структурна декомпозиција процеса протока података, идентификација индикатора за праћење ефеката протока, јединице мере индикатора ефеката протока, идентификација ограничења индикатора ефеката протока података, идентификација ризика ефеката протока података и утврђивање акционих мера за митигацију ризика ефеката протока података. Елементи од посебног значаја за предложену методологију за оптимизацију ефеката протока података су: итеративни софтверски процес, структурна системска анализа, ефекти протока података, имплементација надгледања система, хибридни приступ у анализи ризика у фази одржавања софтвера и CASE алати. Посматрајући првенствено трансакционе информационе системе предложена је нова методологија оптимизације ефеката протока података са интеграцијом ССА и анализе ризика у облику хибридне модификоване FMEA методе. Предложена методологија подразумева итеративни и инкрементални модел софтверског процеса као основу за успешну примену у пракси. Модификована хибридна FMEA метода која се посматрано у контексту софтверског процеса доменског софтвера, налази позиционирана у фази одржавања, као свој резултат даје списак мера које се примењују као активности модификације и наставка развоја софтверског решења. Неке од тако дефинисаних активности налазе се у фази дизајна, неке у фази имплементације дизајна, неке могу да се простиру на више фаза активности, али у сваком случају налазе се у ранијим фазама софтверског процеса, следећег циклуса. С друге стране, као улаз и предуслов за реализацију овакве предложене методологије, користе се елементи, посебно хијерархија декомпонованих процеса, спроведене ССА из ранијих фаза софтверског процеа из преходних итерација. Ова дуална међузависност, започиње условом иницијално спроведене структурне системске анализе...In the doctoral dissertation, the problem of optimizing the effects of data flow in information systems and the development of a methodology for efficient management of data flow processes was researched. The methodological process for optimizing the effects of data flow consists of: identification of data flow processes, structural decomposition of data flow processes, identification of indicators for monitoring flow effects, units of measure of flow effect indicators, identification of data flow effect limiters, identification of data flow risk effects and determination of action measures for risk mitigation of data flow effects. Elements of special importance for the proposed methodology for optimizing the effects of data flow are: iterative software process, structural system analysis, data flow effects, implementation of system monitoring, hybrid approach in risk analysis in the software maintenance phase and CASE tools. Observing primarily transactional information systems, a new methodology for optimizing the effects of data flow with the integration of SSA and risk analysis in the form of a hybrid modified FMEA method has been proposed. The proposed methodology implies an iterative and incremental model of the software process as a basis for successful application in practice. The modified hybrid FMEA method, which observed in the context of the software process of domain software, is positioned in the maintenance phase, as its result provides a list of measures that are applied as modification activities and extension of the development of the software solution. Some of the activities thus defined are in the design phase, some in the design implementation phase, some may extend to more phases of activity, but in any case they are in the earlier stages of the software process, of the next cycle. On the other hand, as an input and a precondition for the realization of such a proposed methodology, elements are used, especially the hierarchy of decomposed processes, implemented SSA from earlier phases of the software process from the previous iterations. This dual interdependence begins with the condition of the initially conducted structural system analysis..

SELECT Triggers For Data Auditing

Abstract—Auditing is a key part of the security infrastructure in a database system. While commercial database systems provide mechanisms such as triggers that can be used to track and log any changes made to “sensitive ” data using UPDATE queries, they are not useful for tracking accesses to sensitive data using complex SQL queries, which is important for many applications given recent laws such as HIPAA. In this paper, we propose the notion of SELECT triggers that extends triggers to work for SELECT queries in order to facilitate data auditing. We discuss the challenges in integrating SELECT triggers in a database system including specification, semantics as well as efficient implementation techniques. We have prototyped our framework in a commercial database system and present an experimental evaluation of our framework using the TPC-H benchmark. I