[Previous entry: "Frank Nimphius talks about JAAS and declarative J2EE security"] [Next entry: "Writing to the alert log"]
2 new books on Oracle security
October 26th, 2004 by Pete
Post to del.icio.us
Post to Furl
I was made aware of two new books on the subject of Oracle security by Stephen Kost a couple of days ago and thought I would mention them here. I will be adding them to my books page when time allows along with details of every other Oracle security book or book that includes something about Oracle security either as a complete section or chapters.
The books are published by Information Systems Audit and Control Association and are directed squarely at the audit market. I have not seen the books yet, I have ordered them but in the mean time I can tell you about what the web site says about them.
The first book is Oracle database security, audit and control features. This was written by Price Waterhouse consultants and it provides guidance on understanding the IT environment and developing a strategy to plan an Oracle audit. It also suggests a security framework for Oracle, talks about general control and application level security. It includes a list of frequently asked questions / answers and a list of audit tools and a control questionnaire and audit program linked to COBIT.
The second book is Security, audit and control features - Oracle applications - A technical and risk management reference guide, wow what a title! - This book is aimed at risk professionals and auditors (IT and non IT) to evaluate the risks in ERP implementations. This book will aid implementation and aid better design and controls. This is the second book in a series covering the major ERP systems, SAP R3 audit, Oracle Financials and Peoplesoft. There is some commonality in the three systems. The book sounds useful and covers how to adopt a risk based audit approach to ERP, an overview of Oracle authorisation, how to test the security etc. The COBIT framework is also covered.
