2 new books on Oracle security
The books are published by http://www.isaca.org - (broken link) Information Systems Audit and Control Association and are directed squarely at the audit market. I have not seen the books yet, I have ordered them but in the mean time I can tell you about what the web site says about them.
The first book is http://www..org/Template.cfm?Section=Browse_By_Category&Template=/Ecommerce/ProductDisplay.cfm&Productid=517 - (broken link) Oracle database security, audit and control features. This was written by Price Waterhouse consultants and it provides guidance on understanding the IT environment and developing a strategy to plan an Oracle audit. It also suggests a security framework for Oracle, talks about general control and application level security. It includes a list of frequently asked questions / answers and a list of audit tools and a control questionnaire and audit program linked to COBIT.
The second book is http://www.isaca.org/Template.cfm?Section=Browse_By_Category&Template=/Ecommerce/ProductDisplay.cfm&Productid=499 - (broken link) Security, audit and control features - Oracle applications - A technical and risk management reference guide, wow what a title! - This book is aimed at risk professionals and auditors (IT and non IT) to evaluate the risks in ERP implementations. This book will aid implementation and aid better design and controls. This is the second book in a series covering the major ERP systems, SAP R3 audit, Oracle Financials and Peoplesoft. There is some commonality in the three systems. The book sounds useful and covers how to adopt a risk based audit approach to ERP, an overview of Oracle authorisation, how to test the security etc. The COBIT framework is also covered.