Application Security - Implementing Database Security and Auditing - page 161

What database login is being used?
What database objects (e.g., table or procedure) are being accessed?
What commands are being used (e.g., SELECT, DML, DDL)?
You should capture all of this information over a lengthy period of time
that reflects full cycles within the application. As an example, if the applica-
tion has special functions that occur at the end of each month, then your
capture must include end-of-the-month activity. What you are trying to do
is create a comprehensive log of which database login is used to access
which database objects, and how they are being accessed. You should end
up with a long report, as shown in Figure 5.10, forming a baseline of how
the application is using database objects.
Although you can create this detailed access log and baseline using data-
base features, you may prefer to use an external product rather than using
Figure 5.10
Detailed report of
application
access—who, what,
and how.