Auditing Architectures - Implementing Database Security and Auditing - page 387

Scenario 3: Midsize media company

A midsize media company has 23 databases throughout the organization,
including finance applications, publishing applications, and others. A com-
pany-wide initiative was put in place to create audit records for all of the
company's databases using a centralized auditing system. The result is a
combined throughput of almost 4 million audit records per day.
These scenarios point to the fact that detailed auditing creates large
amounts of information that need to be stored. Most auditing systems
and homegrown solutions will save this data within a database, allowing
you to get the information and run any query to infer information from
the data. Given these numbers, it should be clear that the only way to effi-
ciently manage this amount of data is using techniques that are common
in data warehousing.
The fact is that every auditing database is a large data warehouse of data-
base access information. If you do not take care in ensuring that the schema
used for storing the data uses various aggregation and precomputing tech-
niques, then you are bound to get bad response times when generating
reports and will usually suffer from a lack of disk space. Therefore, one of
the architectural requirements you should pay attention to has to do with
how efficiently this data is stored.

13.9 Implement good mining tools and security

applications

If you just keep data in a flat file or a naïve database schema, you will not
only run into storage issues, but the data will also not be readily available
when you need it. Every audit exercise will immediately become an exercise
of looking for a needle in a haystack. With a data warehouse architecture,
the data is accessible from reporting and data mining tools.
Two kinds of tools will be useful for making the best use of the auditing
information. Tools can include generic reporting tools such as Crystal
Reports, Business Objects, or even OLAP solutions, which can help you
create more efficient reporting and mining environments. The second class
of tools are security-oriented or auditing-oriented and provide added value
over generic reporting tools. These more specific tools include prepackaged
reports that are based on common auditing best practices, alerting applica-
tions that can be set up to notify you when deviations from a policy occur,
and baselining tools that allow you to generate audit trails that can be com-
pared with previous audit trails. The main focus of these advanced tools is