Security and Audit functionality

From: MattC (m_at_m.com)
Date: 05/25/04 

Date: Tue, 25 May 2004 11:09:18 +0100

Hi,

I have a requirement that security be devised at page level, I'm am also
required to keep an audit trail of who performed what action, when and what
on.

My current solution is as follows:

Create 5 DB tables: Users, SecurityProfiles, SystemTasks, TasksProfileLinks,
Audit.

For this to work each user is given a securityprofileID, a security profile
is told which SystemTasks can be performed (via the TasksProfileLinks
table). As each ASPX page loads it will have hardcoded the name of the
Systemtasks it is designed to perform. It will then take the current
sessions SecurityProfileID and determine if this user is allowed to view the
page, if not then a redirect takes place and the UserID, SystemTask,
DateTime are entered into the audit table.

Although this would work, it does require that each page knows ahead of time
what its SystemTask name is.

Has anyone done something similar to this before and have a better
implementation.

Thanx in advance.

Matt

Relevant Pages

  • Re: Security and Audit functionality
    ... Security is something very important and most of usnormally ... > required to keep an audit trail of who performed what action, ... > is told which SystemTasks can be performed (via the TasksProfileLinks ... > page, if not then a redirect takes place and the UserID, SystemTask, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: [Full-Disclosure] Partial Solution to SUID Problems
    ... It's so you have an audit trail of who did what. ... If you only have a couple admins, direct root logins should work fine. ... I agree that it doesn't add much in the way of security, ...
    (Full-Disclosure)
  • Re: Securing the database from the DBA
    ... > All of these methods, and many of Oracle's other security features, ... > also give the DBA the powers to circumvent these measures? ... > facilities as your audit trail tool, ... All machines immediately send a web service post (via custom ...
    (comp.security.misc)
  • Securing the database from the DBA
    ... All of these methods, and many of Oracle's other security features, ... also give the DBA the powers to circumvent these measures? ... facilities as your audit trail tool, ... of Oracle for securing the database, such as some third party tool? ...
    (comp.security.misc)
  • Re: Securing the database from the DBA
    ... IT Security professionals have responsibilities to setup security standards ... > also give the DBA the powers to circumvent these measures? ... > facilities as your audit trail tool, ...
    (comp.security.misc)