AUDIT OF CHANGES TO SQL SERVERDATABASE TABLES - Kolomytsev , Myhailo; Nosok, Svitlana (Ukrainian Information Security Research Journal, 2023)
The registration and audit subsystemis an inalienable component of information systems. All modern DBMS have the ability to register and process information about performedoperations. SQL Server since version 2008 has the ability to define an audit specification [1] at the server or database level. However, the data from the system audit does not consider the requirements of theinformation system’s business model. It becomes necessary to customize the registration process considering the specifics of the subject area. In addition, the most important task of database protection is to ensure data integrity. In modern complex IS a number of tables must be protected from unwanted change operations (inserts, updates and deletions). Audit data can be used to cancel such unwanted actions. In this case, there is not enough information in the system logs. This article discusses an approach to solving the audit of changes to DB tables problem in order to prevent unwanted data changes. This approach is implemented in the form of a methodology of creating database objects with the help of which user actions are registered and unwanted changes can be canceled. To solve the problem of user actions registration it is proposed to use a separate database schema for audit, a special audit table and triggers of the DB information tables.SQL procedures are proposed for unwanted changes cancellation. The software implementation that makes it possible to use it as part of automated DB protection is given for each stage of methodology.