Operations and Business Resilience · Topic 5 of 8
Operational Log and Database Management
Collecting, protecting, reviewing and retaining operational logs, time synchronization, database integrity, normalization and DBA monitoring.
- 3 min
- Centralize logs, synchronize time, protect integrity, review and retain.
- People whose actions are logged must not be able to alter the logs.
- Referential integrity keeps links between tables valid.
What it is
Operational log management collects, protects, reviews and retains records of what happened on systems, so problems and suspicious activity can be found and investigated. Database management covers how databases are designed, administered and protected so data stays accurate, available and confidential.
How it works
What to log
Typical events: logons and failed logons, privileged activity, changes to accounts and permissions, configuration changes, access to sensitive data, security alerts and system errors. Each log entry should show who, what, when, where and the outcome.
Log management controls
| Control | Why |
|---|---|
| Central collection (for example a SIEM) | Correlation across systems; logs survive if a server is compromised |
| Time synchronization | All systems use a common time source so events can be correlated |
| Integrity protection | Write-once storage, restricted access, hashing; administrators cannot alter logs of their own activity |
| Regular review and alerting | Logs no one reads give no control |
| Retention | Kept as long as policy, law and investigations require |
| Capacity | Enough storage so logging does not stop when full |
The auditor checks that critical systems actually send logs, that alerts are reviewed and acted on, and that the people whose actions are logged cannot change the logs.
When an administrator can delete the logs that record administrator actions, the control is ineffective. Look for an option that sends logs to a system the administrator cannot modify.
Database structures
| Model | Description |
|---|---|
| Relational | Data in tables with rows and columns, linked by keys; queried with SQL |
| Hierarchical | Parent-child tree structure |
| Network | Records with many-to-many links |
| NoSQL | Document, key-value, column or graph stores for scale and flexible structures |
Integrity concepts
- Primary key: uniquely identifies each row.
- Foreign key and referential integrity: a reference to another table must point to a record that exists.
- Normalization: organizes data to reduce redundancy and update anomalies; denormalization adds redundancy for performance and needs controls to keep copies consistent.
- Concurrency controls such as locking stop two users overwriting each other's updates.
- Transaction logging and commit/rollback let incomplete transactions be undone and the database recovered.
Database administration controls
The database administrator (DBA) has powerful access to data. Controls include:
- Segregating DBA duties from application development and from security administration.
- Restricting direct data changes; changes go through the application or an approved, logged process.
- Logging and independent review of DBA activity.
- Using named accounts instead of shared administrator accounts.
- Protecting sensitive data with encryption, masking and access controls.
- Regular backup and tested restoration.
How the exam asks about this
- "Logs from different servers cannot be correlated." Synchronize time across systems.
- "The DBA can change payment data directly." Restrict direct updates, log DBA activity and have it reviewed independently.
- "Which feature prevents an order pointing to a non-existent customer?" Referential integrity.
What to remember for the exam
- Centralize logs, synchronize time, protect integrity, review and retain.
- People whose actions are logged must not be able to alter the logs.
- Referential integrity keeps links between tables valid.
- Normalization reduces redundancy; denormalization needs consistency controls.
- Log and independently review DBA activity.
Turning off logging to improve performance removes the evidence needed to investigate incidents.
Common mistakes
Collecting logs but never reviewing them.
Letting the DBA review their own activity logs.
Ignoring time synchronization. Investigations depend on it.
Check yourself
Why is time synchronization important for logs?
So events from different systems can be correlated in the correct order.
What does referential integrity ensure?
That a reference to another table points to a record that actually exists.
Who should review database administrator activity?
Someone independent of the DBA, such as security or a manager outside database administration.
Topic 5 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.