83
KSU does not have user security auditing enabled for the Banner accounting system. Auditing is the monitoring and recording of selected user database actions. Banner was fully implemented by KSU in 2011 and runs on the Oracle database. At the time of implementation, KSU did not configure the Banner Oracle database to capture events related to user security. As a result, changes made to user account profiles cannot be viewed within the system.
For example, a user is granted BAN_DEFAULT_M access to the Student Course Registration form in the Student module of Banner. This access would allow the user to view and maintain or change the data associated with the registration form. If the manager subsequently decides that incorrect access was given to the user and changes the access to BAN_DEFAULT_Q, then this would only allow the user to query, or view, the form and its contents. Since security auditing is not enabled, there is no history of individuals' access in Banner. As such, an auditor can only see the user's current access, or in this example, the BAN_DEFAULT_Q access level. An auditor would not see that the user was ever granted the BAN_DEFAULT_M access.
Due to the lack of security auditing, examination procedures were limited as to what testing could be performed. KSU provided historical audit reports for FY 2019 through FY 2021. These reports allowed a manual comparison of Banner user access. However, the authenticity of these reports could not be verified and there was no way to verify any changes made to a user's access that was identified by this comparison via Banner.
According to the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-92, Guide to Computer Security Log Management, “Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems. Logs are also useful when performing auditing and forensic analysis, supporting internal investigations, establishing baselines, and identifying operational trends and long-term problems.”
Additionally, according to the Oracle Help Center, auditing is typically used to:
Enable future accountability for current actions taken in a particular schema, table, or row, or affecting specific content
Deter users from inappropriate actions based on that accountability
Investigate suspicious activity
Notify an auditor that an unauthorized user is manipulating or deleting data and that the user has more privileges than expected which can lead to reassessing user authorizations
Monitor and gather data about specific database activities
Detect problems with an authorization or access control implementation.
We recommend:
KSU work with the vendor to enable security auditing on the Banner Oracle database.
KSU management regularly monitor changes to user access, and reports on this monitoring should be included in the quarterly audits.