More organizations are seeing the business requirement to secure some of their more critical data. Whether it's general human resources information, payroll information, their vendor list in their accounts receivable files or credit card information, organizations are making the effort to set database access controls to more appropriate settings - either "deny by default" - that is, *PUBLIC *EXCLUDE or "read only" - that is, *PUBLIC *USE. Unfortunately, once the effort has been made to set the access controls, it's my experience that these authority settings are never re-visited. In other words, organizations make this a one-time "security project" and never examine the settings again. Unless these settings are examined on a regular basis, there's no assurance that the settings remain set to (or are in compliance with) your organization's security policy requirements. This leads to a rise in "organizational risk." That is, the risk of loss resulting from inadequate or failed internal processes.

Let's look at some examples. ...