oracle security presentation

ORACLE SECURITY

Francisco Munoz Alvarez Oracle ACE Director

President CLOUG, LAOUC & NZOUG

IOUC LA Spokesperson

8/9/10g/11g OCP, RAC OCE, AS OCA, E-Business OCP, SQL/PLSQL OCA, Oracle 7 OCM

Oracle 7, 11GR2 & OVM 3.1 Beta Tester

ITIL Certified

2010 Oracle Ace Director of the year by Oracle Magazine

Blog: http://oraclenz.wordpress.com - Email: [email protected] – Twitter : fcomunoz

Oracle Professional Services Manager

Revera

www.revera.co.nz

http://oraclenz.wordpress.com/

mailto:[email protected]

http://www.revera.co.nz/

ORACLE SECURITY TIPS

By:

Francisco Munoz Alvarez

APAC OTN Tour 2012

DBIS - Copyright 2010 3

Born here Grow up here

Got Married Here Mature

here Now Living here

The Rule:

“The most important rule with respect to data is to never put yourself into an unrecoverable situation.”

The importance of this guideline cannot be stressed enough, but it does not mean that you can never use time saving or performance enhancing options.

5

Always Try it Before!

When it comes to theory, “NEVER” believe anything you hear

or read until you have tried it yourself.

7

Backup, Backup &

Backup

Why? Because bad stuff

happens…

Information Security Has Changed

Hacking Steps

OFFICIAL STATISTICS from Secret Service Germany

SOME SHORT FACTS

HIGH SCORE LIST

2007/2008 SHOPPING LIST

CRISIS SHOPPING LIST 2009

CONCLUSION

Oracle Security Solutions

Oracle Security Components

DB ENVIRONMENT

Security Data in Rest/Access Control

WHAT IS ASO?

What Security Problems does ASO solve?

ASO BENEFITS

TDE – Transparent Data Encryption

SECURING DATA IN MOTION

NETWORK ENCRYPTION

SECURING BACKUP

SECURING BACKUP Examples

DATAMASKING

WHAT IS DATAMASKING?

PREVENT MODIFICATIONS BY UNAUTHORIZED USERS

WHAT IS DATA VAULT?

DATA VAULT HELP TO SOLVE:

DATA VAULT Vs VPD and OLS

DATABASE VAULT Realms and Rule

DATA VAULT REPORTS

DATA VAULT EXAMPLES

HIGHLY SECURED ENVIROMENTS AUDIT VALT

AUDIT VAULT EXAMPLES

AUDIT VAULT REPORTS Who, What, When, Where

AUDIT VAULT DASHBOARD

AUDIT VAULT SUMMARY

27 Security Tips

Some Oracle Security Tips

1) Grant privileges only to a user or application which requires the privilege to accomplish necessary work. Excessive granting of unnecessary privileges can compromise security.


2)No administrative functions are to be performed by an application. For example create user, delete user, grant role, grant object privileges, etc.


3) Privileges for schema or database owner objects should be granted via a role and not explicitly. Do not use the “ALL” option when granting object privileges, instead specify the exact privilege needed, such as select, update, insert, delete.


4)Password protected roles may be implemented to allow an application to control access to its data. Thereby, end users may not access the application’s data from outside the application.


5)Access to Administrative or System user accounts should be restricted to authorized DBAs.


6) Do not grant system supplied database roles. These roles may have administrative privileges and the role privileges may change with new releases of the database.


7) Database catalog access should be restricted. Example: Use “USER_VIEWS” instead of “DBA_VIEWS” for an Oracle database.


8) Privileges granted to PUBLIC are accessible to every user and should be granted only when necessary.


9) Any password stored by applications in the database should be encrypted.


10) Applications should not “DROP”, “CREATE” or “ALTER” objects within the application.


11) Utilize the shared database infrastructure to share cost whenever possible.


12) Applications should not access the database with the same security as the owner of the database objects. For example on SQL Server do not grant the “dbowner” role and on Oracle do not use the Schema userid to connect to the database. Setup another userid with the necessary privileges to run the application.


13) Database integrity should be enforced on the database using foreign keys not in the application code. This helps prevent code outside the application from creating orphan records and/or invalid data.


14) Do not hard code username and passwords in the application source code.

• Sqlplus /nolog @myscript

– Create a password file (.password) fmunoz evelyn scott tiger

– Create a shell script getpwd.sh fgrep $1 $HOME/tools/.password | cut –d “ “ –f2 – Use the script and the password file

Getpwd.sh fmunoz | sqlplus –s fmunoz @script

• RMAN rman target /

connect catalog user/pwd@catdb


15) Protect your Listener :

– LSNRCTL> Set Current Listener <ip_address>

– LSNRCTL> Set rawmode on

– LSNRCTL> Services

– LSNRCTL> Stop

– LSNRCTL> Set startup_waittime 20

– LSNRCTL> Set logfile redo01a

– LSNRCTL> Set log_directory ‘/u01/app/oracle/redo’


15) Protect your Listener (Cont.):

– Disable online modifications • LSNRCTL> Admin_restrictions _<listener_name>=ON

– Set Password (<= 9i) • LSNRCTL> Change_password

• LSNRCTL> Save_config

– Disable OS Authentication • LOCAL_OS_AUTHENTICATION_<Listener_name>=OFF


16) Ensure external users have the least privilege possible.


17) Have a clear and well documented Backup and Recovery Strategy


18) Implement an strong password policy (user profile) and force all users to change their passwords constantly .


19) All important passwords need to be saved in a safe and replaced when changed.


20) Install only what’s really required.


21) Implement Audit, soon or later you will be ask to tell who changed that. Please, implement a purge strategy.


22) Create promotion procedures (DEV->TEST->PROD), lock your production environment and test environment. Don’t forget to implement and document a change register.


23) Implement an Indirect Login Policy

– Each user have their own login account

– Allow connections to oracle account (OS) only thru sudo

– This will leaves an audit trail of actions

#sudo –u oracle sqlplus / as sysdba


24) Prevent SYSDBA connection – Sqlplus / as sysdba

• Change SQLNET.ORA SQLNET.AUTHENTICATION_SERVICES=(NONE)


25) Avoid Risk Connections (Ext. Procedures) – Listener.ora

• (ADDRESS_LIST =

(ADDRESS = (PROTOCOL = IPC)

(KEY = EXTPROC))

Remove this lines, or move to a different listener


26) Enable Data Dictionary Protection

Oracle Recommends that customers implement data dictionary protection to prevent

users who have the “ANY” system privileges to modify or harm the Oracle data dictionary.

Set 07_DICTIONARY_ACCESSIBILITY parameter to FALSE.


27) Create your own metadata repository.

Use datapump for this

$ expdp user/password content=metadata_only full=y

directory=datapump dumpfile=metadata_24112010.dmp

$ impdp user/password directory=datapump dumpfile=

metadata_24112010.dmp sqlfile=metadata_24112010.sql

PROGRAM

The Oracle ACE Program is designed to recognize and reward members of the

Oracle Technology and Applications communities for their contributions to those

communities. These individuals are technically proficient (when applicable) and

willingly share their knowledge and experiences.

The program comprises two levels: Oracle ACE and Oracle ACE Director.

The former designation is Oracle's way of saying "thank you" to community

contributors for their efforts; we (and the community) appreciate their

enthusiasm. The latter designation is for community enthusiasts who not only

share their knowledge (usually in extraordinary ways), but also want to increase

their community advocacy and work more proactively with Oracle to find

opportunities for the same. In this sense, Oracle ACE is "backward looking" and

Oracle ACE Director is "forward looking."

http://www.oracle.com/technology/community/oracle_ace/index.html





PROGRAM

Questions?

Thank you !

oracle security presentation

Technology

oracle database

security data

oracle security solutions

oracle security components

ocm oracle

security problems

information security

oracle magazine blog