oracle security webinar
DESCRIPTION
Oracle Security Webinar by Uwe HesseDefine and presente 4 ways to achieve security in Oracle Database.Traditional AuditingAuditing the SYS userFine Grained AuditingTransparent Data EncryptionTRANSCRIPT
Copyright © 2009, Oracle. All rights reserved.
:HELQDU2UDFOH�'DWDEDVH���J��6HFXULW\
8ZH�+HVVH2UDFOH�8QLYHUVLW\�3ULQFLSDO�,QVWUXFWRU
0RUH�DERXW�PH� KWWS���XKHVVH�ZRUGSUHVV�FRP�DERXW
*HW�WKHVH�VOLGHV��KWWS���XKHVVH�ZRUGSUHVV�GRZQORDGV
Copyright © 2009, Oracle. All rights reserved.2
$JHQGD
• ³7UDGLWLRQDO´�$XGLWLQJ¾ %ULHI�LQWURGXFWLRQ
¾ 'HPRQVWUDWLRQ
• $XGLWLQJ�WKH�6<6 XVHU¾ %ULHI�LQWURGXFWLRQ¾ 'HPRQVWUDWLRQ
• )LQH�*UDLQHG�$XGLWLQJ¾ %ULHI�LQWURGXFWLRQ
¾ 'HPRQVWUDWLRQ
• 7UDQVSDUHQW�'DWD�(QFU\SWLRQ¾ %ULHI�LQWURGXFWLRQ
¾ 'HPRQVWUDWLRQ
Copyright © 2009, Oracle. All rights reserved.3
$XGLWWUDLO
3DUDPHWHU�ILOH
6SHFLI\�DXGLW�RSWLRQV�
*HQHUDWH�DXGLW�WUDLO�
³7UDGLWLRQDO´ $XGLWLQJ
'%$ 8VHUH[HFXWHV�FRPPDQG�
'DWDEDVH
26�RU�;0/�DXGLW�WUDLO
$XGLW�RSWLRQV
6HUYHUSURFHVV
�
�
�
(QDEOHGDWDEDVHDXGLWLQJ�
5HYLHZ�DXGLWLQIRUPDWLRQ�
0DLQWDLQ�DXGLWWUDLO�
�
Copyright © 2009, Oracle. All rights reserved.4
([DPSOHV�IRU�³7UDGLWLRQDO´�DXGLWLQJ�RQ�D��3ULYLOHJHV��E��2EMHFWV��F��6WDWHPHQWV
64/!�DOWHU�V\VWHP�VHW�DXGLWBWUDLO µ'%¶�¶(;7(1'('¶�VFRSH VSILOH�
64/!�DXGLW�VHVVLRQ�ZKHQHYHU�QRW�VXFFHVVIXO���� D�
64/!�DXGLW�DOO�RQ�KU�HPSOR\HHV�E\�DFFHVV�ZKHQHYHU�VXFFHVVIXO���� E�
64/!�DXGLW�WDEOH�E\�DFFHVV�ZKHQHYHU�VXFFHVVIXO���� F�
Copyright © 2009, Oracle. All rights reserved.5
'HPRQVWUDWLRQ7UDGLWLRQDO�$XGLWLQJ����
Copyright © 2009, Oracle. All rights reserved.6
3RVVLEOH�YDOXHV�IRU�$8',7B75$,/�
121( �'HIDXOW�EHIRUH���J�
'% �'HIDXOW�LQ���J��Æ 7DEOH�V\V�DXG�� DFFHVVHG�E\�'%$B$8',7B75$,/
26 Æ 26�WH[WILOH��GLUHFWRU\�VSHFLILHG�E\�$8',7B),/(B'(67
;0/ Æ 26�ILOH��GLWR��DFFHVVHG�E\�9�;0/B$8',7B75$,/
'%� (;7(1'(' �VHWWLQJ�LQ�RXU�GHPR��LQFOXGHV�FRPSOHWH�VWDWHPHQWV�
;0/��(;7(1'(' �DV�DERYH��LQ�;0/�ILOHV�
Copyright © 2009, Oracle. All rights reserved.7
$XGLWLQJ�WKH�6<6 XVHU
8VHUV�ZLWK�WKH�6<6'%$ RU�6<623(5SULYLOHJHV�FDQ�FRQQHFW�ZKHQ�WKH�GDWDEDVH�LV�FORVHG�• $XGLW�WUDLO�PXVW EH�VWRUHG�RXWVLGH�WKH�GDWDEDVH• 'LUHFWRU\�LV�GHWHUPLQHG�E\�DXGLWBILOHBGHVW• &RQQHFWLRQV DV�6<6'%$ RU�6<623(5 DUH�DOZD\V�
DXGLWHG�
• <RX�FDQ�HQDEOH�DGGLWLRQDO�DXGLWLQJ ZLWKDXGLWBV\VBRSHUDWLRQV
Copyright © 2009, Oracle. All rights reserved.8
6WHSV�WR�DXGLW�DOO�DFWLRQV�RI�V\V LQWR�D�ILOH�RZQHG�E\�URRW
64/!�DOWHU�V\VWHP�VHW�DXGLWBV\VBRSHUDWLRQV� WUXHVFRSH VSILOH�
64/!�DOWHU�V\VWHP�VHW�DXGLWBV\VORJBOHYHO �/2&$/��:$51,1* VFRSH VSILOH�
>URRW#XKHVVH�a@��FDW��HWF�V\VORJ�FRQI _�JUHS�ORFDO�ORFDO��ZDUQLQJ��YDU�ORJ�DXGLW�ORJ
>URRW#XKHVVH�a@���HWF�UF�G�LQLW�G�V\VORJ�UHVWDUW
Copyright © 2009, Oracle. All rights reserved.9
'HPRQVWUDWLRQ$XGLWLQJ�V\V����
Copyright © 2009, Oracle. All rights reserved.10
)LQH�*UDLQHG�$XGLWLQJ�
• $XGLWV�RQO\�LI�GHILQDEOH�FRQGLWLRQV�DUH�PHW
• 3RVVLEOH�IRU 6(/(&7 DQG�'0/
• &DQ�EH�OLQNHG�WR�D�WDEOH�RU�YLHZ��WR�RQH�RU�PRUH�FROXPQV
• ,PSOHPHQWHG ZLWK�WKH�'%06B)*$ SDFNDJH
HPSOR\HHV
3ROLF\��P\BSROLF\
6(/(&7�QDPH��VDODU\)520�HPSOR\HHV�
Copyright © 2009, Oracle. All rights reserved.11
)*$�3ROLF\�LQ�DFWLRQ�
%(*,1GEPVBIJD�DGGBSROLF\�REMHFWBVFKHPD� !���+5�REMHFWBQDPH� !�����(03/2<((6�SROLF\BQDPH� !�����P\BSROLF\�DXGLWBFROXPQ� !����VDODU\�VWDWHPHQWBW\SHV� !�6(/(&7�,16(57�83'$7(�'(/(7(��
(1'��
64/!�VHOHFW�ODVWBQDPH�HPDLO�IURP�HPSOR\HHV���� QR�DXGLW�HQWULHV�
64/!�VHOHFW�ODVWBQDPH�VDODU\ IURP�HPSOR\HHV���� DXGLWHG�64/!�XSGDWH�HPSOR\HHV�VHW�VDODU\ �VDODU\�������� DXGLWHG�
64/!�VHOHFW�GEBXVHU�RVBXVHU�VTOBWH[W�WLPHVWDPS�IURP�GEDBIJDBDXGLWBWUDLO ZKHUH�GEBXVHU µ+5¶�
Copyright © 2009, Oracle. All rights reserved.12
'HPRQVWUDWLRQ)LQH�*UDLQHG�$XGLWLQJ����
Copyright © 2009, Oracle. All rights reserved.13
$XGLWLQJ�&RQVLGHUDWLRQV
6RPH�WKLQJV�WR�EH�DZDUH�RI�
• $UH�\RX�LQ�OLQH�ZLWK�\RXU��QDWLRQDO��OHJDO�FRQGLWLRQV"• $XGLWLQJ�PD\�FRQVXPH�PXFK�VSDFH��HVSHFLDOO\
¾ ZLWK $8',7B75$,/� ������(;7(1'('
¾ ZLWK $8',7B6<6B23(5$7,216 �758(
• $�VWUDWHJ\�LV�QHHGHG�WR¾ DQDO\VH WKH�DXGLW�LQIRUPDWLRQ¾ UHPRYH ROG�DXGLW�LQIRUPDWLRQ
o IURP�V\V�DXG� �7UDGLWLRQDO�$XGLWLQJ�o IURP�ILOHV\VWHP��DXGLWLQJ�RI�V\V RU�$8',7B75$,/ 26�o IURP�V\V�IJDBORJ� �)LQH�*UDLQHG�$XGLWLQJ�
Copyright © 2009, Oracle. All rights reserved.14
7UDQVSDUHQW�'DWD�(QFU\SWLRQ��2YHUYLHZ
([WHUQDO6HFXULW\0RGXOH
:DOOHW1DPH 6DO &DUG $GGUHVV
-)9 ����� $���� 5RJQHV����� %��������� &��������� '��������� (��������� )����
&OHDU�GDWD &LSKHU�GDWD
1DPH 6DO &DUG $GGUHVV
-)9 ej^ �´ap> 5RJQHV@�� � ��"`�qC� `^_?o^#´�_` �^>_qC�� �^ `_B#`a^�>oA ³ð�q
$/7(5�7$%/(
0DVWHU�NH\
6(/(&7_,16(57_83'$7(_&5($7(�7$%/(
&ROXPQ�NH\V
Copyright © 2009, Oracle. All rights reserved.15
6WHSV�WR�VHWXS�7'(����
(1&5<37,21B:$//(7B/2&$7,21 �VRXUFH
�0(7+2' ),/(��0(7+2'B'$7$ �',5(&725< �X���DSS�RUDFOH�DGPLQ�RUFO�ZDOOHW�
��
$GG�WKH�IROORZLQJ�WR��25$&/(B+20(�QHWZRUN�DGPLQ�VTOQHW�RUD��
PNGLU��X���DSS�RUDFOH�DGPLQ�RUFO�ZDOOHW
&UHDWH�WKDW�GLUHFWRU\�DW�WKH�26�SURPSW�
64/!�DOWHU�V\VWHP�VHW�HQFU\SWLRQ�NH\�LGHQWLILHG�E\��RUDFOH��
6HW�WKH�7'(�PDVWHU�SDVVZRUG��LPSOLFWO\�FUHDWLQJ�WKH�ZDOOHW��
Copyright © 2009, Oracle. All rights reserved.16
����FRQWLQXHG�6WHSV�7'(
64/!�FUHDWH�WDEOHVSDFH�NU\SWR�GDWDILOH��X���DSS�RUDFOH�RUDGDWD�RUFO�NU\SWR���GEI�VL]H��P�HQFU\SWLRQ�GHIDXOW�VWRUDJH��HQFU\SW� �
64/!�FUHDWH�WDEOH�FLD�EJHQWV��LG�QXPEHU��FRYHUQDPH�YDUFKDU�������UHDOQDPH����YDUFKDU������HQFU\SW��
,Q���J�DOUHDG\��&UHDWH�WDEOHV�ZLWK�HQFU\SWHG�FROXPQV
,Q���J��&UHDWH�HQFU\SWHG�WDEOHVSDFHV�
Copyright © 2009, Oracle. All rights reserved.17
7'(�LQ�DFWLRQ���
64/!��VHOHFW� �IURP�FLD�EJHQWV�VHOHFW� �IURP�FLD�EJHQWV
(5525�DW�OLQH���25$��������ZDOOHW�LV�QRW�RSHQ
$WWDFNHU�KDV�VWROHQ�P\�ZKROH�GDWDEDVH�
$IWHU�VWDUWXS�RI�WKH�LQVWDQFH�
>RUDFOH#XKHVVH�RUFO@��VWULQJV�NU\SWR���GEI�_�JUHS�+HVVH
/HWµV�ORRN�LQWR�WKH�GDWDILOH�
,WµV�HQFU\SWHG��1R�UHDOQDPH�LV�H[SRVHG�����J�DQG���J�ZD\�HLWKHU�
Copyright © 2009, Oracle. All rights reserved.18
����FRQWLQXHG�7'(�LQ�DFWLRQ
64/!�VHOHFW�GEPVBURZLG�URZLGBUHODWLYHBIQR�URZLG�������GEPVBURZLG�URZLGBEORFNBQXPEHU�URZLG��IURP�FLD�EJHQWV�
64/!�DOWHU�V\VWHP�GXPS�GDWDILOH�[ EORFN�\�
:KDW�LI�ZH�GXPS�WKH�EORFNV"
64/!�DOWHU�V\VWHP�VHW�HQFU\SWLRQ�ZDOOHW�RSHQ LGHQWLILHG�E\��RUDFOH��
7KH�EORFN�GXPSV�LQ�XVHUBGXPSBGHVW GRQµW�H[SRVH�WKH�HQFU\SWHG�YDOXHV��2QO\�LI�ZH�VSHFLI\�WKH�FRUUHFW�SDVVZRUG�RI�WKH�RULJLQDO�ZDOOHW��WKH�HQFU\SWHG�FRQWHQW�LV�UHDGDEOH�
(YHQ�DIWHU�WKH�FUHDWLRQ�RI�D�QHZ�ZDOOHW��LW�ZRXOG�QRW�EH�SRVVLEOH�WR�UHDG�WKH�HQFU\SWHG�WDEOHV�
Copyright © 2009, Oracle. All rights reserved.19
'HPRQVWUDWLRQ7UDQVSDUHQW�'DWD�(QFU\SWLRQ����
Copyright © 2009, Oracle. All rights reserved.20
7'(�&RQVLGHUDWLRQV
• <RX�QHHG�D�EDFNXS�RI�WKH�ZDOOHW� ,W�FDQ¶W�EH�VLPSO\�UHFUHDWHG����
• 7'(�GRHV�QRW�SURWHFW�DJDLQVW�'%�XVHUV��WKDW�KDYH�DFFHVV�SULYLOHJHV�RQ�WKH�WDEOHV��7KDW�LV�H[DFWO\�WKH�PHDQLQJ�RI�³7UDQVSDUHQW´�KHUH�
Copyright © 2009, Oracle. All rights reserved.21
7KDQN�\RX�IRU�\RXU�DWWHQWLRQ�
*HW�WKHVH�VOLGHV��KWWS���XKHVVH�ZRUGSUHVV�GRZQORDGV