Five Thoughts on Oracle Security

pete Audit Trail Management, Configuration, Database STIG, DBA, Hardening and Patching, Limit Access to the Database, Security , , , , , , , , , , , , , , ,

Five different security related posts to which I have contributed on dba.stackexchange.com. I did not necessarily provide the accepted answer for these, but felt that the questions posed were interesting enough to warrant a mention.

Every Which Way But Loose

pete Configuration, Data Access Controls, DBA, PL/SQL, Security , , , , , , , , ,

Rather than a one-size fits all solution - trying to handle everything through a Virtual Private Database policy - a proper security plan involves the use of a variety of techniques, each with their own place in the model. #oracle #vpd #security #roles #plsql #privileges #constraints

How To Do It In Parallel

pete PL/SQL, Scheduler , , , , , ,

I just came across an interesting question on the Stack Exchange forum, where a user was asking how to execute a set of PL/SQL procedures in parallel with each other. There really isn't a construct in PL/SQL to accomplish this. That is not to say that it can't be done, however...

Top STIG – Part 6 (OS Accounts)

pete Configuration, Database STIG, DBA, Hardening and Patching, Linux, Security , , , , , ,

The final installment in my series on CAT I STIG controls is all about the use (or not) of the server operating system accounts that support the Oracle database. Two controls address the use of and access to the Oracle software installation account, and one addresses the privileges associated with individual user accounts for DBAs. … Continue reading Top STIG – Part 6 (OS Accounts)

Top STIG – Part 5 (Default Passwords)

pete Configuration, Database STIG, DBA, Limit Access to the Database, Networking, Passwords, Security , , , , , , , ,

One of the most common attack vectors for any hacker is checking to see if you have reset default passwords on service and administrator accounts. Almost every piece of hardware or software comes with some default way to login the first time, and a lot of people are really bad at changing those credentials to be more secure. Oracle databases and DBAs are no exception...

Top STIG – Part 3 (Software Support)

pete Configuration, Database STIG, DBA, Hardening and Patching, Security , , , , , ,

The next CAT I STIG control in this series is less technical and more about policy. Like all of the others, however, it requires the DBA to be aware of things beyond their immediate day to day workload, and involved in the planning, design, and development of the system technology stack...

Top STIG – Part 2 (Obscuring Credentials)

pete Configuration, Database STIG, DBA, Hardening and Patching, Security , , , , , , ,

Applications must obscure feedback of authentication information; when using command-line tools such as Oracle SQL*Plus, which can accept a plain-text password, users must use an alternative logon method that does not expose the password.

Well That’s Random…

pete DBA, Limit Access to the Database, Passwords, PL/SQL, Security , , , , , , ,

Increasingly we are asked to provide more secure passwords for accounts of all kinds. As I have written previously, because coming up with new ones that meet all complexity requirements can be a real pain, I try to avoid passwords whenever possible in favor of PKE authentication. Sometimes, however, they are unavoidable.

Oracle 12c Database STIG Breakdown

pete Audit Trail Management, Configuration, Data Access Controls, Database STIG, DBA, Hardening and Patching, Limit Access to the Database, Security, User Access Controls , , , , ,

This post contains a listing of all 199 Oracle 12c Database STIG controls from Release 16 (24 January 2020), organized by the five major categories of database security...

What the Cloud Can’t Do

pete Budget, Configuration, DBA , , ,

A lot of things are possible in the cloud, but not everything. A couple of technologies in particular that might seem common in on premise systems are nearly impossible to deploy in the cloud. The first is the idea of multiple networks. Many systems are deployed around the idea that there is a common, “public” … Continue reading What the Cloud Can’t Do

How To Complete a STIG Review

pete Database STIG, DBA, Hardening and Patching, Security , , ,

The simplest way to complete a DISA Secure Technical Implementation Guide (STIG) review is to start at the beginning of the checklist and work through it, one control item at a time. As you read each control, the information will be broken down into several distinct areas: metadata, content, and findings. Each control has metadata … Continue reading How To Complete a STIG Review

FIPS is a Four Letter Word

pete Configuration, Database STIG, DBA, Limit Access to the Database, Networking, Security, Uncategorized, User Access Controls , , , , , , ,

FIPS is a four letter word. It is also a source of some confusion when it comes to the Oracle database and DISA STIG compliance, which I will attempt to sort out to the best of my ability in this post.

code-obfuscation-toolkit

pete Database STIG, DBA, Hardening and Patching, PL/SQL, Security , , , , ,

The code-obfuscation-toolkit allows you to obfuscate the source code of a variety of stored programs, including procedures, functions, package bodies, and type bodies. When wrapping an object, to further obfuscate the original code in the event that it is ever unwrapped, all comments and line breaks can also be removed.

How to Limit a User Connection to a Specific IP Address

pete Configuration, DBA, Hardening and Patching, Limit Access to the Database, Networking, Security, Uncategorized, User Access Controls , , , ,

Seriously, I find all the best questions about Oracle security on forums like Oracle Communities and AskTom. Sometimes I need to be careful, though. I have a tendency to jump right to implementation details in my head without always considering all of the ramifications of the original question. Sometimes the answers seem immediately obvious, but it doesn't usually take long before someone offers an observation that makes me sit back and think that maybe my first instinct needs some qualification. Case in point...

AntiVirus for my Database Server?

pete Anti-Virus, Configuration, Database STIG, DBA, Hardening and Patching, Linux, Security , , , , ,

I've seen a couple of Oracle Community and AskTom posts over the last year or two about installing anti-virus software on Oracle database servers. Usually it is because someone in security told the sysadmin or the DBA that they had to install some kind of AV software because it was required. Been there; done that. I found out the hard way that doing so was a bad idea...

Understanding the AF/Oracle ESLA

pete Budget, Configuration, DBA , , , , , ,

A proper understanding of Oracle product licensing is essential to planning and controlling costs associated with system development and deployment. Taking into account that the cost and number of licenses you need may vary depending on the operating system you choose to use, the number of physical CPU sockets in your hardware, the number of users your system will support, or whether or not your servers are virtualized, and it doesn’t take much to get completely lost. If you don’t plan and implement carefully, an audit of database usage by Oracle (yes, they do that!) could wind up costing you hundreds of thousands of dollars or more in additional fees.