book

Applied Oracle Security: Developing Secure Database and Middleware Environments

by David Knox, Scott Gaetjen, Hamza Jahangir, Tyler Muth, Patrick Sack, Richard Wark, Bryan Wise

November 2009

Intermediate to advanced

640 pages

19h 45m

English

McGraw Hill Computing

Read now

Unlock full access

Cover Page
Applied Oracle Security
Copyright Page
Dedication
About the Authors
Contents
Foreword
Acknowledgments
PART I Oracle Database Security New Features
1 Security Blueprints and New Thinking
About This BookBackground InformationOrganizationDatabase Security TodayEvolving TechnologiesSecurity MotivatorsSensitive Data CategorizationPrinciplesModeling Secure SchemasSchema ProfilesObject Owner AccountsUser Access AccountsGetting StartedUser ProfilesSchema NamingSecurity Architecture ChecklistSummary

2 Transparent Data Encryption
Encryption 101Goal of EncryptionThe BasicsEncryption ChoicesThe Algorithm and the KeyEncrypting Data Stored in the DatabaseWhere the Data “Sleeps”Protecting the DataViewing the DataApplied ExampleEncrypting in the DatabaseThe Transparent Data Encryption SolutionTDE as Part of the Advanced Security OptionTDE Setup: Oracle 10gThe Oracle WalletTDE’s Key ManagementCreating an Encrypted Column in a New TableViewing Encrypted ColumnsEncrypting an Existing ColumnTDE CaveatsTablespace Encryption: New with Oracle 11gOracle 11g ConfigurationTDE to Address PCI-DSSOperational ConcernsExporting and Importing Encrypted DataIntegration with Hardware Security ModulesSummary
3 Applied Auditing and Audit Vault
An Era of GovernanceAuditing for Nonsecurity ReasonsThe Audit Data WarehouseAudit Warehouse ObjectivesWhat to Audit and When to AuditGuiding PrinciplesAudit PatternsOther Audit Action Best PracticesThe Audit Warehouse Becomes the Audit VaultAudit Vault ArchitectureInstallation OptionsInstalling Audit Vault ServerInstalling Audit Vault Collection AgentInstallation CaveatsReportingAlertsManaging Audit Policy for Source DatabasesAudit Maintenance OperationsSummary
PART II Oracle Database Vault
4 Database Vault Introduction
The Security GapHistory of Privileged AccountsThe Security RemedySecurity Should-havesDatabase Vault ComponentsFactorsRulesRealmsCommand RulesInstalling Oracle Database VaultInstalled DBV Administration RolesManaging Oracle DBV ConfigurationDefault Separation of DutyDefault Audit PolicyDefault Security-relevant DBV FactorsSummary: Database Vault Is Differentiating Security
5 Database Vault Fundamentals
RealmsRealm Protection PatternsCreating Your First RealmRealm ComponentsCommand RulesCommand Rule ComponentsCommands Supported in Command RulesDBV CONNECT Command RuleRule SetsRule Set Evaluation ModeRule Set AuditingCustom Event HandlersRule ConfigurationDBV Rule Set Event FunctionsDBV Factors Used in Rule Set ExpressionsFactorsCreating FactorsFactor IdentitiesDBV Factor Integration with OLSDBV Secure Application RolesSummary
6 Applied Database Vault for Custom Applications
Notional Database Applications EnvironmentFrom Requirements to Security Profile DesignRequirements Technique: Use Cases and ScenariosAnalyzing Requirements: Example Use CaseIdentify Coarse-Grained Security ProfileIdentify Fine-Grained Security ProfileIdentify DBV Factors Based on Business or System ConditionsCentralizing PL/SQL Routines for DBV Factors and RulesFactors Based on ComplianceFactors Based on Conflict of Interest or Separation of DutyFactors Based on Organizational PolicyFactors Based on Identity ManagementFactors Based on Access Path or Operational ContextFactors Based on Time or Sequential ConditionsFactors Based on Data or Events Stored ExternallyIncorporating DBV Factors in Your ApplicationIdentify DBV Realms and Realm Objects Based on ObjectsConfigure Standard Object-level Auditing for Realm-protected ObjectsConfigure RLS on Realm-protected ObjectsIdentify Accounts, Roles, and DBV Realm Authorizations from Use Case ActorsSecure Schemas Under DBVUser Access AccountsExample Implementation of Secure Schemas with DBVPost-configuration Account ProvisioningEstablish DBV Command Rules from ConditionsConfigure System-level AuditingEstablish DBV Secure Application Roles from ConditionsSummary
7 Applied Database Vault for Existing Applications
Audit Capture PreparationCapturing AuditsAnalyzing the Audit TrailDBV Realms from Object-Owner AccountsDBV Realm Secured ObjectsDBV Realm AuthorizationsIdentify End User Access Accounts and Roles for DBV SARsIdentifying DBV Command Rules from ConditionsIdentifying DBV Factors Based on Business or System ConditionsRefining the DBV Policy DesignDeploying and Validating the DBV PolicyIntegrating DBV with Oracle Database FeaturesOracle TextOracle SpatialExpression FiltersOracle Streams Advanced QueuingTransparent Data EncryptionOracle Recovery ManagerGathering Statistics on Realm-protected SchemasEXPLAIN PLAN on Realm-protected SchemasAdvanced Monitoring and Alerting with a DBV DatabaseMonitoring and Alerting on DBV with OEM GCExtending the DBV Rule Set Custom Event HandlerSummary
PART III Identity Management
8 Architecting Identity Management
Understanding the Problem with Identity ManagementCentral Issuance AuthorityIdentity VerificationIdentity PropagationArchitecting Identity ManagementIdentity Management DiscoveryIdentity Management PatternsOracle Identity Management SolutionsUser ProvisioningDirectory ManagementAuthentication ManagementAuthorization ManagementRole Mining and ManagementSummary
9 Oracle Identity Manager
The User Provisioning ChallengeOracle Identity Manager OverviewUserUser GroupOrganizationAccess PolicyResource ObjectIT ResourceUser Provisioning ProcessesDiscretionary Account ProvisioningSelf-Service ProvisioningWorkflow-based ProvisioningAccess Policy–driven ProvisioningUser Provisioning IntegrationsPrebuilt ConnectorsGeneric Technology ConnectorReconciliation IntegrationsCompliance SolutionsAttestationAccess ReportingOIM DeploymentSummary
10 Oracle Directory Services
Identity Management and the LDAP DirectoryOracle Internet DirectoryOID ArchitectureOID SynchronizationsDirectory Virtualization and Oracle Virtual DirectoryOVD 101OVD ArchitectureOVD AppliedOVD InstallationCreating a New OVD ServerInitializing the Virtual LDAP Tree Using a Local Store AdapterIntegrating OVD with an Active Directory LDAP ServerIntegrating OVD with an Oracle DatabaseJoining Information in OVDSummary
PART IV Applied Security for Oracle APEX and Oracle Business Intelligence
11 Web-centric Security in APEX
Introduction to the APEX EnvironmentComponents and ConfigurationsArchitectureAPEX and Database RolesAPEX SessionsSecuring an APEX InstanceAPEX Security SettingsSecuring the Application Server TierPrevent Web-based Attacks with mod_securitySSL/TLS TechniquesProtecting the APEX Database SchemasDatabase Vault and APEXSummary
12 Secure Coding Practices in APEX
Authentication and AuthorizationAuthentication SchemesCustom Table of Usernames and PasswordsAuthorization SchemesSQL InjectionExample 1: The Wrong WayExample 2: The Right WayCross-site ScriptingURL TamperingLeveraging Database Security FeaturesVirtual Private DatabaseFine-grained AuditingSummary
13 Securing Access to Oracle BI
The Challenge in Securing BISystem UsersSecurity in the Warehouse vs. the Transactional SystemWhat Needs To Be SecuredMechanics of Accessing Data with Oracle BIArchitectureConnection PoolsVariablesAuthentication and AuthorizationAuthentication OptionsAuthorizationSingle Sign-OnSSO OptionsSSO Setup CautionsSSO Using Oracle Access ManagerDeploying in a Secure EnvironmentSSL EverywhereEncrypted Outward ConnectionsSecuring the BI CachePublic-facing ApplicationsFirewalls and DMZsPublic UserSummary
14 Securing Oracle BI Content and Data
Securing Web Catalog ContentWeb Catalog GroupsFolder-based SecurityiBot SecuritySecuring BI Publisher Catalog ContentConveying Identity to the DatabaseSetting Client IdentifiersSecuring Data Presented by Oracle BISecurity Policies Within the BI ServerIntegrating Oracle BI with Database Security PoliciesDeciding When to Use VPD or Oracle BI Row-level SecurityOracle BI and Database VaultFactors and Oracle BIRealms and Oracle BIAuditingUsage TrackingDatabase AuditingCombining Usage Tracking and Database AuditingBI Features with Security ImplicationsDefault PrivilegesAct as ProxyDirect Database RequestsAdvanced TabDirect Access to the BI ServerWeb Services AccessSummary
A Using the Oracle BI Examples
Users and GroupsDatabase PreparationsDatabase AuditingDatabase ScriptsOracle BI SetupCredential StoreBI Publisher SuperuserOther BI Publisher Configuration StepsSample BI Publisher ReportScheduler ConfigurationUsage TrackingRecommend TestingOracle BI TestsBI Publisher TestsOracle Delivers TestsSample Web Catalog DescriptionSH DashboardUtilities DashboardOther DashboardsSample RPD DescriptionsCommon to All RPDsInternal AuthenticationInternal Authentication with Act as Proxy EnabledColumn-based SecurityTable-based AuthenticationDatabase AuthenticationLDAP AuthenticationSSO IntegrationSummary
Index

Content preview from Applied Oracle Security: Developing Secure Database and Middleware Environments

CHAPTER 5Database Vault Fundamentals

This chapter presents a collection of examples that demonstrate the fundamentals behind how DBV components are configured using the DBMS_MACADM API. The examples are built around the Sales History (SH) object-owner account included with Oracle Database’s sample schemas. These examples cover the following component configurations and demonstrate how these components’ configurations impact sessions trying to access objects owned by the SH accounts:

Realms Provide boundaries around the use of system ANY privileges that administrators typically have been granted. Realms examples demonstrate how you can meet your ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Learning Oracle 11g - Real Application Clusters

Publisher Resources

ISBN: 9780071613705

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills