Effective Oracle Database 10g Security by Design

Effective Oracle Database 10g Security by Design

by David Knox
Released July 2004
Publisher(s): McGraw Hill Computing
ISBN: 9780071770460

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Oracle security expert David Knox explains how to design and develop an integrated, secure Oracle environment. “In my experience in the security world, including 32 years at the Central Intelligence Agency, I’ve not found anyone with more experience in the theory and practice of protecting your data than David Knox.” --Dave Carey, former Executive Director of the CIA

Table of contents

  1. Cover Page
  2. Effective Oracle Database 10g Security by Design
  3. Copyright Page
  4. Contents
  5. Foreword
  6. Acknowledgments
  7. Introduction
  8. PART I Quick Start
    1. 1 General Security Best Practices
      1. Security Policies
        1. Different Policies for Different Needs
        2. Understanding Security Requirements
        3. Policy Creation
        4. Practical Policies
      2. The Tenets of Security
        1. Security by Design
        2. Defense in Depth
        3. Least Privileges
      3. Risk Analysis
        1. Document Your Risk Analysis
        2. Expect the Unexpected
        3. Contingency Planning and Incident Response
      4. Snapshots and Situational Awareness
        1. Cover All the Areas
      5. Hardening the Infrastructure
        1. The Operating System
        2. The Network
        3. The Application Server
    2. 2 Securing the Database
      1. Securing (Default) User Accounts
        1. Lock Down Example
        2. Throw Out Anything Stale
      2. Oracle Passwords
        1. Application Password Authentication Using Oracle's Native Password Store
        2. Checking for Weak or Default Passwords
        3. Impossible Passwords
        4. Managing and Ensuring Good Passwords
      3. Limiting Database Resources
        1. Resource Limits
      4. Default Roles
        1. CONNECT
        2. RESOURCE
        3. DBA
      5. PUBLIC Privileges
        1. When to Grant Privileges to PUBLIC
        2. Oracle Supplied Objects
      6. Securing the Network
        1. Encryption
        2. Database Listener
  9. PART II Identification and Authentication
    1. 3 Understanding Identification and Authentication
      1. Importance of Identification and Authentication
      2. Identification Methods
        1. User-Supplied Identification
        2. Technological Identification
      3. Identity Crisis
        1. Spoofing
        2. Identity Theft
      4. Authentication
        1. Methods
        2. Best Practices for Secure Authentication
      5. Single Sign-On
        1. Why Single Sign-On Exists
        2. Challenges to Single Sign-On
      6. Database I&A
        1. Associating Users with Database Schemas
        2. Separate Users and Data
        3. Identity Preservation
        4. Determining the Appropriate Level of I&A
    2. 4 Connection Pools and Proxy Authentication
      1. Heritage
        1. Host-Based Identification and Authentication
        2. Client-Server Identification and Authentication
      2. Web Applications
        1. The Stateless Environment
        2. Web Databases
      3. Connection Pools
        1. Oracle Implicit Connection Cache
        2. Security Risks
      4. Session Pools and the Oracle OCI Connection Pool
        1. OCI Connection Pool Example
        2. Password Management Risk
      5. Proxy Authentication
        1. Proxy Example
        2. Proxy Authentication Database Setup
        3. Proxy Authentication Modes
        4. Forcing Proxy Authentication
    3. 5 Identity Management and Enterprise Users
      1. Identity Management
        1. Directory Services
        2. IM Components
        3. Oracle Internet Directory (OiD)
      2. Enterprise Users
        1. History
      3. Setting Up EUS
        1. LDAP Setup
        2. Database Setup
      4. Applying EUS
        1. Creating the Enterprise User
        2. The Connection Process
      5. User-Schema Mappings
        1. Creating the Shared Schemas
        2. Directory Mappings
        3. Mapping Permutations Example
        4. Exclusive Schemas
      6. Considerations
        1. Single Credentials and Performance
        2. Dependencies
    4. 6 Identification and Authentication for Web Applications
      1. Application Processes for Identification and Authentication
      2. Integrated Authentication
        1. Creating the Application User
        2. Connecting the Application User to the Database
        3. Getting the User Identity
        4. Database Account Setup
        5. User Database Account(s)
        6. Authentication Blueprint
        7. Performance
      3. Proxy Authentication Alternatives
        1. Application Directed Security
        2. Application User Proxy—Client Identifiers
        3. Leveraging Database Security with Anonymous Connection Pools
      4. Identifying Information
  10. PART III Authorizations and Auditing
    1. 7 Privileges and Roles
      1. Access Control, Authorizations, and Privileges
        1. Access Control
        2. Enforcing Access Control
        3. Authorizations
      2. Privileges
        1. System Privileges
        2. Object Privileges
        3. Synonyms
        4. System and Object Privileges Together
        5. Privilege Persistence
      3. Roles
        1. Role Hierarchies
        2. Designing for Definer and Invoker Rights
      4. Selective Privilege Enablement
        1. Selective Privilege Use Cases
      5. Password-Protected Roles
        1. Password-Protected Role Example
        2. Password-Protected Roles and Proxy Authentication
        3. Challenges to Securing the Password
      6. Secure Application Roles
        1. Secure Application Role Example
      7. Global Roles and Enterprise Roles
        1. Creating and Assigning Global and Enterprise Roles
        2. Combining Standard and Global/Enterprise Roles
      8. Using Roles Wisely
        1. Too Many Roles
        2. Naming
        3. Dependencies
      9. Example—Putting the Pieces Together
        1. Application Authentication
        2. Verifying the User
        3. Setting the Secure Application Role
        4. Securing the Source
    2. 8 Effective Auditing for Accountability
      1. The Security Cycle
        1. Auditing for Accountability
        2. Auditing Provides the Feedback Loop
        3. Auditing Is Not Overhead
      2. Audit Methods
        1. Application Server Logs
        2. Application Auditing
        3. Application Audit Example
        4. Trigger Auditing
        5. Trigger Audit Example
        6. Autonomous Transactions and Auditing
      3. Data Versioning
        1. Flashback Version Query
        2. Flashback Transaction Query
      4. Standard Database Auditing
        1. Mandatory Auditing
        2. Auditing SYS
        3. Enabling Standard Auditing
        4. Auditing By User, Privilege, and Object
        5. Auditing Best Practices
        6. Determining the Audit Status
        7. Extending the Audit Data with Client Identifiers
        8. Peformance Test
        9. Caveats
      5. Fine-Grained Auditing
        1. Audit Conditions
        2. Column Sensitivity
        3. Capturing SQL
        4. Acting on the Audit
        5. Caveats
  11. PART IV Fine-Grained Access Control
    1. 9 Application Contexts for Security and Performance
      1. Application Context
      2. Default USERENV Context
      3. Local Context
        1. Creating an Application Context
        2. Setting Context Attributes and Values
        3. Applying the Application Context to Security
        4. Secure Use
        5. Common Mistakes
      4. Global Context
        1. Uses
        2. Examples
      5. External and Initialized Globally
    2. 10 Implementing Fine-Grained Access Controls with Views
      1. Introduction to Fine-Grained Access
        1. Object Access
        2. Fine-Grained Access
      2. Secure Views
        1. Views for Column-Level Security
        2. Views for Row-Level Security
        3. Viewing Problems
    3. 11 Row-Level Security with Virtual Private Database
      1. The Need for Virtual Private Databases
      2. Row-Level Security Quick Start
        1. Quick Start Example
      3. RLS In-Depth
        1. Benefits
        2. Setup
        3. The RLS Layer of Security
        4. RLS Exemption
        5. Debugging RLS Policies
        6. Partitioned Fine-Grained Access Control
      4. Column Sensitive VPD
      5. VPD Performance
        1. Bind Variables
        2. Code Location
        3. Policy Caching
        4. Caching Caution
        5. Comparing VPD Performance to View-Based RLS
    4. 12 Oracle Label Security
      1. Classifying Data
      2. OLS Ancestry
        1. Labels and Mandatory Access Control
        2. Trusted Oracle
      3. Oracle Label Security
        1. How OLS Works
        2. Installing OLS
        3. Implementing Label Security
      4. Label Example
        1. Creating the Policy
      5. Label Components
        1. Levels
        2. Creating Labels
        3. Applying the Policy
        4. Authorizing Access
        5. Testing the Labels
        6. Special OLS Privileges
        7. Compartments
        8. Adding Data to OLS Protected Tables
        9. Groups
        10. Using the Default Session Label
        11. Comparing the Labels
      6. Hiding the Label
        1. Changing the Hidden Status
      7. Writing to OLS Protected Tables
        1. Understanding Write Authorizations
        2. Groups and Compartments Dependency
      8. Tips and Tricks
        1. Restricted Updates to the Labels
        2. Trusted Procedures
        3. Label Functions
        4. Storing the Labels in OID
        5. Using Labels with Connection Pools and Shared Schemas
      9. OLS Consideration Factors
      10. VPD Versus Label Security
        1. Advantages of OLS
        2. Advantages of VPD
        3. VPD and OLS
    5. 13 Database Encryption
      1. Encryption 101
        1. The Basics
        2. Encryption Choices
      2. When to Use Database Encryption
        1. Reasons Not to Encrypt
        2. Reasons to Encrypt
      3. DBMS_CRYPTO
        1. Encryption Routines
        2. DBMS_CRYPTO Simple Example
        3. DATA_CRYPTO Package
      4. Encryption Examples
        1. Encrypting Character, Numbers, and Dates
        2. Encrypting CLOBs and BLOBs
      5. Encryption In-Depth
        1. Keys, Data, and IVs
        2. Storing Encrypted Data
        3. Encrypted Data Sizes
      6. Hashing
        1. DBMS_CRYPTO Hashing
        2. Message Authentication Codes
      7. Performance
      8. Key Management
        1. Key Management Options
        2. The Best Key Management Strategy
  12. PART V Appendixes
    1. A Setting Up the Security Manager
    2. B DATA_CRYPTO Package
    3. C DBMS_CRYPTO Performance Test Results
  13. Index

Product information

  • Title: Effective Oracle Database 10g Security by Design
  • Author(s): David Knox
  • Release date: July 2004
  • Publisher(s): McGraw Hill Computing
  • ISBN: 9780071770460