book

Oracle Database 12c Security

by Scott Gaetjen, David Knox, William Maroulis

January 2015

Intermediate to advanced

552 pages

16h 27m

English

McGraw Hill Computing

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
About the Author
Contents
Foreword
Acknowledgments
Introduction
Part I: Essential Database Security

Chapter 1: Security for Today’s World
The Security LandscapeBase AssumptionsDatabase Security TodayEvolving Security TechnologiesSecurity MotivatorsSensitive Data CategorizationPrinciplesSummary
Chapter 2: Essential Elements of User Security
Understanding Identification and AuthenticationIdentification MethodsAuthenticationUnderstanding Database Account TypesDatabase Account Types in Oracle Database 12c Multitenant ArchitecturePrivileged Database Account Management in Oracle Database 12cAdministrative Privileges for Separation of DutyMethods for Privileged Database Account ManagementAccount Management in Multitenant Oracle Database 12cCreating Common Database AccountsManaging Accounts in a Pluggable DatabaseManaging Database Account Passwords and ProfilesManaging Passwords for Local Database AccountsManaging Database Account ProfilesSummary
Chapter 3: Connection Pools and Enterprise Users
External Identification and Authentication ChallengesConnection ChallengesPerformanceConnection PoolsSecurity RisksExternal Identification and Authentication in Oracle Database 12cOracle Proxy AuthenticationOracle Enterprise User SecurityOracle Kerberos AuthenticationOracle RADIUS AuthenticationSummary
Chapter 4: Foundational Elements for a Secure Database
Access Control, Authorization, and PrivilegeAccess ControlAuthorizationPrivilegeObject PrivilegesColumn PrivilegesSynonymsSystem and Object Privileges TogetherPrivilege Conveyance and RetractionRolesRole and Privilege ImmediacyRoles and Container DatabasesPublic and Default Database RolesRole HierarchiesObject Privileges Through Roles and PL/SQLSelective Privilege EnablementSelective Privilege Use CasesPassword-Protected RolesPassword-Protected Role ExamplePassword-Protected Roles and Proxy AuthenticationChallenges to Securing the PasswordSecure Application RolesSecure Application Role ExampleGlobal Roles and Enterprise RolesCreating and Assigning Global and Enterprise RolesCombining Standard and Global RolesUsing Roles WiselyToo Many RolesNamingDependenciesSummary
Chapter 5: Foundational Elements of Database Application Security
Application ContextDefault Application Context (USERENV)Auditing with USERENVDatabase Session-Based Application ContextCreating a Database Session-Based Application ContextSetting Context Attributes and ValuesApplying the Application Context to SecuritySecure UseCommon MistakesGlobal Application ContextGAC UsesGAC ExampleGlobal Context Memory UsageExternal and Initialized GloballyUsing Views in SecurityViews for Column- and Cell-Level SecurityViews for Row-Level SecurityDefiner’s vs. Invoker’s Privileges/Rights for PL/SQLDefiner’s Rights Invocation on PL/SQL ProgramsInvoker’s Rights Invocation for PL/SQLDefiner’s vs. Invoker’s Privileges/Rights on Java Stored ProceduresJava Stored Procedure and Definer’s RightsJava Stored Procedure and Invoker’s RightsCode-Based SecurityGranting Roles and Privileges to PL/SQLEntitlement AnalyticsProfile Application UsePrivilege ReductionOracle Enterprise Manager Cloud Control (OEMCC) 12cSharing Application CodeManaging Common Application Code with Pluggable DatabasesManaging Common Application Code with Database LinksSummary
Chapter 6: Real Application Security
Account Management in Oracle RASConfiguring DLAU AccountsConfiguring Simple Application User AccountsOracle RAS RolesIntegration of Standard Database Roles with Oracle RAS RolesRole Management Procedures in Package XS_PRINCIPALOut-of-the-Box Roles in Oracle RASLightweight Sessions in Oracle RASSetting Privileges for Direct Login Application User AccountsLightweight Session Management in JavaNamespaces in Oracle RASServer-Side Event Handling and Namespaces in Oracle RASSession Performance in Oracle RASPrivilege Management and Data Security in Oracle RASSecurity Classes, Application Privileges, and ACLsData Security PoliciesProtecting Namespaces with ACLsAuditing in Oracle RASDefault Audit Policies for Oracle RASReporting on Audit Events and Audit Policies in RASValidating Policies and Tracing in Oracle RASValidating Policy ComponentsTracing Sessions and Data Security PoliciesSummary
Part II: Advanced Database Security
Chapter 7: Controlled Data Access with Virtual Private Database
Introduction to Virtual Private DatabaseHow VPD WorksBenefitsVPD ComponentsTypes of ControlHow to Use VPDWhich Type of VPD Is Right for Me?Row-Level SecurityTable Fire with Row FilterColumn Fire with Row FilterVPD and INSERT StatementsVPD and INDEX StatementsColumn-Level SecurityColumn Fire with Column FilterVPD ExemptionsAudit EXEMPT ACCESS POLICY PrivilegeVerify EXEMPT ACCESS POLICY PrivilegeVerify Audit TrailDebugging and Troubleshooting VPD PoliciesInvalid Policy FunctionsVerifying and Validating PredicatesVPD PerformanceApplication Context and Logon TriggerBind VariablesVPD CachingSummary
Chapter 8: Essential Elements of Sensitive Data Control
Sensitive Data Protection ChallengesOracle Database 12c Transparent Sensitive Data ProtectionDiscover Sensitive Information with Enterprise ManagerConfiguring a TSDP AdministratorDefining Sensitive Information TypesMapping Sensitive Information Types to ColumnsCreating Sensitive Information PoliciesMapping Sensitive Information Policies to Sensitive TypesEnabling Sensitive Information RedactionRedacting Sensitive Information in the Database Audit TrailSummary
Chapter 9: Access Controls with Oracle Label Security
About Oracle Label SecurityHistoryOLS Functional OverviewOLS vs. VPDLabel-Based Access ControlOLS Label TypesOLS InstallationInstalling OLSRegister and Enable OLS in the Root ContainerRegister and Enable OLS in a Pluggable DatabaseAdministering OLSOLS Role LBAC_DBAOLS ExampleCreate a PolicyCreate Label ComponentsCreate OLS LabelsApply OLS Policy to a TableAuthorize OLS AccessInsert Data Using OLS FunctionsQuerying Data from an OLS Protected TableOLS and the Connection PoolAuditing OLS Privileges and UseTrusted Stored ProceduresIntegrating OLS and Oracle Internet DirectoryPerformance with OLSSummary
Chapter 10: Oracle Database Vault: Securing for the Compliance Regulations, Cybersecurity, and Insider Threats
History of Privileged AccountsSYS as SYSDBA (Super User 0)Security Should HavesMultifactored SecurityConditional SecurityDBV ComponentsFactorsRulesRealmsCommand RulesDBV Secure Application RolesConfiguring and Enabling DBVDBV Administration Using Common AccountsDBV Administration Using Delegated AccountsManually Configuring DBV in a PDBManaging DBV ConfigurationDBV Administration PL/SQL Package and Configuration ViewsDBV Security Policies in ActionInstalled DBV RolesSoD with Roles, Realms, and Command RulesDefault Audit PoliciesGeneral Database Maintenance and Operations AuthorizationsCreating Custom DBV PoliciesSummary
Chapter 11: Oracle Transparent Data Encryption: Securing for the Compliance Regulations, Cybersecurity, and Insider Threats
Encryption 101Goal of EncryptionThe BasicsEncryption ChoicesThe Algorithm and the KeyEncrypting Data Stored in the DatabaseWhere the Data “Rests”Protecting the DataApplied ExampleEncrypting in the DatabaseThe Transparent Data Encryption SolutionKey Management FacilitiesKey Management RolesCreating Keystores and a Master Key in the Root ContainerCreating Master Keys in Pluggable DatabasesCreating an Encrypted Column in a New TableDetermining TDE Encrypted ColumnsEncrypting an Existing ColumnCaveats to Column-Level TDETablespace EncryptionTDE and Oracle Database Tools InteroperabilityPerformanceAdvanced Encryption Protection SupportConfiguring FIPS 140-2 SupportSummary
Part III: Security and Auditing for the Cloud
Chapter 12: Audit for Accountability
The Security CycleAuditing for AccountabilityAuditing Provides the Feedback LoopAuditing Is Not OverheadAudit MethodsInfrastructure and Application Server LogsApplication AuditingTrigger AuditingDatabase AuditingEnabling Auditing in the DatabaseAudit Destination for Standard Auditing and FGAEnable Oracle Unified Auditing in Oracle Database 12cWho Conducts the Audit Policy and Audit Reporting?Audit Administrator RoleAudit Reporting RoleWhat Should be Audited? Creating the Audit PolicyBest Practices for Audit PolicesOUA Audit Policy ConfigurationTraditional Audit Policy ConfigurationFine-Grained AuditingEnabling FGAActing on the AuditAudit Storage, Audit Retention, and ReportingOracle Audit VaultAudit Trail Retention Under OUAAudit Trail Retention Under Traditional AuditingReporting on Database HistorySummary
Chapter 13: An Applied Approach to Multitenancy and Cloud Security
System Baseline and ConfigurationFacility and Infrastructure SecurityPersonnel SecurityConfiguration ManagementEquipmentSecure VirtualizationOperating SystemJobs, Users, Groups/Roles, and PrivilegesOracle Database 12c Multitenancy and Cloud ComputingCloud ComputingOracle 12c Software InstallationSecurity-Related Installation Prerequisites and Installation OptionsChoosing the Number of Oracle HomesSecuring the Oracle HomeAre You Still Secure?Securing the ListenerManaging PasswordsSecure Database Initialization ParametersInstalling and Securing Your ApplicationSensitive Data DiscoveryAccount ManagementPrivilege ManagementLeast PrivilegeData Access ControlsProtecting Your Company Intellectual PropertyDatabase FirewallData EncryptionNetwork Data Encryption and IntegrityEncryption of Data at RestEncryption of Backup DataAuditingOracle AuditingOracle Audit VaultAudit Life Cycle ManagementLocking Down Your SystemStandards for LockdownSecure PatchingMonitoring and AlertingMonitoring Audit EventsSystem Monitoring Using OEMCCAvailability, Backup and Recovery, and Continuity of OperationsAvailabilityBackup and RecoverySummary
Appendix: Sample Preparation Scripts
Sample Pluggable DatabasesSALES Pluggable DatabaseHuman Resources (HR) Pluggable DatabaseSample Security Manager Account CreationRoot ContainerPluggable Databases
Index

Content preview from Oracle Database 12c Security

images

CHAPTER9

Access Controls with Oracle Label Security

Oracle Label Security (OLS) controls row-level access to data in a protected table. The foundation of OLS is Virtual Private Database (VPD), implemented using the row-level security package DBMS_RLS. OLS is another example of table fire with row filter (TFRF) as we saw with VPD in Chapter 7 and RAS in Chapter 4.

About Oracle Label Security

OLS is uniquely different from VPD and RAS because OLS offers a declarative policy with constructs for its components. OLS does not require the deep technical programming know-how that RAS and VPD require. Also, VPD, RAS, and OLS can be used as separate security ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780071824286

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Oracle Database 12c Security

by Scott Gaetjen, David Knox, William Maroulis

CHAPTER9