book

Oracle Database 12c Security Cookbook

Name: Oracle Database 12c Security Cookbook
ISBN: 9781782172123

by Maja Veselica & Zoran Pavlovic, Zoran Pavlovic, Maja Veselica

June 2016

Intermediate to advanced

388 pages

5h 49m

English

Packt Publishing

Read now

Unlock full access

Oracle Database 12c Security Cookbook
Oracle Database 12c Security Cookbook
Credits
About the Authors
About the Reviewers
www.PacktPub.com
eBooks, discount offers, and moreWhy subscribe?Instant updates on new Packt books
Preface
What this book covers
What you need for this book
Who this book is for
Sections
Getting readyHow to do it…How it works…There's more…See also

Conventions
Reader feedback
Customer support
Downloading the example code ErrataPiracyQuestions
1. Basic Database Security
Introduction
Creating a password profile
Getting readyHow to do it...How it works...There's more...See also
Creating password-authenticated users
Getting readyHow to do it...How it works...There's more...How to create a user using EM ExpressSee also
Changing a user's password
Getting readyHow to do it...How it works...There's more...See also
Creating a user with the same credentials on another database
Getting readyHow to do it...How it works...There's more...See also
Locking a user account
Getting readyHow to do it...How it works...See also
Expiring a user's password
Getting readyHow to do it...How it works...See also
Creating and using OS-authenticated users
Getting readyHow to do it...How it works...There's more...
Creating and using proxy users
Getting readyHow to do it...How it works...There's more...
Creating and using database roles
Getting readyHow to do it...How it works...There's more...See also
The sysbackup privilege – how, when, and why should you use it?
Getting readyHow to do it...Database authenticationOS authenticationHow it works...There's more...See also
The syskm privilege – how, when, and why should you use it?
Getting readyHow to do it...Database authenticationOS authenticationHow it works...There's more...See also
The sysdg privilege – how, when, and why should you use it?
Getting readyHow to do it...Database authenticationOS authenticationHow it works...There's more...See also
2. Security Considerations in Multitenant Environment
Introduction
Creating a common user
Getting readyHow to do it...How it works...Rules/guidelines for creating and managing common usersThere's more...How to create a common user using OEM 12c
Creating a local user
Getting readyHow to do it...How it works...Rules/guidelines for creating and managing local usersThere's more...How to create a local user using OEM 12c
Creating a common role
Getting readyHow to do it...How it works...There's more...How to create a common role using OEM 12c
Creating a local role
Getting readyHow to do it...How it works...There's more...How to create a local role using OEM 12c
Granting privileges and roles commonly
Getting readyHow to do it...How it works...
Granting privileges and roles locally
Getting readyHow to do it...How it works...
Effects of plugging/unplugging operations on users, roles, and privileges
Getting readyHow to do it...How it works...
3. PL/SQL Security
Introduction
Creating and using definer's rights procedures
Getting readyHow to do it...How it works...
Creating and using invoker's right procedures
Getting readyHow to do it...How it works...There's more...
Using code-based access control
Getting readyHow to do it...How it works...There's more...
Restricting access to program units by using accessible by
Getting readyHow to do it...How it works...
4. Virtual Private Database
Introduction
Creating different policy functions
Getting readyHow to do it...How it works...There's more...See also
Creating Oracle Virtual Private Database row-level policies
Getting readyHow to do it...There's more...See also
Creating column-level policies
Getting readyHow to do it...How it works...
Creating a driving context
Getting readyHow to do it...
Creating policy groups
Getting readyHow to do it...
Setting context as a driving context
Getting readyHow to do it...
Adding policy to a group
Getting readyHow to do it...
Exempting users from VPD policies
Getting readyHow to do it...
5. Data Redaction
Introduction
Creating a redaction policy when using full redaction
Getting readyHow to do it...How it works...There's more...How to change the default valueSee also
Creating a redaction policy when using partial redaction
How to do it...How it works...There's more...
Creating a redaction policy when using random redaction
Getting readyHow to do it...How it works...
Creating a redaction policy when using regular expression redaction
Getting readyHow to do it...How it works...
Using Oracle Enterprise Manager Cloud Control 12c to manage redaction policies
Getting readyHow to do it...
Changing the function parameters for a specified column
Getting readyHow to do it...
Add a column to the redaction policy
Getting readyHow to do it...How it works...See also
Enabling, disabling, and dropping redaction policy
Getting readyHow to do it...See also
Exempting users from data redaction policies
Getting readyHow to do it...How it works...
6. Transparent Sensitive Data Protection
Introduction
Creating a sensitive type
Getting readyHow to do it...How it works...There's more...
Determining sensitive columns
Getting readyHow to do it...How it works...
Creating transparent sensitive data protection policy
Getting readyHow to do it...How it works...See also
Associating transparent sensitive data protection policy with sensitive type
Getting readyHow to do it...There's more...See also
Enabling, disabling, and dropping policy
Getting readyHow to do it...How it works...There's more...
Altering transparent sensitive data protection policy
Getting readyHow to do it...How it works...See also
7. Privilege Analysis
Introduction
Creating database analysis policy
Getting readyHow to do it...How it works...There's more...See also
Creating role analysis policy
Getting readyHow to do it...There's more...See also
Creating context analysis policy
Getting readyHow to do it...There's more...See also
Creating combined analysis policy
Getting readyHow to do it...There's more...See also
Starting and stopping privilege analysis
Getting readyHow to do it...How it works...There's more...
Reporting on used system privileges
Getting readyHow to do it...There's more...
Reporting on used object privileges
Getting readyHow to do it...There's more...
Reporting on unused system privileges
Getting readyHow to do it...There's more...
Reporting on unused object privileges
Getting readyHow to do it...There's more...
How to revoke unused privileges
How to do it...There's more...
Dropping the analysis
Getting readyHow to do it...There's more...
8. Transparent Data Encryption
Introduction
Configuring keystore location in sqlnet.ora
How to do it...
Creating and opening the keystore
Getting readyHow to do it...How it works...There's more...
Setting master encryption key in software keystore
Getting readyHow to do it...There's more...See also
Column encryption - adding new encrypted column to table
Getting readyHow to do it...
Column encryption - creating new table that has encrypted column(s)
Getting readyHow to do it...
Using salt and MAC
Getting readyHow to do it...How it works...There's more...
Column encryption - encrypting existing column
Getting readyHow to do it...There's more...
Auto-login keystore
Getting readyHow to do it...How it works...
Encrypting tablespace
Getting readyHow to do it...How it works...There's more...
Rekeying
Getting readyHow to do it...How it works...
Backup and Recovery
How to do it...There's more...
9. Database Vault
Introduction
Registering Database Vault
Getting readyHow to do it...How it works...There's more...See also
Preventing users from exercising system privileges on schema objects
Getting readyHow to do it...There's more...See also
Securing roles
Getting readyHow to do it...There's more...See also
Preventing users from executing specific command on specific object
How to do it...How it works...
Creating a rule set
Getting readyHow to do it...There's more...
Creating a secure application role
How to do it...There's more...See also
Using Database Vault to implement that administrators cannot view data
How to do it...There's more...
Running Oracle Database Vault reports
How to do it...
Disabling Database Vault
How to do it...
Re-enabling Database Vault
How to do it...
10. Unified Auditing
Introduction
Enabling Unified Auditing mode
Getting readyHow to do it...How it works...Predefined unified audit policiesThere's more...See also
Configuring whether loss of audit data is acceptable
Getting readyHow to do it...How it works...
Which roles do you need to have to be able to create audit policies and to view audit data?
Getting readyHow to do it...How it works...There's more...
Auditing RMAN operations
Getting readyHow to do it...How it works...See also
Auditing Data Pump operations
Getting readyHow to do it...See also
Auditing Database Vault operations
Getting readyHow to do it...How it works...There's more...See also
Creating audit policies to audit privileges, actions and roles under specified conditions
Getting readyHow to do it...How it works...See also
Enabling audit policy
Getting readyHow to do it...How it works...
Finding information about audit policies and audited data
Getting readyHow to do it...
Auditing application contexts
Getting readyHow to do it...How it works...There's more...See also
Purging audit trail
Getting readyHow to do it...How it works...There's more...
Disabling and dropping audit policies
Getting readyHow to do it...How it works...See also
11. Additional Topics
Introduction
Exporting data using Oracle Data Pump in Oracle Database Vault environment
Getting readyHow to do it...How it works...There's more...See also
Creating factors in Oracle Database Vault
Getting readyHow to do it...How it works...There's more...See also
Using TDE in a multitenant environment
Getting readyHow to do it...How it works...See also
12. Appendix – Application Contexts
Introduction
Exploring and using built-in contexts
Getting readyHow to do it...How it works...There's more...See also
Creating an application context
Getting readyHow to do it...How it works...
Setting application context attributes
Getting readyHow to do it...How it works...There's more...See also
Using an application context
Getting readyHow to do it...How it works...See also

Content preview from Oracle Database 12c Security Cookbook

Rekeying

You can change (rekey) a master key and table keys. You cannot rekey tablespace keys.

Getting ready

It is assumed that a keystore is opened and a master key is created.

How to do it...

Connect to the database as a user who has administer key privilege or SYSKM privilege (for example, maja):
```
$ sqlplus maja
```
To rekey a table (for example, the oe.customer) using a different encryption algorithm (for example, AES128), execute the following statement:
Figure 24 - Rekeying a table key
Change a master key by executing the following statement (in our example, keystore_password is welcome1):
```
SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY keystore_password ...
```

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781782172123

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design