1 Introduction Oracle Database Security

About Oracle Database Security

You can use the default Oracle Database features to configure security in several areas for your Oracle Database installation.

• User accounts. When you create user accounts, you can secure them in a variety of ways. You can also create password profiles to better secure password policies for your site. Chapter 2, "Managing Security for Oracle Database Users," describes how to manage user accounts.

• Authentication methods. Oracle Database provides several ways to configure authentication for users and database administrators. For example, you can authenticate users on the database level, from the operating system, and on the network. Chapter 3, "Configuring Authentication," describes how authentication in Oracle Database works.

• Privileges and roles. You can use privileges and roles to restrict user access to data. The following chapters describe how to manage privileges and roles:

  • Chapter 4, "Configuring Privilege and Role Authorization"

  • Chapter 5, "Managing Security for Definer's Rights and Invoker's Rights"

  • Chapter 6, "Managing Fine-Grained Access in PL/SQL Packages and Types"

  • Chapter 7, "Managing Security for a Multitenant Environment in Enterprise Manager"

• Application security. The first step to creating a database application is to ensure that it is properly secure. Chapter 8, "Managing Security for Application Developers," discusses how to incorporate application security into your application security policies.

• User session information using application context. An application context is a name-value pair that holds the session information. You can retrieve session information about a user, such as the user name or terminal, and restrict database and application access for that user based on this information. Chapter 9, "Using Application Contexts to Retrieve User Information," describes how to use application contexts.

• Database access on the row and column level using Virtual Private Database. A Virtual Private Database policy dynamically imbeds a WHERE predicate into SQL statements the user issues. Chapter 10, "Using Oracle Virtual Private Database to Control Data Access," describes how to create and manage Virtual Private Database policies.

• Classify and protect data in different categories. You can find all table columns in a database that hold sensitive data (such as credit card or Social Security numbers), classify this data, and then create a policy that protects this data as a whole for a given class. Chapter 11, "Using Transparent Sensitive Data Protection," explains how to create Transparent Sensitive Data Protection policies.

• Network data encryption. Chapter 12, "Manually Encrypting Data," explains how to use the DBMS_CRYPTO PL/SQL package to encrypt data as it travels on the network to prevent unauthorized access to that data. You can configure native Oracle Net Services data encryption and integrity for both servers and clients, which are described in Chapter 13, "Configuring Network Data Encryption and Integrity."

• Thin JDBC client network configuration. You can configure thin Java Database Connectivity (JDBC) clients to securely connect to Oracle databases. Chapter 14, "Configuring the Thin JDBC Client Network," provides detailed information.

• Strong authentication. You can configure your databases to use strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates. Oracle Database provides the following strong authentication support:

  • Centralized authentication and single sign-on.

  • Kerberos

  • Remote Authentication Dial-in User Service (RADIUS)

  • Secure Sockets Layer (SSL)

  The following chapters cover strong authentication:

  • Chapter 15, "Introduction to Strong Authentication"

  • Chapter 16, "Strong Authentication Administration Tools"

  • Chapter 17, "Configuring Kerberos Authentication"

  • Chapter 18, "Configuring Secure Sockets Layer Authentication"

  • Chapter 19, "Configuring RADIUS Authentication"

  • Chapter 20, "Customizing the Use of Strong Authentication"

• Auditing database activities. You can audit database activities in general terms, such as auditing all SQL statements, SQL privileges, schema objects, and network activity. Or, you can audit in a granular manner, such as when the IP addresses from outside the corporate network is being used. This chapter also explains how to purge the database audit trail. The following chapters describe how to configure and administer database auditing.

  • Chapter 21, "Introduction to Auditing"

  • Chapter 22, "Configuring Audit Policies"

  • Chapter 23, "Administering the Audit Trail"

In addition, Appendix A, "Keeping Your Oracle Database Secure," provides guidelines that you should follow when you secure your Oracle Database installation.

Additional Oracle Database Security Resources

In addition to the security resources described in this guide, Oracle Database provides several other database security products.

• Oracle Advanced Security. See Oracle Database Advanced Security Guide for information about Transparent Data Encryption and Oracle Data Redaction.

• Oracle Label Security. Oracle Label Security applies classification labels to data, allowing you to filter user access to data at the row level. See Oracle Label Security Administrator's Guide for detailed information about Oracle Label Security.

• Oracle Database Vault. Oracle Database Vault provides fine-grained access control to your sensitive data, including protecting data from privileged users. Oracle Database Vault Administrator's Guide describes how to use Oracle Database Vault.

• Oracle Audit Vault and Database Firewall. Oracle Audit Vault and Database Firewall collects database audit data from sources such as Oracle Database audit trail tables, database operating system audit files, and database redo logs. Using Oracle Audit Vault and Database Firewall, you can create alerts on suspicious activities, and create reports on the history of privileged user changes, schema modifications, and even data-level access. Oracle Audit Vault and Database Firewall Administrator's Guide explains how to administer Oracle Audit Vault and Database Firewall.

• Oracle Enterprise User Security. Oracle Enterprise User Security enables you to manage user security at the enterprise level. Oracle Database Enterprise User Security Administrator's Guide explains how to configure Oracle Enterprise User Security.

• Oracle Enterprise Manager Data Masking and Subsetting Pack. Data Masking and Subsetting Pack helps reduce this risk by irreversibly replacing the original sensitive data with fictitious data so that production data can be shared safely with IT developers or offshore business partners. See Oracle Database Testing Guide for additional information.

In addition to these products, you can find the latest information about Oracle Database security, such as new products and important information about security patches and alerts, by visiting the Security Technology Center on Oracle Technology Network at

http://www.oracle.com/technetwork/topics/security/whatsnew/index.html