Implementing Oracle Database Security
Copyright 2008, Oracle. All rights reserved.
Objectives
After completing this lesson, you should be able to: Describe DBA responsibilities for security Apply the principle of least privilege Enable standard database auditing Specify audit options Review audit information Maintain the audit trail
11 - 2
Copyright 2008, Oracle. All rights reserved.
Industry Security Requirements
Legal:
Sarbanes-Oxley Act (SOX) Health Information Portability and Accountability Act (HIPAA) India Information Technology Act UK Data Protection Act EU Data Directive 95/46/EC Norwegian Personal Data Act
Auditing
11 - 3
Copyright 2008, Oracle. All rights reserved.
Separation of Responsibilities
Users with DBA privileges must be trusted.
Abuse of trust Audit trails protecting the trusted position
DBA responsibilities must be shared. Accounts must never be shared. The DBA and the system administrator must be different people. Separate operator and DBA responsibilities.
11 - 5
Copyright 2008, Oracle. All rights reserved.
Database Security
A secure system ensures the confidentiality of the data that it contains. There are several aspects of security: Restricting access to data and services Authenticating users Monitoring for suspicious activity
11 - 6
Copyright 2008, Oracle. All rights reserved.
Principle of Least Privilege
Install only required software on the machine. Activate only required services on the machine. Give OS and database access to only those users that require access. Limit access to the root or administrator account. Limit access to the SYSDBA and SYSOPER accounts. Limit users access to only the database objects that are required to do their jobs.
11 - 8
Copyright 2008, Oracle. All rights reserved.
Applying the Principle of Least Privilege
Protect the data dictionary:
O7_DICTIONARY_ACCESSIBILITY=FALSE
Revoke unnecessary privileges from PUBLIC.
Restrict the directories accessible by users. Limit users with administrative privileges. Restrict remote database authentication:
REMOTE_OS_AUTHENT=FALSE
11 - 9
Copyright 2008, Oracle. All rights reserved.
Protect Privileged Accounts
Privileged accounts can be protected by: Using password file with case-sensitive passwords Enabling strong authentication for administrator roles
Grant administrator roles in Oracle Internet Directory Use Kerberos tickets Use certificates with SSL
SYSDBA
11 - 11
Copyright 2008, Oracle. All rights reserved.
Monitoring for Compliance
Monitoring or auditing must be an integral part of your security procedures.
Review the following: Mandatory auditing Standard database auditing Value-based auditing Fine-grained auditing (FGA) SYSDBA (and SYSOPER) auditing
11 - 12
Copyright 2008, Oracle. All rights reserved.
Standard Database Auditing
1 Enable database auditing.
2
DBA
Parameter file
Specify audit options.
User executes command.
Database
Server process Audit options 3 Review audit information. Audit trail Generate audit trail.
4 Maintain audit trail.
OS or XML audit trail
11 - 13
Copyright 2008, Oracle. All rights reserved.
Configuring the Audit Trail
ALTER SYSTEM SET audit_trail=XML SCOPE=SPFILE;
Restart database after modifying a static initialization parameter.
11 - 14
Copyright 2008, Oracle. All rights reserved.
Default Auditing
Privileges Audited by Default
ALTER ANY PROCEDURE ALTER ANY TABLE ALTER DATABASE ALTER PROFILE ALTER SYSTEM ALTER USER AUDIT SYSTEM CREATE ANY JOB CREATE ANY LIBRARY CREATE ANY PROCEDURE CREATE ANY TABLE CREATE EXTERNAL JOB CREATE PUBLIC DATABASE LINK CREATE SESSION CREATE USER GRANT ANY OBJECT PRIVILEGE GRANT ANY PRIVILEGE GRANT ANY ROLE DROP ANY PROCEDURE DROP ANY TABLE DROP PROFILE DROP USER EXEMPT ACCESS POLICY
Statements Audited by Default
SYSTEM AUDIT BY ACCESS ROLE BY ACCESS
11 - 15
Copyright 2008, Oracle. All rights reserved.
Uniform Audit Trails
Use AUDIT_TRAIL to enable database auditing.
AUDIT_TRAIL=DB,DB_EXTENDED STATEMENTID, ENTRYID DBA_FGA_AUDIT_TRAIL
DBA_AUDIT_TRAIL
EXTENDED_TIMESTAMP, PROXY_SESSIONID, GLOBAL_UID, INSTANCE_NUMBER, OS_PROCESS, TRANSACTIONID, SCN, SQL_BIND, SQL_TEXT DBA_COMMON_AUDIT_TRAIL
11 - 16
Copyright 2008, Oracle. All rights reserved.
Specifying Audit Options
SQL statement auditing:
AUDIT table;
System-privilege auditing (nonfocused and focused):
AUDIT select any table, create any trigger; AUDIT select any table BY hr BY SESSION;
Object-privilege auditing (nonfocused and focused):
AUDIT ALL on hr.employees; AUDIT UPDATE,DELETE on hr.employees BY ACCESS;
11 - 17
Copyright 2008, Oracle. All rights reserved.
Enterprise Manager Audit Page
11 - 18
Copyright 2008, Oracle. All rights reserved.
Using and Maintaining Audit Information
Disable audit options if you are not using them.
11 - 19
Copyright 2008, Oracle. All rights reserved.
Value-Based Auditing
A user makes a change.
The trigger fires.
Audit record is created by the trigger.
Users change is made.
Audit record is inserted into an audit trail table.
11 - 20
Copyright 2008, Oracle. All rights reserved.
Fine-Grained Auditing
Monitors data access on the basis of content Audits SELECT, INSERT, UPDATE, DELETE, and MERGE Can be linked to one or more columns in a table or view May fire a procedure Is administered with the DBMS_FGA package
Policy: AUDIT_EMPS_SALARY SELECT name, salary FROM employees WHERE department_id = 10;
11 - 22
employees
Copyright 2008, Oracle. All rights reserved.
FGA Policy
dbms_fga.add_policy ( object_schema => 'HR', object_name => 'EMPLOYEES', policy_name => 'audit_emps_salary', audit_condition=> 'department_id=10', audit_column => 'SALARY,COMMISSION_PCT', handler_schema => 'secure', handler_module => 'log_emps_salary', enable => TRUE, statement_types => 'SELECT,UPDATE');
Defines:
Audit criteria Audit action
Is created with DBMS_FGA .ADD_POLICY
SELECT name, job_id FROM employees WHERE department_id = 20; SELECT name, salary FROM employees WHERE department_id = 10;
Not audited
SECURE.LOG_ EMPS_SALARY employees
11 - 23
Copyright 2008, Oracle. All rights reserved.
Audited DML Statement: Considerations
Records are audited if the FGA predicate is satisfied and the relevant columns are referenced. DELETE statements are audited regardless of columns specified. MERGE statements are audited with the underlying INSERT or UPDATE generated statements.
UPDATE hr.employees SET salary = 1000 WHERE commission_pct = .2;
UPDATE hr.employees SET salary = 1000 WHERE employee_id = 200;
11 - 25
Copyright 2008, Oracle. All rights reserved.
FGA Guidelines
To audit all rows, use a null audit condition. To audit all columns, use a null audit column.
Policy names must be unique. The audited table or view must already exist when you create the policy. If the audit condition syntax is invalid, an ORA-28112 error is raised when the audited object is accessed. If the audited column does not exist in the table, no rows are audited. If the event handler does not exist, no error is returned and the audit record is still created.
11 - 26
Copyright 2008, Oracle. All rights reserved.
SYSDBA Auditing
Users with SYSDBA or SYSOPER privileges can connect when the database is closed. Audit trail must be stored outside the database. Connections as SYSDBA or SYSOPER are always audited. You can enable additional auditing of SYSDBA or SYSOPER actions with audit_sys_operations. You can control the audit trail with audit_file_dest.
11 - 27
Copyright 2008, Oracle. All rights reserved.
Maintaining the Audit Trail
The audit trail should be maintained with the following best-practice guidelines: Review and store old records. Prevent storage problems. Avoid loss of records.
11 - 28
Copyright 2008, Oracle. All rights reserved.
Security Updates
Oracle posts Critical Patch Update information on the Oracle Technology Network (OTN) site at: http://www.oracle.com/technology/deploy/ security/alerts.htm Oracle database administrators and developers can also subscribe to email notification of security updates from this OTN page.
11 - 29
Copyright 2008, Oracle. All rights reserved.
Applying Security Patches
Use the Critical Patch Update process. Apply all security patches and workarounds. Contact the Oracle Security product team.
11 - 30
Copyright 2008, Oracle. All rights reserved.
Summary
In this lesson, you should have learned how to: Describe DBA responsibilities for security Apply the principle of least privilege Enable standard database auditing Specify audit options Review audit information Maintain the audit trail
11 - 31
Copyright 2008, Oracle. All rights reserved.
Practice 11 Overview: Implementing Oracle Database Security
This practice covers the following topics: Enabling standard database auditing Specifying audit options for the HR.JOBS table Updating the table Reviewing audit information Maintaining the audit trail
11 - 32
Copyright 2008, Oracle. All rights reserved.
