Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Oracle Database 12c Security Cookbook
  • Toc
  • feedback
Oracle Database 12c Security Cookbook

Oracle Database 12c Security Cookbook

By : Maja Veselica & Zoran Pavlovic, Pavlovic, Veselica
4.7 (3)
close
Oracle Database 12c Security Cookbook

Oracle Database 12c Security Cookbook

4.7 (3)
By: Maja Veselica & Zoran Pavlovic, Pavlovic, Veselica

Overview of this book

Businesses around the world are paying much greater attention toward database security than they ever have before. Not only does the current regulatory environment require tight security, particularly when dealing with sensitive and personal data, data is also arguably a company’s most valuable asset - why wouldn’t you want to protect it in a secure and reliable database? Oracle Database lets you do exactly that. It’s why it is one of the world’s leading databases – with a rich portfolio of features to protect data from contemporary vulnerabilities, it’s the go-to database for many organizations. Oracle Database 12c Security Cookbook helps DBAs, developers, and architects to better understand database security challenges. Let it guide you through the process of implementing appropriate security mechanisms, helping you to ensure you are taking proactive steps to keep your data safe. Featuring solutions for common security problems in the new Oracle Database 12c, with this book you can be confident about securing your database from a range of different threats and problems.
Table of Contents (13 chapters)
close
close
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Sections
Conventions
Reader feedback
Customer support
Free Chapter
1
1. Basic Database Security
chevron up
1. Basic Database Security
Introduction
Creating a password profile
Creating password-authenticated users
Changing a user's password
Creating a user with the same credentials on another database
Locking a user account
Expiring a user's password
Creating and using OS-authenticated users
Creating and using proxy users
Creating and using database roles
The sysbackup privilege – how, when, and why should you use it?
The syskm privilege – how, when, and why should you use it?
The sysdg privilege – how, when, and why should you use it?
2
2. Security Considerations in Multitenant Environment
2. Security Considerations in Multitenant Environment
Introduction
Creating a common user
Creating a local user
Creating a common role
Creating a local role
Granting privileges and roles commonly
Granting privileges and roles locally
Effects of plugging/unplugging operations on users, roles, and privileges
3
3. PL/SQL Security
3. PL/SQL Security
Introduction
Creating and using definer's rights procedures
Creating and using invoker's right procedures
Using code-based access control
Restricting access to program units by using accessible by
4
4. Virtual Private Database
4. Virtual Private Database
Introduction
Creating different policy functions
Creating Oracle Virtual Private Database row-level policies
Creating column-level policies
Creating a driving context
Creating policy groups
Setting context as a driving context
Adding policy to a group
Exempting users from VPD policies
5
5. Data Redaction
5. Data Redaction
Introduction
Creating a redaction policy when using full redaction
Creating a redaction policy when using partial redaction
Creating a redaction policy when using random redaction
Creating a redaction policy when using regular expression redaction
Using Oracle Enterprise Manager Cloud Control 12c to manage redaction policies
Changing the function parameters for a specified column
Add a column to the redaction policy
Enabling, disabling, and dropping redaction policy
Exempting users from data redaction policies
6
6. Transparent Sensitive Data Protection
6. Transparent Sensitive Data Protection
Introduction
Creating a sensitive type
Determining sensitive columns
Creating transparent sensitive data protection policy
Associating transparent sensitive data protection policy with sensitive type
Enabling, disabling, and dropping policy
Altering transparent sensitive data protection policy
7
7. Privilege Analysis
7. Privilege Analysis
Introduction
Creating database analysis policy
Creating role analysis policy
Creating context analysis policy
Creating combined analysis policy
Starting and stopping privilege analysis
Reporting on used system privileges
Reporting on used object privileges
Reporting on unused system privileges
Reporting on unused object privileges
How to revoke unused privileges
Dropping the analysis
8
8. Transparent Data Encryption
8. Transparent Data Encryption
Introduction
Configuring keystore location in sqlnet.ora
Creating and opening the keystore
Setting master encryption key in software keystore
Column encryption - adding new encrypted column to table
Column encryption - creating new table that has encrypted column(s)
Using salt and MAC
Column encryption - encrypting existing column
Auto-login keystore
Encrypting tablespace
Rekeying
Backup and Recovery
9
9. Database Vault
9. Database Vault
Introduction
Registering Database Vault
Preventing users from exercising system privileges on schema objects
Securing roles
Preventing users from executing specific command on specific object
Creating a rule set
Creating a secure application role
Using Database Vault to implement that administrators cannot view data
Running Oracle Database Vault reports
Disabling Database Vault
Re-enabling Database Vault
10
10. Unified Auditing
10. Unified Auditing
Introduction
Enabling Unified Auditing mode
Configuring whether loss of audit data is acceptable
Which roles do you need to have to be able to create audit policies and to view audit data?
Auditing RMAN operations
Auditing Data Pump operations
Auditing Database Vault operations
Creating audit policies to audit privileges, actions and roles under specified conditions
Enabling audit policy
Finding information about audit policies and audited data
Auditing application contexts
Purging audit trail
Disabling and dropping audit policies
11
11. Additional Topics
11. Additional Topics
Introduction
Exporting data using Oracle Data Pump in Oracle Database Vault environment
Creating factors in Oracle Database Vault
Using TDE in a multitenant environment
12
12. Appendix – Application Contexts
12. Appendix – Application Contexts
Introduction
Exploring and using built-in contexts
Creating an application context
Setting application context attributes
Using an application context

Creating a user with the same credentials on another database

This recipe explains a way to create a user with the same credentials on another database.

Getting ready

To complete this recipe, you'll need:

  • An existing user who has dba role in the first database (you can use an OS-authenticated user)
  • An existing user in the first database (for example, jessica)
  • An existing (for example, password-authenticated) user, who has create user privilege, in the second database (for example, zoran)

How to do it...

  1. Connect to the first database as a user who has a DBA role:
           $ sqlplus /
  2. Find a Data Definition Language (DDL) statement (ddl) that is used for user creation (for example, user jessica):
           SQL> select dbms_metadata.get_ddl('USER', 'JESSICA') from
dual;
  3. Connect to the second database as a user who has create user privilege:
           $ sqlplus zoran@orcl2
  4. Create a user using the value you found in step 2:
    SQL> create user "JESSICA" identified by values
'S:D82E6EF961F2EA7A878BCDDBC7E5C542BC148C4759D19A7
20A96BBF65658;H:F297A50FD538EF4AB119EB0278C9E72D;
C50B1E9C9AA52EC2';

How it works...

In step 1, you used OS authentication to connect to the database.

In step 2, you found a DDL statement that has been used for user creation. This DDL statement may contain default and temporary tablespace assignments (note that even if you haven't explicitly assigned these tablespaces during user creation, the system will assign them implicitly using default values for the database). For instance, output in step 2 may look like this:

SQL> select dbms_metadata.get_ddl('USER', 'JESSICA') from dual;
    
DBMS_METADATA.GET_DDL('USER','JESSICA')
------------------------------------------------------------------
CREATE USER "JESSICA" IDENTIFIED BY VALUES 'S:D82E6EF961F2EA7A878BCDDBC7E5C542BC148C4759D19A720A96BBF65658;H:F297A50FD538EF4AB1 19EB0278C9E72D;C50B1E9C9AA52EC2'
DEFAULT TABLESPACE "USERS"            TEMPORARY TABLESPACE "TEMP"

However, we used only the first part of this DDL in step 4 to create a user on the second database (and let the database decide about default tablespaces).

There's more...

There is another way to accomplish the task.

Note

You can only reveal the hash value of user's password (you cannot reveal the actual password).

This way requires select on the sys.user$ table:

  1. Connect to the first database as a user who has the select privilege on the sys.user$ table (for example, user who has the sysdba privilege):
    $ sqlplus / as sysdba
  2. Find the hash value of a user's password (for example, user jessica):
    SQL> select spare4
from user$
where name='JESSICA';
  3. Connect to the second database as a user who has create user privilege:
    $ sqlplus zoran@orcl2
  4. Create a user with the same username (for example, jessica) using the hash value of the password that you have found in step 2:
    SQL> create user jessica identified by values 
'S:2724193130FC67E7E23E3E44E33AF143F7A6C36489792B
5856133DCB331D;H:184895E50EA2FBCC2311ED76A3E5CF35;
T:BECCD5FC6F6E62BC34DF1C826AEE899EC6A6025FA0D5071659DA
7DD1ABB37763483B5C821E5A34C1184A56BE4B1C92CED79639D11101D
61B86ACBE60A30F19CC277D5753F7D3756DC1B7705C0ACE81F3';

See also

  • Creating and using OS-authenticated users
End of Section 6
Next Section
bookmark search playlist download
font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete