securing your oracle database to protect your data · 2019-03-22 · agenda •security policies...

Securing Your Oracle Database to Protect your Data

Michael Messina

Senior Managing Consultant, Rolta-AdvizeX

[email protected] / [email protected]

mailto:[email protected]


Introduction

• Michael Messina

• Senior Managing Consultant Rolta-AdvizeX,

• Working with Oracle Approximately 25 years

• Background includes Performance Tuning, High Availability and Disaster Recovery

• Oracle Database OCP

• Oracle RAC Certified Expert

• Oracle Exadata Implementation Specialist

• Vice President Indiana Oracle Users Group

• Oracle ACE

• [email protected] / [email protected]

• www.tusc.com / www.roltasolutions.com



http://www.tusc.com/

http://www.roltasolutions.com/

Agenda

• Security Policies

▪ Physical Access, Network Access, Operating System, Database

• Data Masking

• Transparent Data Encryption

• Database Listener

• Class of Secure Transport (COST)

• Oracle Password Store Wallet

• Database Vault

• Database 12c New Privilege Management features

• Audit Vault and Database Firewall (AVDF)

• Cloud Security and the Oracle Database

• Questions / Discussion

Why Security?

• From Oracle Corporation

Security

• Insider threat often more overlooked then outside threat so need to ensure focus on security includes the more likely insider threat to data breach. (ie. Separation of Duties)

• Physical Security typically has had more focus then data security though that has been changing.

• Data Security is getting more focus as more breaches are highlighted in Media as they happen.

• Regulatory Compliance must be adhered to for Health Care and Financial information some critical business data is left unprotected leaving organization exposed to that data being stolen by competitors and organization may not even realize it.

What do we do?

Be Like this Guy?

• Organization can not fix what it is not aware of

• Organization needs to take compliance and security gaps seriously

Security Policies

• Physical Access Control

• Physical Protection

• Operating System

• Network

• Database Access

Physical Access Control

• Physical Access to servers that run the database

▪ Machine Room Access Controls

▪ Biometric

▪ Card Key

▪ Physical Security Guards

▪ Access to Power feeding machine room

▪ Gate/Wall around power feeds/utilities

▪ Restricted Access to Power Controls

▪ Access to ventilation and cooling systems to machine room.

▪ Gate/Wall around cooling / heating systems pushing air into machine room.

▪ Access to controls for Cooling and heating systems

▪ Machine Console access limited to essential personnel

▪ Physical machine consoles offer direct login for super user

▪ Control access to machine console

▪ Control Access to Machine ILOM

Physical Access Control

• Network Controls

▪ Limit Access ability to physically connect to network that can access the database.

▪ Limit Physical Access to Network switches

▪ Limit Physical Access to Network Firewalls

▪ Limit Access for physical connectivity to network to authorized personnel (separate guest networks)

Physical Protection

• Database Server protection Physical

▪ Power - Control against power surges, etc. and access to power controls

▪ Cooling – Backup cooling to machines or protection to bring them down if the overheat and access to cooling controls

▪ Fire – Fire Suppression System and backup fire suppression and access

• Network Physical Protection

▪ Power - Control against power surges, etc. and access to power controls

▪ Cooling – Backup cooling to machines or protection to bring them down if the overheat and access to cooling controls

▪ Fire – Fire Suppression System and backup fire suppression and access

Physical Access Control / Physical Protection Cloud

• How does this change in the cloud

▪ Understand what controls should be there and ensure you understand how the cloud provided maintains these Controls

▪ Ensure your control standards are met by the cloud provider

▪ Understand how you may or may not be notified if a physical breech happens

Network

• Utilize Firewalls to Control Connections

▪ IP Filtering (listener / Whitelists)

▪ Cloud - Whitelists, Network ACLs, Security Groups)

▪ Database Firewall (IAAS)

▪ Activity Monitoring/Blocking

▪ Network Firewall

• Network Level Encryption between clients and database

▪ Oracle Advanced Security Option

▪ sqlnet.ora

▪ AES 256-bit key, 3-key 3DES and many other options

▪ On the server:

▪ SQLNET.ENCRYPTION_SERVER = [accepted | rejected | requested | required] SQLNET.ENCRYPTION_TYPES_SERVER = (valid_encryption_algorithm[,valid_encryption_algorithm])

▪ On the client:

▪ SQLNET.ENCRYPTION_CLIENT = [accepted | rejected | requested | required] SQLNET.ENCRYPTION_TYPES_CLIENT = (valid_encryption_algorithm[,valid_encryption_algorithm])

Database Security

• Utilize same security in Non-Production

▪ Make sure security Controls are working

▪ Ensure that security procedures are full proof

▪ Ensure items like encryption, advanced security and other security controls do not affect production operations, performance and procedures.

• Database Listener Filtering

▪ Listener IP Access Control list use Invited lists not exclude lists to be proactive

▪ Listener has list of IP addresses that it will allow connections to database and stop connections for IP address not in the list

• Applying Security Patches as they are Released

▪ In Cloud what is the apply schedule for security patches for Database as a service.

Operating System

• Access to Login to Physical Server

• Operating system account to only Administration personnel

• DBAs and System Admins Only

• Database as a Service in Cloud no server access control needed as no server access exists

• Latest Operating System Security Updates Applied

• Apply security updates from operating system vendor within 30 days of release

• In Cloud what is the OS level / VM Level security update schedule, timeframe and impact

• Ensure Operating system security controls are well known and utilized where possible.

Data Masking

• Mask Sensitive data in Non-Production Environments

▪ Developers to do not see actual identifiable data during the development process

▪ Quality assurance does not see actual identifiable data during release testing.

▪ Integrated with Real Application Testing

▪ Can have masked data on a test environment from captured production workload for Replay on masked test environment.

• Do this as a best practice regardless of Regulation Requirements therefore you are always securing you data across your environments the same way. This ensures that it is an integrated part of you daily support, processes and activities.

Transparent Data Encryption

• Transparent data encryption protects you data at rest

▪ Requires a wallet at the database level that is

▪ Focus is to protect the datafiles of the database

▪ File system encryption does not = database backup level encryption

• Keeps users and applications from having to manage an encryption key for increased security without having to change the application in anyway.

▪ Create Wallet for Encryption

▪ system set encryption key identified by "xxxxxxxxx" ;

▪ Open Encryption Wallet

▪ alter system set encryption wallet open identified by "xxxxxxxxx" ;

▪ Auto Login so Wallet always open with database▪ ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE

'/u01/app/oracle/network/admin/encrypt' IDENTIFIED BY "xxxxxxxxx";

▪ Create encrypted tablespace▪ CREATE BIGFILE TABLESPACE MY_DATA datafile '+DATA_HC' size 500M AUTOEXTEND ON

NEXT 500M MAXSIZE UNLIMITED encryption using 'AES256' default storage (encrypt) ;

▪ Encrypt Column

▪ alter table emp modify (ssn encrypt) ;

Database Access

• Least Privilege

▪ Control access to database tables to only tables user is required access to

▪ Fine Grained Access Control

▪ Virtual Private Database

• Do not use common shared database accounts

▪ This creates an elevated level of privileges to accommodate multiple user roles

▪ Reduces auditing accuracy and ability to track at lowest layer, the database

• REMOTE_OS_AUTHENT

▪ In some cases central Authentication will have this TRUE, if not required for Central authentication set to FALSE

Database Access

• User Account Approval Process

▪ Ensure all database account creations are controlled through a multi-layer approval process

• Password Rules / Enforcement

▪ Ensure all database accounts have a password rules in place and enforced for all accounts

▪ Passwords are required to be changed regularly even system level

• Central Authentication

▪ Kerberos Authentication

▪ LDAP

▪ Wallets

▪ S/MIME signing certificate

▪ S/MIME encryption certificate

▪ Code-signing certificate

▪ RADIUS (Remote Authentication Dial-in User Service)

▪ Two factor authentication (password / PIN [token card])

Database Listener

• Prevent online administration

▪ Require administrators to have write privileges on the listener.ora file

▪ ADMIN_RESTRICTIONS_LISTENER=ON

▪ Listener Password

▪ Remote Listener management is disabled when password is not used

• Database Listener Filtering

▪ Control to a list of IP addresses that are allowed to connect, active list not recommended to use passive exclude list.

▪ Controlled in sqlnet.ora

▪ tcp.validnode_checking = YES

▪ tcp.invited_nodes = {list of IP addresses}

Class of Secure Transport (COST) (TNS Poison) < 12c

• Work around is to IP Filter Listener to restrict access to listener

• Can not use with Password Store Wallet, must use a different sqlnet.ora for clients to be able to use Password Store Wallet

• Patches Require for environments < 11.2.0.4

▪ Cumulative Patch Inclusion - DBPSU 10.2.0.5.8 (Released)





▪ Windows patch availability for bugfix:12880299

• Create and enable wallet

▪ orapki wallet create -wallet <wallet_location> -auto_login

▪ orapki wallet add -wallet <wallet_location> -self_signed -dn"cn=secure_register" -keysize 1024 -validity 3650

Class of Secure Transport (COST) (TNS Poison) < 12c

• Set Wallet Location in sqlnet.ora / listener.ora (each ORACLE_HOME) and each node in a RAC Cluster

▪ WALLET_LOCATION =(SOURCE =(METHOD = FILE)(METHOD_DATA =(DIRECTORY = <Wallet_Location>))

)

• Add TCPS and Port to Listener

▪ (ADDRESS = (PROTOCOL = TCPS)(HOST = IPAddress)(PORT = 1523))

▪ Comment out TCP address line(s)

• Database Secure Listener Registration Parameter listener.ora / sqlnet.ora

▪ SECURE_REGISTER_listener_name

▪ SECURE_REGISTER_listener = (TCP, TCPS, IPC)

▪ SECURE_REGISTER_LISTENER_SCAN1 = (IPC,TCPS)

• Set database remote_listener to port for TCPS

Class of Secure Transport (COST) (TNS Poison) >= 12c

• VNCR

▪ Valid Node Checking for Registration

• Can be used with Password Store Wallet do not need separate sqlnet.ora for client and database on database server

• Listener.ora

▪ VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=SUBNET

▪ VALID_NODE_CHECKING_REGISTRATION_LISTENER=SUBNET

▪ Value of ON instead of SUBNET more restrictive ON used non-RAC

▪ REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(dbserver1,dbserver2)

• Set remote_listener for database

▪ alter system set remote_listener = '<endpoint>:<port>' scope=memory sid='*';

Database Vault

• Licensed Option for Oracle Database

• Privileged User Access Control

▪ Database Administrator

• Protects application data access in the database

• Policy based access controls

• Protection Policies for Many Enterprise Applications Available (no need to create you own)

Database Vault

• Database Configuration Controls

▪ create, alter, drop user

▪ alter system

▪ etc.

• Database DDL/DML Control

▪ Control Create table, truncate table, drop table, etc.

▪ Control create database link

▪ Control analyze on a table

▪ SQL Statements

▪ For Example if DBA attempts to access table protected database vault blocks the SQL Statement and creates an audit record of the access attempt.

• Focus on separation of duties

▪ Control grant/revoke for database roles, limit privileged users power

▪ Freeze role privileges, no changes to role privileges allowed.

Database Vault

• With 12c Can identify unused privileges. (called Privilege Analysis)

▪ Allow unused privileges to be removed to tighten security to least access required.

• Fully Integrated with oracle Enterprise Manager 12c

▪ Simplify Management

• Reporting

▪ SQL Statements Blocked by Database Vault

▪ For Example if DBA attempts to access table protected database vault blocks the SQL Statement and creates an audit record of the access attempt.

▪ Any Security Policy Changes

▪ Any Changes to Vault Configuration

• Compliments Database Firewall and Audit Vault well to provide additional level of security and view into overall environment.

Oracle Password Store Wallet

• Utilize to access database without password for client level accounts

▪ Can be setup on client machines

▪ Reads Wallet for username/password based on TNS entry used.

▪ Unique to each TNS_ADMIN location, multiple TNS_ADMIN locations, you can use multiple wallets to create more security and control wallet access.

▪ Great for batch processes, eliminates users having to know password, does not show password on command line, no more special processes for batch to get passwords.

▪ Available since 10g

▪ Usable to access cloud databases

▪ From Oracle Client with password wallet

▪ Oracle Cloud

▪ Database as a Service

▪ Infrastructure as a Service

▪ Amazon

▪ Amazon RDS

▪ Amazon EC2

Oracle Password Store Wallet

• Create Wallet for password store

▪ cd $TNS_ADMIN

▪ mkdir authent

▪ mkstore –wrl $TNS_ADMIN/authent –create

▪ Enter password for wallet (will have to be entered 2 times for confirmation)*

▪ * Creates 2 files ewallet.p12 and cwallet.sso

• Create credential(s) for Wallet

▪ mkstore -wrl $TNS_ADMIN/authent –createCredential tnsstring username password

▪ Unique to each TNS entry within the wallet to have different database users for same tns entry must use different wallet

Password Store Wallet

• Update sqlnet.ora to set for standard wallet locations

WALLET_LOCATION=

(SOURCE=

(METHOD=FILE)

(METHOD_DATA=

(DIRECTORY= /u01/app/oracle/network/admin/authent)

)

)

SQLNET.WALLET_OVERRIDE = TRUE

SSL_CLIENT_AUTHENTICATION = FALSE

SSL_VERSION = 0

Password Store Wallet

• Test the wallet credentials to login

▪ Now that the wallet password store has been created, the sqlnet.ora and tnsnames.ora setup to utilize the wallet we need to test and make sure the wallet password store is functioning as expected.

▪ sqlplus /@tnsstring

• Select user from dual ;

▪ Show us that we logged in as the user we set in the wallet

• Can not be used with COST TNS Poisoning Fix in < 12c, must use a different TNS_ADMIN location then database to be able to use on database server.

• Does not required Advanced Security Option and does not have any additional license requirements to use.

Database 12c New Privilege Management Features

• Task Based System Privileges

▪ SYSDBA

▪ Same as prior versions

▪ SYSOPER

▪ Same as prior versions

▪ SYSASM

▪ Same as prior versions ASM Only

▪ SYSBACKUP

▪ Ability to perform RMAN backups and recovery

▪ Applies to both the SQL and RMAN command lines

▪ SYSDG

▪ For Data Guard Operations

▪ dgmgrl command line

▪ Applies to Data Guard Broker

▪ SYSKM

▪ Manage keys for Transparent Data Encryption


• changes to the password file

▪ remote connections for roles

▪ orapwd file=orapwSID password=xxxx entries=5 format=12 sysbackup=y sysdg=y

▪ Format – 12 for the 12c format of password file

▪ Sysdg – for remote access for new sysdg

▪ Sysbackup – for remote access for new sysbackup

▪ Migrate old password file to new format

▪ Input_file parameter

▪ orapwd format 12 sysbackup=y sysdg=y input_file=$ORACLE_HOME/dbs/orapwdb1

• AUDIT_SYS_OPERATIONS=TRUE

▪ Audit operations with new roles

• New roles incorporated with Database Vault as well.


• Privilege Usage Capture

▪ New package to capture privilege usage for analysis

▪ Database level

▪ For all Privilege usage for entire database

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.CREATE_CAPTURE (name=>’DB_PRIV_ANALYSIS’, description=>’Captures all Privilege Usage’, type => dbms_privilege_capture.g_database);

▪ Role level

▪ Privilege usage by roles

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.CREATE_CAPTURE ( name=>’ROLE_PRIVS_ANALYSIS’, description=>’Captures Privilege Usage for a roles’, type=> dbms_privilege_capture.g_role, roles=> role_name_list(‘DBA’,’IMP_FULL_DATABASE’,’EXP_FULL_DATABASE’);

▪ Context

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.CREATE_CAPTURE ( name=>’PRIV_FOR_AP’, description=>’Captures All AP’, type=>dbms_privilege_capture.g.context, condition=> ‘SYS_CONTEXT (‘ ‘USERENV’ ‘,’ ‘MODULE’ ‘)=’ ‘Accounts Payable’ ‘ ‘);


• Enable Capture

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.ENABLE_CAPTURE ( name =>’DB_PRIV_ANALYSIS’) ;

• Disable Capture

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.DISABLE_CAPTURE (name =>’DB_PRIV_ANALYSIS’) ;

• Analysis Report

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.GENERATE_RESULT (name=>’DB_PRIV_ANALYSIS’);

• Remove Capture Data

▪ exec SYS.DBMS_PRIVILEGE_CAPTURE.DROP_CAPTURE (name=>’DB_PRIV_ANALYSIS’);


• New Dictionary Views

▪ DBA_USED_SYSPRIVS shows which system privileges were used during the analysis period

▪ DBA_USED_OBJPRIVS shows which object privileges were used during the analysis period

▪ DBA_USED_OBJPRIVS_PATH shows how the privileges were granted – direct to the user or via a role

▪ DBA_UNUSED_PRIVS shows privileges that were granted to the users but not used during the analysis period

▪ DBA_PRIV_CAPTURES shows information about the various captures that have been created

Database Auditing and Database Audit Reporting

• Database Auditing

▪ Monitor data/database access execution of dml/ddl

▪ Deter users for doing or attempting ill advised activities

▪ Investigate Suspicious activity and creates accountability for data/database changes

• What is Covered

▪ Statements Auditing – Audit by type of Statement (CREATE TABLE, etc)

▪ Privilege Auditing – Audit use of system privileges (Create, Drop, Alter, etc)

▪ Schema Object Auditing - Audit on object (Select, Insert, Update, Delete)

▪ Fine Grained Auditing – Audit Access to certain records

• Database Audit Trail

▪ AUDIT_TRAIL=DB

▪ Recommended Backup and Recovery with DB

▪ Will stop DB activity if Audit record can not be written


• OS Audit Trail

▪ AUDIT_TRAIL=XML

▪ Dynamic View V$XML_AUDIT_TRAIL

▪ Stored on the OS file System

▪ CAN miss audit records if file system becomes full

▪ Some actions always written to OS Audit Trail

• SYSLOG

▪ Can be used for security reasons such as DBA/oracle account can modify/delete OS and DB Audit Trails (Trust!!! ????)

▪ Can Goto a remote syslog

▪ Can be used for a dedicated logging host


• Actions Always Written to SYSLOG / OS Audit Trail

▪ Instance startup

▪ OS user starting instance

▪ Terminal of user

▪ Time stamp

▪ Done because database audit trail not there yet

▪ Instance shutdown

▪ OS user stopping instance

▪ Terminal of user

▪ Time stamp

▪ Connections made with administrator privileges

▪ OS User

▪ Done for accountability for users connecting with administrator privileges.


• Audit BY SESSION

▪ Will only insert a single audit

▪ record for example user a access table a 5 times and table b 3 times only 2 audit records would be created

▪ For OS / SYSLOG - generates and stores an audit record each time an access is made so it acts just like BY ACCESS.

• Audit BY ACCESS

▪ Audit record is created for each operation

▪ For example user a access table a 5 times 5 audit records would be created.

One Final Thought

• This is what security is about


• Reporting

▪ Database Audit Trail

▪ dba_audit_trial (view) / sys.aud$ (table)

▪ dba_fga_audit_trail (view) / sys.fga_log$ (table)

▪ dba_common_audit_trail (Combined Audit Trail)

▪ OS Audit Trail

▪ Dynamic View V$XML_AUDIT_TRAIL

• Good for certain monitoring of events as well

▪ Find Audit Record Accessing or changing Salary table

▪ Find Audit Record where change was made to an Accounts Payable Record

▪ Other rules that organization would want to be aware of

Audit Vault and Database Firewall (AVDF)

• Additionally Licensed Product suite

• Combined into one Comprehensive product for database protection and reporting on that protection

• For environments with high security requirements and ability to identify and investigate threats

• Not Just for Oracle Databases, has capability to work across the databases in the environment.

▪ Oracle

▪ MySQL

▪ MS SQL Server

▪ IBM DB2

▪ Sybase

▪ OS, Unix and Windows

▪ Directory Services

Database Firewall

• First Line of Defense for Oracle and non-Oracle Databases

• Enables perimeter security controls

• Monitoring incoming SQL and Accept or Reject SQL

• Block unauthorized SQL statements from Reaching database

• Policy Driven controls

• Protect against network based attacks

• Protect against SQL Injection Based Attacks

• Control Access for added level of security

• Record activity for Compliance Reporting

• Compatible with Oracle Advanced Security Network encryption

• No Database Changes Required for protection to work

Database Firewall

• Thanks for the image Oracle very Nice illustration

Database Firewall

• Again another great Illustration from Oracle

• In-line Blocking and monitoring

▪ Traffic is evaluated/inspected forwarded to database or blocked/modified based on policy

• Out-of Band Monitoring

▪ Traffic is recorded before sent to database, but not evaluated/inspected therefore never blocked from database.

• HA Mode

▪ 2 firewalls for uninterrupted SQL monitoring.

Audit Vault

• Collects and consolidates Audit Data from a variety of Sources

▪ Databases

▪ OS

▪ Directories

▪ Database Firewall

• Ability to alert to security violations found in the audit data

Audit Vault

• Notice Database Firewall Events Feeding into Audit Vault working together to provide the front line security, tracking and alerting.

Audit Vault

• Alerting

▪ Analysis of specific events

▪ Define event thresholds

▪ Alert to defined activities

▪ Alert to defined event thresholds

• Reporting

▪ Predefined reports

▪ Sarbanes-Oxley (SOX)

▪ Payment Card Industry Data Security Standard (PCI)

▪ Health Insurance Portability and Accountability Act (HIPAA)

▪ Gramm-Leach-Bliley Act (GBLA)

▪ Data Protection Act (DPA)

▪ Others….

▪ Custom Reporting Capabilities

Cloud Security and the Oracle Database

• Amazon AWS EC2

▪ Infrastructure as a service Offering from Amazon

▪ Bring Your Only License

▪ VPC Security Groups to manage security access

▪ Network ACLs can be used for greater security

▪ Think of the EC2 instance like you would on an Premise Virtual Machine

▪ Must install and manage software like a virtual machine on Premise

▪ No Support for RAC

▪ Supports Security Features Such as:

▪ Database Vault

▪ Transparent Data Encryption

▪ Data Masking, etc.

▪ Falls into buckets for Sizing and CPU and Storage

▪ Examples: m3.medium, m3.large, m4.large, m4.xlarge

▪ This defines CPU capability, storage type and capabilities, memory size, etc.

▪ Largest EC2 for database

▪ m4.16xlarge 64 vCPU 256G Ram

▪ Except In-memory Database X1, x1.32xlarge 128 vCPU 1,952G Ram


• Amazon AWS RDS

▪ Amazon RDS does not support a number of critical Oracle security features

▪ Database Vault

▪ Unified Auditing

▪ Data Guard / Active Data Guard


▪ Oracle Enterprise Manager Cloud Control

▪ DB Security Groups to manage security access

▪ Privileges not Allowed in RDS

▪ Alter database

▪ Alter system

▪ Create any directory

▪ Drop any directory

▪ Grant any privilege

▪ Grant any role

▪ No Access to SYS or SYSTEM accounts

▪ Backend DR with Multi-AZ (This is Not Data Guard!!!)


• Amazon RDS - Continued

▪ Bring you own License

▪ All Editions

▪ “License Included”

▪ No Enterprise Security Features Available in “License Included”

▪ Standard Edition One

▪ Standard Edition Two

▪ Defined by Instance Classes

▪ db.m4.large (2 vCPU, 8G Ram)

▪ db.m4.4xlarge (16 vCPU 64G Ram)

▪ Maximum is 40 vCPU and 160G Ram


• Oracle Cloud General Security

▪ Whitelists

▪ Oracle Network Cloud Service

▪ 2 VPN Solutions

▪ Site-to-site VPN for dedicated compute enables customers to connect their data centers to Oracle Cloud over an IPSec tunnel

▪ Corente Cloud Services Exchange, which uses a distributed virtual appliance located at the network edge

▪ Security Monitoring and Analytics (Part of Oracle Management Cloud)

▪ Combine Hybrid Cloud, On Premise, Oracle Cloud, etc

▪ Provides features very similar to the Database Firewall for the database

▪ Comprehensive Detection

▪ Any log, any intelligence feed, any metric, any location (on-premises or cloud)

▪ Rapid Investigation

▪ Intuitive visualization of threats and early warning signs

▪ Intelligent Remediation

▪ Powerful auto-remediation framework for any IT stack

▪ https://cloud.oracle.com/en_US/security-analytics

https://cloud.oracle.com/en_US/security-analytics


• Oracle Cloud Infrastructure as a Service

▪ Bring your own license or get it included with your service

▪ Works much on Premise have to manage the OS, Database binaries, etc.

▪ Oracle Enterprise Database Security Feature All supported here


▪ Audit Vault

▪ Database Vault

▪ Data Masking

▪ Listener IP Filtering

▪ Etc.

▪ Oracle RAC Supported unlike Amazon EC2

▪ Define your exact compute power CPU, Memory, storage

▪ Max is 36 physical Cores


• Oracle Cloud Database Service

▪ Oracle Cloud will allow all licensed features included as part of the service.

▪ Database Vault

▪ Auditing

▪ Data Masking

55

Any Further Questions?

securing your oracle database to protect your data · 2019-03-22 · agenda •security policies...

Documents