oracle experts.
My client of mine wants to deploy an application that has to hold credit card numbers in a database. The client is obviously concerned with security.
We are particularly concerend with one painful issue. How can we make sure that only authorized users with a 'business need to know' are allowed to access the data? How can we protect the data from the DBA?
One obvious solution is to encrypt at the application level. We don't want to do that.
An oracle product that came up as a possible solution is Orace TDE (Transparent Data Encryption). It seems to cover the on-disk encryption case well. However, there have been disputing claims if it can be used to hide data from someone with DBA privileges.
I want to be very specific about the use case we're dealing with. We have an up and running application, 24/7/365, that is doing data access constantly. That means that the Oracle wallet is open and data is being decrypted by the database. AT THE SAME TIME a DBA should still be unable to access the data.
I know that Oracle is marketing Oracle Database Vault for this very issue. Given that all I want to do is block DBA access from just one particular table, do I really need the Vault or can I use TDE?
Assistance would be much appreciated,
Or
My guess is that you need Oracle Vault. TDE makes it impossible to read the datafiles but a simple select will still retrieve the data unencrypted.
But ask the dudes or dudettes who made the claim that TDE is sufficient, to explain how to do it without Oracle Vault.
Edit: Two threads on this issue:
http://forums.oracle.com/forums/thread.jspa?messageID=3249532�
http://forums.oracle.com/forums/thread.jspa?messageID=3261345�
"there have been disputing claims if it can be used to hide data from someone with DBA privileges."
Probably because there can be conflicting ideas about what constitutes DBA privileges. There is a DBA database role, a SYSDBA privilege and someone who can login as oracle (or Administrator) to the server at the operating system level, each with higher privileges
Privileges can be revoked from the DBA role, so that is even more vague.
VPD can ensure that, for example, the credit-card column is only visible to users logged in from a specific IP (eg the application server), as a certain user or with a certain role.
While a user with DBA role would be able to change the VPD privileges, or grant themselves the appropriate role or impersonate the relevant user, this would show up in the audit log.
i came across a similiar problem with one of our customers. During the evaluation process i have found a possible solution from a german security company. It seems they have developed a system that should prevent the DBA to access any sensitive data. Take a look at their website. It didn´t take a deeper look yet, so i cannot give you further information about this solution.
There are certain alternative companies with DB encryption and access control solutions that implement a strict separation of duties between DBA and Security Admin.
You may want to take a look into D'Amo from a Korean company, Penta Security Systems.
Disclaimer: I have worked as a DB consultant and deployed the solution to many of my customers.
Related
I want to design a database for a student portal. I want to create a student role, so for every student I need to create a user and assign the users's role. It seems like many users will be created. Could there be any problem such that large resources will be needed.
The number of user accounts is not the issue - you can create as many as you think you need. The issue that is of more concern is how many concurrent user sessions - users logged into the database at the same time - will there be? Each user needs memory to do their work and this must be allocated. If you have more simultaneous user session than memory can accommodate, this can be a problem. Read more here and here. If you will have a huge number of concurrent users, consider a shared server connection setup, rather than the default dedicated connection.
Another thing you need to be aware of is the financial cost implications depending on whether you have a per user licence.
However as others have already mentioned applications usually connect to the database using a single set of credentials, end users are not usually defined as database users, and therefore you would not be able to use the database defined roles to differentiate between the permissions.
You could likely have two database defined roles DBA or SYSADMIN, and PORTAL_APP.
The end user roles would need to be handled within the portal application, and this should be consistent on the front-end and the back-end of the application.
I am looking to learn a little more about Oracle Identity Analytics (OIA) and how it works in conjunction with other Oracle Identity Management (OIM) products. For example, what is it's role in Identity/Access Management and how do companies typically utilize it?
You can think of OIA as of an accounts and entitlements warehouse where you'd go to figure out who has access to what, when OIM is more oriented to providing automation in managing (granting and revoking access).
Where I work we utilize it mainly for Identity Audit. It covers prevention and reaction to Segregation of Duties violations. ( For example developers shouldn't have direct, high-privileged access to production environment - that would be a violation ). It's done by designing and executing Identity Audit Policies and Rules against set of employees.
Unfortunately the tool has a lot of deficiencies, so one needs to test it thoroughly before making final decision. Some of them you will be able to solve by writing some small scripts, but some of them are fully on Oracle (scaling, performance, WebUI) so you might want to wait to find out more details about OIG (Oracle Identity Governance suite) that they've announced in Oct'12 ( http://www.oracle.com/us/corporate/press/1859216 )
Oracle Identity Analytics (OIA) augments the provisioning, re-certification and privileged access components of OIM by allowing you to run Audit Policies and Role Management.
OIM allows you to define roles to automate and simplify provisioning, but it does not have the role mining capability to suggest roles based on Who has access What already. Therefore in OIM you have to manually define the roles for users. OIA can partially automate the process by looking at the data bottom up to find commonality. Oracle suggest a hybrid approach, a combination of the two.
The audit polices are aimed at Separation of Duties (or toxic combinations) which allow you to prevent access being granted where there is a conflict of interest. A typical example would be the permissions to raise a payment request and permissions to approve a payment request in some software. This is particularly important in highly regulated environments such as banking and the health sector.
In OIM for Privileged Access you would not normally use a SoD constraint for a user to have both a non-privileged and a privileged account. In fact you would want a user to by default use the Standard account and then Step-Up through a break glass process to get their password and use a Privileged Access manager to maintain the audit trail. I am more familiar with CyberArk than the Oracle product included as part of OIM.
Under Oracle Identity Governance 11g PS 2 the licence agreement should give you all the products in the suite. Over time Oracle are further integrating the two products.
My manager keeps talking about how I will be "developing" an Application Express "security module", however from what she told me we need to have, I don't see what there would be to develop, seeing as Apex already has authorization/groups which allow for various groups of people to see various content.
Is there something that I am missing? What does she mean by a "module", or is it just general wording?
APEX provides several different ways to authenticate users. One approach is to use the "Application Express" authentication scheme and just to create APEX users. Another approach is to use the "Database Account" authentication scheme and to create Oracle users. A third option is to create a custom authentication scheme and to implement your own user management functionality.
Application Express authentication tends to be the easiest to deploy for a small application but tends to get unwieldy over time. It's hard, for example, to give an application administrator the ability to create APEX accounts. You can't tie an APEX account in to a single sign-on solution. It's not easy to integrate with the permission management systems that other applications use. If you're deploying an application in a large company, the last thing the security department needs is one more place where they need to create user accounts, manage privileges, de-activate accounts when someone leaves or changes roles, etc.
Database authentication tends to be more scalable than APEX authentication since Oracle database account provisioning is likely already part of your organization's authentication and authorization infrastructure. On the other hand, that still means that you're creating an Oracle database user for every user you want to create in your application which probably involves a call to a DBA (technically, you could create database users from your application, but most DBAs are going to be concerned about the security implications of that). If you intend to create an internet-facing application with tens of thousands of users, database accounts may get unwieldy.
I'd wager that the vast majority of medium to large-scale APEX applications use a custom authentication scheme. That may involve creating a USER table where you store the username & the hash of the password or a query against an LDAP/ AD repository. That sort of approach provides the most flexibility since you can code whatever you'd like into the authentication system. You can hook into whatever custom authentication/ single sign-on solution the organization happens to use. It probably makes creating new users from within the application much easier (obviously depending on how the authentication system is designed).
My assumption is that your manager is expecting that you'll be writing a custom authentication scheme for your APEX applications.
My team will develop an internal (known users) application that has an architecture based on Java as front-end and PL/SQL as back-end. So, currently we are thinking in a better solution to manage the user/permissions, and we have two options:
Each user has their own database account, granted with the permissions. Currently the legacy system use this approach and I don't like it because it manages permissions based on database objects' granularity. So, I believe it is a bad choice to have a database connection per user. Can you see more cons here?
Build some tables at database to store the users and theirs permissions/profiles and build a PL/SQL procedure to do the login, generating a token and include a parameter to all others PL/SQL to verify this token and then authorize (or not) the execution.
So, you can ask me: why not just manage your permissions in your web-application? Answer: Those PL/SQL are already done and are used by all legacy systems, and this web-application should behave according it (ie. User permissions should be managed by the PL/SQL and its granularity based in please.)
How do you proceed in this case?
I think using the database's built-in mechanism is always to be preferred over rolling our own. And that applies to logging in users as much as anything else.
The biggest single advantage of dedicated user accounts is that we can link a given session with a named user. Well, yes, duh. But the point is, doing thinks like auditing user activity or tracing a performance issue in some process is way more difficult in web applications with generic accounts.
To address your main objection, we don't have to manage database privileges at the user level. That's why we have roles. For normal users, a role will provide sufficient privileges.
So:
define a set of roles which match the various business jobs your application serves.
grant system and object permissions to those roles; remember that roles can be additive (i.e. we can grant privileges on a role to another role).
grant roles to the users.
Find out more.
I'd like to authorize the user/application combination, not only the user.
The scenario is that we've built an app that guides the user to safe updates of some data.
If the same user installs PL/SQL Dev, Toad, or any other Oracle management tool, she can edit the data in ways that the app prohibits.
Vincent's answer is good (and he also makes a good point in his comment about spoofing the executable).
For a more programmatic method (no mid tier), see my answer to a similar question. It basically involves coding an ALTER SESSION into your application that enables a role.
You can use a proxy user to restrict access to the database. Your users would only be able to connect (authentication) and activate a role (authorization) through the middle-tier account. They would not need to know their DB password. They can be authenticated externally (with AD for example).
See this thread on AskTom and the documentation for further reading.
The v$session view contains a column 'program'. This contains the name of the connected application. You may be able to use this information.
To determine the sessions ID use this:
select
sys_context('USERENV','SID')
from dual;