Oracle security 01-security requirements & solutions

云和恩墨成就所托 by 王朝阳 18516271611 [email protected]

Security Requirements & Solutions

mailto:[email protected]


ObjectivesAfter completing this lesson, you should be able to do the following:• Describe fundamental security requirements• Define the following terms:

– Least privilege– Authorization– Authentication

• Describe security policies• Describe the concept of security in detail• Preventing exploits• Maintaining data integrity• Protecting data• Controlling data access



Industry-Security Requirements

• Legal:– Sarbanes-Oxley Act (SOX)– Health Information Portability and Accountability

Act (HIPAA)– California Breach Law– UK Data Protection Act

• Auditing



Security Standards

Recognized security standards: • ISO 17799 • SANS Institute• CERT/CC

Do your policies meet the standards?



Fundamental Data-Security Requirements

You should know the following fundamental data-security requirements:• Confidentiality• Integrity• Availability



Components for Enforcing Security

• Authentication• Authorization• Access control• Auditing



Security Risks

Risk analysis includes:• External attack:

– Unauthorized users– Denial of service– Unauthorized data and service

access• Internal abuse: data or service theft• Sabotage: data or service corruption• Complexity



Principle of Least Privilege

• Install only the required software on the machine.• Activate only the required services on the machine.• Give operating system (OS) and database access

to only those users who require access.• Limit access to the root or administrator account.• Limit access to SYSDBA and SYSOPER accounts.• Limit users’ access to only the database objects

that are required to do their jobs.



Defining a Security Policy

• What is a security policy?– A set of rules– Specific to an area and site– Required – Approved by management

• What is a standard?– Rules specific to a system or process– Required for everyone

• What are guidelines?– Suggestions and best practices– Specific to a system or a process



Developing Your Security Policy

The steps to develop your security policy are:1. Assemble your security team.2. Define your security requirements.3. Develop procedures and systems to meet these

requirements.4. Implement security procedures.



Examining All Aspects of Security

Consider the following dimensions:• Physical• Personnel• Technical• Procedural

Example: An employee leaves his or her desk while using an application.



Implementing a Security Policy

• Implement your standards and procedures.• Implement the plan for developing new systems

and applications.• Monitor and enforce the policy.• Keep systems and applications up-to-date with

security patches.• Educate users.



Hardening the Operating System

• Limit services to required services.• Limit users.• Use security from the service.• Apply all security patches and workarounds.• Protect backups.• Test security for in-house development.• Require strong passwords.• Control physical access.• Audit system activity.• Use intrusion-detection tools.



Easing Administration

• Examine the security features of the service:– Select the features that meet your security

requirements.– Integrate the features to simplify administration.

• Ease security administration by:– Using single sign-on– Delegating security authority– Grouping users with common privileges– Synchronizing with other sources



Using a Firewall to Restrict Network Access

ApplicationWeb server

Databaseserver

Client computers

Firewall Firewall



Hardening Oracle Services

• Harden the database.• Harden Oracle Net Services. • Use Connection Manager as a firewall.• Use available components:

– Fine-grained access control– Enterprise user authentication – Encryption– Label security – Strong authentication by using public key

infrastructure or Kerberos• Harden the middle tier.



Preventing Exploits

Use industry-standard practices:• Harden the database.• Harden the operating system.• Harden the network.



Maintaining Data Integrity

Sarbanes-Oxley requires assurance of the integrity of the data that is used to produce financial reports. Oracle Database 10g can provide the following: • Standard auditing• Fine-grained auditing• Privileged-account auditing• Network encryption



Data Protection

Under CA-SB-1386, personally identifiable information must be protected. Use the following techniques:• Restrict access.• Encrypt stored data.• Encrypt network traffic.• Restrict network access.• Monitor activity.• Harden every layer.

OKYMSEISPDTGA

MyCreditCardNum



Access Control

The law requires that only certain persons may access specific data. Access control and monitoring include: • Implement the Virtual Private Database (VPD):

– Application context– Fine-grained access control (FGAC)

• Use Oracle Label Security (OLS).• Apply auditing.



SummaryIn this lesson, you should have learned how to:• List and describe fundamental security

requirements• Define the following terms:

– Principle of least privilege– Authorization– Authentication

• Describe some security risks and requirements• Describe the concept of security in detail• Preventing exploits• Maintaining data integrity• Protecting data• Controlling data access



Q&A


Technology

Oracle security 01-security requirements & solutions