Oracle Database Security Administration Training

Introduction 

• Standards and risks: assessing the need
• Developing a security policy
• Multi-layered security: defence in depth
• Selecting a security solution

SQL Injection 

• What is SQL injection?
• How can injections be made?
• How can attempted injections be blocked?

User authentication

• Authentication delegated to the operating system
• Administrative user authentication
• Use of a password file
• Data dictionary password authentication
• Proxy authentication
• Using the external secure password store
• Authentication by external services

Basic Access control with roles and privileges

• Direct system and object privileges
• Grouping privileges into roles
• Enabling and disabling roles

Some more advanced topics with roles and PL/SQL

• Secure application roles
• Assigning roles through OS authentication
• The PL/SQL privilege model: definers and invokers rights code
• Code based access control
• Privilege inheritance and controlling privilege escalation
• Privilege usage analysis

Database links

• Public and private database links
• Authentication options for links
• Security risks and auditing of links

Virtual Private Database

• Local and global application contexts
• Using contexts for fine grained access control
• Row level security
• VPD performance issues

Control access to the operating system

• Access to the server file system with PL/SQL
• Use of directories
• Access to network facilities with PL/SQL
• Use of Scheduler external jobs
• External procedure

Encryption within the database

• Programmatic data encryption
• Transparent column encryption
• Transparent tablespace encryption
• Key management

Encryption outside the database

• Encryption in the redo stream
• Encrypted backups
• Encrypting in export dumps

Concealing data

• The Data Masking Pack
• Data redaction
• Transparent Sensitive Data Protection

Network security

• Encrypting network traffic
• Access control with Oracle Net
• Access control with the Connection Manager

Audit

• Traditional audit: users, privileges, and objects
• Fine Grained Auditing
• Auditing SYS activity
• Auditing with triggers
• Unified audit