1.2k likes | 1.56k Views
A First look at Database Vault David Bergmeier. Agenda. Overview Installation Limitations Securing Data Backups A trigger problem. About me. Senior Oracle DBA Worked for MGA nearly 2 years Background as an Analyst/Programmer 12 years in financial services industry
E N D
Agenda • Overview • Installation • Limitations • Securing Data • Backups • A trigger problem
About me • Senior Oracle DBA • Worked for MGA nearly 2 years • Background as an Analyst/Programmer • 12 years in financial services industry • Started using Oracle in 1996
Overview Why Oracle Database Vault? • Don’t trust the DBA • Regulatory Compliance(e.g. Sarbanes Oxley) • Separation of duties
Separation of duties connect / as sysdba create user david ... grant dba to david; select * from scott.emp;
Separation of duties connect / as sysdba create user david ... grant dba to david; select * from scott.emp;
Agenda • Overview • Installation • Limitations • Securing Data • Backups • A trigger problem
Prerequisites • Oracle 10.2.0.3 • 1024 MB of Physical RAM • Swap space (1.5 times RAM) • 400 MB in /tmp • 270 MB for database vault binaries • 10 MB additional for database files
Prerequisites Installation • Assumes one instance per Oracle home • But can support more
Installation User to receive DV_OWNER role
Installation Passwords must have alpha, numeric & special
Installation User to receive DV_ACCTMGR role
Agenda • Overview • Installation • Limitations • Securing Data • Backups • A trigger problem
The First Problem Let’s start the database
The First Problem I cannot login as SYDBA So how do I start/stop Oracle?
The First Problem connect / as SYSOPER
Agenda • Overview • Installation • Limitations • Securing Data • Backups • A trigger problem
Securing Some Data $ lsnrctl start $ emctl start dbconsole
Securing Some Data $ sqlplus system/manager SQL> select * from scott.emp; ... 14 rows selected. SQL>
What is a Realm? A realm is a functional grouping of schemas and roles that are secured.
Realm Authorizations Secured Objects What is a Realm? One Many
Securing Some Data SQL> select * from scott.emp; select * from scott.emp * ERROR at line 1: ORA-01031: Insufficient Privileges SQL>
Securing Some Data SQL> select * from scott.dept; DEPTNO DNAME LOC ---------- -------------- -------- 10 ACCOUNTING NEW YORK 20 RESEARCH DALLAS 30 SALES CHICAGO 40 OPERATIONS BOSTON SQL>
Securing Some Data That’s the end of the tutorial. So now let’s consider a real world application.
application user SCOTT Real world Example Application server connects to database as single user EMP