Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> How To Block Super User In Particular Time.
        
(Message started by: Pete Finnigan on Aug 20^th, 2010, 11:11am)

Title: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 20^th, 2010, 11:11am

Hey Guys...

I really found this website very helpful. But here this time i got stuck, I just simply want to know the way to block the "Super User" or "DBA " to access the Oracle Database.
Definitely their might be a way out for this. Is there any method at the time of installation of database we can provide the agreement date. So that after that date the user and the super user/DBA will not able to fetch/access the data from database.

Definitely their will be a way to resolve this...
It will be really appreciated if will get the solution for this.

Thanks in advance.

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 20^th, 2010, 12:17pm

Hi Vibhu,

Could you give us some more information what you are trying to accomplish with this. For example: are you trying to block one specific user? SYS or SYSTEM or someones account?

Or do you want to block all DBA accounts? That doesn't seem like a good idea since DBAs probably need to administer the database.

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 20^th, 2010, 12:34pm

Hi Marcel

Actually the motto is to block the complete access to the database. For example:

As a vendor, we are the application provider, once we'll installed our application and the oracle database (registered version). Vendor usually provide with the support to the application, for that Annual Maintenance Charges(AMC) are there. But right now as any of the client will over with the AMC, they need not to pay anything as AMC as because application is running perfectly, they won't renew with the AMC. So i want any solution, like if the AMC Date will be over, on or from same date the database access will also stopped, or simply all the users and the Super user/DBA received with a message like "Please Contact To The Vendor, To Renew The AMC".

I Suppose the above example will figure you out, that what exactly I need.

As the business point of view, I need any solution to secure the Data access after a particular Span of time(or the contract period).

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 20^th, 2010, 3:58pm

Wow. Would you even deny them to get the data they gathered over the year? That sounds extremely customer unfriendly. Hint: it's not such a great business model as it may sound now. There are much better ways to convince customers they need your support, like reminding them regularely what you do for their money.

Anyway I don't think there is such a feature, except maybe Database Vault. It can block even DBAs, but the licence is probably more expensive than the AMC.

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 21^st, 2010, 9:48am

Hello Marcel.

Its not on the rude side. But sometimes customers deny or simply postpone the plans to through with the payments.

Such customers forced to take some steps like this. If you have some other alternate to stop with the services calmly so that clients will have to call the vendor to start with the services.

So is there any way out which will provide the solution for both the vendor and the client.

I need a calm and polite way out.

As I already know about the database vault, but that is not the budgeted solution. Is there any other alternate for this.

Will VPD(Virtual Private Database) help me out from this? Will it possible to define some policies in RLS(Row Level Security), so that the access will be stopped after some time?

Please Suggest me for the above.

It would be really appreciated.

Thanks in advance.

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 23^rd, 2010, 12:55pm

Hey Marcel

I'm still waiting for ur response.

Is there any other alternate, in spite of database vault.
Will VPD provide & resolve the concern?

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 24^th, 2010, 12:42pm

Hey MJ

I'm still waiting for your response.

Please assist me on this.

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 24^th, 2010, 1:01pm

Hi Vibhu,

I still think it is a rather harsh measure. You might want to warn customers that that might happen if they don't pay. Probably somewhere in the fine print.

Virtual Private Database and RLS are the same thing as far as I know and as long as the DBA reigns on the database server, there is always a way to get around the data. Which I would probably want if I was the DBA.

Also, I would probably backup regularely. And I would make sure to export the data after restore, so I would still have them safely somewhere.

The message is: expect a lot of creativity if people find out that access to their data is blocked.

Your best bet would be to block the application in stead of the database. It's still harsh, but at least they haven't lost the data, which I think is their right to keep.

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 24^th, 2010, 1:11pm

Thanx a tonn MJ

But this even i'm thinking from the client's side too. Because sometimes clients want to deploy the application on internet. So i want to provide them with the secured network. As the world is full of hackers. For that purposes if we will restrict the specific roles and privileges to the database, simultaneously we will apply VPD concept, will that help to protect the data from stealth.

Thanks & Regads
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 30^th, 2010, 8:16am

Hi MJ

Hope you got some conclusion...

Best Regards
Vibhu