KK Mookhey who is based in India and is CTO of Network Intelligence India Pvt. Ltd has written an excellent paper about auditing an Oracle database, this was published sometime ago but is still generating interest and quite a lot of people have not seen or read it yet so I thought I would talk about it here. The paper is called "Auditing Oracle Security" and is available here.
This paper is very well written and covers a good degree of the ground to get anyone started on trying to secure a database. It covers the installation, parameters, users and profiles, default accounts, how to use auditing, even defunct accounts, password management, roles and privileges and of course the listener. KK also talks about controls within the database such as the product user profile functionality for controlling access through SQL*Plus. He covers Virtual Private Databases (VPD) and encryption. KK also gives good advice on how to focus any audit of an Oracle database.
This is a good overall discussion on Oracle security and anyone starting to think about auditing an Oracle database should read it before delving into more detailed discussions and tools.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "The SANS S.C.O.R.E. Oracle security checklist has been updated"] [Next entry: "eweek article: Oracle Users Take Aim at High Costs, Security Silence"]
September 2004
- A new Oracle security based weblog - 09/20/2004 by 09/20/2004
- Are your system triggers firing? - 09/21/2004 by 09/21/2004
- Arup Nanda is interviewed about the Oracle security patch nightmare - 09/22/2004 by 09/22/2004
- The SANS S.C.O.R.E. Oracle security checklist has been updated - 09/23/2004 by 09/23/2004
- KK Mookhey writes about auditing Oracle security - 09/24/2004 by 09/24/2004
- eweek article: Oracle Users Take Aim at High Costs, Security Silence - 09/25/2004 by 09/25/2004
- Oracle Database 9i SQL Command Buffer Overflow Vulnerability - 09/26/2004 by 09/26/2004
- Creating read only users - 09/28/2004 by 09/28/2004
- Oracle announce that clients also need patching for alert #68 - 09/30/2004 by 09/30/2004
Archives
Syndication
Powered by gm-rss 2.0.0
