Call: +44 (0)7759 277220 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "The JHeadstart blog talks about J2EE authentication and authorization with JHeadstart"] [Next entry: "A new free Java based Oracle password management tool"]

Jonathan Lewis on Row Level Security - part 2

I talked about a week ago about the first part of a multi-part paper I found by Jonathan when I was looking for something else on Google. The post was titled "Jonathan Lewis on Row Level Security" and was the first part of Jonathans paper. I was looking a day or so ago for the second part and beyond but found that the domain name for dbazine had expired according to the page I was given. Today I checked back again and the DBAZine site seems to be back again. The first part of Jonathans paper is also on his own site if the glitch should occur again.

I found the second part of this paper titled "Row Level Security Part 2: Security Policies" on DBAZine. This is a good paper and well worth reading for anyone interested in Oracle security. Jonathan gives some great examples and covers requirements, security policies, preparing Row Level Security, some problems and a conclusion where Jonathan makes a good statement that says "For relatively simple requirements Im not convinced that you really need to go any further than the deliberate creation of views described in the first article in this series." - This is refreshing in articles about specific functionality to remind the reader that it is not always necessary to embrace all new features and functions just for the sake of it.