Download ebooks file (Ebook) Oracle Database Application Security: With Oracle Internet Directory, Oracle Access Manager, and Oracle Identity Manager by Osama Mustafa, Robert P. Lockard ISBN 9781484253663, 9781484253670, 1484253663, 1484253671 all chapters
Download ebooks file (Ebook) Oracle Database Application Security: With Oracle Internet Directory, Oracle Access Manager, and Oracle Identity Manager by Osama Mustafa, Robert P. Lockard ISBN 9781484253663, 9781484253670, 1484253663, 1484253671 all chapters
com
DOWLOAD EBOOK
ebooknice.com
ebooknice.com
https://ebooknice.com/product/sat-ii-success-
math-1c-and-2c-2002-peterson-s-sat-ii-success-1722018
ebooknice.com
ebooknice.com
(Ebook) Cambridge IGCSE and O Level History Workbook 2C -
Depth Study: the United States, 1919-41 2nd Edition by
Benjamin Harrison ISBN 9781398375147, 9781398375048,
1398375144, 1398375047
https://ebooknice.com/product/cambridge-igcse-and-o-level-history-
workbook-2c-depth-study-the-united-states-1919-41-2nd-edition-53538044
ebooknice.com
ebooknice.com
ebooknice.com
ebooknice.com
ebooknice.com
Oracle Database
Application
Security
With Oracle Internet Directory,
Oracle Access Manager,
and Oracle Identity Manager
—
Osama Mustafa
Robert P. Lockard
Oracle Database
Application Security
With Oracle Internet Directory,
Oracle Access Manager, and
Oracle Identity Manager
Osama Mustafa
Robert P. Lockard
Oracle Database Application Security
Osama Mustafa Robert P. Lockard
Amman, Jordan Baltimore, MD, USA
Chapter 1: Encryption���������������������������������������������������������������������������1
Transparent Data Encryption���������������������������������������������������������������������������������1
Rekey the Keystore Master Encryption Key�����������������������������������������������������6
Query the Master Key Information�������������������������������������������������������������������7
Rekey a Table Key������������������������������������������������������������������������������������������15
Rekey a Tablespace���������������������������������������������������������������������������������������15
Change the Password of the Keystore�����������������������������������������������������������16
Column Encryption����������������������������������������������������������������������������������������������17
Salt or No Salt?����������������������������������������������������������������������������������������������18
Encrypt a Column in an Existing Table����������������������������������������������������������18
Primary Key Foreign Key Constraints on an Encrypted Column��������������������19
Rekey a Column���������������������������������������������������������������������������������������������19
Tablespace Encryption����������������������������������������������������������������������������������������20
Tablespace Encryption vs. Column Encryption Performance������������������������������22
External Table Encryption������������������������������������������������������������������������������������24
Where Can Data Spill Out in Plain Text When Using External Tables?�����������������28
Full Database Encryption������������������������������������������������������������������������������������30
v
Table of Contents
Ghost Data����������������������������������������������������������������������������������������������������������31
How to Fix It���������������������������������������������������������������������������������������������������33
Column Encryption����������������������������������������������������������������������������������������33
Tablespace Encryption����������������������������������������������������������������������������������33
Full Encryption�����������������������������������������������������������������������������������������������33
Online Tablespace Encryption������������������������������������������������������������������������34
External Tables����������������������������������������������������������������������������������������������34
Algorithms�����������������������������������������������������������������������������������������������������34
RMAN������������������������������������������������������������������������������������������������������������������35
Data Pump����������������������������������������������������������������������������������������������������������36
Network Encryption and Integrity�����������������������������������������������������������������������39
Configure�������������������������������������������������������������������������������������������������������39
Cross-Border Issues��������������������������������������������������������������������������������������43
Integrity���������������������������������������������������������������������������������������������������������44
Chapter 2: Audits��������������������������������������������������������������������������������47
Ways to Audit a Database�����������������������������������������������������������������������������������48
Application API Code��������������������������������������������������������������������������������������48
Auditing with Trigger Code����������������������������������������������������������������������������48
Normal Audit��������������������������������������������������������������������������������������������������49
Unified Audit��������������������������������������������������������������������������������������������������50
Fine-Grained Auditing������������������������������������������������������������������������������������52
Comparing Methods��������������������������������������������������������������������������������������53
What Happened Yesterday�����������������������������������������������������������������������������55
What Are You Looking for When You Audit?���������������������������������������������������������67
Accessing Information Outside of the Trusted Path��������������������������������������������67
vi
Table of Contents
vii
Table of Contents
viii
Table of Contents
ix
Table of Contents
Index�������������������������������������������������������������������������������������������������333
x
Visit https://ebooknice.com to
discover a wide range of
eBooks across various genres.
Enjoy exclusive deals and
discounts to enhance your
reading experience. Start your
digital reading journey today!
About the Authors
Osama Mustafa is the first Oracle ACE Director
in the Middle East and creator/director of the
Jordan Amman Oracle User Group, the first
group in Jordan related to Oracle technology.
The author of two oracle books, Osama is
providing a different high services to clients
around the world, Furthermore Osama works
with different cloud vendors such as AWS,
Google, and Oracle. He has experience in automating and implementing
projects around the world, as well as solid knowledge of many different
databases. Osama has presented at conferences around the world and has
written more than 100 articles for different magazines. He also shares his
knowledge on his web site at www.osamaoracle.com/.
xi
About the Technical Reviewer
Srinath Menon is currently working with
Oracle India Pvt Ltd for the Oracle Identity
and Access Management Support team where
he deals with product-related issues that are
technical and functional in nature. Prior to
being associated with the OIAM product stack,
he worked with the Oracle WebCenter Suite.
He is also involved in the Oracle forums
and community.
xiii
Acknowledgments
I am grateful to several people. First I would like to thank my mother for
motivating me to become a writer, my fiancée who was patient with me
during this project while I spent many weekends working, and my family
for their support and understanding of my chosen path and my obsession
of information technology. I would like to thank my coauthor, Rob, for
collaborating with me on this book. Without all of your support, this book
would not have been possible.
—Osama Mustafa
There are quite a few people who made this book possible. Thanks to
Candace Dayton for constantly asking the hard questions and encouraging
me; to Associate Professor Olesya Zmazneva, PhD, for passing chapters on
to her students so I could get feedback from non-native English speakers
who are new to this business; to Darya Lutkova, for reading the draft of
the secure coding chapter and then asking great questions that made the
chapter even better; and to Roger MacNicol who always made himself
available to answer my questions or to bounce ideas around.
—Robert P. Lockard
xv
Introduction
Security is a complex subject. With the number of attacks on different
systems increasing every day, securing a system to protect your company’s
data can be overwhelming. However, there is a pragmatic approach you
can take to implement a security solution to meet your requirements and
to secure the system and protect your data.
In this book, you will learn about database security and how to secure
your database against database threats, and you’ll see real examples of
these threats. Furthermore, this book covers application security and
implements single sign-on with different products such as Oracle Internet
Directory, Oracle Access Manager, and Oracle Identity Management.
Specifically, in this book, you will learn about the following topics and
technologies:
• Single sign-on
xvii
CHAPTER 1
Encryption
From the time of Julius Caesar and the “Caesar shift” algorithm, people
have been using encryption to protect information from prying eyes. To
use encryption properly, you need to understand how data moves through
systems, from storage to where the data is presented. If you are not careful,
there will be places where encrypted data will spill out unencrypted.
You also need to understand that encryption is just one part of securing
your information. Even after you set up encryption, you need to concern
yourself with ghost data that may be left behind in storage unencrypted.
In this chapter, we’ll discuss how to set up Transparent Data Encryption
(TDE), how to implement network encryption, and where ghost data can
be found so it can be safely destroyed and kept from prying eyes.
2
Chapter 1 Encryption
a scope of spfile and then restart the database. The choice is yours. We
prefer to use the alter system command.
Create the user c##sec_admin that will be used to manage TDE, create
the keystore, and do the rekeying operations. This user must be granted
the syskm and connect privileges.
3
Chapter 1 Encryption
Now that we have the account set up to manage TDE, we can create
the keystore. There are a couple of options when we create the keystore.
One of them is to set up an auto open keystore. There are some corner
cases where you would not want an auto open keystore, but most
databases that we have worked with were up 24/7; therefore, if there is a
case where you needed to restart the database, the keystore would open
up automatically.
There is an argument to not use an auto open keystore in case the
keystore ever gets lost. If you are concerned about forgetting the password
to the keystore, put the password in the password envelope that is kept in
the safe along with the other admin passwords.
When we create the keystore using the administer key management
command, we do not need to set the keystore location because we set the
wallet_root value in the configuration.
Now if you look in the wallet_root location, you will see that an empty
keystore named ewallet.p12 has been created.
4
Chapter 1 Encryption
Now we’re going to set the master encryption key. This is needed to
decrypt the tablespace and table encryption keys. We use a tag to indicate
this is the initial master encryption key and automatically create a backup
with bk1 in the backup name.
You’ll notice that after you create the master key, the file size will
change, and a backup of the original keystore will be created.
5
Chapter 1 Encryption
• Master key
• Table key
• Tablespace key
When you rekey the master encryption key, a history of the master
encryption keys is kept in the keystore; this history will be needed if you
need to recover backups.
You will notice that in the example, we used the current date for the
tag. This will make it easier to know what master keys are out there and
when they were created.
6
Visit https://ebooknice.com to
discover a wide range of
eBooks across various genres.
Enjoy exclusive deals and
discounts to enhance your
reading experience. Start your
digital reading journey today!
Chapter 1 Encryption
V$ENCRYPTION_WALLET
Let’s see what keystores (wallets) you have and their statuses. You see that
the type of keystore is FILE, and you can see the location of the keystore,
which is open. A single wallet is configured, which is in the ROOT container.
It’s fully backed up and has connection ID 1 (the root container).
7
Chapter 1 Encryption
V
$ENCRYPTION_KEYS
To get a list of the encryption keys and what they apply to, use the
following (see Figure 1-1):
select tag,
activation_time,
creator,
key_use,
keystore_type,
backed_up,
activating_pdbname
from V$ENCRYPTION_KEYS;
9
Chapter 1 Encryption
Figure 1-1. Getting a list of the encryption keys and what they
apply to
Here you’ll see the master encryption keys for the root container and
the pluggable database ORCLPDB1:
10
Chapter 1 Encryption
11
Chapter 1 Encryption
12
Chapter 1 Encryption
V$DATABASE_KEY_INFO
Query the keys that are being used to encrypt the system, sysaux, temp,
and undo tablespaces. You will notice that when you query from the root
container, you get all the keys, and when you query from the pluggable
database, you get only the key information for the pluggable database.
13
Chapter 1 Encryption
4 con_id
5* from v$database_key_info
14
Chapter 1 Encryption
You can also change the encryption algorithm with the rekey option.
Use the rekey using <algorithm> option.
Rekey a Tablespace
Rekeying a tablespace requires you know the name of the data files,
because you are going to need to use the FILE_NAME_CONVERT clause. The
first thing you are going to do is to get the file names for the data files. After
you have the file name, then execute the alter tablespace <tablespace>
encryption rekey command.
15
Exploring the Variety of Random
Documents with Different Content
All the shadows crowded around the mouth of the bag, and one
after another stooped and went in. There was none left but the
shadow of the old woman herself. She closed the bag, now bulging,
and flinging it over her shoulder she said to her own shadow,
“Hither, Skag, and lie down!”
Her shadow moved close to her, and spread itself out on the ground
with its feet to hers, growing longer as it did so, so that it became
no more than an ordinary shadow cast by the lamplight on the floor.
The old woman went to the lamp and blew out the light, and the
room was in darkness, except for the glimmer of the dying fire.
I flattened myself on the ground as the door opened and the old
woman came forth with her bag on her back. I could scarcely see
her, and in an instant she had disappeared in the darkness.
I must tell you (said the fat young man), that I am an apothecary,
and my name is Tush.
“We had a Lord Treasurer once,” interrupted the Queen, “whose
name was Filch. It seemed so odd.”
My name is Tush; and this damsel, my sister, who was lately a
Ragpicker, is known as Paravaine. So much for that. I now proceed
to the catastrophe which begins my tale, and I hope you will pardon
me if I pause at times to wipe away a tear.
We were left alone at an early age, my sister and myself, without
kith or kin, and we dwelt together in the city of our birth, the city of
Fadz—you have heard of Fadz? A seaport of the Kingdom of Wen, a
city of ships and conversation; and in that city we dwelt quietly
together, and there I kept my shop.
My sister, as you may see by looking at her, was beautiful in the
highest degree; and I am bound to admit to you that she was not a
little vain of her beauty, and prized admiration above all things in the
world. Regarding myself, I may say that I was considered to be quite
handsome, though a trifle fat.
In the art of inventing remedies I greatly excelled; and I would
beyond a doubt have succeeded in my profession, but that I was
much given to the making of songs and the tasting of rare dishes,
and these two occupations consumed the greater part of my days.
My sister, on her part, applied herself so diligently to the adornment
of her lovely person before the mirror, that she had scarcely time for
anything else. In consequence, my business and my house fell into
neglect; and another apothecary, a tuneless fellow in a neighboring
street, who knew not beef from mutton, took away all my trade. But
such is the fate of your true artist, the world over.
I forgot, in the application necessary for the composition of songs,
the foolish moneys which I chanced to owe here and there, and at
length (so dead to the finer things of life is the coarse mind of
trade), I could find no one who was willing to trust us any longer,
even for the meanest knuckle of the least respectable portion of a
pig. I burn with indignation when I think of it,—but I proceed.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebooknice.com