Dienstag, 15. November Security

Transcription

1 Security

2 Database Security Extreme - Example Configuration - SAOUG11 Security Peter Kestner Tech Director - Security ORACLE Technology Europe - Middle East - Africa

3 Disclaimer This example will show features which are available today with OpenSolaris and/or Solaris>10 This does not mean that possible combinations are valid for support/production (only supported combination is Solaris>10 with corresponging Oracle Databases) The base target of the following Information is to demonstrate structures, functionalities and setup

4 Project Levels Application & Middleware Database Operating system Server & Storage

5 OS Challenges Priviledged users (root, oracle,...) Easy to use and changeable filesystems/devices Difficult security related monitoring Not used audit features -> No evidence for actions Thinking: Security prevents daily work Unclear access path Insider threats Account jumings

6 Database Challenges High priviledged users may see/change everything SqlNet not encrypted by default Data in DB/OS/Backup not encrypted by default Default auditing to unsecure / not enough Prod vs. Test systems Insider threats SQL injections External access control

7 The Mission Extreme secure Oracle database environment Intelligent combination / usage of available security features (OS+DB) Easy to use and to manage Invisible protection for daily work Defined DEFCON levels

8 The Approach (1/3) - OS Zones Encapsulate database in own environment Zone configuration and resources are controlled from outside Zone Networking inclusive IPF/IPNAT Enforce network traffic Block/Filter traffic Map external to/from internal traffic Control network traffic Log/Monitor network traffic ZFS with Zones Filesystem will be controlled from outside Selective read/execute rights per filesystem (dataset) The use of snapshots enables evidence and fast return

9 The Approach (2/3) - OS RBAC (Roled Based Access Control - OS) No high priviledged user (root/oracle) User rights and execute control Enforce correct login BSM (Base Security Module - OS) Create audit trail Enforce that audit data are trustable Store access- and execute- path BART (Basic Audit and reporting tool - OS) Doublecheck OS-Installation with fingerprint database Searches for changes on files and directory-zones Encapsulate database in own OS environment Zone configuration and resources are controlled from outisde

10 The Approach (3/3) - OS Projects- and Resource- Controls Limited access or usage of Memory/Swap/CPU PRM (Process right management) Reduces rights for processes/users/executable SMF (Service management facilities) Central switchboard for services Access to the switchboard might be granted/restricted Dtrace Others CryptoFramework, Kerberos, IPsec, Trusted Extensions, signed patches, ssh,/def/random, pam, smartcard framework, java security, ldap connections...

11 The Approach - Oracle Database Oracle Database Firewall Oracle Advanced Security Oracle Database Vault Oracle Label Security Oracle Total Recall Oracle Audit Vault Oracle Configuration Management Oracle Data Masking Copyright 2010, Oracle. All rights reserved

12 DB environment

13 Securing data in rest / access control ASO Component: - Transparent Data Encryption (TDE) - Strong authentication

14 Securing data in motion (Network encryption / ASO) Virtual Private Database Oracle Label Security Encryption (TDE) Strong authentication

15 Securing Backup (Network encryption / ASO) Protected Backup ASO Component: - Transparent Data Encryption (TDE) - Strong authentication

16 DataMasking (Network encryption / ASO) Protected Backup DataMasking ASO Component: - Transparent Data Encryption (TDE) - Strong authentication

17 Prevent unauthorized modifications by insiders (Network encryption / ASO) Protected by Database Vault Protected Backup ASO Component: - Transparent Data Encryption (TDE) - Strong authentication

18 Database Firewall Database Firewall (Network encryption / ASO) Protected by Database Vault Protected Backup DataMasking ASO Component: - Transparent Data Encryption (TDE) - Strong authentication

19 Auditing / Monitoring Database Firewall (Network encryption / ASO) Protected by Database Vault Protected Backup DataMasking ASO Component: - Transparent Data Encryption (TDE) - Strong authentication Protected by Audit Vault

20 Demo Project (Alcatraz)

21

22 Security