Oracle Database Security 12c

Transcription

1 Oracle Database Security 12c Jan Peter Timmermann, PITSS GmbH The Oracle Modernization Experts PITSS GmbH 2014

2 Wer wir sind: Forms und Reports Modernisierungsexperte über 15 Jahre Erfahrung mit Oracle Technologien Oracle Gold Partner Mitglied der Oracle Modernization Alliance Oracle Forms Migration Partner PITSS GmbH Geschichte PITSS America LLC PITSS GmbH Stuttgart/Bielefeld PITSS GmbH

3 PITSS Standorte Troy (MI), USA Milton Keynes, UK PITSS Region Nord D Bielefeld region.nord@pitss.de Tel.: PITSS Region Südwest (HQ) D Stuttgart region.suedwest@pitss.d e Tel.: PITSS Region Südost D Wolfratshausen region.suedost@pitss.de Tel.:

4 Security Risks and Oracle Solutions Security Requirements Basic Database Security Oracle Solutions Net Services Firewall Network Traffic Encryption Listener Security Authentication Basic Strong Proxy Database and Enterprise Users Data Access Control Privileges and Roles Privilege Analysis Virtual Private Database RMAN Virtual Private Catalog Oracle Label Security Data Confidentiality Data Redaction Data Masking Transparent Data Encryption TDSP DBMS_CRYPTO Database Storage Security Auditing Unified Auditing Fine Grained Audit 4

5 Use a firewall. Restrict IP addresses. Encrypt network traffic. Use network log files to monitor connections. 5

6 Restricting Network IP Addresses tcp.validnode_checking = YES tcp.excluded_nodes = ( ) tcp.invited_nodes = ( , ) 6

7 Restricting Network IP Addresses Do not use IP restrictions as your only security. IP addresses can be spoofed. Use listener node registration lists. Limit access by protocol: TCPS is a secure protocol and can be used 7

8 8

9 9

10 10

11 Listener Security: Checklist Limit the privileges of the listener. Restrict node registration. Move the listener to a nondefault port. Secure administration. Protect against denial of service (DoS) attacks. Monitor listener activity. 11

12 Password protecting the listener is no longer supported. Local listener administration is secured through local By default, remote listener administration is disabled. Remote listener administration allows all commands except START. 12

13 INBOUND_CONNECT_TIMEOUT Protect the listener from DoS attacks with the following network parameters: SQLNET.INBOUND_CONNECT_TIMEOUT INBOUND_CONNECT_TIMEOUT_listener_name These parameters: Set the time allowed for a connection to complete authentication Log failures with source IP addresses Default 60 Sekunden 13

14 ORAPKI Anlegen eines Wallet mit ORAPKI Configuring SSL for Client Authentication and Encryption With Self Signed Certificates On Both Ends Using orapki Doc ID ) 14

15 orapki wallet create wallet /home/oracle/wallet/server_wallet auto_login pwd welcome1 orapki wallet add wallet /home/oracle/wallet/server_wallet/ dn "CN=server" keysize 512 self_signed validity 365 pwd welcome1 orapki wallet export wallet /home/oracle/wallet/server_wallet dn "CN=server" cert server_ca.cert orapki wallet create wallet /home/oracle/wallet/client_wallet auto_login pwd welcome1 orapki wallet add wallet /home/oracle/wallet/client_wallet dn "CN=client" keysize 512 self_signed validity 365 pwd welcome1 orapki wallet export wallet /home/oracle/wallet/client_wallet dn "CN=client" cert client_ca.cert orapki wallet add wallet /home/oracle/wallet/client_wallet trusted_cert cert server_ca.cert pwd welcome1 orapki wallet add wallet /home/oracle/wallet/server_wallet trusted_cert cert client_ca.cert pwd welcome1 15

16 LISTENER = (DESCRIPTION_LIST = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = fmw11gr2)(port = 1521)) ) (DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = fmw11gr2)(port = 1522)) ) ) WALLET_LOCATION = (SOURCE= (METHOD=File) (METHOD_DATA= (DIRECTORY=/home/oracle/wallet/server_wallet))) 16

17 Basic User Authentication by Password A database user: CONNECT paul/xxx Identity: paul Authentication method: password Password: xxx Audited Schema SQL> CREATE USER username IDENTIFIED BY password; A common user connects with the same password in all containers of a CDB: CONNECT c##u1/xxx@pdb1 CDB1 CONNECT c##u1/xxx@pdb2 PDB1 PDB2 PDB3 CONNECT local_u1/p1@pdb3 A local user connects with its own password in the PDB. 17

18 New Administrative Privileges Administrative Privilege Username Tasks SYSDBA, SYSOPER SYS / PUBLIC Same operations as in 11g SYSASM SYS Specific to ASM instances only SYSBACKUP SYSBACKUP Perform RMAN backup and recovery operations from RMAN or through SQL SYSDG SYSDG Perform Data Guard operations with Data Guard Broker or DGMGRL SYSKM SYSKM Manage transparent data encryption keystore operations 18

19 New Administrative Privilege: SYSBACKUP System / Object Privileges ALTER DATABASE ALTER SYSTEM CREATE SESSION ALTER SESSION ALTER TABLESPACE DROP TABLESPACE UNLIMITED TABLESPACE RESUMABLE Statements and Roles CREATE ANY DIRECTORY CREATE ANY TABLE CREATE ANY CLUSTER AUDIT ANY SELECT ANY DICTIONARY SELECT ANY TRANSACTION SELECT X$ tables, V$ / GV$ views EXECUTE SYS.DBMS_BACKUP_RESTORE SYS.DBMS_RCVMAN SYS.DBMS_IR SYS.DBMS_TTS SYS.DBMS_TDB SYS.DBMS_PLUGTS SYS.DBMS_PLUGTSP CREATE PFILE CREATE SPFILE CREATE CONTROLFILE DROP DATABASE STARTUP, SHUTDOWN CREATE / DROP RESTORE POINT (GUARANTEED restore points) FLASHBACK DATABASE SELECT_CATALOG_ROLE HS_ADMIN_SELECT_ROLE 19

20 New Administrative Privilege: SYSDG System / Object privileges CREATE SESSION ALTER SYSTEM ALTER SESSION ALTER DATABASE SELECT ANY DICTIONARY SELECT X$ tables, V$ and GV$ views DELETE / SELECT APPQOSSYS.WLM_CLASSIFIER_PLAN EXECUTE SYS.DBMS_DRS Statements and Roles STARTUP SHUTDOWN CREATE RESTORE POINT DROP RESTORE POINT (including GUARANTEED restore points) FLASHBACK DATABASE 20

21 New Administrative Privilege: SYSKM System / Object privileges CREATE SESSION ADMINISTER KEY MANAGEMENT SELECT SYS.V$WALLET SELECT SYS.V$ENCRYPTION_WALLET SELECT SYS.V$ENCRYPTED_TABLESPACES Connected as SYSKM predefined user Manage TDE operations Keystore creation, opening, closing Master Key creation and changes Column and tablespace keys management Access to TDE information in appropriate views No access to application data 21

22 Creating Common and Local Roles Container Database CDB1 root c##r1 In a CDB, a common role is created in all containers. SQL> CREATE ROLE c##r1 CONTAINER=ALL; A local role is created in one single container. SQL> CREATE ROLE l_role1 ; PDB_HR PDB_SALES c##r1 c##r1 r1 22

23 Granting Common and Local Privileges Container Database CDB1 root c##dba create sessio n In a CDB, a common privilege is granted to a grantee in all containers. SQL> GRANT create session TO c##dba 2 CONTAINER=ALL; A local privilege is granted to a grantee in one single container. SQL> GRANT advisor TO u1; PDB_HR PDB_SALES c##dba create sessio n c##dba create sessio n u1 adviso r 23

24 Controlling Backup Access Based on Privilege PREVENTION Databases registered in RMAN catalog Privileged User Controls RMAN Base catalog Enhancing security by restricting access to metadata RMAN Virtual Private Catalog (VPC) Avoid the inadvertent or malicious destruction of catalog data for other databases Keep clear separation of duty between administrators of various databases 24

25 RMAN Encrypted Backups Encrypted to disk (Oracle Advanced Security) RMAN Third-party media manager Data files Encrypted to tape Password (Oracle Secure Backup) 25

26 Controlling Data Access Based on Label Confidential Sensitive Transactions Confidential Report Data Public Reports OLS policies Sensitive Oracle Label Security (OLS): Chooses your virtual information partitioning Classifies users and data using labels Creates labels based on business drivers Enforces row level access control automatically, transparent to applications Uses labels as factors in other policies (Database Vault) 26

27 Oracle Audit Vault and Database Firewall A single solution: Oracle Audit Vault and Database Firewall Users Applications Database Firewall Allo wlog Alert Substitute Block Firewall Events Alerts! Auditor Built-in Reports Audit Data Security Analyst Custom Reports Policies Audit Vault OS, Directory, File System, & Custom Audit Logs 27

28 Suggested Schedule Security Risks and Oracle Solutions Security Requirements Basic Database Security Oracle Solutions Day 1 Net Services Firewall Network Traffic Encryption Listener Security Authentication Data Access Control Data Confidentiality Auditing Basic Strong Proxy Database and Enterprise Users Privileges and Roles RMAN Virtual Private Catalog Privilege Analysis Virtual Private Database Oracle Label Security Data Redaction Data Masking TDSP DBMS_CRYPTO Transparent Data Encryption Database Storage Security Unified Auditing Fine Grained Audit Day 5 Days Days 3 & 4 Day 2 4 & 5 28

29 Oracle Data Redaction: Overview On the fly redaction based on username, IP address, application context, and other factors Transparent, consistent enforcement in the database High performance for production applications Appropriate for call centers, decision support systems, and systems with PII, PHI, and PCI data SELECT creditcard_no FROM Query executed Redaction Policies CREDITCARD_NO XXXX-XXXX-XXXX-5100 XXXX-XXXX-XXXX-1118 XXXX-XXXX-XXXX-5454 Redacted data returned Redaction policy enforced Sensitive data 29

30 Suggested Schedule Security Risks and Oracle Solutions Security Requirements Basic Database Security Oracle Solutions Day 1 Net Services Firewall Network Traffic Encryption Listener Security Authentication Data Access Control Data Confidentiality Auditing Basic Strong Proxy Database and Enterprise Users Privileges and Roles RMAN Virtual Private Catalog Privilege Analysis Virtual Private Database Oracle Label Security Data Redaction Data Masking TSDP DBMS_CRYPTO Transparent Data Encryption Database Storage Security Unified Auditing Fine Grained Audit Day 5 Days Days 3 & 4 Day 2 4 & 5 30

31 Auditing and Alerting in Real Time Auditing and Reporting Oracle Audit Vault Unified Audit Fine-Grained Audit Oracle Audit Vault Audit Data & Event Logs Oracle Database Firewall OS & Storage Directories Databases Custom Database audit streamline Powerful detection and alert of suspicious activities Out of the box compliance and custom reports Consolidated multi source reporting Built in segregation of duties Centralized secure repository! Security Analyst Alerts Built-in Reports Custom Reports AV policies Auditor 31

32 Fine Grained Auditing Auditing and Reporting Oracle Audit Vault Unified Audit Fine-Grained Audit Users Applications Audit Data Security Officer Event handler Policies configuration Secured options audited columns Fine Grained Auditing (FGA): Monitors data access based on content Audits SELECT and DML statements May fire an event handler procedure 32

33 Enforcing Security at Different Levels Database Access Network Security Database Firewall Encryption (sqlnet.ora) Listener security Firewall Clients User Authentication Basic Strong Proxy Centralized with LDAP/EUS Authorization & Access Control Privileges Views, VPD, OLS Database Vault, Audit Vault VPC HR.EMP table Confidentiality Firewall Application Web server Control Constraints, triggers Unified audit, FGA Audit Vault Logminer Temporal History Compliance standards Data Masking, Data Redaction, TSDP TDE, Data Pump & TDE, DBMS_CRYPTO RMAN & TDE, Oracle Secure Backup 33

34 Vielen Dank für Ihre Zeit. Hamburg, den Jan Peter Timmermann, Pitss GmbH The Oracle Modernization Experts PITSS GmbH 2014