Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Transcription

1 1

2 The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle. 2

3 Secure Development and Test Environments with Oracle Data Masking Jaime Briggs Account Manager Strategic Accounts MSc CS, CCISP, CCSK 3

4 Program Agenda IOUG Data Security Survey: Top Risk Database Defense-in-Depth Data Discovery and Modeling Oracle Data Masking Features Data Subsetting Q&A 4

5 IOUG Enterprise Data Security Survey, respondents Multiple industries Orgs of all sizes 39% DBA title 38% responsible for more than 100 databases 57% Say A Data Breach is Likely or Are Unsure What is the likelihood of a data breach over the next 12 months? 5

6 Identified Top Risk Over Half Use Production Data in Non-Production Environments What kind of data is used within non-production environments? (e.g. staging, dev environments) 6

7 Database Security Defense-in-Depth Mitigate Database Bypass Prevent Application Bypass Consolidate Auditing and Compliance Reporting Monitor Database Traffic and Block Threats Protect All Database Environments Prevent access to data at OS, storage, network, media layers Transparent data encryption for data at rest, in transit, on media Separation of duties for key management Privileged user access control to limit access to application data Multi-factor authorization for enforcing enterprise security policies Secure application consolidation Native Oracle and non-oracle database auditing, centralized audit policies Consolidate, secure, analyze audit trail, alert on suspicious activities Report for compliance & security, automate database audit workflow Monitor Oracle & non-oracle database traffic over the network Block threats like SQL injection attacks before reaching databases Enforce normal database activity, lightweight monitoring Sensitive data discovery for production Secure database lifecycle management, configuration scanning, patch automation Mask data for nonproduction development & test 7

8 Database Security Defense-in-Depth Mitigate Database Bypass Prevent Application Bypass Consolidate Auditing and Compliance Reporting Monitor Database Traffic and Block Threats Protect All Database Environments Sensitive data discovery for production environments Secure database lifecycle management, configuration scanning, patch automation Mask data for nonproduction development & test 8

9 Data Discovery and Modeling Application Data Models Scans application schemas to model relationships between tables and columns Extracts data relationships from Oracle application meta-data Oracle E-Business Suite Oracle Fusion Applications Referential relationships stored in repository Enables test data operations such as data subsetting and masking 9

10 Data Discovery and Modeling Sensitive Data Identification Sensitive data discovery Pattern-based database scanning Import from pre-built mask templates Oracle Data Masking templates for Oracle applications Oracle Fusion Applications 10

11 Sensitive Column Discovery Discover Sensitive Column w/ Patterns Create Sensitive Column Types using Regular Expression to define the pattern for column name, comment, or data Run discovery job to scan database and discover sensitive columns Import From Masking Templates Import masking templates for Oracle Applications such as Fusion Applications Sensitive columns will be automatically tagged Set Columns as Sensitive Manually Add columns directly in the sensitive column list 11

12 Oracle Data Masking Irreversibly De-Identify Data for Non-Production Use Production Non-Production LAST_NAME SSN SALARY AGUILAR ,000 BENSON ,000 LAST_NAME SSN SALARY ANSKEKSL ,000 BKJHHEIEDK ,000 Data Never Leaves Database 12

13 Oracle Data Masking Comprehensive, Extensible Mask formats for common sensitive data Accelerates masking solution deployment Extensible mask routines Business rule customization Define once, apply everywhere Consistent policy enforcement 13

14 Sophisticated Masking Techniques Sophisticated Masking Techniques Compound Mask Sets of related columns masked together e.g. Address, City, State, Zip, Phone Condition-based Masking Specify separate mask format for each condition, e.g. driver s license format for each state SQL-expression based masking Use SQL functions, e.g. UPPER, SUBSTR, TO_CHAR, to generate mask values, e.g. SUBSTR(%ORIG_VALUE%,1,3) Compound Masking Condition-based Masking 14

15 Key-Based Reversible Masking New in Oracle Enterprise Manager 12c Mask Preserved data format Any pattern and length Numeric, alphanumeric or mixed Deterministic Unique Key-based Unmask Reverse masked data back to original value with same key 15

16 Masking Real Application Testing Workloads Real Application Testing Integration with Data Masking Copying production data to test systems puts sensitive information at risk Perform secure, production-scale testing Sensitive data found in workload capture files and STS are masked along with application data STS bind data (used with SPA) Workload Capture files (used with DB Replay) AWR sensitive bind data is purged Consistent masking across all data sources, workloads 16

17 Masking Workflow Security Admin Identify Sensitive Information Identify Data Formats Format Library Masking Definition DBA Clone Prod to Staging Review Mask Definition Execute Mask Clone Staging to Test Prod Staging Test 17

18 Performance Optimizations SQL Parallelism for tables > 1 million rows Statistics collection before & after masking CTAS statement with NOLOGGING Test Results Linux x86 4 CPU: Single core Pentium 4 (Northwood) [D1]) Memory: 5.7G Column scalability 215 columns masked:100 tables 60GB Database, 20 minutes Rows scalability 100M row table, 6 columns masked Random Number 1.3 hours 18

19 Heterogeneous Data Masking Oracle Databases Non-Oracle Databases Enterprise Manager Cloud Control with Data Masking Manage Manage Manage Production (Oracle) Staging (Oracle) Test (Oracle) Production (non-oracle) Staging (Oracle) Test (non-oracle) Database Gateway Database Gateway Monitor* Manage* Monitor* Enterprise Manager Cloud Control with Data Masking 19 * Available for IBM DB2, Microsoft SQLServer, Sybase

20 Oracle Data Masking Demo: De-Identifying Information for Sharing 20

21 Demo 21

22 Oracle Database Security Transparent Data Encryption, Privileged User Controls, Multi-Factor Authorization, Data Classification, and Change Tracking Maximum Security for Oracle Databases: Oracle Advanced Security Oracle Database Vault Oracle Label Security Oracle Total Recall Database Activity Auditing and Reporting, SQL Traffic Monitoring and Blocking, Real-Time Alerting, Workflow Automation Security for Oracle and non-oracle Databases Outside the Database: Oracle Audit Vault Oracle Database Firewall Secure Configuration Scanning, Automated Patching, Configuration Change Control, Sensitive Data Discovery, Data Masking Security for Production and non- Production Database Environments: Oracle Database Lifecycle Oracle Enterprise Manager Oracle Data Masking 22

23 Q&A 23

24 For More Information search.oracle.com database security or oracle.com/goto/database/data-masking 24

25 25

26 26