Securing Data in Oracle Database 12c

Transcription

1

2 Securing Data in Oracle Database 12c Thomas Kyte

3 Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

4 Oracle Database Security 30 years of Innovation Oracle Key Vault Data Redaction Oracle Audit Vault Oracle Database Vault DB Security Evaluation #19 Transparent Data Encryption EM Configuration Scanning Fine Grained Auditing (9i) Secure application roles Client Identifier / Identity propagation Oracle Label Security Proxy authentication Enterprise User Security Global roles Virtual Private Database (8i) 1977 Database Encryption API Strong authentication (PKI, Kerberos, RADIUS) Native Network Encryption (Oracle7) Database Auditing Government customer 2014

5 Security Oracle is very secure Therefore, we don t need to be, it just happens Besides, it is not as important as having pretty screens after all. And if we add it later, I m sure it ll be non-intrusive And very performant And easy to do

6

7 Oracle Maximum Security Architecture Core Components Advanced Security Data Redaction Users Database Vault Privilege Analysis Apps Alerts Database Firewall Events Data Masking TDE Database Vault Privileged User Controls Reports Policies Audit Vault Audit Data & Event Logs Databases OS & Storage Directories Custom

8 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

9 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

10 Transparent Data Encryption (TDE) Preventive Control for Oracle Databases Advanced Security SQL Interface to key management *New* FIPS mode (dbfips_140) Encrypts tablespaces or columns to secure data at rest Requires no application changes Near Zero overhead with hardware Integrated with Oracle DB technologies Log files, Compression, ASM, DataPump Applications Disk Backups Exports Off-Site Facilities

11 The Challenges of Key Management Management Proliferation of encryption wallets and keys Authorized sharing of keys Key availability, retention, and recovery Custody of keys and key storage files Regulations Physical separation of keys from encrypted data Periodic key rotations Monitoring and auditing of keys Long-term retention of keys and encrypted data 11

12 Key Management with Oracle Key Vault Centrally manage and share keys, secrets, Oracle wallets, Java keystores, and more Optimized for Oracle stack (Database, Middleware, Systems) and Advanced Security TDE Robust, secure, and standards compliant (OASIS KMIP) key manager 12

13 Oracle Key Vault High-Level Architecture Middleware Standby Databases Administration Console, Alerts, Reports Servers Secure Backups = Oracle Wallet = Java Keystore = Certificate = Server Password = Credential File 13

14 Oracle Wallet Scenarios Oracle Advanced Security Transparent Data Encryption (TDE) RAC Data Guard Multiple DBs Same Machine GoldenGate Single Instance 14

15 Oracle Advanced Security Transparent Data Encryption (TDE) Direct Connection Scenarios RAC Data Guard Multiple DBs Same Machine GoldenGate Single Instance 15

16 Oracle Key Vault Software Appliance Platform Turnkey solution based on hardened stack Includes Oracle Database and security options Open x86-64 hardware to choose from Easy to install, configure, deploy, and patch Separation of duties for administrative users Full auditing, preconfigured reports, and alerts 16

17 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

18 Privilege Analysis You want to use the concept of least privileges Problem: You don t know what privileges they really need, maybe just give them SELECT ANY TABLE That is not very secure and hard to justify to an auditor

19 Discover Use of Privileges and Roles Administrative Control for Oracle Database 12c Privilege Analysis Turn on privilege capture mode Report on actual privileges and roles used in the database Helps revoke unnecessary privileges Enforce least privilege and reduce risks Increase security without disruption Create Drop Update DBA role APPADMIN role Unused Update APPADMIN

20 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

21 Oracle Database Vault Privileged User and Operational Controls Procurement Application HR Finance select * from finance.customers Limit default powers of privileged users Enforce policy rules inside the database Violations audited, secured and sent to Oracle Audit Vault No application changes required DBA

22 Oracle Database Vault Privileged User and Operational Controls Procurement Application HR Finance select * from finance.customers Limit default powers of privileged users Enforce policy rules inside the database Violations audited, secured and sent to Oracle Audit Vault No application changes required DBA

23 Oracle Database Vault Realms Block DBA Privileges Block privileged database users from accessing application data Block threats from compromised privileged accounts Block application users from accessing other applications inside the same database Securely consolidate and use private or public cloud computing

24 Oracle Database Vault 12c New Mandatory Realms Block Direct Object Grants Provide additional security check before allowing authorized users to access application data Enable application DBA control by allowing patching while denying access to sensitive application data Freeze security settings identified by Privilege Analysis: roles, grants, Temporarily seal off entire application data in the event of a cyber threat

25 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

26 Database Activity Monitoring and Firewall Detective Control for Oracle and non-oracle Databases Oracle Audit Vault and Database Firewall Monitors and logs database network traffic Detects and blocks unauthorized database activity including SQL injection attacks Highly accurate SQL grammar analysis Users Apps Allow Log Alert Substitute Block Whitelist approach to enforce activity Blacklists for managing high risk activity Scalable secure software appliance SQL Analysis Whitelist Blacklist Policy Factors

27 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

28 Oracle Data Redaction Redacting Sensitive Data for Applications Policy Credit Card # On-the-fly redaction based upon user name, IP address, application context, and other factors Transparent, consistent enforcement in the database Minimal impact on production work loads Call Centers Decision Support Systems Systems with PII, PHI, PCI data

29 Supported Transformations Full Redaction Partial Redaction RegExp Redaction Random Redaction Original Redacted 05/24/75 01/01/01 11 Rock Bluff Dr. XXXXXXX ***-**-2299 D1L86YZV8K D1******8K [hidden] /30/73 11/14/85

30 Introducing Oracle Data Masking and Subsetting Pack Reduces Risk in Sharing by Obfuscating or Removing Sensitive Data Discover Sensitive Data NAME SALARY Mask Data Using Format Library AGUILAR BENSON CHANDRA DONNER NAME SALARY AGUILAR CHANDRA Subset Based on Conditions/Goal Retain Application Integrity Mask/Subset in Export or on Staging 30

31 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

32 Conditional Auditing Framework Detective Control for Oracle Database 12c Database Auditing New policy- and condition-based syntax What: CREATE, ALTER, ALL, Where: Set of Privileges, Roles, objects When: IP_ADDRESS!= Exceptions: Except HR Group audit settings for manageability New roles: Audit Viewer and Audit Admin Out-of-box audit policies Single unified database audit trail IF ACTIONS CREATE AND IP_ADDRESS = THEN THEN

33 Oracle Audit Vault Detective Control for Databases, Operating Systems, Database Firewall Firewall Events Alerts! Built-in Reports Custom Reports Policies AUDIT VAULT AUDIT DATA Custom

34 Program Agenda Transparent Data Encryption (TDE), Key Vault Privilege Analysis Database Vault Database Firewall Data Redaction, Data Masking, Fine Grained Access Control Audit Vault

35