Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Transcription

1 1

2 Seguridad en profundidad Jaime Briggs MSc CS, CISSP, CCSK Sales Manager Strategic accounts

3 Agenda Los Controles ISO Defensa en Profundidad Productos que dan respuesta Roadmap a seguridad Q&A 3

4 4

5 5

6 6

7 7

8 8

9 Database Security Defense in Depth Mitigate Database Bypass Prevent Application Bypass Consolidate Auditing and Compliance Reporting Monitor Database Traffic and Block Threats Protect All Database Environments Prevent access to data at OS, storage, network, media layers Transparent data encryption for data at rest, in transit, on media Separation of duties for key management Privileged user access control to limit access to application data Multi-factor authorization for enforcing enterprise security policies Secure application consolidation Native Oracle and non-oracle database auditing, centralized audit policies Consolidate, secure, analyze audit trail, alert on suspicious activities Report for compliance & security, automate database audit workflow Monitor Oracle & non-oracle database traffic over the network Block threats like SQL injection attacks before reaching databases Enforce normal database activity, lightweight monitoring Sensitive data discovery for production Secure database lifecycle management, configuration scanning, patch automation Mask data for nonproduction development & test 9

10 La piedra fundamental es la encriptación Preventive Control for Oracle Databases Oracle Advanced Security Complete data at rest encryption prevents IT Staff/OS user direct access Efficient application data encryption without application changes Built-in two-tier key management for SoD with support for centralized key management using HSM/KMS Strong authentication of database users for greater identity assurance Applications Disk Backups Exports Off-Site Facilities 10

11 Privileged User Controls Preventive Control for Oracle Databases Database Vault Automatic and customizable DBA separation of duties and protective realms Enforce who, where, when, and how data is accessed using rules and factors Securely consolidate application data or enable multi-tenant data management Applications Procurement HR Finance Security DBA select * from finance.customers DBA Application DBA 11

12 Label Based Access Control Preventive Control for Oracle Databases Oracle Label Security Virtual information partitioning Classify users and data using labels Database enforced row level access control transparent to applications Classification labels based on business drivers, can be factors in other policies Users classification through Oracle Identity Management Suite Confidential Sensitive Transactions Confidential Report Data Public Reports Sensitive 12

13 Database Activity Monitoring and Firewall Detective Control for Oracle and non-oracle Databases Oracle Database Firewall Monitors database activity, detects, & prevents attacks e.g. SQL injections White-list, black-list, and exception-list security policies based on highly accurate SQL grammar based analysis Scalable software appliance offers inline blocking and monitoring, or out-ofband monitoring modes Built-in and custom compliance reports Applications Users Oracle Database Firewall Allow Log Alert Substitute Block SQL Analysis Whitelist Blacklist Policy Factors 13

14 Audit, Report, and Alert in Real-Time Detective Control for Oracle and non-oracle Databases Oracle Audit Vault Consolidate database audit trail into secure centralized repository Detect and alert on suspicious activities, including privileged users Out-of-the box compliance reports for SOX, PCI, and other regulations Audit Data HR Data CRM Data ERP Data Alerts Built-in Reports Custom Reports Streamline audits with report generation, notification, attestation, archiving, etc. Databases Policies Auditor 14

15 Configuration Management Administrative Control for Oracle Databases Oracle Database Lifecycle Management Discover and classify databases into security and compliance policy groups Scan databases against 400+ best practices, industry standards, custom Detect unauthorized database config. changes, trouble ticket tracking Automated patching, provisioning, and change management Scan & Monitor Discover Patch 15

16 Masking Data for Non-Production Use Preventive Control for Oracle Databases Oracle Data Masking Securely available application data in non-production environments Prevent application developers and testers from seeing production data Extensible template library and policies for data masking automation Referential integrity automatically preserved so applications work LAST_NAME SSN SALARY AGUILAR ,000 BENSON ,000 Production Non-Production Test Dev LAST_NAME SSN SALARY ANSKEKSL ,000 BKJHHEIEDK ,000 Production 16

17 17

18 Cual sería su próximo paso? 1 Verificar como se encuentra su seguridad 2 Desarrollar una estrategia de Seguridad 3 4 Detección es buena pero la prevención mejor Diseñe con seguridad, no solo cumpla normas 5 Accione no se convierta en solo análisis 18

19 Q&A 19

20 20

21 21