Expert Oracle Application. Express Security. Scott Spendolini. Apress"

Transcription

1 Expert Oracle Application Express Security Scott Spendolini Apress"

2 Contents Foreword About the Author About the Technical Reviewer Acknowledgments Introduction xv xvii xix xxi xxiii BChapter 1: Threat Analysis 1 Assessment 1 Home Security Assessment 1 Application Security Assessment 2 Data and Privileges 3 Types of Threats 4 Preventable 4 Unpreventable 6 Summary 6 Chapter 2: Implementing a Security Plan 7 What Is a Security Plan? 7 Assessment 8 Risk Analysis 8 Access Control 8 Data Access 9 Auditing and Monitoring Application Management Design vii

3 Development 10 Contingency 10 Review and Revision 11 Security Reviews 11 Automated Reviews 11 Manual Reviews 12 Simulating a Breach 12 Summary 13 SChapter 3: APEX Architecture 15 Overview of APEX 15 Administration Console 17 Managing Requests 18 Managing Instances 19 Managing Workspaces 19 Monitoring Activity 19 Workspaces 20 Users and Roles 20 Schema Mappings 22 Components 22 Architecture 26 Metadata-Based Architecture 26 Schemas 27 Transactions 32 The f Procedure and WWV_FL0W.SH0W 32 The WWV_FLOW.ACCEPT Procedure 33 Session State 36 Infrastructure 38 Embedded PL/SQL Gateway 38 Oracle HTTP Server and mod_plsql 39 APEX Listener 39 Summary 40 viii

4 Chapter 4: Instance Settings 41 Overview 41 Runtime Mode 42 The Instance Administration API 43 The Instance Administrator Database Role 43 Other Options 44 Configuration and Management 44 Manage Instance Settings 45 Feature Configuration 47 Security 48 Instance Configuration Settings 56 Session State 60 Logs and Files 62 Messages 63 Self Service Sign Up 64 Manage Workspaces 64 Create Workspace 65 Create Multiple Workspaces 68 Remove Workspace 70 Lock Workspace 71 Manage Workspace to Schema Assignments 72 Manage Developers and Users 73 Manage Component Availability 75 Export and Import 76 View Workspace Reports 76 Manage Applications 78 View Application Attributes 78 Monitor Activity 80 Realtime Monitor Reports 80 Archived Activity Reports 87 Dashboard Report 87 Summary 88 ix

5 Chapter 5: Workspace Settings 89 Manage Service 89 Service Requests 90 Workspace Preferences 91 Manage Meta Data 92 Manage Users and Groups 94 User Types 95 Managing Users 96 Managing Groups 98 Monitor Activity 99 Workspace Management Best Practices 100 Summary 100 Chapter 6: Application Settings 101 Application Settings 101 Definition 101 Security Attributes 108 User Interface 117 Page and Region Settings 118 Page Settings 118 Region Settings 124 Report Settings 126 Mobile Applications 127 Hesitancy Toward Corporate Adoption 127 Mobile Considerations for Security 127 Summary 128 Chapter 7: Application Threats 129 SQL Injection 129 Anatomy of an Attack 130 SQL Injection in APEX 133 Bind Variable Notation and Dynamic SQL in APEX 136 x

6 Cross-Site Scripting 139 Anatomy of an Attack 140 Reflexive Attacks 140 Persistent Attacks 143 Sanitizing Data 144 Restricted Characters 145 APEX_ESCAPE 145 Column Formatting 146 Escaping Regions and Items 151 Protecting Cookies 152 Frames 152 URL Tampering 153 Authorization Inconsistencies 153 Page and Item Protection 154 Virtual Private Database and Secure Views 157 Summary 158 Chapter 8: User Authentication 159 Types of Authentication Schemes 159 Application Express Users 160 Database Accounts 160 HTTP Header Variable 160 LDAP Directory 162 No Authentication (Using DAD) 162 Open Door Credentials 163 Oracle Application Server Single Sign-On 163 Custom 163 APIs for Custom Authentication 165 Common Authentication Scheme Components 166 Source 166 Session Not Valid 167 Login Processing 167 xi

7 Post Logout URL 168 Session Cookie Attributes 168 Mechanics of Authentication 169 The Login Page 169 Login Page Processes 170 Logging Out 174 Summary 175 Chapter 9: User Authorization 177 Authorization Schemes 177 Implementing Authorization Schemes 179 Role Location 179 Table-Based Roles 179 Gatekeeper Authorization Scheme 180 Page-Level Authorization Schemes 180 Authorization Inconsistencies 182 APEX Access Control 183 Summary 184 Chapter 10: Secure Export to CSV 185 APEX Export Options 185 Maximum Row Count 185 Column Restrictions: Standard Reports 187 Column Restrictions: Interactive Reports 187 Custom Export to CSV 188 Restricting Records with ROWNUM 188 Restricting Records with PL/SQL 190 Summary 200 xii

8 Chapter 11: Secure Views 201 The View 201 Secure View Components 202 Application Contexts 203 PL/SQL Procedure 203 Secure View SQL 204 Security Attributes 206 Benefits and Drawbacks 208 Summary 209 Chapter 12: Virtual Private Database 211 The Evolution of Data 211 VPD Basics 212 Integration with APEX 212 VPD Policy Function 213 Column Masking and Obfuscation 215 Managing VPD in Oracle Enterprise Manager 222 Summary 223 Chapter 13: Shadow Schema 225 Overview 225 Components 226 Database: Schema and Object Creation 226 Data Schema: Views 228 Revoke Privileges 229 System and User Event Trigger 230 APEX: Simple Form and Report 231 DML APIs and Processes 232 Grants and Synonyms 238 Table API Processes 238 xiii

9 Securing Data 242 Application Context Views Synonym PL/SQL Initialization Code Summary Chapter 14: Encryption Encryption HTTPS APEX HTTPS Settings InstanceAdmin Console and Application Development Environment 251 Applications APEX Item Encryption Data Encryption DBMS_CRYPTO Encrypted Collections 256 Example Advanced Security Option Transparent Data Encryption 263 Network Encryption Summary Index. 265 xiv