Oracle Data Masking. Bruce Elton. Master Principal Sales Consultant Information Security. 1 2012 Oracle Corporation

Oracle Data Masking Bruce Elton Master Principal Sales Consultant Information Security 1 2012 Oracle Corporation

Oracle Data Masking Comprehensive and Extensible Mask Library Mask formats for common sensitive data Extensible mask routines Define once, apply everywhere Accelerates solution deployment of masking Enables customization of business rules Ensures consistent enforcement of policies 2 2012 Oracle Corporation

Oracle Data Masking Sophisticated Masking Techniques Conditionbased Masking Compound Masking Compound Mask Sets of related columns masked together e.g. Address, City, State, Zip, Phone Condition-based Masking Specify separate mask format for each condition, e.g. driver s license format for each state SQL-expression based masking Use SQL functions, e.g. UPPER, SUBSTR, TO_CHAR, to generate mask values, e.g. SUBSTR(%ORIG_VALUE%,1,3) 111-1111 3 2012 Oracle Corporation

Format Libraries Mask Primitives Random Number Random String Random Date within range Shuffle Sub string of original value Table Column User Defined Function National Identifiers Social Security Numbers Credit Card Numbers 4 2012 Oracle Corporation 4

Masking Definitions Associates formats with database Maps formats to table columns being masked Defines dependent columns Associated Database target Automatically identifies foreign key relationships Can specify undeclared constraints as related columns Import-from or export-to XML Create like to apply to similar databases 5 2012 Oracle Corporation 5

Heterogeneous Data Masking Enterprise Manager Cloujd Control with Data Masking Oracle Databases manage manage manage Production (Oracle) Staging (Oracle) Test (Oracle) Production (non-oracle) Staging (Oracle) Test (non-oracle) Non-Oracle Databases Database Gateway Database Gateway monitor manage monitor Data Relationship Modeling Sensitive Data Identification Test System Setup Enterprise Manager Cloud Control with Data Masking Data Subsetting Data Masking 6 2012 Oracle Corporation Available for IBM DB2, Microsoft SQLServer, Sybase

Key-based Reversible Masking New in EM 12c Mask Data format is preserved Any pattern and any length Numeric, alphanumeric or mixed Deterministic Unique Key-based Unmask Reverse the masked data back to its original value with the same key 7 2012 Oracle Corporation

D E M O N S T R A T I O N Oracle Data Masking De-Indentifying Information for Sharing 8 2012 Oracle Corporation 8

Oracle Testing Solutions Testing Application Changes Testing Application Changes Oracle Test Manager Oracle Functional Testing Oracle Load Testing Testing Infrastructure Changes SQL Performance Analyzer Database Replay Application Replay Test Data and Lab Management Data Masking Data Discovery and Modeling Data Sub setting Synthetic Workload Production Workload Test Data Management 9 2012 Oracle Corporation

Quality is key. In todays highly competitive market place the competitive advantage is your processes and the applications your using to support them. Packaged applictions are complex both from a infrastrcuture and software point of view. Poor application quality will reduce or eliminate the competitive advantage that the applications intended to provide... 10 2012 Oracle Corporation

Example: EBS Infrastructure Complexity Client Application Database 10g OC4J 10gR2 11g HTTP/S Web Listener JSP BC4J UIX BI Publisher Forms JDBC/SQL Net Global Single Data Model RAC & ASM 11 2012 Oracle Corporation

Example: EBS Infrastructure Complexity Internal Users LBR SSO #1 LBR SSO #2 Web #3 Web #4 Web #1 Internet Firewall Reverse Proxy Firewall LBR Web #2 RAC #1 RAC #2 OID #1 OID #2 Shared EBS DB Filesystem Oracle AS Infrastructure DB 12 2012 Oracle Corporation

Oracle Approach to Quality Management Middleware DBMS Storage O/S Application Replay Infrastructure Infrastructure Testing Testing toolstools Real Application Testing Application Infrastructure Changes Application Changes Test infrastructure changes separately from application changes Test one change at a time Application Testing Suite Testing tools Specialized tools can result in much higher quality and efficient testing Proper test systems and test data mandatory for good testing results 13 2012 Oracle Corporation

Infrastructure Testing If change is limited to application infrastructure only ias patching (upgrading version or applying security patches) O/S changes or patching (e.g. moving to Solaris/Linux, security patches) Database changes or patching (e.g adding patches, config changes) HW changes (e.g moving to new Hardware platform) Application Replay Tests any changes to application stack Real Application Testing Tests changes to application stack that are in the DB-tier 14 2012 Oracle Corporation

Oracle Application Testing Suite Oracle Functional Testing Powerful, integrated solution for ensuring application quality. Oracle Test Manager Oracle Load Testing 15 2012 Oracle Corporation

Oracle Application Testing Suite 9.3 Supports Functional/regression testing Load/Performance testing Test Management Web, Siebel, EBS/Forms, ADF, Adobe Flex, Database & WebServices Reduce scripting time by ~50% Automatic script generation Load/Performance test Scripts generated using RUEI and Real Application Testing Smart integration with EM Diagnostics JVM Diagnostics for mid-tier DB Diagnostics for DB-tier DB Profiles for Oracle Database 16 2012 Oracle Corporation

<Insert Picture Here> Oracle Test Manager

Oracle Test Manager Bring structure, repeatability and visibility to testing efforts. Key Benefits Integrated modules for total test process management Common repository for all assets Web-based interface Manual and automated tests User-defined roles and fields Increase visibility of app readiness Pre-packaged reports 18 2012 Oracle Corporation

Oracle Test Manager -Test Plans Define Test plans in Oracle Test Manager Key Benefits User definable test plans Pre-defined TMAP template TMap best practice Links to TMap content from Capgemini Group TMap specific Fields Reports Associated data 19 2012 Oracle Corporation

<Insert Picture Here> Oracle Functional Testing

Oracle Functional Testing Easy to use, best-in-class functional test automation tool Key Benefits Single unified scripting platform based on Oracle OpenScript JAVA/Eclipse based IDE Different perspectives/views Non-technical users (GUI) Technical users (JAVA code UI) Support for Web 2.0, SOA and Oracle applications 21 2012 Oracle Corporation

<Insert Picture Here> Optimised Testing for Oracle Applications

Optimized testing for Oracle Applications Application Testing Suite Testing Accelerators Oracle Fusion Applications Oracle Ebusiness Suite Siebel JD Edwards Enterprise ONE PeopleSoft Hyperion Accelerators Web Siebel EBS/ Fusion/ Web Database Adobe FORMS Services Flex ADF OpenScript 23 2012 Oracle Corporation

Optimized testing for Oracle Test Accelerators and Test Starter Kits Test Accelerator extends the web testing functionality Example EBS: Support for EBS 11i & R12 (socket & servlet mode) Supports both FORMS and Web actions (back-office/self service) EBS specific object identification rules EBS specific correlations Automatic test case creation EBS Test Starter Kit (~75 pre-build scripts) 24 2012 Oracle Corporation

EBS Test Starter Kit Coverage Financial Products: Oracle Payables Oracle Receivables Oracle General Ledger Oracle Assets Oracle Internet Expenses Manufacturing Products: Oracle Purchasing Oracle Inventory Oracle Order Management Oracle Cost Management Oracle Materials Requirement Planning Oracle Process Manufacturing Products CRM Products: Oracle Contracts Oracle Service Oracle Marketing Human Resources Product: Oracle Human Resources Projects Product: Oracle Projects Technology Product: Oracle Application Object Library 25 2012 Oracle Corporation

Automatic script creation for Oracle Applications Generate load test scripts from RUEI Zero effort load script creation for Oracle Applications No need to record scripts manually Support for Oracle e-business Suite, Siebel, JD Edwards... Export real user sessions from Oracle Real User Experience Insight (RUEI) as Load scripts for Oracle Load Testing for realistic scenarios or synthetic testing of user sessions with issues... 26 2012 Oracle Corporation

<Insert Picture Here> Oracle Load Testing

Oracle Load Testing Eliminate performance bottlenecks in your applications Key Benefits Oracle infrastructure included Weblogic 11g Oracle 11g Enterprise Edition Scalable automatic content validation Comprehensive performance monitors Web-based reporting interface Easy to use real-time data views Extensive analysis capabilities 28 2012 Oracle Corporation

Oracle database and java diagnostics Oracle Enterprise Manager integration to Oracle Load Testing Level 1: Measure End-User Performance under load Level 3: Measure Server-Side Transaction Performance with EM diagnostics Level 2: Measure Infrastructure Performance under load with ServerStats 29 2012 Oracle Corporation

Oracle Database Diagnostics Integration Easier database related trouble-shooting during load tests Key Benefits Oracle Load Testing integration with Oracle Diagnostics Pack for Oracle databases ADDM & AWR reports directly in the Oracle Load Testing console 30 2012 Oracle Corporation

<Insert Picture Here> Using Database diagnostics with ATS

Run a load test againt your application... 32 2012 Oracle Corporation

Monitor application through EM and OLT... The tested applications database CPU load is high. This is seen in Oracle Load Testing s ServerStats monitoring or external solutions like Oracle Enterprise Manager Grid Control 33 2012 Oracle Corporation

Access diagnostics reports from OLT After the load test is completed: The Automatic Workload Repository (AWR) and the Automatic Database Diagnostic Monitor (ADDM) reports for the selected session is loaded in the OLT console. AWR report provides a detailed report of the statistics collected during the load session ADDM report analyzes snapshots taken by the AWR during the session to identify potential performance bottlenecks 34 2012 Oracle Corporation

Identify, impact, cause, recommendation... ADDM report findings and Recommendations ---------------------------- Finding 1: Hard Parse Due to Literal Usage Impact is.85 active sessions, 84.84% of total activity. -------------------------------------------------------- SQL statements were not shared due to the usage of literals. This resulted in additional hard parses which were consuming significant database time. Recommendation 1: Application Analysis Estimated benefit is.86 active sessions, 84.84% of total activity. ------------------------------------------------------------------- Action Investigate application logic for possible use of bind variables instead of literals. Action Alternatively, you may set the parameter "cursor_sharing" to "force". Identifies the performance bottlenecks Estimates the impact of the problem Drills down to the root cause Gives recommendations & suggests the estimated benefit Provides specific actions to correct the problem 35 2012 Oracle Corporation

Superior test automation of Oracle applications Oracle Application Testing Suite (OFT, OTM & OLT) Fully integrated, synthetic test automation solution with one single scripting platform that utilizes JAVA as programming language. Supports Web, SOA and packaged applications (EBS, Siebel, JD Edwards, Peoplesoft & Hyperion) Oracle Functional Testing (OFT) Reduce scripting with up to 60% Better Object identification for EBS/Forms (other solutions uses object Labels, OFT uses XPATH) Does not require additional Siebel licenses (Siebel Test Automation Interfaces) like other test tool vendors Oracle Test Manager (OTM) Easy to use test process management solution Browser based UI Support for manual testing, Test Automation (OFT) and 3rd party solutions Oracle Load Testing (OLT) Reduce scripting time with upto 60% Best correlation coverage compared to other EBS/Siebel solutions Does not require additional Siebel licenses (Siebel Test Automation Interfaces) like other test tool vendors Zero effort scripting for RUEI customers Integration to EM diagnostics (Java/Database) Oracle Fusion support Browser based UI 36 2012 Oracle Corporation

Oracle Testing Solutions Test Infrastructure Changes Testing Application Changes Oracle Test Manager Oracle Functional Testing Oracle Load Testing Testing Infrastructure Changes SQL Performance Analyzer Database Replay Application Replay Test Data and Lab Management Data Masking Data Discovery and Modeling Data Sub setting Synthetic Workload Production Workload Test Data Management 37 2012 Oracle Corporation

Secure Database Testing New in EM 12c End-to-end testing with real workloads Create Test System Capture Workload Replay Workload Deploy Replay Clients SQL Performance Analyzer Database Replay SQL unit testing for response time Load, performance testing for throughput Identify and tune regressed SQL Remediate application concurrency problems Integrated into SQL Tuning Advisor and Integrated with Oracle Application Testing SQL Plan Baseline Suite for superior comprehensive testing solution Seamless integration with Data Masking to preserve data privacy compliance 38 2012 Oracle Corporation

Real Application Testing SQL Performance Analyzer SQL Plans + Stats Pre-Change Trial SQL Workload STS SQL Plans + Stats Post-Change Trial Compare SQL Performance Test and predict impact of system changes on SQL query performance Analyze performance changes for improvements or regression Comprehensive performance analysis and reporting Re-execute SQL queries in test environment End-to-end solution: STS, SQL Plan Baselines, & SQL Tuning Advisor Analysis Report 39 2012 Oracle Corporation

Real Application Testing Database Replay Load and concurrency testing for db tier testing Capture all external db calls on prod and replays on test Uses production workloads instead of synthetic scripts Maintains all production workload characteristics such as timing, transaction order, concurrency Production Users Storage Capture Replay Test Replay Driver Storage Analyze & Report 40 2012 Oracle Corporation

Testing Database Change Reduce the time to test system changes by as much as by 80% and the cost of testing by 70% 1 SAP has certified Real Application Testing as a valuable tool to assist in testing Database Infrastructure Changes. SPA was particularly helpful in evaluating the performance of important queries at statement level, which must not be negatively impacted Manfred Fischer, Manager of SAP System Maintenance, Stadtwerke Munich, SAP customer 1 Source: Oracle Real Application Testing business agility through superior testing OVUM, Jan 2008 41 2012 Oracle Corporation

Masking Real Application Testing Workloads Real Application Testing Integration with Data Masking Copying production data to test systems puts sensitive information at risk Perform secure, production-scale testing Sensitive data found in workload capture files and STS are masked along with application data STS bind data (used with SPA) Workload Capture files (used with DB Replay) AWR sensitive bind data is purged Consistent masking across all data sources and workloads 42 2012 Oracle Corporation

Oracle Testing Solutions Test Infrastructure Changes Testing Application Changes Oracle Test Manager Oracle Functional Testing Oracle Load Testing Testing Infrastructure Changes SQL Performance Analyzer Database Replay Application Replay Test Data and Lab Management Data Masking Data Discovery and Modeling Data Sub setting Synthetic Workload Production Workload Test Data Management 44 2012 Oracle Corporation

Application Replay Captures and replays actual production workload Maintains all production characteristics during replay such as timing, order, concurrency, dependency, etc. Like DB Replay but for the mid-tier Benefits Faster testing No script development or maintenance Better testing Real production workloads Broader workflow coverage: captures all flows that arise in practice Automatic user requests capture Authentic replay with minimal divergence Automatic request correlation Automatic Http-DB Synchronization 45 2012 Oracle Corporation

Application Replay Capture application workload (http/nca user requests) in production Leverages RUEI to capture all user interactions, performance data Zero performance overhead Replay full workload in test Maintains all production characteristics Automatic correlation based on Application Testing Suite Analyze & Report Replay divergence: access, content, Pages load times, page views, think time Production Users App server DB server Storage Capture App server DB server Storage Test Replay Drivers Replay Analyze & Report 46 2012 Oracle Corporation

Workload Capture Uses RUEI to capture all user requests along with performance data for specific application No overhead HTTP/nca protocol level capture Enables RUEI in complete logging mode Progress monitoring provided by processing RUEI files in near real-time such as number of requests captured Prerequisite RUEI version 11.2 or above 47 2012 Oracle Corporation

Replay Deployment Application Replay deploys the correct number of clients to match workload concurrency Number of clients automatically configured by Enterprise Manager All client hosts must have access to workload files Replay timing options Observes all capture-time timings by default Allows user-configurable timing Playback modes With or without database synchronization 48 2012 Oracle Corporation

Replay Options and Parameters Two replay modes synchronous and asynchronous Synchronous: DB calls generated by application are intercepted and submitted in same order as capture to maintain transaction dependency Asynchronous: Only user request order is maintained and no special handling of database calls Think time: Scales the elapsed time between two successive user calls for same session Session start time: Controls login rate by scaling elapsed time between start of capture and session creation time Maintain request rate: Autocorrects think time (based on the think_time_scale parameter) between calls when user calls take longer to complete during replay 49 2012 Oracle Corporation

Analyze and Report Result Summary Replay divergence Average page load times Top pages by average load times 50 2012 Oracle Corporation

Analyze and Report Page Analysis Metrics 51 2012 Oracle Corporation

Analyze and Report Chart Metrics 52 2012 Oracle Corporation

Application Replay Benefits Faster Testing: Reduce Testing time by 5x NO test script development NO test script maintenance Better Testing ENTIRE application stack tested hardware and software ALL code paths exercised 53 2012 Oracle Corporation

Key take-a-ways The goal of testing is to ensure the expected quality for your application and infrastructure under test Test automation can help to ensure quality Quality is key in today s competitive market Oracle offers multiple solutions for testing and quality management Oracle and Oracle partners can help you to optimize your Oracle applications testing 54 2012 Oracle Corporation