Limelight

Posted by David Yahalom under Security, Oracle

I would like to thank the several people that have emailed me about this. Pete Finnegan, who is one of the most prominent figures in the world of Oracle databases and Oracle Security has mentioned AuthorityBase on his web site!

He has a writeup mentioning the Oracle Security presentation I’ve created for my company (XpertOne1) and he seemed to liked it.

Check it out at Pete’s site!

The secure Oracle database - howto

Posted by David Yahalom under Security, Oracle

Last week I’ve held a 45 minute presentation about Oracle-made DB security solutions at a customer convention held by Xpert-One1, the company I work for (Xpert-one1).

It was a pretty neat presentation focusing on how to achieve 360 degrees of protection for your database, how most security exploits originate from within the organization (an IDC study shows as much as %80) and how while network security is well understood (firewalls, VPNs, etc) database security is almost always forsaken (not many businesses expect their DBAs to be security focused).

My presentation covers the following Oracle products and how the fit in creating a secure database:

Oracle Database Vault
Oracle Advanced Security
Oracle Transparent Table Encryption
Oracle Label Security & Oracle Virtual Private Database
Oracle Secure Backup
Oracle Grid Control

You can download my presentation here.

It’s high level, since the audience we were targeting were CTOs, IT managers, security guys and not actual DBAs.

Fell free to leave comments or contact me if you have questions or want more information.

Great Oracle RLS article

Posted by David Yahalom under Security, Oracle

Yesterday I stumbled across a great article about Oracle Row Level Security (RLS) with a great and detailed beginners tutorial.

RLS is a great way to implement application security where many users must connect to the same data but only see different parts of the data based on their role or position in the organization.

In many cases RLS is easier to implement and maintain compared to using views, tirggers or using different schema for data access as business rules and security implementations are done through one PL/SQL procedure per table instead of being spread throughout the applications code.

Another great benefit of RLS is tighter security than what views or triggers provide because RLS can prevent a user from circumventing the security policy by accessing the database directly and query the tables underlying the views.

Oracle Row Level Security: Part 1