Ad
More Related Content
What's hot (20)
Similar to Oracle Database 23c Security New Features.pptx (20)
Ad
More from Satishbabu Gunukula (16)
Ad
Recently uploaded (20)
Oracle Database 23c Security New Features.pptx
- 1. Oracle Database 23c Security New Features Satishbabu Gunukula, Oracle ACE Pro • 24+ Years of Experience in Database, Enterprise Apps, Cloud Technologies and specialized in high availability solutions. • Masters Degree in Computer Applications • Technical Review of Books (6x) • Written articles for major publications Certifications: • Oracle Cloud Infra 2023 Multicloud Architect Associate • Oracle Cloud Infra 2023 Devops Professional • Oracle Certified Professional Oracle 8i,9i,10g,19c & MySQL 8.0 • Oracle Certified Expert Oracle 10g RAC • AWS Certified Solutions Architect – Associate • Snowflake Hands on Essentials – Data Warehouse • Microsoft Certified Azure Database Administrator Associate • Microsoft Certified Professional in Visual Basic 6.0 • SAP Certified Technology Associate – SAP HANA 1.0 http://www.oracleracexpert.com
- 2. Program Agenda • SQL Firewall • Encryption • Audit • Authentication • Authorization • Autonomous Database • Other • Demo • Q&A
- 3. SQL Firewall • SQL Firewall inspects all incoming statements and ensures only authorized SQL is run • SQL Firewall embedded in the Oracle Database and unauthorized SQL Statements will be logged and blocked. • SQL firewall provides real-time protection from attacks and mitigate risks from SQL injection attacks, anomalous access, credential abuse or theft. • SQL Firewall supports all commands except transaction control commands such as SAVEPOINT, COMMIT, ROLLBACK. • To administer SQL Firewall user must have SQL_FIREWALL_ADMIN role • To query DBA_SQL_FIREWALL* data dictionary the user must have SQL_FIREWALL_VIEWER role • You can Configure SQL Firewall using DBMS_SQL_FIREWALL package or Oracle Data Safe • SQL Firewall can be used in both root and Pluggable Database (PDB)
- 4. SQL Firewall • Enable SQL Firewall SQL> EXEC DBMS_SQL_FIREWALL.ENABLE; • Create and enable SQL Firewall capture for a user SQL> BEGIN DBMS_SQL_FIREWALL.CAPTURE_CAPTURE ( Username => ‘SCOTT’ top_level_only => TRUE, Start_capture => TRUE ); END; • Enable SQL Firewall Allow List SQL>BEGIN DBMS_SQL_FIREWALL.ENABLE_ALLOW_LIST ( username => ‘SCOTT’, enforce => DBMS_SQL_FIREWALL.ENFORCE_SQL, block => TRUE ); END;
- 5. SQL Firewall • START and STOP capture SQL> EXEC DBMS_SQL_FIREWALL.START_CAPTURE (‘SCOTT’); SQL> EXEC DBMS_SQL_FIREWALL.STOP_CAPTURE (‘SCOTT’); • You can generate an allow list using below procedures DBMS_SQL_FIREWALL.ADD_ALLOWED_CONTEXT DBMS_SQL_FIREWALL.DELETE_ALLOWED_CONTEXT DBMS_SQL_FIREWALL.DELETE_ALLOWED_SQL • Data Dictionary Views for SQL Firewall protections – DBA_SQL_FIREWALL_ALLOWED_SQL - View shows allowed SQL and Accessed objects – DBA_SQL_FIREWALL_ALLOWED_IP_ADDR – View shows the Users allowed IP address – DBA_SQL_FIREWALL_CAPTURE_LOGS – View shows the Capture log entries – DBA_SQL_FIREWALL_VIOLATIONS – View shows the SQL Firewall Violations
- 6. SQL Firewall Data Dictionary Views for SQL Firewall Configurations DBA_SQL_FIREWALL_ALLOW_LISTS Lists the status and generation date of the user's allow-lists DBA_SQL_FIREWALL_ALLOWED_IP_ADDR Lists the allowed IP addresses for a user DBA_SQL_FIREWALL_ALLOWED_OS_PROG Lists the allowed operating system programs for a user DBA_SQL_FIREWALL_ALLOWED_OS_USER Lists the allowed operating system users for a user DBA_SQL_FIREWALL_ALLOWED_SQL Lists information about the allowed SQL statements for a user, including the allowed SQL ID and the allow-list version of the allowed SQL DBA_SQL_FIREWALL_CAPTURE_LOGS Lists log information for a user's SQL Firewall configuration, such as the database user name, SQL text, accessed objects, and the SQL Firewall session ID DBA_SQL_FIREWALL_CAPTURES Lists the status SQL Firewall captures, such as whether they are enabled DBA_SQL_FIREWALL_SESSION_LOGS Lists information about the SQL Firewall session, such as the session ID, database user name, and client program DBA_SQL_FIREWALL_SQL_LOGS Lists information about the SQL logs, such as the SQL text, the command type, the SQL signature, accessed objects, and the character set DBA_SQL_FIREWALL_STATUS Lists the status of an SQL Firewall configuration, such as whether it is enabled and what its timestamp is DBA_SQL_FIREWALL_VIOLATIONS Provides a detailed report on SQL Firewall violations, including information such as the objects that were accessed, the user the SQL was run on, and whether the action was blocked or allowed
- 7. Encryption Transport Layer Security (TLS) • Oracle release 23c supports Transport Layer security (TLS) 1.3 • Moving to TLS 1.3 user will see some performance improvements • TLS 1.3 is more secure and improve confidentiality during data transit • The old cipher suites are less secure are deprecated by default, but you can enable using SSL_ENABLE_WEAK_CIPHERS to TRUE in sqlnet.ora • By default, the weak ciphers are set to FALSE. • When SSL_ENABLE_WEAK_CIPHERS is set to FALSE, then the following cipher suites are available for use: TLS_AES_128_CCM_SHA256 TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- 8. Encryption Enhancements in sqlnet.ora and wallets • New parameters added to SQLNET.ora to prevent use of deprecated ciphers suites • Use SSL_ALLOW_WEAK_DN_MATCH parameter to control how SSL_SERVER_DN_MATCH allows the service name • DN matching provides better security for listener and server certificates • The TLS configuration between database client and server has been simplified with new parameters and old protocols have been removed • User can configure TLS connections without client Wallets, user no need to install and configure a wallet to hold a root certification if it is available in the local system • A Local auto login wallet provides more security and more tightly bound to host without need of root access • The enhancements applies to TDE auto login keystores
- 9. Encryption AES-XTS Encryption Mode and TDE Encryption Algorithms • The enhancements provides more secure algorithms and encryption modes Transparent Database encryption (TDE) supports Advanced encryption standard (AES) and XEX-based mode with ciphertext stealing mode. • AES-XTS provides better performance and security on platforms where TDE used • The older versions of Oracle Database TDE used AES-CFB cipher mode • The Default encryption algorithm for both TDE column and tablespace is AES 256 • The column encryption mode is Galois/Counter mode (GCM) instead of cipher block chaining (CBC) • The table keys are XTS operating mode instead of cipher feedback (CFB) • The GOST and SEED algorithms are deprecated • Oracle RMAN integrity check for column encryption uses SHA512 instead of SHA1
- 10. Audit Audit Actions at Column level • Audit Actions at Column level for Tables and Views – You can audit actions at individual column level by creating audit policies – Audit only necessary actions and meet compliance requirements • You can audit action on a Tableau or view column using “CREATE AUDIT POLICY” Statement • Audit all actions on a table SQL> CREATE AUDIT POLICY aud_all_act_emp ACTIONS ALL ON SCOTT.EMP; • Audit action on a column SQL> CREATE AUDIT POLICY aud_col_bon_act_emp ACTIONS SELECT (BONOUS) ON SCOTT.EMP; • To audit recursive actions, use ONLY TOPLEVEL clause in the CREATE AUDIT POLICY statement
- 11. Audit Unified Auditing and Traditional Auditing • Unified Auditing and Traditional Auditing Authorization control • You can grant and revoke authorizations using Oracle Database roles AUDIT_ADMIN and AUDIT_VIEWER , not part of Database vault • AUDIT_ADMIN role – Using this role user can manager audit policies – User can create unified and fine-grained audit policies – Grant this role to trusted users only • AUDIT_VIEWER role – Using this role user can view and analyze data – This role provides execute privilege on DBMS_AUDIT_UTIL pls/sql package – Grant this role to users who audit the records , typically external auditors • The mandatory Oracle Audit realm protects Oracle Database vault AUDSYS schema and objects in SYS schema • Authorizations prevents DDL and DML on SYS.AUD$, SYS.FGA_LOG$ tables
- 12. Audit Unified Auditing and Traditional Auditing • Grant AUDIT_ADMIN authorization to user SCOTT SQL> EXEC DBMS_MACADM.AUTHORIZE_AUDIT_ADMIN (‘SCOTT’); • Revoke AUDIT_ADMIN from user SCOTT SQL> EXEC DBMS_MACADM.UNAUTHORIZE_AUDIT_ADMIN (‘SCOTT’); OR SQL> REVOKE AUDIT_ADMIN FROM SCOTT; • Dictionary view UNIFIED_AUDIT_TRAIL lists audit events and system privileges. SQL> SELECT ACTION_NAME, OBJECT_SCHEMA, OBJECT_NAME FROM UNIFIED_AUDIT_TRAIL WHERE DBUSERNAME = ‘<>’; • You can audit functions, triggers, procedures, Pl/SQL packages
- 13. Authentication • You can login into Oracle Database using Microsoft Azure Active Directory single sing-on OAuth2 access token. • Multicloud feature integrates Oracle Database and Azure AD • You can perform this integration on – Oracle 19.16 and later (Back ported) but not for Oracle 21c. – Oracle Autonomous Database on Dedicated/Shared Exadata Infrastructure – Oracle Exadata Clod Service – Oracle Base Database Service • You can map AD users to Oracle Database schema and roles • You can login ODP.NET can login into Oracle Database Using Microsoft Azure Active Directory • Database user password authentication now supports up to 1024 bytes • UTL_HTTP support SHA-256/512 and XDB HTTP supports SHA512, authentication and updated Kerberos Library support.
- 14. Authentication Password authentication • Oracle 23c offers longer passwords improved security – Oracle Data pump Export and import support longer encryption passwords up to 2024 bytes long – Oracle Call interface (OCI) and Oracle C++ Call interface support up to 1024 bytes long password for user authentication – JDBC think driver support up to 1024 characters for password – Oracle Database (including Autonomous) and clients supports password up to 1024 bytes • The password length helps accommodating Oracle Identity Access management (IAM) and Identity Cloud service (IDCS) • This helps enabling uniform password rules
- 15. Authentication Kerberos security • Improvements in Kerberos security and MIT Kerberos version 1.20.1 supports cross domain, windows credential guard and multiple principals. • KERBEROS5_CC_NAME and KERBEROS5_PRINCIPAL can be specified in tnsnames.ora and the values must match for user authentication. kuser = (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orahost)(PORT=1521)) (CONNECT_DATA=(SERVICE_NAME=ORCL)) (SECURITY=(KERBEROS5_CC_NAME = /tmp/kuser/krb.cc) (KERBEROS5_PRINCIPAL = kprinc))) • Kerberos parameters can be specified in Sqlnet.ora file SQLNET.KERBEROS5_CONF=<Kerberos_configfile_path > SQLNET.KERBEROS5_KEYTAB=<Kerberos_principal> SQLNET.KERBEROS5_CONF_MIT=TRUE SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=<Kerberos_service> SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)
- 16. Authorization Schema privilege • Instead of granting system privilege (* ANY) granting Schema privilege helps to grant least privilege necessary and database will be more secure. • System or Admin privileges excluded from schema privileges grants such as SYSDBA, SYSOPER, SYSASM, SYSBACKUP, SYSDB, SYSKM • Use GRANT and REVOKE statement to managing schema for a user or role. SQL> GRANT SELECT ANY TABLE ON SCHEMA SCOTT TO orauser; SQL> REVOKE SELECT ANY TABLE ON SCHEMA SCOTT FROM orauser; • Data dictionary protection extended to NON-SYS schemas with additional separation of duties helps to prevent malicious changes within the schemas • Data dictionary views has information about Schema privilege grants – DBA_SCHEMA_PRIVS – ROLE_SCHEMA_PRIVS – USER_SCHEMA_PRIVS – SESSION_SCHEMA_PRIVS – V$ENABLEDSCHEMAPRIVS
- 17. Authorization Label security and Goldengate new Roles • New Schema LBAC_TRIGGER introduced to won internal triggers previously owned by Oracle Label security (LBACSYS) • When you upgrade to Oracle 23c or later migrate previous release LBACSYS to LBAC_TRIGGER schema • Downgrade to pre-Oracle 23c will fail if the LBAC_TRIGGER schema has any triggers • New Goldengate roles OGG_CAPTURE, OGG_APPLY, OGG_APPLY_PROCREP and XStream roles XSTREAM_CAPTURE, XSTREAM_APPLY created for granting appropriate capture and apply privileges • The old packages DBMS_GOLDENGATE_AUTH and DBMS_XSTREAM_AUTH are now de-supported.
- 18. Autonomous Database DbaaS and ODP.NET • Oracle Identity and Access Management (IAM) can be used login to Oracle Cloud Infrastructure(OCI) Database as Service (DBaaS) platforms using password or token-based authentication. • When mapping with Oracle DbaaS the IAM users must be mapped either exclusive mapping to IAM user or shared mapping to an IAM group where the user should be member of . • Oracle Dbaas platform users can be centrally managed in the OCI identify and Access management • Users can login to OCI DbaaS with IAM Single-Sign On (SSO) as well • ODP.NET supports Oracle IAM across oracle cloud services, IAM credentials can be used for authentication and authorization. The same will be applicable for IAM SSO tokens • ODP.NET Core and managed 19.13.x and 21.4.x supports TLS connection without wallet. • ODP.NET Core 19.13.x and 21.4.x and managed ODP.NET 21.6.x supports token-based authentication with IAM.
- 19. Other • Oracle Connection Manager (CMAN) can be used to limit no of connections allowed from am IP in specified time using IP Rate limit. The IP Rate limit feature protects against denial of service attacks • ODP.NET supports Transport Later Security (TLS) 1.3 and it is used for encryption and authentication • Microsoft Azure AD integration support expanded to on-prem Oracle Databases release 19.1.6 and later • Distributed Transaction recovery background processes (RECO) provides additional security using ALLOW_LEGACY_RECO_PROTOCOL parameter to FALSE. • The ALLOW_LEGACY_RECO_PROTOCOL parameter applicable to 23c only and applying to prior releases will case transaction recovery to fail.
- 20. Summary Oracle 23c offers cutting edge database security features for audit, encryption, authentication, authorization. SQL firewall provides real- time protection from attacks and mitigate risks from SQL injection attacks, anomalous access, credential abuse or theft with centralized administration.
Editor's Notes
- #2: 1