Presentation database security enhancements with oracle

Presentation database security enhancements with oracle

• 1.
  Database Security EnhancementsWith Oracle Database 11g Daniel Wong Director of Engineering, Database Security Oracle Corporation
• 2.
  2 Agenda • About OracleSoftware Security Assurance • Overview of Security Enhancements in 11g • Secure Configuration Enhancements • Other Key Security Enhancements • Q&A
• 3.
  3 Oracle Software SecurityAssurance All the processes, procedures, and technologies that have been implemented to ensure that Oracle’s products are meeting our customers’ security requirements, while providing for the most cost-effective ownership experience. Product Development Product Definition Ongoing Assurance Secure Coding Standards
• 4.
  4 Oracle Software SecurityAssurance Secure Configuration • Enhance “out of the box installation” settings to be more secure • Remove default passwords • Disable unneeded services • Reduce proliferation of powerful privileges • Identify and minimize potential effects of enhanced secure configuration settings: • Impacts resulting from version upgrade • Impacts on Oracle and third-party applications • Document and share current security best practices • http://www.oracle.com/security/resource-library.html
• 5.
  5 Oracle Software SecurityAssurance Secure Configuration • Goals: • Improve security of default configuration • Secure by Default while maintaining upgradability and usability • Inputs: • Internal: Various Oracle Software Security Assurance programs • External: CIS, SANS, DISA • Recent Enhancements: • Locked default accounts, expired passwords • Optional install of demo schemas • Best Practices document • Default password/account scanner
• 6.
  6 Secure Configuration Enhancements with11g - Overview 1. Default Audit Settings • Preconfigured • Enhanced performance 2. Default Password Management • Enhanced protection against brute force attack • Complexity enforcement procedure • Built-in default password scanner 3. Enhanced Authentication • Case sensitive password authentication • Control authentication version 4. Enhanced Access Control • Improved security for several utl* packages
• 7.
  7 Audit Settings • Keyrequirement for compliance • 10gR2: OFF by default • 11g: • AUDIT_TRAIL=DB by default in DBCA • security-relevant actions audited • Performance: • Set audit_trail=XML or OS for best performance • In our informal lab environment, we found 1-2% performance degradation for the TPCC benchmark with AUDIT_TRAIL=DB and our default auditing statements
• 8.
  8 Updated Default AuditSettings • Statement Audit option • ROLE • Privilege Audit Options • CREATE USER • ALTER USER • DROP USER • CREATE SESSION • CREATE ANY TABLE • ALTER ANY TABLE • DROP ANY TABLE • CREATE ANY PROCEDURE • ALTER ANY PROCEDURE • DROP ANY PROCEDURE • ALTER PROFILE • DROP PROFILE • GRANT ANY PRIVILEGE • GRANT ANY OBJECT PRIV. • GRANT ANY ROLE • CREATE ANY JOB • CREATE EXTERNAL JOB • CREATE ANY LIBRARY • CREATE PUBLIC DB LINK • EXEMPT ACCESS POLICY • ALTER DATABASE • ALTER SYSTEM • AUDIT SYSTEM
• 9.
  9 Default Profile PasswordSettings • 10gR2 • FAILED_LOGIN_ATTEMPTS = 10 • all others: unlimited • 11g - more restrictive • FAILED_LOGIN_ATTEMPTS = 10 (no change) • PASSWORD_LOCK_TIME = 1 • PASSWORD_GRACE_TIME = 7 • PASSWORD_LIFE_TIME = 180 • Balanced protection against Denial of Service (DOS) and password attacks while keeping usability
• 10.
  10 Password Complexity • Supportscase sensitive passwords • Supports special and multi-byte characters to increase security and usability • Takes effect immediately after password change • Enhanced default password complexity verification • Password Complexity Verification not enabled in default profile; can be enabled via Enterprise Manager or SQL • In utlpwdmg.sql in $ORACLE_HOME/admin directory • SQL to set the password complexity verification • ALTER PROFILE DEFAULT PASSWORD_VERIFY_FUNCTION verify_function_11G • This routine will verify that password • Has minimum length of 8 characters • Has at least one letter and one digit • Is not username, reverse thereof, or username(1-100) • Is not one of a few common passwords (e.g. welcome1) • Must differ from previous password by at least 3 characters
• 11.
  11 Password Complexity Recommendations • Defaultpassword profile parameters may not suit everyone • Adjust the password settings to your security needs • Change default password verification routine as per your needs • Define at least two password profiles - one for users and one for mid-tiers and administrators • Password recommendations vary with use cases: • See for example, recommendations for E-Business Suite - MetaLink 189367.1 • See also Visit OTN: otn.oracle.com -> products -> database -> security and compliance for detailed recommendations
• 12.
  12 Default Password View •View DBA_USERS_WITH_DEFPWD will show all accounts still using default passwords • Over 140 default username/passwords collected from the field, including application accounts for Peoplesoft and Ebizs • SQL> desc DBA_USERS_WITH_DEFPWD • Name Null? Type • ----------------------------------------- -------- ---------------------------- • USERNAME NOT NULL VARCHAR2(30) • SQL> select * from DBA_USERS_WITH_DEFPWD • 2 ; • USERNAME • ------------------------------ • JONES
• 13.
  13 Enhanced Authentication • Supportsmulti-bytes and special characters • Case sensitive passwords always enforced • Use SEC _ CASE _ SENSITIVE _ LOGON to turn it OFF if necessary • Set SQLNET . ALLOWED _ LOGON _ VERSION to highest OCI client version in use: • Use 8 if there are Oracle 8.x clients connecting to the DB • Use 9 if there are Oracle 9.x clients connecting to the DB • Use 11 if there are Oracle 10.x and/or 11.x clients connecting to the DB • Use 8 if there are pre-Oracle 11g JDBC pure Java client connecting to the DB • Use of SHA-1 hashing algorithm to protect password
• 14.
  14 Enhanced Access Control •Improved security for several utl* packages • UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP, etc. • These packages will no longer allow connections to external network services to non-privileged users by default • SYS and XDB schemas will specifically remain excluded from this kind of restriction • DBAs will be able to specify what network services database users will be allowed to access when using these packages.
• 15.
  15 Enhanced Access Control Recommendations •Open access to external network services only minimally • Specify down to hosts and ports, avoid unnecessary “*” wildcards • Have small number of ACLs for manageability and performance • Share ACLs among network services open to the same users • Consider giving access indirectly through application schemas • Applications can further restrict user interaction with network services
• 16.
  16 Access Control Administration •Administration via DBMS_NETWORK_ACL_ADMIN • Grant access to a network service • create_acl – create an ACL for the first user • assign_acl – assign ACL to network service • Grant access to more users in ACL – add_privilege • Revoke access from users in ACL – delete_privilege • Stop access to network services • unassign_acl – take ACL away from network service • All ACL changes are transactional • Remember to “COMMIT” the transaction !!! • View ACL settings via dictionary views • DBA_NETWORK_ACLS – which network services have ACLs? • DBA_NETWORK_ACL_PRIVILEGES – who are in the ACLs?
• 17.
  17 Access Control Administration Example begin dbms_network_acl_admin.create_acl( acl=> 'smtp-access.xml', description => 'ACL for SMTP service', principal => 'MAILAGENT', is_grant => TRUE, privilege => 'connect'); dbms_network_acl_admin.assign_acl( acl => 'smtp-access.xml', host => 'smtp-host.oracle.com', lower_port => 25); end; / commit;
• 18.
  18 Access Control Administration Example SQL>select * from dba_network_acls; HOST LOWER_PORT UPPER_PORT ACL -------------------- ---------- ---------- ------------------------- smtp-host.oracle.com 25 25 /sys/acls/smtp-access.xml SQL> select * from dba_network_acl_privileges; ACL PRINCIPAL PRIVILEGE ------------------------- -------------------- --------- /sys/acls/smtp-access.xml MAILAGENT connect
• 19.
  19 How Do TheseChanges Impact Installation? • Default new installations will include audit and password profiles • Option during install to retain 10gR2 settings • DBCA screens to: • Revert back to 10gR2 settings for audit and/or password • Apply new default settings • Upgrades will not change the audit and password profile settings
• 20.
  20 Recommendations for UpgradesI • Audit settings • Turn on auditing for security sensitive DDL operations listed • Set to DB or DB_extended for querability • Set to OS or XML for performance • Password Management • Institute password policies by classifying users into a different usage groups and assign dedicated profiles to each group • Check DBA_USERS_WITH_DEFPWD for default passwords
• 21.
  21 Recommendations for UpgradesII • Authentication • Identify sources of connection and set security level to highest possible supported by the client • Ask users to change password as soon as possible for case sensitive password to take effect • Look into EUS for centralized user management • Reminder: we support connect username/password as SYSDBA • Access Control • Identify applications using utl_* packages, and identify and grant appropriate new ACL privileges and confirm applications are running fine • Evaluate current privileges granted, follow least privileged model
• 22.
  22 Other Key SecurityEnhancements • Tablespace Encryption option in Transparent Data Encryption • Allows bulk encryption at tablespace level • No restriction on data types and indexes • Works with all High Availability offerings • Hardware Security Module and External Key Server support in Transparent Data Encryption • Provides additional option for security and key management services by third party products • Management of SYSDBA and SYSOPER in Enterprise User Security • Identity management of super users in databases • Enhanced Kerberos support • Cross realm and type 4 certificate support • Support Microsoft KDC default encryption modes
• 23.
  23 Oracle Software SecurityAssurance Conclusion • MAXIMUM SECURITY • Best of breed security features • Secure design from the ground up • Effective vulnerability remediation process • LOWER COST OF OWNERSHIP • Unwavering commitment to maintaining our customer’s security posture • Predictable security patch process • Priority given to quality
• 24.
  24 For More Information •Oracle Software Security Assurance Web Site at http://www.oracle.com/security/software-security-assurance.html • Technical white papers and security guides • Online security seminars and webcasts • Blogs and more • Critical Patch Update & Security Alerts at http://www.oracle.com/technology/deploy/security/alerts.htm • Critical Patch Updates and current security alerts • Patch download • CPU documentation & Risk Matrices http://search.oracle.com Oracle Software Security Assurance