1. Database Security - Case Study for Enterprise License Features
1235
Case study of the Security Features in the Enterprise License of Oracle RDBMS
April Sims
@aprilcsims

2. Enterprise License Security Features
Oracle External Password Store
Encrypting Client Connections
12c Security Features of RDBMS –
Other Security Measures beyond Oracle
Case Study – What did we implement?
Security Checklist: 10 Basic Steps to Make Your Database Secure from Attacks (Doc ID )

3. Don't trust our slides - only believe what you've verified by yourself
Mike Dietrich

4. Now part of the Enterprise License
Some features used to be part of the Advanced Security Option but now included in the Enterprise License
License does have specific applications to RAC environments for COST
Covers:
PKI authentication
Network Encryption – SSL/TLS
TDE encryption
Kerberos, PKI, Radius
Native Network Encryption
"An Oracle Wallet is a PKCS#12 container used to store authentication and encryption keys. The Oracle database secure external password store feature stores passwords in an Oracle Wallet for password-based authentication to the Oracle database. The Oracle Wallet may also be used to store credentials for PKI authentication to the Oracle Database, configuration of network encryption (SSL/TLS), and Oracle Advanced Security transparent data encryption (TDE) master encryption keys. Strong authentication services (Kerberos, PKI, and RADIUS) and network encryption (native network encryption and SSL/TLS) are no longer part of Oracle Advanced Security and are available in all licensed editions of all supported releases of the Oracle database."
Using The Secure External Password Store (Doc ID )
The feature Secure External Password Store can be used without any restriction in all product editions, you do not require a license for the Advanced Security Option (ASO).
"Note that implementing COST restrictions in RAC environments require the use of SSL/TLS encryption.  Such network encryption features were previously only available to customers who were licensed for Oracle Advanced Security.  However, RAC customers who were previously not licensed for Oracle Advanced Security need not be concerned about a licensing restriction as Oracle has updated its licensing to allow these customers the use of these features (namely SSL and TLS) to protect themselves against vulnerability CVE  In other words, Oracle has added Oracle Advanced Security SSL/TLS to the Enterprise Edition Real Application Clusters (Oracle RAC) and RAC One Node options, and added Oracle Advanced Security SSL/TLS to the Oracle Database Standard Edition license when used with the Real Application Clusters."

5. Encryption Interoperability – see URL in Notes
Transparent Data Encryption
ASO
Oracle Wallet
OSB
DG, Streams and GoldenGate
Exadata
RMAN
Compression
Transportable Tablespaces
SQL Loader
Incompatible Features – what is not encrypted

6. Addressing Data at Rest Vulnerabilities
Data at Rest Encrypted RMAN Backups – Encryption Password or Key Wallet DataPump – prompt for encryption key or Encryption Wallet Oracle Secure Backup – free …RMAN to tape – single node to single tape device What did we do? Encrypted all files at the OS level including datafiles, backup to local filesystem which is backed up to tape nightly.

7. Addressing Data in Use Vulnerabilities
Fine Grained Access
Data Masking
Encrypting Client Connections
Auditing
Performance Tradeoffs related to Auditing based on implementation:
DB, OS, and XML audit trail – see notes
One last update on Fine-Grained Auditing. I've run a few simple tests
to see what kind of effect an FGA policy on the SPBPERS_SSN column would
have. This is the query I ran for each test (which selects 16,472 rows
from our SPBPERS table) and with _no_ FGA policy defined it ran in only
9.02 seconds:
DECLARE
lv_ssn varchar(9);
BEGIN
FOR i IN (SELECT i.spbpers_pidm FROM spbpers i WHERE
spbpers_confid_ind='Y') loop
SELECT s.spbpers_ssn INTO lv_ssn
FROM spbpers s
WHERE s.spbpers_pidm = i.spbpers_pidm;
END LOOP;
END; /
Prior to each test run of the above plsql I bounced the database
(clearing the shared pool), truncated the FGA_LOG$ table and issued the
'set timing on' command. Also keep in mind that with FGA enabled for a
column you have the option to store the SQL statement issued in addition
to the username, timestamp, machine name, etc. And you can either send
the audit trail to the FGA_LOG$ table or to an XML file on the OS.
Below are the results of my tests (I hope the formatting of my columns
display correctly):
location SQL? time (sec) storage size
======== ==== ========== ============
FGA_LOG$ Y ? (forgot to query)
FGA_LOG$ N MB
XML file Y MB (222K zipped)
XML file N MB (141K zipped)
Note that not storing the sql statement made a big difference in query
time, as did storing the audit trail in an XML file on the operating
system. Once I did both of those things (output to XML and no storing
of the SQL statement) the query time was virtually the same as when FGA
was disabled. If we don't store the SQL statement issued that is not
going to tell us which SSNs were accessed, but it does at least tell us
who accessed some SSNs, when, from which machine, and whether it was a
select, update, or delete operation, which is more information that we
currently have.
Another thing to note is that querying SPBPERS and just specifying the
SPBPERS_SSN in the WHERE clause does _not_ cause an audit record to be
created (ie. select spbpers_pidm from spbpers where
spbpers_ssn=' '). So forms and jobs that do queries based on
that column should not be affected by an FGA policy, unless they are
also selecting that SSN column too (ie. select * from spbpers where...).
We will be implementing a FGA policy on the SPBPERS_SSN column in our
develop database next week. I am very curious to see how real database
jobs and forms will perform after doing so. In the end we may not be
able to implement FGA on the SPBPERS_SSN column because it is such an
active table tied to so many other tables. But even if that is the case
I know there are some other less active tables with sensitive data that
we could implement FGA on. Just food for thought.
Mandy

8. Passwords
Password Complexity controlled by Profiles 1. Password Function 2. Recommendations Is the Password Encrypted when I Logon and Other Related Questions (Doc ID )

11. Database Auditing
a. Table Privs b. System Privs c. We use a Logon/Logoff Trigger – see notes Minimal Auditing AUDIT SESSION WHENEVER NOT SUCCESSFUL;
CREATE TABLE system.logonaudit (
event VARCHAR2(10),
sid NUMBER,
serial# NUMBER,
timestamp DATE,
username VARCHAR2(30),
osuserid VARCHAR2(30),
machinename VARCHAR2(64) );
CREATE OR REPLACE TRIGGER logoff_audit_users
BEFORE LOGOFF ON database
DECLARE
machinename VARCHAR2(64);
osuserid VARCHAR2(30);
v_sid NUMBER(10);
v_serial NUMBER(10);
CURSOR c1 IS
SELECT sid, serial#, osuser, machine
FROM v$session WHERE audsid = userenv('sessionid');
BEGIN
OPEN c1;
FETCH c1 INTO v_sid, v_serial, osuserid, machinename;
INSERT INTO system.logonaudit VALUES ( 'LOGOFF', v_sid, v_serial, sysdate,
user, osuserid, machinename );
CLOSE c1;
END; /
CREATE OR REPLACE TRIGGER logon_audit_users AFTER LOGON ON database
INSERT INTO system.logonaudit VALUES ( 'LOGON', v_sid, v_serial, sysdate,
CREATE OR REPLACE TRIGGER host_logon_trg
AFTER LOGON ON DATABASE
v_username VARCHAR2(30) := sys_context('USERENV','SESSION_USER');
v_host_info VARCHAR2(200) := sys_context('USERENV','HOST');
IF v_username = 'TECHACCOUNT' THEN
IF v_host_info IS NULL THEN
write_log('failed: direct login', v_username, v_host_info);
raise_application_error(-20101, 'Direct login not allowed.');
ELSIF v_host_info NOT LIKE ’NONTECHOS%'
THEN
write_log('failed: wrong hostink', v_username, v_host_info);
raise_application_error(-20102, 'Login from wrong host not allowed.');
ELSE
write_log('successful login', v_username, v_host_info);
END IF;
EXCEPTION
WHEN OTHERS THEN
RETURN;
END host_logon_trg; ~

12. SELECT * FROM dba_stmt_audit_opts; audit DROP any TABLE BY access; audit DROP any PROCEDURE BY access; audit CREATE public DATABASE link BY access; audit ALTER USER BY access; audit CREATE USER BY access; audit DROP USER BY access; audit ALTER DATABASE BY access; audit ALTER system BY access; audit ALTER profile BY access; audit DROP profile BY access; audit DELETE ON sys.aud$;

13. Operating System Auditing
Oracle MOS Notes Master Note for Auditing Audit syslog setup *.audit_trail='OS' *.audit_syslog_level=LOCAL1.WARNING Integrated w/ OS LogRotate on Linux to maintain files, files are transferred to our LogSearch implementation for searching and archiving

14. Open Source LogSearch
Storage of Auditing Records Integrated with Logstash , Kibana 1. Searching 2. Archiving Auditing Records – Last 15 minutes, last 24 hours, compressed/archived still available 3. Screenshot next slide is a Firewall Search

16. Oracle External Password Store
Removing clear text passwords in batch files, limit access to username/passwords

17. Oracle External Password Store EPS
TNS ALIAS to define a username/password combo for SQLNET connections
Remove the need for storing username/password in clear-text for scripts, batch jobs
Can be integrated with RMAN for backups
Stored in an Oracle Wallet
Removes the need for distributing username/password to programming staff
Use both orapki and mkstore command - more secure method
Oracle login - use DBMS_PRIVILEGE_CAPTURE

18. External Password Store
Goal: Remove clear text passwords for jobs , tasks run on a regular basis
Staff no longer needs to know the username/password combo
Environment needs to support this methodology – clear lines between production and non-production environments
Shell environment variables by user
Production files separated by permissions
Korn Shell , Bash Shell, Output directory, Git Hub
Convert Wallet to Java Keystore – see notes HTTP/SSL
How to Convert an Oracle Wallet to a Java Keystore (Doc ID )

19. Oracle Key Manager – Another License
“ What is the minimum configuration of Oracle Key Manger? The Oracle Key Manager 3 system at a minimum requires pair of key management appliances (KMAs), an encryption enabled storage device (i.e., Oracle's StorageTek T10000 tape drive), a connectivity kit to connect the encrypting device to the Oracle Key Manager cluster, and an encryption key for each device enrolled in the system.”

20. ORAPKI & MKSTORE command
orapki wallet create -wallet . -pwd ”pass” -auto_login_local
mkstore -wrl . -createCredential <service_name> <user> <password>
sqlplus
Can only login to same host and same OS user
Requires a correct /etc/hosts
ORA-12578: TNS:wallet open failed error
service_name matches the tnsnames.ora entry
How To Prevent The Secure Password Store Wallet From Being Moved to Another Host (Doc ID )

21. NOTE:1114599.1 - How To Prevent The Secure Password Store Wallet From Being Moved to Another Host
Since 11.2 – new parameter Copy the wallet (ewallet.p12 and cwallet.sso) to another host and test if it can be opened.If it fails,then the wallet is a local auto login wallet. OR The local auto login wallet is also tied to the operating system user.Try opening the wallet in the same host with another OS user.If it fails,then the wallet is auto login local wallet.
How To Check Whether The Wallet Is A Local Auto Login Wallet (Doc ID )To Bottom
In this Document
Goal Fix References
Applies to:
Advanced Networking Option - Version and later Information in this document applies to any platform. Goal
How to determine if the wallet is an auto login wallet or a local auto login wallet?  
Fix
 There is no way to determine that via a query or by running a simple command.
There is an enhancement request (Bug ) filed to implement a method to determine whether the wallet is auto_login_local.
Workaround:
Copy the wallet (ewallet.p12 and cwallet.sso) to another host and test if it can be opened.If it fails,then the wallet is a local auto login wallet. OR
The local auto login wallet is also tied to the operating system user.Try opening the wallet in the same host with another OS user.If it fails,then the wallet is auto login local wallet.
References
NOTE: How To Prevent The Secure Password Store Wallet From Being Moved to Another Host

22. SQLNET.ora Client Side – Batch Job
sqlnet.expire_time=10 DEFAULT_SDU_SIZE=32768 NAMES.DIRECTORY_PATH= (TNSNAMES, HOSTNAME) SQLNET.INBOUND_CONNECT_TIMEOUT=120 RECV_BUF_SIZE= SEND_BUF_SIZE= TCP.NODELAY=YES WALLET_LOCATION =(SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /walletlocation))) SQLNET.WALLET_OVERRIDE = TRUE SSL_VERSION=1.0

23. SQLNET.WALLET_OVERRIDE = TRUE
This setting causes all CONNECT statements to use the information in the wallet at the specified location to authenticate to databases.
We choose FALSE….as part of our migration..why?
It requires additional compile steps to integrate with Pro Cobol and Pro C programs
3rd party requirement mandated the current setting, in the process of migrating

24. Lessons Learned
Each time an entry is modified it changes the wallet permissions Easy to Implement…takes a while to migrate all code to use new TNSALIAS New Oracle login - minimum grants Co-exists with Encrypted Connections We made different entries for production and non-production environments - environmental variable $PASS_FOR_JOB $PPASS_FOR_JOB $PASS_FOR_BJOB $PASS_FOR_CJOB
Using The Secure External Password Store (Doc ID )
 The Impact of the Sqlnet Settings on Database Security (sqlnet.ora Security Parameters and Wallet Location) (Doc ID ) - Great for troubleshooting
How To Prevent The Secure Password Store Wallet From Being Moved to Another Host (Doc ID ) -- Also please be aware that besides the wallet being tied to the host, it is also tied to the operating system user, it cannot be used by another OS user, even if on the same host.
ORA and ORA on database startup with external wallet store (Doc ID )To Bottom
Modified:Mar 11, 2014Type:PROBLEM
In this Document
Symptoms Changes Cause Solution
Applies to:
Oracle Database - Enterprise Edition - Version and later Information in this document applies to any platform. Symptoms
Starting up a database using sqlplus fails with the following errors:
SQL> startup nomount ; ORA-01078: failure in processing system parameters ORA-01565: error in identifying file '+data01/ilab14/spfileilab14.ora' ORA-17503: ksfdopn:2 Failed to open file +data01/ilab14/spfileilab14.ora ORA-15056: additional error message ORA-17503: ksfdopn:2 Failed to open file +DATA01/ilab14/spfileilab14.ora ORA-15055: unable to connect to ASM instance ORA-12578: TNS:wallet open failed ORA-06512: at line 4   
Database startup using SRVCTL fails with  following errors:
oraenv14:/export/home/oraenv14>srvctl start database -d ilab14 PRCR-1079 : Failed to start resource ora.ilab14.db CRS-5017: The resource action "ora.ilab14.db start" encountered the following error: ORA-01078: failure in processing system parameters ORA-01565: error in identifying file '+data01/ilab14/spfileilab14.ora' ORA-17503: ksfdopn:2 Failed to open file +data01/ilab14/spfileilab14.ora ORA-15056: additional error message ORA-17503: ksfdopn:2 Failed to open file +DATA01/ilab14/spfileilab14.ora ORA-15055: unable to connect to ASM instance ORA-12578: TNS:wallet open failed ORA-06512: at line 4 . For details refer to "(:CLSN00107:)" in "/u001/oracle/env00gi/ /grid/log/selabu11/agent/crsd/oraagent_oraenv14/oraagent_oraenv14.log". CRS-2674: Start of 'ora.ilab14.db' on 'selabu11' failed CRS-2632: There are no more servers to try to place resource 'ora.ilab14.db' on that would satisfy its placement policy CRS-5017: The resource action "ora.ilab14.db start" encountered the following error: ORA-01078: failure in processing system parameters ORA-01565: error in identifying file '+data01/ilab14/spfileilab14.ora' ORA-17503: ksfdopn:2 Failed to open file +data01/ilab14/spfileilab14.ora ORA-15056: additional error message ORA-17503: ksfdopn:2 Failed to open file +DATA01/ilab14/spfileilab14.ora ORA-15055: unable to connect to ASM instance ORA-12578: TNS:wallet open failed ORA-06512: at line 4 . For details refer to "(:CLSN00107:)" in "/u001/oracle/env00gi/ /grid/log/selabu12/agent/crsd/oraagent_oraenv14/oraagent_oraenv14.log". CRS-2674: Start of 'ora.ilab14.db' on 'selabu12' failed
- If the entry SQLNET.WALLET_OVERRIDE=TRUE in the sqlnet.ora file is commented out, everything works well.
Changes
Database uses ASM storage and external wallet store has been configured to allow RMAN connections to the database without providing password as per Note
As part of this the following entries have been added to the sqlnet.ora file :
SQLNET.WALLET_OVERRIDE=TRUE
WALLET_LOCATION=<wallet_location>
Cause
The setting SQLNET.WALLET_OVERRIDE=TRUE interferes with the authentication mechanism between database and ASM instances.
Solution
The solution is to change the permission on the wallet to 750 to allow both grid and oracle OS users access to the file. Furthermore the grid user should be a member of the group that owns the wallet ( tipically oinstall )
A workaround would be to simply comment out the entry SQLNET.WALLET_OVERRIDE=TRUE from the sqlnet.ora file before database startup.

25. Encrypting Client Connections

26. Encrypting Client Connections
When using standard unencrypted connections the username/password is encrypted when connecting using SQLNET, everything else is clear text. Easy to confirm by running a SQL trace Oracle refers to this as Native Network Encryption – in My Oracle Support ******SSL Encryption also available with an Oracle Wallet using TCPS protocol
Step by Step Guide To Configure SSL Authentication (Doc ID )
Security Checklist: 10 Basic Steps to Make Your Database Secure from Attacks (Doc ID )
Consider to encrypt network traffic between clients, databases, and application servers. For an introduction to Oracle network encryption, see "Configuring Network Data Encryption and Integrity". With the Network Encryption feature liberated from the license for the Advanced Security Option there's no longer any reason for not implementing at least native network encryption for Oracle client / server connections.
To mitigate a number of recent vulnerability issues with ssl / tls, please consider to add the following parameters to both sqlnet.ora and listener.ora:
SSL_VERSION = 1.0
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA)
This will have the following effect on secured connections originating or terminating from the database or oracle listener:
- disable ssl v3 and thus cut-off any vulnerability in this deprecated protocol
- by explicitly configuring only a limited number of cipher suites disable the use of RC4 and the dreaded export ciphers.

27. Client Types SQL PLUS , SQLNET ODBC JDBC SQL Developer C compile
Cobol compiles
Cold Fusion **** - this one has given us problems
How To Configure Oracle External Password Store (Wallet) To Work With Oracle ODBC (Doc ID )
Does the full Oracle client have to be installed to use SSL for database connections ? (Doc ID )
The JDBC Thin driver is a full Java implementation of SQL*Net including most ASO features including native network encryption features that work seamlessly. However to work with an Oracle wallet and certificates for use with protocol TCPS it needs a special Java application side implementation, since Java applications making use of the JDBC Thin driver do not use typical client side configuration files such as sqlnet.ora to find and use the wallet_location. The following documents have examples to code it:
End To End Examples of using SSL With Oracle's JDBC THIN Driver (Doc ID )
How To Setup The Database And The Client To Have SSL Mutual Authentication With An Oracle Jdbc Thin Client And The Database? (Doc ID )
If application code changes are not an option, then consider to install an Oracle client home and use the JDBC OCI (thick) driver.

28. Listener Side Encryption
LISTENER.ORA/SQLNET.ORA - see Notes Implemented in a separate 12c Oracle Home $TNS_ADMIN Requires a database restart/listener restart Live Since Sept 2013 No problems w/ Database Links to non-encrypted Very few client issues or compatibility problems No noticeable slowness seen
INST_ID SID SERIAL# USERNAME
ENCRYPTION_TYPE
SYS
Oracle Advanced Security: RC4_40 encryption service adapter for Linux: Version Product
--sessioninfo.sql
with sessions as (
select /*+ MATERIALIZE */ inst_id, username, sid, serial#
from gv$session
where not ( type = 'BACKGROUND' or username is NULL ) ),
session_connect_info as (
select /*+ MATERIALIZE */ inst_id, sid, serial#,
regexp_replace( network_service_banner,
'^Oracle Advanced Security: ([[:alnum:]]+) encryption service adapter.+$',
'\1'
) encryption_type
from gv$session_connect_info
where network_service_banner like 'Oracle Advanced Security: %encryption service adapter%' )
select s.inst_id, s.sid, s.serial#, s.username, sci.encryption_type
from sessions s
join session_connect_info sci on ( sci.inst_id = s.inst_id and
sci.sid = s.sid and
sci.serial# = s.serial#
order by s.sid;

29. Tracing Sessions Best way to determine if encryption is active
Note Section has trace files from SQLNET connections on our Linux jobsub box to Linux Database server
SQLNET Client = SQLNET.ORA/TNSNAMES.ORA
Database Server = LISTENER.ORA/SQLNET.ORA
Cross Platform Encryption
Tracing is different as of 11g….recommended to disable adrci for control of output files
New diagnostic messages have been added in Oracle Net 12c's sqlnet.log file
trace_directory_server=<directory>
trace_level_client=16
trace_level_server=16
Encryption …..
( ) [04-SEP :29:06:929] naeecom: The server chose the 'RC4_40' encryption algorithm
( ) [04-SEP :29:06:929] naeecom: exit
( ) [04-SEP :29:06:929] naeccom: entry
( ) [04-SEP :29:06:929] naeccom: Crypto-Checksumming inactive( ) [04-SEP :29:06:929] naeccom: exit
( ) [04-SEP :29:06:929] na_tns: entry
( ) [04-SEP :29:06:929] na_tns: Secure Network Services is available.
( ) [04-SEP :29:06:929] nau_adi: entry
( ) [04-SEP :29:06:929] nau_adi: exit
( ) [04-SEP :29:06:929] na_tns: authentication is not active
( ) [04-SEP :29:06:929] na_tns: encryption is active, using RC4_40
( ) [04-SEP :29:06:929] na_tns: crypto-checksumming is not active
No encryption…..
Checksumming inactive( ) [04-SEP :31:43:105] naeccom: exit
( ) [04-SEP :31:43:105] na_tns: entry
( ) [04-SEP :31:43:105] na_tns: Secure Network Services is available.
( ) [04-SEP :31:43:105] nau_adi: entry
( ) [04-SEP :31:43:105] nau_adi: exit
( ) [04-SEP :31:43:105] na_tns: authentication is not active
( ) [04-SEP :31:43:105] na_tns: encryption is not active
( ) [04-SEP :31:43:105] na_tns: crypto-checksumming is not active
( ) [04-SEP :31:43:105] na_tns: exit

30. SQLNET.ora - Database Listener
DISABLE_OOB = ON
SQLNET.AUTHENTICATION_SERVICES= (TCPS)
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER= (MD5)
SQLNET.ENCRYPTION_SERVER = required
NAMES.DIRECTORY_PATH= (TNSNAMES, HOSTNAME)
SSL_CLIENT_AUTHENTICATION = TRUE
SQLNET.CRYPTO_SEED = ’YOURSEEDNUMBERS’
SQLNET.ENCRYPTION_TYPES_SERVER= (RC4_40, AES256, RC4_256, AES192, 3DES168, AES128, RC4_128, 3DES112, RC4_56)
SEND_BUF_SIZE =
RECV_BUF_SIZE =
DEFAULT_SDU_SIZE = 32768
TCP.NODELAY = YES
SQLNET.EXPIRE_TIME = 10
SQLNET.INBOUND_CONNECT_TIMEOUT = 120
ADR_BASE = /u01/app/oracle
SQLNET.CRYPTO_CHECKSUM_SERVER = required
USE_NS_PROBES_FOR_DCD=true
SSL_VERSION=1.0
Consider to encrypt network traffic between clients, databases, and application servers. For an introduction to Oracle network encryption, see "Configuring Network Data Encryption and Integrity". With the Network Encryption feature liberated from the license for the Advanced Security Option there's no longer any reason for not implementing at least native network encryption for Oracle client / server connections.
To mitigate a number of recent vulnerability issues with ssl / tls, please consider to add the following parameters to both sqlnet.ora and listener.ora:
SSL_VERSION = 1.0
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA)
This will have the following effect on secured connections originating or terminating from the database or oracle listener:
- disable ssl v3 and thus cut-off any vulnerability in this deprecated protocol
- by explicitly configuring only a limited number of cipher suites disable the use of RC4 and the dreaded export ciphers.

31. SQL Net Changes in 12c Dead Connection Detection
Network/switches/routers may no longer recognize Oracle’s DCD packets (they are zero length) but they do recognize the OS packets for keep alive (non zero length)
The host OS keep alive setting (tcp_keep_alive) can be modified to be less than the firewall inactivity timeout. This will cause the OS to send a test packet to the client when the timeout is reached and the client will respond with an ACK. To all intents and purposes this is the same as turning off the firewall inactivity timer for this host.
Oracle Net 12c: New Implementation of Dead Connection Detection (DCD) (Doc ID )

32. SQLNET Changes in 12c – cont’d
Larger Session Data Unit Sizes
Advanced Network Compression
Terminated Client Detection
Intelligent Client Connection
SQLNET.ALLOWED_LOGON_VERSION- Setting of 8 permits most password versions, and allows any combination of the DBA_USERS.PASSWORD_VERSIONS values 10G, 11G, and 12C.
SQLNET.ALLOWED_LOGON_VERSION_SERVER setting of 12a permits only the 12C password version.

33. Client Compatibility
Recently Released Oracle Products come with Encryption enabled, used by default if configured
SQL DEVELOPER – uses encryption if available
SQL PLUS/SQLNET - different implementation types – server and/or client configured
JDBC – see Notes
Recommendation:
Use Listener-Side Encryption if all Clients Compatible
Not all compatible – make encryption available but not mandatory, make plans to migrate or convert

34. Security Features in 12c

35. Security Features in 12c
a. Verifier/ DBMS_PRIVILEGE_CAPTURE b. Case Sensitivity c. Password Hash d. Unified Auditing e. RMAN f. DataPump g. Other Notes/Tips for 12c - including bugs

36. Verifier
DBMS_PRIVILEGE_CAPTURE – analyzes actual permissions needed during execution CAPTURE_ADMIN privilege Populates DBA_ views DATABASE – Ran in non-prod – 12:47 pm ROLE SYS_CONTEXT – sqlplus, session

37. Start Capture, Stop Capture, Report …
Username Role Sys Priv Owner Object Name Type ObjPriv UserPriv Grant Path

38. Protecting the Database
Change sys,system passwords
Lock, expire,change passwords, default/unused accounts
Restrict access to the Oracle binaries,audit, diag, logs
Review database user privileges - VERIFIER
Revoke privileges from PUBLIC - VERIFIER
Protect the data dictionary - VERIFIER
remote_os_authent = false
sec_case_sensitive_logon = true
global_names = true
unset parameter utl_file_dir
Protect listener and network connections
Encrypt sqlnet connections using network encryption.
Protect the database host
Security Alerts, CPU - notifications via MOS
Security Checklist: 10 Basic Steps to Make Your Database Secure from Attacks (Doc ID )

39. Case Sensitive Passwords
This doubled the number of passwords plus salt (makes it harder to reverse engineer
- -
HTH -- Mark D Powell --
PS - Here is a link to Oratig's reference article
11g R1 New Feature : Case Sensitive Passwords and Strong User Authentication (Doc ID )

40. Unified Auditing
Oracle Database 12c Unified Auditing enables selective and effective auditing inside the Oracle database using policies and conditions. For example, audit policies can be configured to audit based on specific IP addresses, programs, time periods, or connection types such as proxy authentication. In addition, specific schemas can be easily exempted from auditing when the audit policy is enabled. New roles have been introduced for management of policies and the viewing of audit data. The AUDIT_ADMIN and AUDIT_VIEWER roles provide separation of duty and flexibility to organizations who wish to designate specific users to manage audit settings and view audit activity. The new architecture unifies the existing audit trails into a single audit trail, enabling simplified management and increasing the security of audit data generated by the database.

41. Unified Auditing
Some Unified Auditing is ON by default in MIXED MODE when you create a fresh Oracle 12c database.
Just two policies are enabled by default: ORA_SECURECONFIG and ORA_LOGON_FAILURES
Upgrading from previous versions there are no rows to this query:
select VALUE from V$OPTION where PARAMETER='Unified Auditing';
FALSE
Bug *.aud File is Generated in Unified Auditing Environment Even When AUDIT_TRAIL=NONE (Doc ID )

42. Unified Auditing – cont’d
You can try Unified Auditing without implementing pure Unified Audit mode Pure Unified Auditing,link oracle binary uniaud_on with instance restart required Unified Auditing records to database store generates REDO, use a physical standby for reporting on the UNIFIED_AUDIT_TRAIL view $ORACLE_BASE/audit/SID on standby is where the OS audit files are stored – monitor storage Auditing SYSBA is now different SQL> CREATE AUDIT POLICY all_actions_pol ACTIONS ALL; SQL> AUDIT POLICY all_actions_pol by SYS; Several Major Bugs – logon not audited, performance of the UNIFIED_AUDIT_TRAIL view, etc
How To Enable The New Unified Auditing In 12c ? (Doc ID )
12c Unified Auditing used with Data Guard (Doc ID )
3) Since ADG is in Read-Only mode, the Unified Audit records generated on the Standby  gets written to the OS .bin files. The UNIFIED_AUDIT_TRAIL (based on V$UNIFIED_AUDIT_TRAIL) view gets you the audit records from both database store and the OS .bin files. Unified Audit (as the name suggests) gives you a single view of the audit trail. It retrieves audit records from both .bin files and database store. When you clean the unified audit records using DBMS_AUDIT_MGMT.clean_audit_trail procedure with AUDIT_TRAIL_UNIFIED parameter, Server internally takes care of purging relevant audit records from both .bin files and database store. As a consumer of unified audit trail, you need not be concerned about where the records are stored and how they are cleaned. I recommend you to use UNIFIED_AUDIT_TRAIL documented view to query unified audit trail, and not the V$UNIFIED_AUDIT_TRAIL, an internal view. The OS files in the standby are binary files in:  $ORACLE_BASE/audit/SID   Therefore this location requires space for them. I don't have any requirements for the amount of space since it would be dependent on what is audited. Auditing everything is not realistic. Auditing specific sensitive columns is what is intended.
Unified Audit Trail - LOGON Action Not Captured (Doc ID )

43. Securing RMAN in 12c
Use external Password Store to remove the need for a username/combo in clear text If you use Doc ID the wallet can be copied and used on other hosts….security flaw, use the command from slide 15. Every doc I have seen EPS have the less secure instructions! mkstore –wrl $ORACLE_HOME/network/admin –create In 12c Oracle, the UNIFIED_AUDIT_TRAIL data dictionary view has a set of fields (prefixed with RMAN_) which automatically record RMAN related events. However, you must have the AUDIT_ADMIN or AUDIT_VIEWER role in order to query the UNIFIED_AUDIT_TRAIL view to see these events.
How To Configure The Secure External Password Store To Allow The Connection To RMAN Catalog? (Doc ID )
RMAN Enhancements in Oracle 12c (Doc ID )

44. SYSBACKUP
SYSBACKUP user must be unlocked and granted SYSDBA is still the default connection if not specified SYSBACKUP – no sql access to underlying data without grants Recreate the passwordfile with FORMAT=12 and sysbackup=Y orapwd file=[fname] entries=[users] force=[y/n] asm=[y/n] dbuniquename=[dbname] format=[legacy/12] sysbackup=[y/n] sysdg=[y/n] syskm=[y/n] delete=[y/n] input_file=[input-fname]

45. RMAN Encryption Methods
Transparent – default, Oracle Key management infrastructure and Oracle Wallet Password - No wallet manager, but requires to specify a password for the encryption and decryption. Lost password = lost backup, lost restores Dual – both types, transparent and password Oracle Key Manager 3 – Hardware/software solution

46. RMAN Encryption & Oracle Secure Backup - OSB
Advanced Security Option (ASO), Enterprise Edition – All options installed as of 12c Encrypted backups to tape not using OSB is not supported Encrypting backups to tape using OSB is supported without ASO, standard edition Oracle Secure Backup Express Edition (free) does not support backup encryption – one database on one node directly attached to tape device Our Environment – backup to encrypted OS file systems, nightly tape backups for the entire enterprise

47. DataPump Enhancements
Prompt for Encryption Password
Unified Auditing
ASO Integration with Key Infrastructure

48. Extended Users & OS Groups
SYSBACKUP, SYSDG - Standbys , SYSKM - TDE COSDBA Group OSOPER Group OSBACKUPDBA Group OSDGDBA Group OSKMDBA Group OSDBA Group OSASM Group To divide responsibilities – job role separation

49. Other Security Recommendations

50. Additional Encryption Information
Encrypted FileSystems/Database Files using RH OS Linux/UNIX Filesystem Encryption – live several years no issues
Not supported by ORACLE - opened SR , Initialization parameter affected
disk_asynch_io FALSE
Requires a password during reboots
Protects files backed up to tape and if server is turned off
We use a SSL encrypted tunnel in between standbys, archive logs vulnerable
Encrypting REDO traffic using Oracle requires Advanced Security Option License
Enabling Encryption for Data Guard Redo Transport (Doc ID )

51. You may complete the session evaluation via the mobile app
April C Sims aprilcsims.wordpress.com LinkedIn Please complete the session evaluation We appreciate your feedback and insight
You may complete the session evaluation via the mobile app