© 2007 by Prentice Hall12-1 Introduction to Oracle 10g Chapter 12 Maintaining Database Security James Perry and Gerald Post

© 2007 by Prentice Hall12-2 Chapter Outline Creating and Editing User Accounts Controlling User Access to Objects Enforcing Privileges through Views and Procedures Protecting Data with Encryption Auditing the Database

© 2007 by Prentice Hall Creating a user with Enterprise Manager Creating and editing user accounts

© 2007 by Prentice Hall12-4 User Accounts Role: Agent Permissions: Add customer Add listings Add offers … Database StewartM Role: Agent 12.2 User roles

© 2007 by Prentice Hall12-5 Table 12.1 Some common system privileges ALTER SESSION ALTER SYSTEM ALTER USER AUDIT ANY BACKUP ANY TABLE CREATE PROCEDURE CREATE ROLE CREATE SEQUENCE CREATE TABLE CREATE TRIGGER CREATE TYPE CREATE USER CREATE VIEW DROP USER FORCE TRANSACTION

© 2007 by Prentice Hall12-6 Table 12.2 Common object privileges PrivilegeTableViewSequenceProcedure, Function, or Package User Defined Type ALTERXX DELETEXX EXECUTEXX DEBUGXXXX FLASHBACKXX INDEXX INSERTXX ON COMMIT REFRESHX QUERY REWRITEX REFERENCESXX SELECTXXX UNDERXX UPDATEXX

© 2007 by Prentice Hall12-7 Purchasing clerk places order Purchasing manager verifies new supplier Supplier Supplier Table INSERT Purchase Table Purchase Item Table INSERT Receiving clerk accepts items UPDATE Quantity Received Accounting clerk authorizes payment SELECT AccountsPayable Cash INSERT 12.3 Separation of duties

© 2007 by Prentice Hall Using a DBA system table to list roles granted to a user

© 2007 by Prentice Hall12-9 Table 12.3 Desired permissions by object and role Database ObjectAgent roleManager role Tables Agents ContactReason CustAgentList Customers LicenseStatus Listings Properties SaleStatus Select All Select? All Select All Forms AgentContacts AgentListings Agents ContactReason Customers LicenseStatus ListingActivity Listings Management Properties SaleStatus Search4 Startup All None All None All None All None All Database ObjectAgent roleManager role Reports AgentSales CustomerList ListingsAndOffers SalesByCityAndAgent SalesByMonthAndAgent Maybe for self All Maybe for self All

© 2007 by Prentice Hall Results for MarcouxListings view

© 2007 by Prentice Hall12-11 Management button is not available 12.6 Startup form run by an agent without the Manager role

© 2007 by Prentice Hall Client Browser Server Server’s public key Data encrypted with server’s public key Data decrypted with server’s private key Public key Private key Certificate Authority Security certificate Database Data 12.7 Public key encryption Securing Internet transmissions

© 2007 by Prentice Hall Encryption test results

© 2007 by Prentice Hall12-14 Table 12.4 Oracle auditing types Type of AuditingDescription Statement AuditingTracks activity by the type of statement. For example, AUDIT TABLE tracks several DDL statements regardless of the table involved. A broad- based tracking but it can be applied to individual users or to everyone. Privilege AuditingMonitors the use of system privileges such as AUDIT CREATE TABLE. Can be assigned to track individual users or everyone. Schema Object AuditingRecords the usage of specific statements on individual objects. For instance, AUDIT SELECT ON customers records a note every time someone retrieves data from the customer table. Always applies to all users. Fine-Grained AuditingThe most detailed specifications, you can create any Boolean condition based on individual columns or specific rows of data. Or example, you might track all orders with a value > 100,000. Auditing the database

© 2007 by Prentice Hall Audit log results Auditing the database

© 2007 by Prentice Hall Changes stored from trigger code Creating triggers for audits