Conocimiento y Experiencia en tecnología ORACLE

Henry GuerraConsultor de Tecnología Oracle

Grupos de Usuariosde America Latina

Grupo Oficial de Usuarios ORACLE en el Perú“Trabajo en equipo con usuarios Oracle para usuarios Oracle”

Comunidad formada por usuarios y difusores de la tecnología ORACLE que

promueven el intercambio y la generación de conocimiento asociado a la tecnología

ORACLE

afiliado a:

Oracle CorporationMisión:

“Hacer de nuestro software una fuente de ventaja competitiva continua para

nuestros clientes”

Get Better Results

Oracle Corporation

•La Compañía de Software Empresarial más Grande del Mundo

• $22.4B en ingresos FY08

• #1 en 40 categorías de producto o mercado

• 320,000 clientes en 145 países

• 20,000 partners

• $34B en 50 adquisiciones, desde 2005

• 85,000 empleados

• 5 millones de desarrolladores en las comunidades online de Oracle

•Innovación e Inversión

• Más de 3,000 productos, con más de 2,000 patentes

• $3B en Investigación y Desarrollo este año

• 20,000 desarrolladores

• 6,500 mejoras propuestas por clientes anuales

• 1 millón de estudiantes soportados

• 7,500 especialistas de soporte a clientes, hablando 27 idiomas

• 20,000 consultores de implementación

<Insert Picture Here>

Database Security Products

John Morales, Consultor Senior - DBA Database & Middleware

GBS Peru

EM Data Masking

TDE Tablespace Encryption

Oracle Audit Vault

Oracle Database Vault

Secure Backup (Tape)

TDE Column Encryption

VPD Column Masking

VPD Column Relevant

EM Secure Config Scanning

Client Identity Propagation

Fine Grained Auditing

Oracle Label Security

Proxy authentication

Enterprise User Security

Virtual Private Database (VPD)

Database Encryption API

Strong Authentication

Native Network Encryption

Database Auditing

Government customer

Oracle Database SecurityContinuous Innovation

Oracle7

Oracle8i

Oracle Database 9i

Oracle Database 10g

Oracle Database 11g

Data Security Components

User Management

Data Protection

Access Control• Controlling Privileged Users

• Custom Security Policies

• Row Level Security

Monitoring

Core Platform Security

Oracle Database Vault

• Controls on privileged users• Restrict highly privileged

users from application data

• Provide Separation of Duty

• Security for database and information consolidation

• Real time access controls• Control who, when, where

and how data is accessed

• Make decision based on IP address, time, auth…

Reports

Protection Realms

Multi-Factor

Authorization

Separation

of Duty

Command

Rules

Compliance and Insider Threats

Oracle Database Vault Realms

DBA

HR DBAHR

HR Realm

HR

• Database DBA views HR

dataselect * from HR.empCompliance and

protection from insiders

Fin

FIN DBA

• HR DBA views Fin. data

Eliminates security risks from server consolidation

Fin Realm

Fin

Realms can be easily applied to existing applications

with minimal performance impact

Oracle Database VaultCustom Policies with Multi-factor Authorization

HR account

FIN DBA

HR

FIN

SELECT ….

CREATE …

Business hours

Unexpected IP address

Oracle Label SecurityLabel Based Transparent Access Mediation

• Enables Multi-level Security

• Public, Confidential, Sensitive PII

• Data Consolidation Security

• Privacy and Compliance

• Oracle 8.1.7 and higher

• EE Security Product

• Oracle was the first to bring this

technology to commercial operating

systemsSensitive PII

Confidential

Public

Sensitive PII

PublicConfidential

Data Security Components

User Management

Data Protection• Network Encryption

• Data Encryption

• Backup Encryption

• Data Masking

• Data Privacy Shield

Access Control

Monitoring

Core Platform Security

The Need for EncryptionPrivacy and Compliance

• Millions of records lost and many more vulnerable

• Student, Faculty, Staff, Donor, Veterans Administration,…..

• Worldwide privacy, security and compliance regulations

• Payment Card Industry (PCI)

• Country-specific laws

Credit

Card Numbers

Disks replaced

for maintenanceLaptops stolen

Backups lost

Oracle Advanced SecurityTransparent Data Encryption at Rest and in Transit

• Network Encryption

• Native encryption for fast easy setup

• Secure Sockets Layer (SSL)

• Data at Rest Encryption

• Column (10gR2)

• RMAN backup (10gR2)

• Tablespace (11g)

• Data Pump export files (11g)

• Key Management

• Built-in two tier architecture

• Oracle Wallet (PKCS #12)

Strong

Authentication

Network Encryption

Data

Written

To Disk

Transparently

Encrypted

Data

Transparently

Decrypted

Through

SQL Interface

Encrypt

Database

Backups

Oracle

Secure

Backup

• Password-based authentication

• Strong authentication with 3rd party industry leaders

• Kerberos, CyberSafe, DCE

• Smart cards, token cards (SecurID), biometrics

• Industry-standard RADIUS allows authentication vendors to

integrate solution

• Smart cards, fingerprints, voice, etc.

• Strong authentication within a PKI

• X.509v3 certificates

Oracle Advanced SecurityStrong Authentication

Oracle Advanced SecurityNetwork Encryption

• Network Encryption includes a sequenced,

cryptographic checksum with every packet before it

is sent

• Uses the industry-standard integrity algorithms• MD5

• SHA-1 (with SSL)

• Automatically detects:

• Modifications

• Replays of packets

• Missing packets

Oracle Advanced SecurityTransparent Data Encryption (TDE)

• Column level encryption (10gR2)

• Transparent to existing applications

• Faster compared to home-grown approaches

• Complements DBMS_CRYPTO package (10gR1)

• Addresses PCI, SB1386, and other privacy requirements

• Tablespace level encryption (11g)

• For encrypting entire application data

• Supports foreign keys and range scan

• LOB encryption - aka Secure Files (11g)

• Master Key protection in hardware using PKCS #11 (11g)

Specifying Encryption Parameters

Oracle Secure Backup Integrated Tape Backup Management

• Protects entire environment• Oracle Database 11g, Oracle

Database 10g, Oracle9i

• Application files (OSB 10.2)

• Built-in Oracle advantage

• Single-vendor advantage

• Fastest backup for Oracle

• 25-40% faster than competition

• Express version

• OSB express protects one server to one attached tape drive

• No encryption

• Bundled with Oracle Database

Oracle Secure BackupCentralized Tape Backup Management

File System Data

UNIX Linux

Windows NAS

Tape

Oracle Databases

Integration with

RMAN

Data Masking – 10g2

11g + for Grid Control Integration

• Protect PII and sensitive

data during test, support,

and analysis

• Social Sec., Credit Card

• Business sensitive data

• In-house or off-shore

• Masking process

• Identify data to mask

• Define format mask or

choose from library

• Schedule masking job

• Customized masking rules

Need for Data Masking

• Key Drivers

• Privacy and compliance

• HIPAA, Breach Notification Laws

• EU Data Privacy Directive

• Application testing

• Offshore application development

• Offshore / In-house software QA

• Key Requirements

• Support database and application referential integrity

• Minimal performance impact

• Protect against reverse transformation

LAST_NAME SSN SALARY

AGUILAR 203-33-3234 40,000

BENSON 323-22-2943 60,000

D’SOUZA 989-22-2403 80,000

FIORANO 093-44-3823 45,000

LAST_NAME SSN SALARY

ANSKEKSL 111—23-1111 40,000

BKJHHEIEDK 111-34-1345 60,000

KDDEHLHESA 111-97-2749 80,000

FPENZXIEK 111-49-3849 45,000

Data Masking PackOracle Enterprise Manager

• Automates production data masking

• Mask data from a production database

• Define rules once

• Data relationship discovery

• Automates data relationship

enforcement using existing foreign keys

• Enter custom data relationships known

to the application

• Rules repository

• Format library, masking definitions

• Testing

• View sample data before masking

Production

Test

Clone/ Staging

Test

Mask

Data Security Components

User Management

Data Protection

Access Control

Monitoring• Enterprise Audit

• Configuration Mgmt Pack

Core Platform Security

Oracle Audit Vault Overview Trust-but-Verify

• Collect and Consolidate Audit Data• Oracle 9i Release 2 and higher

• Simplify Compliance Reporting• Built-in reports

• Open warehouse schema

• Detect and Prevent Insider Threats• Detect and alert proactively on

suspicious activity early

• Scale and Security• Database Vault, Advanced Security

• Partitioning

• Lower IT Costs with Audit Policies• Centrally manage and provision audit settings

28

Oracle 10gR2Oracle 10gR1

Oracle 9iR2

(Future)Other Sources,

Databases

Monitor Policies

Reports Security

Oracle Audit Vault ReportsOut-of-the-box Audit Assessments & Custom Reports

• Out-of-the-box reports

• Privileged user activity

• Access to sensitive data

• Role grants

• DDL activity

• Login/logout

• User-defined reports

• What privileged users did on the financial database?

• What user „A‟ did across multiple databases?

• Which non-app. users accessed sensitive data?

• Warehouse schema published

• Oracle BI Publisher or 3rd party tools

29

Oracle Audit Vault PoliciesEnterprise-wide Security & Compliance view

• Audit Policies - collection of audit settings on the databases

• Compare new settings against existing audit settings on source

• Apply audit settings centrally

• Demonstrate compliance to auditors

Audit Vault

Administrator

Financial

Database

Student

Database

HR

Database

FERPA

Audit

Settings

Privilege

User Audit

Settings

Student

Privacy

Audit

Settings

30

EM Config. Mgmt Pack for Database Compliance-driven Secure Configuration Policies

• Automate Database Security Assessment

• Database Parameters

• Database Profile

• Database Access

• Database File Permissions

• Post-installation Checks

• Track Configuration Drift across all monitored

databases

• Supports 8i and higher database releases

• Maps to COBIT, CIS, and Oracle‟s best practices

Compliance Score Trends

Oracle Database 11gSecurity Manageability

• Integrated with EM

• Label Security

• Virtual Private Database

• Application Context

• Enterprise Security

Manager

• Transparent Data

Encryption

Summary:

Oracle Database Security Products

Transparent Data EncryptionProtect Information without change to

the application by transparently

encrypting and decrypting data

Oracle Label SecurityControl access using labels

and classifications

Virtual Private DatabaseBuild custom security policies

Oracle Secure BackupData-to-tape encryption

protects against the misuse of

sensitive information if backup

tapes are stolen

Fine-Grained AuditingDBAs specify the

conditions necessary to

generate an audit record

Oracle Audit VaultAdministrators can consolidate and protect

audit information, enabling centralized

analysis and reporting on audit data.Oracle Identity ManagementWith Oracle Enterprise User Security,

DBAs manage database users

and authorizations in one

central place.

Oracle Database Vault

• Control access to data and applications, even among administrators.

• Build Rules and Realms to restrict access.

• Multifactor authorization enforces how, when, and where applications can be accessed by verifying IP address, authentication method, and time of day.

EM Data Masking

TDE Tablespace Encryption

Oracle Audit Vault

Oracle Database Vault

Secure Backup (Tape)

TDE Column Encryption

VPD Column Masking

VPD Column Relevant

EM Secure Config Scanning

Client Identity Propagation

Fine Grained Auditing

Oracle Label Security

Proxy authentication

Enterprise User Security

Virtual Private Database (VPD)

Database Encryption API

Strong Authentication

Native Network Encryption

Database Auditing

Government customer

Oracle Database SecurityContinuous Innovation

Oracle7

Oracle8i

Oracle Database 9i

Oracle Database 10g

Oracle Database 11g

Oracle Data Privacy ShieldPrivacy Vault Security

ODPS Identity Protection Application

Maintain Privacy Vault Data

ODPS Privacy Vault

DB Auth

Realms

Rules

VPD

Auditing

Restrict SSN column level access

Restrict authorized actions based on rules

Restrict use of system privileges (e.g. DBA access)

Implement role-based security

Trust but verify

Defense In Depth Securityinside the ODPS Privacy Vault

TDEEncrypt SSN column