Database Security

Database Security

Password Management
Components of password mgmt:
Account Locking
Password Aging and Expiration
Password History
Password Complexity Verification
Specify the max number of failed login attempts and time to keep acct locked by using the CREATE PROFILE command.
Password Settings that can be used in a profile:
FAILED_LOGIN_ATTEMPTS - number of unsuccessful login attempts before locking out the user.
PASSWORD_LOCK_TIME - Number of days a lock stays in place after a password expires.
PASSWORD_LIFE_TIME - Number of days a password stays effective before expiring.
PASSWORD_GRACE_TIME - Number of days "grace period" for creating a new password after first login after password has expired.
PASSWORD_REUSE_TIME - Number of days before a password can be reused.
PASSWORD_REUSE_MAX - Max number of times that a password can be reused.
PASSWORD_VERIFY_FUNCTION - PL/SQL function used to verify the complexity of a password before allowing it to be used as a valid password. Function must be created in the SYS schema and follow specific guidelines. Oracle provides a password complexity function that is created by the utlpwdmg.sql script that must be run as the SYS user.
Oracle default password verify function characteristics:
Min length is 4 characters
Password not equal to username
Must have at least 1 special character, 1 numeric value, and 1 character value.
Does not match simple words like welcome and user.
Must differ from previous password by at least 3 characters.
Invokers Rights Security Mgmt
CREATE PROCEDURE procedure_name (...)
AUTHID invoker_rights_clause IS
.... ;
Valid values for the invoker_rights_clause are:
DEFINER - procedure executes with the privileges of the schema owner where the procedure was created. External name will try to resolve in the procedure owner schema. AUTHID is the DEFAULT.
CURRENT_USER - procedure executes with the privileges of the current user. An “invoker-rights” procedure is created. All external names in queries, DML and dynamic SQL must resolve to the schema of the current user. All other external name references resolve to the procedure owner schema, these are known as references to other statements for test wording.
Fine-Grained Access Control
Provides a method to associate security policies with tables and views. Define once on the database server and then it is applicable to all applications that access the table or view. Database server automatically enforces the policies.
Implement the security policy with package functions and then associate with the table or view.
A table or view may have multiple policies defined on it. The policy enforcement is cumulative. AND logic is used to evaluate the multiple access control conditions that have been defined.
Application Context Areas
Use Application Context to help facilitate the implementation of fine-grained access control. You can associate security policies with applications, similar to associating them with tables or views.
Each application may have its own application specific context that the user of the app can not arbitrarily change.
Steps to define an application context:
1. Create the validation functions as part of a PL/SQL package.
2. Issue the CREATE CONTEXT command to associate a unique context name with the package of functions created in step 1.
3. Either reference the context in a policy function OR use an event trigger to set the context for a user upon initial login to an application.
N-Tier Authentication
In N-Tier authentication an application server that sits between the client machine and the database server assumes the responsibility for controlling security.
The application server can validate the credentials of a client and the database server can audit the actions of the application server performed on behalf of the client.