Understanding Security Principles

There are four basic security principles: access, authentication, authorization, and accounting.

• Access

  Physical and software controls are necessary to protect your hardware or data from intrusion.

  • For hardware, access limits usually mean physical access limits.

  • For software, access is limited through both physical and virtual means.

  • Firmware cannot be changed except through the Oracle update process.

• Authentication

  All platform operating systems provide authentication features that can be set up to ensure that users are who they say they are.

  Authentication provides varying degrees of security through measures such as badges and passwords.

• Authorization

  Authorization allows company personnel to work only with hardware and software that they are trained and qualified to use. To this end, system administrators create systems of Read/Write/Execute permissions to control user access to commands, disk space, devices, and applications.

• Accounting

  Oracle software and hardware features allow customer IT to monitor login activity and maintain hardware inventories.

  • User logins can be monitored through system logs. System Administrator and Service accounts in particular have access to powerful commands and should be carefully monitored through system logs. Logs are typically maintained for a long period, so it is essential to periodically retire log files when they exceed a reasonable size, in accordance with the customer company policy.

  • Customer IT assets are usually tracked through serial numbers. Oracle part numbers are electronically recorded on all cards, modules, and mother boards, and can be used for inventory purposes.