| Oracle® Healthcare Analytics Data Integration Security Guide Release 3.1 for Oracle Data Integrator E63828-01 |
|
| PDF · Mobi · ePub |
| Oracle® Healthcare Analytics Data Integration Security Guide Release 3.1 for Oracle Data Integrator E63828-01 |
|
| PDF · Mobi · ePub |
Security Guide
Release 3.1 for Oracle Data Integrator
E63828-01
June 2015
This document contains the following sections:
OHADI processes data from diverse source systems and loads the homogenized, consistent, complete, correct, and standardized data into HDWF for analysis.
The following principles are fundamental to using any application securely.
One of the principles of good security practice is to keep all software versions and patches up-to-date.
Oracle continually improves its software and documentation. Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of January, April, July, and October. We highly recommend customers to apply these patches as soon as they are released.
Although the importance of passwords is well known, the following basic rule of security management is worth repeating:
Make sure all passwords are strong passwords.
You can strengthen passwords by creating and using password policies for your organization. For guidelines on securing passwords and for additional ways to protect passwords, refer to the Oracle® Database Security Guide specific to the database release you are using.
You should modify the following passwords to use your policy-compliant strings:
Passwords for the database default accounts, such as SYS and SYSTEM.
Passwords for the database application-specific schema accounts, such as HDM, HDI, and HMC.
The password for the database listener. You must not configure a password for the database listener as that will enable remote administration. For more information, refer to the section Removing the Listener Password of Oracle® Database Net Services Reference 11g Release 2 (11.2).
The principle of least privilege states that users should be given the least amount of privilege to perform their jobs. Overly ambitious granting of responsibilities, roles, grants — especially early on in an organization's life cycle when people are few and work needs to be done quickly — often leaves a system wide open for abuse. User privileges should be reviewed periodically to determine relevance to current job responsibilities.
Before executing DDL scripts to create HMC schema, a database user should be created with specified limited set of privileges. DBA access should not be given to the user.
The following principles are fundamental to using any application securely:
Oracle Database Vault restricts access to specific areas in an Oracle database from any user, including users who have administrative access. For example, you can restrict administrative access to employee salaries, customer medical records, or other sensitive information.
Oracle Audit Vault automates the audit collection, monitoring, and reporting process. It turns audit data into a key security resource for detecting unauthorized activity. Consider using this feature to satisfy compliance regulations such as SOX, PCI, and HIPAA, and to mitigate security risks.
Transparent Data Encryption is one of the three components of the Oracle Advanced Security option for Oracle Database 11.2.0.4 Enterprise Edition. It provides transparent encryption of stored data to support your compliance efforts. Applications do not have to be modified and will continue to work seamlessly as before. Data is automatically encrypted when it is written to disk, and automatically decrypted when accessed by the application. Key management is built in to the Tablespace Encryption feature, eliminating the complex task of creating, managing, and securing encryption keys.
Schema owner should not be the user for normal production; instead the account should be locked after the installation.
Keep only the minimum number of ports open and close all ports that are not in use.
Oracle Healthcare Analytics Data Integration Configuration does not use the Telnet service.
Telnet listens on port 23 by default.
If the Telnet service is available on any computer, Oracle recommends that you disable Telnet in favor of Secure Shell (SSH). Telnet, which sends clear-text passwords and user names through a log-in, is a security risk to your servers. Disabling Telnet tightens and protects your system security.
In addition to not using Telnet, the Oracle Healthcare Analytics Data Integration Configuration does not use the following services or information for any functionality:
Simple Mail Transfer Protocol (SMTP). This protocol is an Internet standard for E-mail transmission across Internet Protocol (IP) networks.
Identification Protocol (identd). This protocol is generally used to identify the owner of a TCP connection on Linux.
Simple Network Management Protocol (SNMP). This protocol is a method for managing and reporting information about different systems.
Restricting these services or information does not affect the use of Oracle Healthcare Analytics Data Integration Configuration. If you are not using these services for other applications, Oracle recommends that you disable these services to minimize your security exposure. If you need SMTP, identd, or SNMP for other applications, be sure to upgrade to the latest version of the protocol to provide the most up-to-date security for your system.
When designing a secure deployment, design multiple layers of protection. If a hacker should gain access to one layer, such as the application server, that should not automatically give them easy access to other layers, such as the database server.
Providing multiple layers of protection may include:
Enable only those ports required for communication between different tiers, for example, only allowing communication to the database tier on the port used for SQL*NET communications (1521 by default).
Place firewalls between servers so that only expected traffic can move between servers.
If the Oracle Data Integrator (ODI) repository is installed in a database server other than the server having HDWF schema, the data transfer will take place between two different database servers over a network. As HDWF contains sensitive clinical and healthcare data, you must secure the communication between database servers. Use Oracle® Net Manager to configure encryption to secure communication between database servers. Oracle provides different encryption algorithms to secure communication. Select an appropriate encryption algorithm. For more information, refer to Oracle® Database Advanced Security Administrator's Guide 11g Release 2 (11.2).
Proxy schema is a schema through which you can access the main schemas like HDI (interface schema), HDM (HDWF schema), and HMC (metadata schema) with limited access. OHADI ETLs must be executed through a proxy schema. This is an optional feature. To use this feature, you must follow the steps in Section 4.1. This appendix provides information on how to execute ETLs using the proxy schema. It contains the following topics:
To execute ETLs using a proxy schema, perform the following steps:
Navigate to the ohadi_sql directory under OHADI Installation folder and open the command prompt.
Note:
If sqlplus does not work from command prompt, first set the ORACLE_HOME environment variable to Oracle's home directory and use the following syntax to connect to sqlplus:Linux:
sqlplus <user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<portnumber>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
Log in as SYS user in database with the following syntax from the command prompt and execute the scripts.
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
Create a proxy schema user within the same DB instance where HDWF 6.0 is installed, with an appropriate default tablespace with requisite quotas and temporary tablespace.
Execute the following scripts from the SYS user:
@OHADI_PROXY_GRANT_SESSION_PREIVS.sql <name of the proxy schema>;
@OHADI_PROXY_HDWF_GRANT_PRIVILEGES.sql <name of the interface schema> <name of the HDWF schema> <name of the metadata schema> <name of the proxy schema PROXY_SCHEMA>;
Log in as <PROXY_SCHEMA> user in the database by executing the following command in the command prompt and execute the script:
sqlplus <proxy schema>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
@OHADI_PROXY_PACKAGE_CREATE_CONTEXT.sql;
Log in as HDWF user (for example, HDM) in the database using the following commands in the command prompt:
sqlplus <hdwf schema>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
@OHADI_PROXY_E_TABLE_SCRIPT_DI_TABLES.sql <name of the HDWF schema>;
@OHADI_PROXY_E_TABLE_SCRIPT_MDM_TABLES.sql;
Log in as Metadata user (for example, HMC) in the database using the following commands in the command prompt:
sqlplus <metadata schema>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
@OHADI_PROXY_E_TABLE_SCRIPT_RULE_TABLES.sql;
@OHADI_PROXY_UPDATE_GLBL_PARAM_TABLE.sql <name of the metadata schema>;
Log in as SYS user and execute the following script:
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
@OHADI_HDWF_CONFIG_GRANT_PRIVILEGES.sql <name of the interface schema> <name of the HDWF schema> <name of the metadata schema>
Log in again as SYS user and execute the following script:
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
@OHADI_PROXY_HDWF_GRANT_PRIVILEGES.sql <name of the interface schema> <name of the HDWF schema> <name of the metadata schema> <name of the proxy schema PROXY_SCHEMA>;
In ODI, log in to OHADI work repository and navigate to Topology > Physical Architecture > Technologies > Oracle.
Click the HDI data server. Modify the following options:
User - <name of the proxy schema>
password - <password of the proxy schema>
Figure 1 Modify the Options for the HDI Data Server
Repeat step 11 for HDWF and HMC data servers.
Save the repository.
Execute the OHADI ETLs.
Proxy schema is a schema through which you have limited access to the main schemas like HDI (interface schema) and HMC (metadata schema). HLI ETLs must also be executed through a proxy schema. This is an optional feature. To use this feature, perform the following steps once:
Traverse to the hli_sql directory under HLI installation folder and open the command prompt.
Note:
If sqlplus does not work from command prompt, first set the ORACLE_HOME environment variable to Oracle's home directory and use the following syntax to connect to sqlplus:Linux:
sqlplus <user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<portnumber>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
Log in as SYS user in database from the command prompt and execute the following scripts:
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
Create a proxy schema user within the same DB instance where HDWF 6.0 is installed, with an appropriate default tablespace with requisite quotas and temporary tablespace.
Log in as HDI user in database and execute the following scripts:
sqlplus <HDI user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
@ HLI_PROXY_E_DDL.sql
Disconnect <HDI user> user.
Log in as SYS user.
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
Run the following script:
@ HLI_PROXY_HDWF_GRANT_PRIVILEGES.sql <name of the interface schema> <name of the metadata schema> <name of the proxy schema PROXY_SCHEMA>;
In ODI:
Log in to HLI work repository.
Navigate to Topology > Physical Architecture > Technologies > Oracle.
Click the HDI data server.
Modify the following options as shown in the screenshot.
User - name of the proxy schema
password - password of the proxy schema
Figure 2 Modifying the HDI Connection Settings
Repeat step 8 for the other data server HMC.
Save the repository.
Execute HLI ETLs.
To revert the proxy schema configuration to the default schema configuration, perform the following steps:
In ODI, log in to OHADI or HLI work repository, and navigate to Topology > Physical Architecture > Technologies > Oracle.
Click the HDI data server. Modify the following options:
User - <name of the HDWF Interface schema name>
password - <password of the HDWF Interface schema>
Repeat step 2 for HDWF and HMC schema.
Save the configuration in the repository.
Log in as SYS user in database with the following syntax from the command prompt and execute the scripts.
sqlplus <sys user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))" as sysdba
Enter the password when prompted.
drop user <name of the proxy schema PROXY_SCHEMA> cascade;
Log in as Metadata user (for example, HMC) in the database using the following commands in the command prompt:
sqlplus <metadata user>@"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST=<hostname>)(PORT=<port number>))(CONNECT_DATA=(SERVICE_NAME=<service_name>)))"
Enter the password when prompted.
@ OHADI_PROXY_REVERT_GLBL_PARAM_TABLE.sql <name of the metadata schema>;
For OHADI, make sure to execute the following global packages before executing any transactional ETL:
PKG_Global_Refresh_Variables
PKG_Global_Refresh_Procedure
For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.
Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.
Oracle Healthcare Analytics Data Integration Security Guide, Release 3.1 for Oracle Data Integrator
E63828-01
Copyright © 2015, Oracle and/or its affiliates. All rights reserved.
This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.
The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.
If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:
U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.
This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.
This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.
 Copyright © 2015, Oracle and/or its affiliates. All rights reserved. Legal Notices |
|
