Oracle® Database Appliance

Security Guide

Release 12.1.2.10.0

E83197-01

February 2017

Oracle Database Appliance Security Guide, Release 12.1.2.10.0

E83197-01

Copyright © 2014, 2017, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

1 Overview of Oracle Database Appliance Security

- Basic Security Principles

- Survivability of Mission-Critical Workloads

- Defense in Depth to Secure the Operating Environment

- Least Privilege for Services and Users

- Accountability of Events and Actions

2 Security Features of Oracle Database Appliance

- About Oracle Database Appliance Security Features

- Using Isolation Policies

- Isolating Network Traffic

- Isolating Databases

- Controlling Access to Data

- Controlling Network Access

- Controlling Database Access

- Configuring a SUDO Security Policy

- Using Cryptographic Services

- Monitoring and Auditing of Oracle Database Appliance

- Using Oracle ILOM for Secure Management

3 Planning a Secure Environment

- Considerations for a Secure Environment

- Understanding User Accounts

- Understanding the Default Security Settings

4 Keeping Oracle Database Appliance Secure

- Securing the Hardware

- Securing the Software

- Maintaining a Secure Environment

- About Secure Environments

- Maintaining Network Security

- Updating Software and Firmware

- Ensuring Data Security Outside of Oracle Database Appliance

Index

Preface

This guide describes security for Oracle Database Appliance. It includes information about the components, the recommended password policies, and best practices for securing the Oracle Database Appliance environment.

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Audience

This document is intended for system, database, and network administrators responsible for securing Oracle Database Appliance.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

For more information, see the following documents:

- Oracle Database Appliance Getting Started Guide

- Oracle Database Appliance X6-2S, X6-2M, and X6-2L Deployment and User’s Guide

- Oracle Database Appliance X6-2-HA Deployment and User’s Guide

- Oracle Database Appliance Administration and Reference Guide

- Oracle Database Appliance Owner's Guide

- Oracle Database Appliance Service Manual

- Oracle Integrated Lights Out Manager (ILOM) Security Guide Firmware Release 3.1

- Oracle Enterprise Manager Plug-in for Oracle Database Appliance User's Guide

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, emphasis, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

$ prompt

The dollar sign ($) prompt indicates a command run as the oracle user.

# prompt

The pound (#) prompt indicates a command that is run as the root user.

1 Overview of Oracle Database Appliance Security

Oracle Database Appliance provides a complete package of integrated security capabilities to complement its integrated hardware and software system design.

In addition to basic security principles, Oracle Database Appliance addresses survivability, defense in depth, least privilege, and accountability. Oracle Database Appliance delivers a well-integrated set of security capabilities that help organizations address their most-pressing security requirements and concerns.

Topics:

- Basic Security Principles
Oracle Database Appliance is configured with common basic security principles for software and hardware.

- Survivability of Mission-Critical Workloads
Oracle Database Appliance follows Oracle Maximum Availability Architecture best practices, which can prevent or minimize the damage caused from accidental and malicious actions taken by internal users or external parties.

- Defense in Depth to Secure the Operating Environment
Oracle Database Appliance employs multiple, independent, and mutually-reinforcing security controls to help organizations create a secure operating environment for their workloads and data.

- Least Privilege for Services and Users
The Least-Privilege principle includes more than ensuring that applications, services and users have access to the capabilities that they need to perform their tasks. It is equally important to limit access to unnecessary capabilities, services, and interfaces.

- Accountability of Events and Actions
When an incident occurs, a system must be able to detect and report the incident. Similarly, when an event cannot be prevented, it is imperative that an organization be able to detect that the event occurred so that proper responses can be taken.

Basic Security Principles

Oracle Database Appliance is configured with common basic security principles for software and hardware.

Basic security includes the following methods:

- Authentication.
Authentication is the means by which a user is identified. Typically, you identify users with confidential information. All components in Oracle Database Appliance use authentication to ensure that users are who they say they are. By default, Oracle Database Appliance authenticates users with local user names and passwords. You can also authenticate users with a Shared Key Authentication (SKA) method.

- Authorization.
Authorization enables administrators to control what tasks or privileges a user may perform or use. You can authorize personnel to access only the tasks and privileges that have been given to them. Oracle Database Appliance system administrators can configure resources with read/write/execute permissions. Use these permissions to control user access to commands, disk space, devices, and applications. In addition, starting with Oracle Database Appliance release 12.1.2.4.0, system administrators can give SUDO privileges to non-root users. SUDO privileges allow users without root privileges to run OAKCLI commands.

- Accounting and Auditing.
Accounting and auditing enables you to maintain a record of users’ activity on the system. Oracle Database Appliance software and hardware features enable administrators to monitor login activity, and to maintain hardware inventories. Accounting and auditing are implemented with the following methods:

- Hardware assets are tracked through serial numbers. Oracle part numbers are electronically recorded on all cards, modules, and motherboards. You can use these serial numbers to maintain inventory records.

- User logins are monitored through system logs. System administrators and service accounts have access to commands that, if used incorrectly, could cause harm and data loss. Use system logs to monitor access and commands.

Survivability of Mission-Critical Workloads

Oracle Database Appliance follows Oracle Maximum Availability Architecture best practices, which can prevent or minimize the damage caused from accidental and malicious actions taken by internal users or external parties.

Oracle Maximum Availability Architecture best practices help to provide organizations with hardware and software platforms for mission-critical workloads. These best practices increase survivability by using the following methods:

- Ensuring that the components used in Oracle Database Appliance are designed, engineered, and tested to work well together in support of secure deployment architectures.
Oracle Database Appliance supports secure isolation, access control, cryptographic services, monitoring and auditing, quality of service, and secure management.

- Reducing the default attack surface of its constituent products to help minimize the overall exposure of the machine.
You can customize Oracle Database Appliance security settings, based on your organization's policies and needs.

- Protecting the machine, including its operational and management interfaces.
Oracle Database Appliance is protected using a complement of open and vetted protocols, and APIs capable of supporting traditional security goals of strong authentication, access control, confidentiality, integrity, and availability.

- Verifying that software and hardware contain features that keep the service available, even when failures occur.
These hardware and software redundancy capabilities help in cases where attackers attempt to disable one or more individual components in the system.

Defense in Depth to Secure the Operating Environment

Oracle Database Appliance employs multiple, independent, and mutually-reinforcing security controls to help organizations create a secure operating environment for their workloads and data.

Oracle Database Appliance supports the principle of defense in depth by using the following methods:

- Offers a strong complement of protections, which secures information in transit, in use, and at rest. Security controls are available at the server, storage, network, database, and application layers. You can integrate each layer's unique security controls with the others to enable the creation of strong, layered security architectures.

- Supports the use of well-defined and open standards, protocols, and interfaces. You can integrate Oracle Database Appliance into your organization's existing security policies, architectures, practices and standards. Integration is critical, because applications and devices do not exist in isolation. IT security architectures is only as strong as its weakest component.

- Conducts multiple security scans using industry-leading security analyzers, which implements all high-priority security items before each new Oracle Database Appliance software version release.

Least Privilege for Services and Users

The Least-Privilege principle includes more than ensuring that applications, services and users have access to the capabilities that they need to perform their tasks. It is equally important to limit access to unnecessary capabilities, services, and interfaces.

Oracle Database Appliance promotes the principle of least-privilege by using the following methods:

- Granting access to individual servers, storage, operating system, databases, and other components based on the role of each user and administrator. Using role-based and multi-factor access control models with fine-grained privileges enables you to limit access only to the privileges needed to perform assigned roles.

- Restricting application access to information, underlying resources, network communications, and local or remote service access only to what is needed for the application.

Whether caused by accident or by malicious attack, applications can misbehave. Enforcing Least Privilege practices helps to prevent applications from causing harm beyond their intended use.

Accountability of Events and Actions

When an incident occurs, a system must be able to detect and report the incident. Similarly, when an event cannot be prevented, it is imperative that an organization be able to detect that the event occurred so that proper responses can be taken.

Oracle Database Appliance uses the following methods to supports the principle of accountability:

- Ensuring each of the components used in Oracle Database Appliance supports activity auditing and monitoring, including the ability to record login and logout events, administrative actions, and other events specific to each component.

- Leveraging features in Oracle Database to support fine-grained, auditing configurations. These configurations enables organizations to tune audit configurations in response to their standards and goals. Administrators can ensure that critical information is captured, while minimizing the amount of unnecessary audit events.

2 Security Features of Oracle Database Appliance

Oracle Database Appliance uses hardware and software hardening processes to secure the system, and that assist in deploying a layered security strategy.

Topics:

- About Oracle Database Appliance Security Features
Oracle Database Appliance includes hardening configuration and security capabilities to core components.

- Using Isolation Policies
Isolation policies provide more secure multitenant services.

- Controlling Access to Data
Controlling access to data, workloads and infrastructure helps to provide greater security.

- Using Cryptographic Services
Cryptographic services can help to protect and validate information at rest, in transit, and in use.

- Monitoring and Auditing of Oracle Database Appliance
Oracle Database Appliance includes Oracle Database Fine Grained Auditing (FGA), Oracle Audit Vault, and Oracle Database Firewall Remote Monitor, which provide comprehensive monitoring and auditing features.

- Using Oracle ILOM for Secure Management
Oracle Integrated Lights-Out Management (ILOM) enables full out-of-band management, providing remote management capability for Oracle Database Appliance.

About Oracle Database Appliance Security Features

Oracle Database Appliance includes hardening configuration and security capabilities to core components.

Your organization can use the security features of Oracle Database Appliance as part of a layered security strategy.

Hardening Configuration

Oracle Database Appliance includes the following recommended hardening configuration procedures:

- Installed packages are trimmed to a minimum, so that unnecessary packages are not installed on the servers.

- Essential services only are enabled on the Oracle Database Appliance nodes.

- Operating system users are audited.

- Secure configurations for NTP, SSH, and other services.

Security Capabilities

Oracle Database Appliance architecture provides security capabilities to the core components. The capabilities are grouped into the following categories:

- Isolation policies

- Controlled access to data

- Cryptographic services

- Monitoring and auditing

- Oracle Integrated Lights Out Manager (ILOM)

Using Isolation Policies

Isolation policies provide more secure multitenant services.

If your organization wants to consolidate IT infrastructure, implement shared service architectures, and deliver secure multitenant services, then you should isolate services, users, data, communications, and storage. Oracle Database Appliance provides organizations the flexibility to implement the isolation policies and strategies, based on their needs.

Topics:

- Isolating Network Traffic
Oracle Database Appliance isolates client access from device management and inter-device communication at the physical network level.

- Isolating Databases
All Oracle Database security options are available for Oracle Database Appliance.

Isolating Network Traffic

Oracle Database Appliance isolates client access from device management and inter-device communication at the physical network level.

Oracle Database Appliance isolates client and management network traffic on separate networks. Clients access services on a redundant 10 Gbps Ethernet network that ensures reliable, high-speed access to services running on the system. Cluster management access is provided over a physically separate 1 Gbps Ethernet network. Providing physically separate networks ensures separation between operational and management network traffic.

Your organization can choose to further segregate network traffic over the client access Ethernet network by configuring virtual local area networks (VLANs). VLANs segregate network traffic based on your organization’s requirements. Oracle recommends the use of encrypted protocols over VLANs to assure the confidentiality and integrity of communications.

Isolating Databases

All Oracle Database security options are available for Oracle Database Appliance.

One of the best isolation methods is to create physical separation is to dedicate an entire environment to a single application or database. However, servers dedicated to one application or one database are expensive. A more cost-effective isolation strategy uses multiple databases within the same operating system image. You can obtain multiple database isolation through a combination of database and operating system-level controls, such as dedicated credentials for users, groups, and resource controls.

All Oracle Database security options are available for Oracle Database Appliance. If your organization requires finer-grained database isolation can use software such as Oracle Database Vault, Oracle Virtual Private Database, and Oracle Label Security.

Oracle Database Vault includes a mandatory access control model, which enforces isolation by using logical realms within a single database. Logical realms form a protective boundary around existing application tables by blocking administrative accounts from having ad-hoc access to application data. Oracle Database Vault command rules enable policy-based controls that limit who, when, where, and how the database and application data is accessed. This creates a trusted path to application data. Oracle Database Vault can also be employed to restrict access based upon time, source IP address, and other criteria.

Oracle Virtual Private Database enables the creation of policies that enforce fine-grained access to database tables and views at the row and column levels. Oracle Virtual Private Database provides security portability because the policies are associated with database objects, and are automatically applied no matter how the data is accessed. Oracle Virtual Private Database can be used for fine-grained isolation within the database.

Oracle Label Security classifies data, and mediates access to that data based upon its classification. Your organization can define classification strategies, such as hierarchical or disjoint, that best support their needs. This capability allows information stored at different classification levels to be isolated at the row level within a single tablespace.

Controlling Access to Data

Controlling access to data, workloads and infrastructure helps to provide greater security.

To protect application data, workloads, and the underlying infrastructure on which it runs, Oracle Database Appliance offers comprehensive yet flexible access control capabilities for both users and administrators. The control capabilities include network access and database access.

Topics:

- Controlling Network Access
Configure Network access to provide fine-grained access control.

- Controlling Database Access
Help to reduce the risk of collusive behavior and inadvertent errors by using separation of duties at every layer of database architecture using role-allocated operating system users and group system privileges.

- Configuring a SUDO Security Policy
Use these examples to help to implement a SUDO policy.

Controlling Network Access

Configure Network access to provide fine-grained access control.

Beyond simple network-level isolation, fine-grained access control policies can be instituted at the device level. All components in Oracle Database Appliance include the ability to limit network access to services either using architectural methods, such as network isolation, or using packet filtering and access control lists to limit communication to, from, and between components and services.

Controlling Database Access

Help to reduce the risk of collusive behavior and inadvertent errors by using separation of duties at every layer of database architecture using role-allocated operating system users and group system privileges.

key credentials,

For example, use different operating system user accounts and designate different physical groups to grant Oracle Database and Oracle Automatic Storage Management (Oracle ASM) system privileges to ensure role separation for database and storage administrators. Within Oracle Database, you can assign specific privileges and roles to ensure that users have access to only those data objects that they are authorized to access. Data cannot be shared unless it is explicitly permitted.

In addition to the password-based authentication available in Oracle Database, Oracle Advanced Security option enables organizations to implement strong authentication using public key credentials, RADIUS, or a Kerberos infrastructure. Using Oracle Enterprise User Security, the database can be integrated with existing LDAP repositories for authentication and authorization. These capabilities provide higher assurance of the identity of users connecting to the database.

You can use Oracle Database Vault to manage administrative and privileged user access, controlling how, when and where application data can be accessed. Oracle Database Vault protects against misuse of stolen login credentials, application bypass, and unauthorized changes to applications and data, including attempts to make copies of application data. Oracle Database Vault is transparent to most applications, and day-to-day tasks. It supports multi-factor authorization policies, allowing for secure enforcement of policy without disrupting business operations.

Oracle Database Vault can enforce separation of duties to ensure that account management, security administration, resource management, and other functions are granted only to those users authorized to have those privileges.

Configuring a SUDO Security Policy

Use these examples to help to implement a SUDO policy.

A SUDO policy helps to provide system auditing and access control for superuser (root) privileges on the operating system.

In environments where the system administration is handled by a different group than the database administration, or where security is a large concern, you may want to limit access to the root user account and password. SUDO allows a system administrator to give certain users (or groups of users) the ability to run commands as root while logging all commands and arguments.

A SUDO security policy is configured by using the file /etc/sudoers. Within the sudoers file, you can configure groups of users and sets of commands to simplify SUDO administration.

Caution:

Configuring SUDO to allow a user to perform any operation is equivalent to giving that user root privileges. Consider carefully if this is appropriate for your security needs.

SUDO Example 1: Allow a User to Perform Any OAKCLI Operation

To configure SUDO to allow a user to perform any OAKCLI operation, add lines to the commands section in the /etc/sudoers file. For example:

## The commands section may have other options added to it.
##
Cmnd_Alias OAKCLI_CMDS=/opt/oracle/oak/bin/oakcli *
jdoe ALL = OAKCLI_CMDS

In this example, jdoe is the user name. ALL= OAKCLI_CMDS grants the jdoe user permission to run all oakcli commands defined in the command alias OAKCLI_CMDS. The sudoers file is designed so that one sudoers file can be copied to multiple hosts with different rules on each host.

Note:

You must have Secure Shell (SSH) user equivalency set up before creating the database. If it is not set up, then you are required to provide the root password during database creation.

After you configure the sudoer file with the user, user jdoe can run oakcli commands. For example:

[jdoe@servernode1 ~]$ sudo /opt/oracle/oak/bin/oakcli create database -db newdb
INFO: 2015-08-05 14:40:55: Look at the logfile  '/opt/oracle/oak/log/scaoda1011/tools/12.1.2.4.0/createdb_newdb_91715.log'
for more details
INFO: 2015-08-05 14:40:59: Database parameter file is not provided. Will be using default parameters for DB creation
Please enter the 'SYSASM'  password : (During deployment we set the SYSASM password to 'welcome1'):

Please re-enter the 'SYSASM' password:

INFO: 2015-08-05 14:41:10: Installing a new home: OraDb12102_home3 at /u01/app/oracle/product/12.1.0.2/dbhome_3
Please select one of the following for Database type  [1 .. 3]:
1    => OLTP
2    => DSS
3    => In-Memory

SUDO Example 2: Allow a User to Perform Only Selected OAKCLI Operations

To configure SUDO to allow a user to perform only selected OAKCLI operations, add lines to the commands section in the /etc/sudoers file. For example:

[jdoe2@servernode1 ~]$ sudo /opt/oracle/oak/bin/oakcli create database -db test
INFO: 2015-09-30 15:49:07: Look at the logfile '/opt/oracle/oak/log/servernode1/tools/12.1.2.4.0/createdb_test_59955.log' for more details
INFO: 2015-09-30 15:49:12: Database parameter file is not provided. Will be using default parameters for DB creation

Please enter the 'SYSASM'  password : (During deployment we set the SYSASM password to 'welcome1'):
Please re-enter the 'SYSASM' password:

INFO: 2015-09-30 15:49:27: Installing a new home: OraDb12102_home2 at /u01/app/oracle/product/12.1.0.2/dbhome_2

Please select one of the following for Database type  [1 .. 3]:
1    => OLTP
2    => DSS
3    => In-Memory

In this command example, the user jdoe2 tries to run the oakcli show databases command, and receives an error message:

[jdoe2@servernode1 ~]$ sudo /opt/oracle/oak/bin/oakcli show database
Sorry, user jdoe2 is not allowed to execute '/opt/oracle/oak/bin/oakcli show database' as root on servernode1.

Note:

You must have Secure Shell (SSH) user equivalency set up before creating the database. If it is not set up, then you are required to provide the root password during database creation.

Note:

For more information about configuring and using SUDO, refer to the SUDO man pages:

http://www.sudo.ws/sudo.html

Using Cryptographic Services

Cryptographic services can help to protect and validate information at rest, in transit, and in use.

From encryption and decryption to digital fingerprint and certificate validation, cryptography is one of the most-widely deployed security controls in IT organizations.

Whenever possible, Oracle Database Appliance makes use of hardware-based cryptographic engines Intel AES-NI and Oracle SPARC processors. Using hardware for cryptographic operations provides significant performance improvement over performing the operations in software. Both engines provide the ability to perform cryptographic operations in hardware, and both are leveraged by Oracle software on the database and storage servers.

Network cryptographic services protect the confidentiality and integrity of communications by using a cryptographically-secure protocol. For example, Secure Shell (SSH) access provides secure administrative access to systems and Integrated Lights Out Managers (ILOMs). SSL/TLS can enable secure communications between applications and other services.

Database cryptographic services are available from Oracle Advanced Security. Oracle Advanced Security encrypts information in the database using the transparent data encryption (TDE) functionality. TDE supports encryption of application table spaces, and encryption of individual columns within a table. Data stored in temporary table spaces, and redo logs are also encrypted. When the database is backed up, the data remains encrypted on destination media. This protects information at rest no matter where it is physically stored. Oracle Advanced Security should be considered for organizations concerned about the confidentiality of stored database content or database encryption, either at the table space level or column-level.

In addition, Oracle Advanced Security can encrypt Oracle Net Services and JDBC traffic using either native encryption or SSL to protect information while in transit over a network. Both administrative and application connections can be protected to ensure that data in transit is protected. The SSL implementation supports the standard set of authentication methods including anonymous (Diffie-Hellman), server-only authentication using X.509 certificates, and mutual (client-server) authentication with X.509.

Monitoring and Auditing of Oracle Database Appliance

Oracle Database Appliance includes Oracle Database Fine Grained Auditing (FGA), Oracle Audit Vault, and Oracle Database Firewall Remote Monitor, which provide comprehensive monitoring and auditing features.

Whether for compliance reporting or incident response, monitoring and auditing are critical functions that organizations must use to gain increased visibility into their IT environment. The degree to which monitoring and auditing is employed is often based upon the risk or criticality of the environment. Oracle Database Appliance has been designed to offer comprehensive monitoring and auditing functionality at the server, network, database, and storage layers ensuring that information can be made available to organizations in support of their audit and compliance requirements.

Oracle Database Fine Grained Auditing (FGA) can help you to create create audit records at the level of individual tables and columns, reducing audit overhead. FGA enables organizations to establish policies that selectively determine when audit records are generated. This helps organizations to focus on other database activities, and to reduce the overhead that is often associated with audit activities.

Oracle Audit Vault centralizes the management of database audit settings and automates the consolidation of audit data into a secure repository. Oracle Audit Vault includes built-in reporting to monitor a wide range of activities including privileged user activity and changes to database structures. The reports generated by Oracle Audit Vault enable visibility into various application and administrative database activities, and provide detailed information to support accountability of actions.

Oracle Audit Vault enables the proactive detection and alerting of activities that may be indicative of unauthorized access attempts or abuse of system privileges. These alerts can include both system and user-defined events and conditions, such as the creation of privileged user accounts or the modification of tables containing sensitive information.

Oracle Database Firewall Remote Monitor can provide real-time database security monitoring. Oracle Database Firewall Remote Monitor queries database connections to detect malicious traffic, such as application bypass, unauthorized activity, SQL injection and other threats. Using an accurate SQL grammar-based approach, Oracle Database Firewall helps organizations quickly identify suspicious database activity.

Using Oracle ILOM for Secure Management

Oracle Integrated Lights-Out Management (ILOM) enables full out-of-band management, providing remote management capability for Oracle Database Appliance.

IPMI v2.0 and Collections of security controls and capabilities are necessary to properly secure individual applications and services. It is equally important to have comprehensive management capabilities to sustain the security of the deployed services and systems. Oracle Database Appliance uses the security management capabilities of Oracle ILOM.

Oracle ILOM is a service processor embedded in many Oracle Database Appliance components to perform out-of-band management activities. Oracle ILOM provides the following features:

- Secure access to perform secure lights-out management of the database and storage servers. Access includes web-based access protected by SSL, command-line access using Secure Shell, and SNMPv3 protocols.

- Separate duty requirements using a role-based access control model. Individual users are assigned to specific roles that limit the functions that can be performed.

- An audit record of all logins and configuration changes. Each audit log entry lists the user performing the action, and a timestamp. This allows organizations to detect unauthorized activity or changes, and attribute those actions back to specific users.

3 Planning a Secure Environment

Determine security practices that you want to deploy before your Oracle Database Appliance is delivered.

After deployment, review your security practices periodically, and adjust them as needed to stay current with the security requirements of your organization.

Topics:

- Considerations for a Secure Environment
Plan to integrate Oracle Database Appliance identity and access management security features with your existing organization security protocols.

- Understanding User Accounts
Review the information in this topic to understand default user account information for Oracle Database Appliance deployments.

- Understanding the Default Security Settings
Oracle Database Appliance is installed with many default security settings and methods.

Considerations for a Secure Environment

Plan to integrate Oracle Database Appliance identity and access management security features with your existing organization security protocols.

Oracle Database Appliance includes many layered security controls that can be tailored to meet an organization's specific policies and requirements. Organizations must evaluate how to best utilize these capabilities and integrate them into their existing IT security architecture. Effective IT security must consider the people, processes, and technology in order to provide solid risk management and governance practices. Practices and policies should be designed and reviewed during the planning, installation, and deployment stages of Oracle Database Appliance.

A unified approach to identity and access management should be used when integrating Oracle Database Appliance components, and deployed services with an organization's existing identity and access management architecture. Oracle Database supports many open and standard protocols that allow it to be integrated with existing identity and access management deployments. To ensure application availability, unified identity and access management systems must be available, or the availability of Oracle Database Appliance may be compromised.

Before Oracle Database Appliance arrives, the following security considerations should be discussed. These considerations are based on Oracle best practices for Oracle Database Appliance.

- The use of intrusion prevention systems on database servers to monitor network traffic flowing to and from Oracle Database Appliance. Such systems enable the identification of suspicious communications, potential attack patterns, and unauthorized access attempts.

- The use of host-based intrusion detection and prevention systems for increased visibility within Oracle Database Appliance. By using the fine-grained auditing capabilities of Oracle Database, host-based systems have a greater likelihood of detecting inappropriate actions and unauthorized activity.

- The use of application and network-layer firewalls to protect information flowing to and from Oracle Database Appliance. Filtering network ports provides the first line of defense in preventing unauthorized access to systems and services.
Network-level segmentation using Ethernet virtual local area networks (VLANs) and host-based firewalls enforce inbound and outbound network policy at the host level. Using segmentation allows fine-grained control of communications between components of Oracle Database Appliance. Oracle Database Appliance can be configured with a software firewall.

- The use of encryption features such as Transparent Data Encryption (TDE), Oracle Recovery Manager (RMAN) encryption for backups, and Oracle Advanced Security to encrypt traffic to Oracle Data Guard standby databases.

While many of the features integrated into Oracle Database Appliance are configured by default for secure deployment, organizations have their own security configuration standards. It is important to review Oracle security information before testing any security setting changes to Oracle Database Appliance components. In particular, it is important to identify where existing standards can be improved, and where support issues may limit what changes can be made to a given component.

The security of the data and system is diminished by weak network security. Oracle recommends the following guidelines to maximize your Ethernet network security:

- Configure administrative and operational services to use encryption protocols and key lengths that align with current policies. Cryptographic services provided by Oracle Database Appliance benefit from hardware acceleration, which improves security without impacting performance.

- Manage and separate switches in Oracle Database Appliance from data traffic on the network. This separation is also referred to as "out-of-band."

- Separate sensitive clusters of the system from the rest of the network when using virtual local area networks (VLANs). This decreases the likelihood that users can gain access to information on these clients and servers.

- Use a static VLAN configuration.

- Disable unused switch ports, and assign an unused VLAN number.

- Assign a unique native VLAN number to trunk ports.

- Limit the VLANs that can be transported over a trunk to only those that are strictly required.

- Disable VLAN Trunking Protocol (VTP), if possible. If it is not possible, then set the management domain, password and pruning for VTP. In addition, set VTP to transparent mode.

- Disable unnecessary network services, such as TCP small servers or HTTP. Enable only necessary network services, and configure these services securely.

- Network switches offer different levels of port security features. Use these port security features if they are available:

- Lock the Media Access Control (MAC) address of one or more connected devices to a physical port on a switch. If a switch port is locked to a particular MAC address, then super users cannot create back doors into the network with rogue access points.

- Disable a specified MAC address from connecting to a switch.

- Use each switch port's direct connections so the switch can set security based on its current connections.

Understanding User Accounts

Review the information in this topic to understand default user account information for Oracle Database Appliance deployments.

The following table lists the default users and passwords for the Oracle Database Appliance components.

Caution:

You must change all default passwords after deploying Oracle Database Appliance.

Table 3-1 Default User Names and Passwords for User Accounts

Component

User Name and Password

Oracle Database Appliance servers

- root/welcome1

- oracle/welcome1

- grid/welcome1

Oracle Databases

- sys/welcome1

- system/welcome1

- dbsnmp/welcome1

Understanding the Default Security Settings

Oracle Database Appliance is installed with many default security settings and methods.

Whenever possible and practical, you should select secure default settings.

Security Settings Deployed by Default on Oracle Database Appliance

Default security methods and settings include the following:

- A minimal software installation to reduce attack surface.

- Oracle Database secure settings developed and implemented using Oracle best practices.

- A password policy that enforces a minimum password complexity.

- Failed log in attempts cause a lockout after a set number of failed attempts.

- All default system accounts in the operating system are locked and prohibited from logging in.

- Restrictive file permissions on key security-related configuration files and executable files.

- SSH listen ports restricted to management and private networks.

- SSH limited to v2 protocol.

- Disabled insecure SSH authentication mechanisms.

- Configured specific cryptographic ciphers.

- Unnecessary protocols and modules are disabled from the operating system kernel.

4 Keeping Oracle Database Appliance Secure

Use the policies and procedures described in this chapter to keep Oracle Database Appliance secure.

Topics:

- Securing the Hardware
Oracle recommends that you implement the security policies described here to restrict access to the hardware.

- Securing the Software
Oracle recommends that you implement software policies to secure the software.

- Maintaining a Secure Environment
After you implement security policies and methods on your appliance, review these topics to understand how to maintain a secure environment.

Securing the Hardware

Oracle recommends that you implement the security policies described here to restrict access to the hardware.

After installation of Oracle Database Appliance, secure the hardware.

Hardware Security Methods and Procedures

- Install Oracle Database Appliance and related equipment in a locked, restricted-access room.

- Restrict access to hot-pluggable or hot-swappable devices because the components can be easily removed by design.

- Limit SSH listener ports to the management and private networks.

- Use SSH protocol 2 (SSH-2) and ciphers that are approved in Federal Information Processing Standard Publication 140-2 (FIPS 140-2).

- Limit allowed SSH authentication mechanisms. By default, inherently insecure SSH authentication methods are disabled.

- Mark all significant items of computer hardware, such as FRUs.

- Record the serial numbers of the components in Oracle Database Appliance, and keep a record in a secure place. All components in Oracle Database Appliance have a serial number.

Securing the Software

Oracle recommends that you implement software policies to secure the software.

Review and implement security features and policies for your appliance software.

Oracle Database Appliance Operating System and Server Security Policies

- Change all default passwords when the system is installed at the site.
Oracle Database Appliance uses default passwords for initial installation and deployment that are widely known. A default password that is still in effect could allow unauthorized access to the equipment. Devices such as the network switches have multiple user accounts. Be sure to change all account passwords on the components in the rack.

- Create and use Oracle Integrated Lights Out Manager (ILOM) user accounts for individual users
Using ILOM user accounts ensures a positive identification in audit trails, and results in less maintenance when administrators leave the team or company.

- Restrict physical access to USB ports, network ports, and system consoles.
Servers and network switches have ports and console connections, which provide direct access to the system.

- Restrict the capability to restart the system over the network.

- Enable available database security features, as described in Oracle Database Security Guide.

Oracle Database Security Features

Oracle Database Appliance can leverage all the security features available with Oracle Databases installed on legacy platforms. Oracle Database security products and features include the following:

- Oracle Advanced Security

- Oracle Audit Vault

- Data Masking

- Oracle Database Firewall

- Oracle Database Vault

- Oracle Label Security

- Oracle Secure Backup

- Oracle Total Recall

Using the Oracle privileged user and multi-factor access control, data classification, transparent data encryption, auditing, monitoring, and data masking, customers can deploy reliable data security solutions that do not require any changes to existing applications.

Maintaining a Secure Environment

After you implement security policies and methods on your appliance, review these topics to understand how to maintain a secure environment.

Topics:

- About Secure Environments
Oracle recommends that you review and update your operational and administrative access policies regularly to maintain a secure environment.

- Maintaining Network Security
After the networks are configured based on the security guidelines, carry out regular review and maintenance to ensure that secure host and ILOM settings remain intact and in effect.

- Updating Software and Firmware
Oracle regularly introduces security enhancements in new releases and patch sets.

- Ensuring Data Security Outside of Oracle Database Appliance
Follow security practices when you back up your data to external storage.

About Secure Environments

Oracle recommends that you review and update your operational and administrative access policies regularly to maintain a secure environment.

After you implement security policies and features for your system, Oracle recommends that your organization establishes a security review policy. As part of your security policy, periodically update and review your software, hardware, and user access.

For example, check all users and administrators granted access to Oracle Database Appliance, and to its deployed services. Verify if the levels of access and privilege that you have granted to users and administrators remains appropriate.

Without regular security reviews, the level of access granted to individuals could increase unintentionally, due to role changes, or due to changes to default settings. Oracle recommends that you review access rights for operational and administrative tasks regularly. Regular reviews can help to ensure that user level of access remains aligned to the roles and responsibilities for each user.

Maintaining Network Security

After the networks are configured based on the security guidelines, carry out regular review and maintenance to ensure that secure host and ILOM settings remain intact and in effect.

Follow these guidelines to ensure the security of local and remote access to the system:

- Manage the management network switch configuration file offline, and limit access to the file to only authorized administrators.

- Add descriptive comments for each setting in the configuration file. Consider keeping a static copy of the configuration file in a source code control system.

- Use access control lists to apply restrictions where appropriate.

- Set time-outs for extended sessions and set privilege levels.

- Use authentication, authorization, and accounting (AAA) features for local and remote access to a switch.

- Use the port mirroring capability of the switch for intrusion detection system (IDS) access.

- Implement port security to limit access based upon a MAC address. Disable auto-trunking on all ports for any switch connected to Oracle Database Appliance.

- Limit remote configuration to specific IP addresses using SSH.

- Require users to use strong passwords by setting minimum password complexity rules and password expiration policies.

- Enable logging and send logs to a dedicated secure log host.

- Configure logging to include accurate time information, using NTP and timestamps.

- Review logs for possible incidents and archive them in accordance with the organization's security policy.

Updating Software and Firmware

Oracle regularly introduces security enhancements in new releases and patch sets.

Effective proactive patch management is a critical part of system security. Oracle recommends that you install the latest release of the software, and install all necessary security patches on the equipment.

To establish baseline security, Oracle recommends that you apply only Oracle-recommended software and security patches

Ensuring Data Security Outside of Oracle Database Appliance

Follow security practices when you back up your data to external storage.

You can back up your data to external storage. Oracle recommends that you store backups in an off-site, secure location. Retain the backups according to your organizational policies and requirements.

When you dispose of old disk drives, physically destroy the drive, or completely erase all the data on the drive. Deleting the files or reformatting the disk drive removes only the address tables on the drive. The information can still be recovered from a disk drive after deleting files or reformatting the drive. If you want to retain replaced disk drives and flash drives, instead of returning them to Oracle, then you can use the Oracle Database Appliance disk retention support option.

Index

A  C  D  E  F  H  I  K  L  M  O  P  R  S  T  V  X

A

- accessing ILOMs 1

- access policies 1

- accountability 1

- accounting 1

- auditing 1

- authentication 1

- authorization 1

C

- ciphers 1

- classification strategies 1

- classifying data 1

- client access

- isolating 1

- cryptographic services 1

D

- default passwords 1

- Diffie-Hellman 1

- disposing old hard drives 1

E

- encrypting

- backups 1

- JDBC traffic 1

- Oracle Net Services 1

- traffic 1

- Ethernet security guidelines 1

- event accountability 1

F

- FIPS 140-2 1

H

- hardening 1

I

- ILOM 1

- ILOM (Integrated Lights Out Manager) 1 , 2

- Intel AES-NI 1

- IPMI v2.0 1

- isolating

- client access 1

- management access 1

- multiple databases 1

K

- Kerberos 1

- key credentials 1

L

- LDAP repositories 1

- logical realms 1

M

- MAC address 1

- management access

- isolating 1

- monitoring user logins 1

O

- Oracle Advanced Security

- cryptographic services 1

- encrypting traffic 1

- using public keys 1

- Oracle Audit Vault

- enablinig proactive detection 1

- Oracle Database Firewall Remote Monitor 1

- Oracle Database security products 1

- Oracle Database Vault

- managing access 1

- mandatory access control 1

- Oracle Data Guard 1

- Oracle Enterprise User Security 1

- Oracle Label Security 1

- Oracle Recovery Manager (RMAN) 1

- Oracle Virtual Private Database 1

- out-of-band 1

P

- password policy 1

R

- RADIUS 1

- restrictive file permissions 1

- RMAN (Oracle Recovery Manager)

- encrypting backups 1

- row level isolation 1

S

- secure isolation levels 1

- securing commnunications 1

- security considerations 1

- separation of duties 1

- serial numbers 1

- SNMPv3 1

- SSH (Secure Shell) 1 , 2 , 3

- SSH (Secure Shell): default protocol limit 1

- SSH protocol 2 (SSH2) 1

- SSL/TLS 1

T

- TDE (Transparent Data Encryption) 1 , 2

- tracking hardware assets 1

V

- VLANs (virtual local area networks) 1 , 2

- VTP (VLAN Trunking Protocol) 1

X

- X.509 certificates 1

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2017, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.