General Security Recommendations

Follow these general security recommendations for Oracle Database Security Central (Oracle DBSecCentral).

• If you are using the Database Firewall to block unwanted traffic, then ensure that all data flowing from the database clients to the database and back passes through the Oracle Database Firewall. This includes both requests and responses.

• Use the appropriate security measures for your site to control access to the computer that contains Oracle DBSecCentral. Give access only to specific and trusted users, because someone with physical or virtual access to the console during installation can compromise the security of the installed system.

• Ensure that passwords conform to best practice.

• Separate the duties of administrators and auditors by assigning these roles to different people.

• Assign the Audit Vault Server user the appropriate administrator, super administrator, auditor, and super auditor roles.

• By default, the following accounts that are related to Oracle DBSecCentral are locked: the Oracle OS user account, Oracle Grid accounts, any Oracle Database Vault accounts (for example, users who have been granted the DV_OWNER and DV_ACCTMGR roles). Ensure that these accounts remain locked.

• Avoid sharing passwords between users and login sessions. Add new operating system users to distinguish access by different people.

• When configuring system log forwarding, use suitable encryption to avoid giving actors with network access (such as network administrators) access to potentially sensitive data. See Configuring Remote Syslog Over TLS.

• Database accounts AGENTUSR# and AVSRCUSR# belong to the AVS_AGENT_NONINTERACTIVE profile. These accounts are created whenever a new agent or target is added. The passwords for these accounts are generated internally and also rotated periodically. Oracle recommends that you do not modify the AGENTUSR# and AVSRCUSR# accounts including modifying password lifetime, failed login attempts, or the password. For more information, see Updating the Passwords of the AGENTUSR# and AVSRCUSR# Accounts.

• Database account AVREPORTUSER belongs to the AVS_NONINTERACTIVE profile. Oracle recommends that you do not modify the AVREPORTUSER account including modifying password lifetime or failed login attempts.