Oracle Database Security Central Hybrid Cloud Deployment and Prerequisites
You can configure Oracle Database Security Central for hybrid cloud deployments.
Oracle Oracle Database Security Central hybrid cloud deployment models:
-
Audit Vault Server deployed on-premises and the targets are deployed in cloud or on-premises
-
Audit Vault Server deployed on cloud and the targets are deployed in cloud or on-premises
In Oracle Cloud Infrastructure (OCI) deployment model, the Audit Vault Server is either deployed on-premises or in OCI. It monitors Oracle Base Database Service, Oracle Exadata Database Service, and on-premises database instances. It uses Audit Vault Agents that can collect audit data from on-premises or cloud targets. These Agents connect to the target database and to the Audit Vault Server. Connections to the Audit Vault Server are made through JDBC on ports 1521 and 1522. This chapter uses OCI as an example.
For non-Oracle clouds, the concepts are similar but the actual execution of configuring network connectivity between Agents and databases differ. There is a wide variety of network configurations, firewalls, and cloud providers, each with their own unique ways of configuring network connectivity. When using the hybrid cloud deployment model for Oracle Databases running in non-Oracle clouds, support is limited to Agent interaction with the database. Due to wide variety of network configuration paradigms used by different cloud providers, support for network connectivity issues must remain with the cloud provider.
When using the hybrid cloud deployment model for Oracle Databases running on-premises, the Audit Vault Server is running in OCI. In such cases, the configuration of the on-premises network to enable connectivity between the Agents and Audit Vault Server is the responsibility of the customer. Oracle DBSecCentral support is limited to the Audit Vault Agent, and not to the underlying network components involved in allowing the connections.
TCP and TCPS are the two connection options in Oracle Base Database Service. Setting up connections for TCP and TCPS is similar. The difference is the port numbers. The following are the key characteristics of Oracle Base Database Service cloud target configuration settings:
-
TCP connections have encryption enforced by default.
-
TCPS connections are configured between Audit Vault Agents and cloud targets.
-
On the Audit Vault Server the TCPS option must be set for cloud targets.
-
Additional Audit Vault Agents can be used to collect audit data from on-premises databases, directories, and operating systems.
Note:
-
The user can have multiple Audit Vault Agents to collect data from Oracle Base Database Service instances.
-
Only one Audit Vault Agent can be installed on a host for a single Audit Vault Server. Multiple audit trail collections can be started using a single Audit Vault Agent.
-
-
This deployment offers great flexibility for customers to address consistent audit or security policies across on-premises and cloud environments.
-
Prerequisites for deploying Database Security Central Hybrid Cloud
There are many factors to consider before deploying Oracle Database Security Central Hybrid. The table outlines the availability of Database Security Central features for databases on-premises against OCI, in case of Oracle Base Database Service and for Oracle Database Exadata Express Cloud Service.
| Feature | DBs On-premises | DBs in OCI | Oracle Database Exadata Express Cloud Service | Oracle Autonomous Data Warehouse |
|---|---|---|---|---|
Database Table based audit collection (SYS.AUD$; SYS.FGA_LOG$ etc..) |
Yes | Yes | No | No |
| Unified Audit Table Trail | Yes | Yes | Yes | Yes |
| Database File based audit collection | Yes | No | No | No |
| REDO log support | Yes | No | No | No |
| OS audit collection | Yes | No | No | No |
| Retrieve Entitlements | Yes | Yes | Yes | Yes |
| Policy retrieval/provisioning for Traditional audit trails | Yes | Yes | No | No |
| View Interactive reports | Yes | Yes | Yes | Yes |
| View Scheduled reports | Yes | Yes | Yes | Yes |
| Stored Procedure Auditing | Yes | No | No | No |
Prerequisites for auditing Oracle Database Security Central Hybrid Cloud
There are multiple aspects that have to be considered while auditing Oracle Base Database Service targets. Audit requirements and audit policies on Oracle Base Database Service cloud targets are critical as the number and type of enabled audit policies directly affects the number of audit records sent to the Audit Vault Server. Oracle Base Database Service instances may have various audit settings. Hence users must review this information either on the Audit Vault Server or directly on the database instance.
The audit data collection from table based audit trails is only supported.
Note: The SYS.AUD$ and SYS.FGA_LOG$ tables have an additional column RLS$INFO. The Unified Audit trail table has RLS_INFO column. This column describes row level security policies configured. This is mapped to the extension field in Oracle Database Security Central. In order to populate this column, the user needs to set the AUDIT_TRAIL parameter of the target to DB EXTENDED.