SQL Firewall Overview

The SQL Firewall feature in Oracle Database Security Central lets you administer and monitor SQL Firewall across your fleet of Oracle AI Database 26ai targets.

About SQL Firewall

The SQL Firewall feature in Oracle Database Security Central lets you administer and monitor SQL Firewall across your fleet of Oracle AI Database targets. SQL Firewall is a built-in security feature of Oracle AI Database 26ai that helps protect against SQL injection attacks, anomalous database access, and credential theft or abuse.

SQL Firewall inspects all incoming database connections and SQL statements, including those issued from PL/SQL units, whether local or over the network, and whether encrypted or unencrypted. It allows only explicitly authorized SQL and can log or block SQL statements and database connections that do not match the configured SQL Firewall policies.

SQL Firewall uses allowlists of authorized SQL statements and trusted database connection paths to determine which SQL statements and connection paths are authorized and which ones should be either logged or blocked. SQL Firewall allowlist policies work at a database account level.

You create a SQL Firewall policy for a database account by learning or collecting the expected application SQL workload from expected database connections. Subsequently, the firewall detects and prevents unauthorized SQL and potential SQL injection attacks.

To learn more about SQL Firewall in Oracle AI Database see the Oracle AI Database Oracle SQL Firewall User’s Guide

SQL Firewall can be managed in multiple ways. The PL/SQL procedures in SYS.DBMS_SQL_FIREWALL package lets you manage SQL Firewall directly in Oracle AI Database 26ai.

Oracle Database Security Central provides a centralized interface for managing and monitoring SQL Firewall across a fleet of Oracle AI Database targets. Use Oracle Database Security Central to administer SQL Firewall policies, monitor SQL Firewall activity, and view SQL Firewall reports from a single console.

Auditors can use DBSecCentral to learn about the SQL activities of database accounts, monitor the learning progress, and stop the learning. Once learning is stopped, DBSecCentral automatically creates policy for the database account which can be reviewed and enabled. Once a SQL Firewall policy is enabled, an administrator user can configure the collection of the firewall violation logs from the database. Those logs are then available for online analysis and reporting across your database fleet as shown in SQL Firewall Violations Report.

Terms in SQL Firewall

The following terms are used throughout DBSecCentral’s SQL Firewall feature.

• Session context: This represents client information initiating SQL traffic: client IP address, client program name, and OS username.

• SQL learning: This resource represents the SQL learning for a specific database user in a target database. In Oracle Database Security Central, SQL learning refers to the SQL collection phase of the Oracle SQL Firewall feature.

• SQL Firewall policy: This resource represents the policy for a specific database user through which incoming SQL statements will be evaluated to determine if they can take action on the target database. In Oracle Database Security Central, the SQL Firewall policy refers to the allowlist in Oracle SQL Firewall. It defines the approved SQL statements and/or session context used to evaluate incoming SQL statements and determine whether they are allowed, allowed and logged, or blocked and logged. SQL statements can be allowed or, if they're not part of the allowlist, allowed and logged or blocked and logged. The policy can consist only of session context information, only of specific SQL statements, or both.

• SQL violations: This represents SQL statements that were initiated on the target database but are not included in the SQL Firewall policy.

• Context violations This represents session contexts from which SQL statements were initiated on the target database but are not included in the SQL Firewall policy.

• Allow and log violations A SQL Firewall policy enforcement option in which SQL statements initiated on the target database that are identified as SQL or context violations are allowed to execute, and the statements and their associated session context are logged for later reference.

• Block and log violations A SQL Firewall policy enforcement option that blocks any SQL or context violations from executing on the database and records them for future review.