Prerequisites for SQL Firewall

To start using SQL Firewall in DBSecCentral, you must register an Oracle AI Database 26ai target database in DBSecCentral and enable SQL Firewall on it.

Have an administrator follow these steps: Using SQL Firewall with DBSecCentral.

SQL Firewall retrieval

The SQL Firewall policies can be retrieved through the following methods:

Automatic retrieval during target registration.
Manual retrieval from Policies > Oracle SQL Firewall.
1. Log in as an auditor, then click on the Policies tab.
2. Expand the Firewall Policies tab.
3. In the left navigation menu, click Oracle SQL Firewall.
4. Select the database(s) you want to retrieve policies for.
5. Click Retrieve policies.
On-demand retrieval or scheduled retrieval from the Policy Console under the Policies tab.

Note:

If you register a target before granting the RETRIEVE_DB_POLICIES privilege to the Database Security Central user, the target does not appear on the SQL Firewall page as the target version has not yet been retrieved. The user interface table displayed after Oracle SQL Firewall navigation menu explicitly check for the target version before displaying the SQL Firewall resources.

To resolve this issue, you must submit a SQL Firewall retrieval job from the Policy Console to retrieve the target version and SQL Firewall metadata.
All the SQL Firewall policies data will be purged after 6 months from the time of data retrieval.

Start Using SQL Firewall

In order to begin using SQL Firewall you need to complete the following steps.

These steps will walk you through:

By completing these steps you will be taking steps to protect your database fleet against SQL injection attacks and compromised accounts.

Step 1: Start SQL Learning for a Database User

This step begins recording the usual SQL statements and connection paths for the database user. Run your normal application tasks from trusted connections.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to start learning for.
Expand the SQL learning for users section.
Select the user(s) you want to start learning for.
Select Start.
Select the period of time you want to learn SQL statements for.
Enable or disable Top level SQL.

During the learning phase, SQL Firewall records the SQL workload to build the allowlist. If Top Level SQL is selected, only the top-level SQL or PL/SQL statement is learned. If Top Level SQL is not selected, SQL Firewall also learns and records all SQL statements executed within the PL/SQL statement.
Select Start.
Perform typical daily tasks in your applications for the selected database user until the end of the time period you selected.

(Optional) Step 2: Manually Stop SQL Learning

This step begins recording the usual SQL statements and connection paths for the database user. Run your normal application tasks from trusted connections.

This step is optional because you can wait until SQL learning stops automatically based on the time period you set in the previous step.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database of the user you want to stop learning for.
Expand the SQL learning for users section.
Select the user(s) you want to view the collected SQL data for.
Select View learning data.
Select Refresh learning data.
View and filter the data to determine if you have collected a sufficient amount of SQL data.

Data should be deemed sufficient if it appears that there is no uniquely new activity.
Review the list of session context types and values.

Reviewing the list of client IP addresses, client programs, and OS usernames allows you to determine where your traffic is coming from. With this information you can set up rules that log or block traffic from all other locations. This is further discussed inCreate a Session Context Only SQL Firewall Policy.
Once you have collected a sufficient amount of unique SQL statements, select Cancel.

You will be brought back to the overview page for the selected target database.
Select the user(s) you want to stop collecting SQL data for.
Select Stop.
Select Ok.
Refresh the page to see the stop state in the table.

Note: When SQL learning is stopped, Oracle DBSec Central automatically generates the SQL Firewall policy for the user based off of the SQL statements and session context that was gathered during the learning.

Step 3: Enable SQL Firewall Policies

Review the SQL statements and database connections collected during the learning phase, and enable SQL Firewall policies based on the learned data. Once enabled, the policies determine which SQL statements and connection paths are allowed and whether unauthorized activity is logged or blocked.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database of the user you want to enable policies for.
In the SQL Firewall details page for the selected target, expand the SQL Firewall policy for users section.
Select the user(s) you want to enable SQL Firewall polices for.
Select Enable.
Select the Enforcement policy.
- Session contexts - This option enforces the policy only on the database connection paths collected during learning.
- SQL statements - This option enforces the policy only on the SQL statements collected during learning.
- SQL statements & session contexts - This option enforces the policy for both the database connections paths and the SQL statements.
Select the Action on violations
- Allow and log violations - This option will observe and allow all SQL statements and connections to the database while logging any violations.
- Block and log violations - This option will block any SQL statements and database connections not listed in the policy and log the violations. Consider this option when you want SQL Firewall to prevent unauthorized SQL traffic to the database.
Select Enable.

Step 4: Set SQL Firewall Behavior for Database Jobs

SQL Firewall can be set to ignore SQL statements run during Oracle Scheduler jobs. This setting applies to all users set up for SQL Firewall monitoring

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to manage SQL Firewall configuration for Oracle Scheduler jobs.
Select Include or Exclude for Database jobs.
- This setting applies across the database.
- When Include is selected, SQL statements and database connections generated by Scheduler jobs are included for database users that are currently in the SQL Firewall learning phase or have SQL Firewall policies, regardless of whether the policies are enabled or disabled.
- When Exclude is selected, SQL statements and database connections generated by Oracle Scheduler jobs are excluded from SQL Firewall learning and enforcement.

Step 5: Start Audit Trail for SQL Firewall Violation Log

In this step you will start the audit trail to collect SQL Firewall violations which is necessary to view the SQL Firewall violations report.

Use the procedure documented in Configuring Audit Trail Collection to start the SYS.DBA_SQL_FIREWALL_VIOLATIONS audit trail.

Step 6: View SQL Firewall Violation Report

In this step you can view a report of violations for your enabled SQL Firewall policies.

Note: Violations are reported only when SQL statements or database connections do not match the configured SQL Firewall allowlists. As a result, you may not see any violations immediately after enabling a SQL Firewall policy.

The SQL Firewall Violations Report can be found in Activity Reports. For more information see SQL Firewall Violations Report.

Follow-Up Actions for SQL Firewall

In an ideal scenario where the SQL learning has captured all expected SQL statements and trusted database connections, violations indicate potential database attacks such as compromised account access and SQL Injection attacks. But if the collected statements or database connections are not complete or there are new authorized SQL statements following an application update, there is a possibility to see a surge in violations. To avoid false positives in the violations report you can update the SQL Firewall policy with additional context and SQL statements found in the violations report. If there are a large number of false violations, you can delete the current polices for the user and re-learn as necessary.

Related Topics

Update SQL Firewall Policies