Types of Database Firewall Policies

Learn about the types of Database Firewall policies.

Database Firewall policies are categorized into:

User-defined Database Firewall Policies

Oracle DBSecCentral allows you to define your own policies quickly and efficiently. There are 6 types of rules that you can create in these policies.

   
Rule Description
Session Context Client program session attributes like, client program name, host IP address, OS user, and database user are used to define the action of the Database Firewall in this rule.
SQL Statement SQL statements captured by Database Firewall are clustered into groups of similar statements. This rule defines the action of the Database Firewall on such SQL clusters.
Database Object Database Object rule defines the action of the Database Firewall based on SQL statement types (DML, DDL, etc.) on a list of configured tables or views.
Login/Logout The login or logout rule defines the action of the Database Firewall based on login and logout sessions by client programs on target databases.
Unknown Traffic

This rule defines the action of the Database Firewall for SQL statements that are not recognized for the following possible reasons:

  • Database Firewall is unable to parse the SQL statement
  • Semantics of SQL statement is not valid
  • Communication protocol used by the client program and the target database is not supported by Database Firewall

Note:

Interpretation of Java code is not supported by Database Firewall.
Default In this rule if a SQL statement does not meet any of the previous configured rules, then the Database Firewall acts as per the actions of this rule.

Pre-defined Database Firewall Policies

Oracle DBSecCentral includes pre-defined Database Firewall policies. These define the frequency of logging SQL statements in Audit Vault Server. They only monitor the SQL statements and do not raise alerts or block SQL statements. For alerting or blocking SQL statements, User-defined Database Firewall Policies should be configured.

   
Policy Name Description
Default

When Database Firewall monitoring point is configured for the target, this Default policy is applied automatically. The auditor can also assign this Default policy to existing Database Firewall monitoring points.

The Default policy consists of the following three rules:

  1. Login/Logout rule that logs all login and logout events on the database with minimal threat severity.
  2. Monitor DDL and DCL Activity rule that logs unique DDL and DCL statements.
  3. Pass all the remaining traffic without logging.

Additionally the traffic is logged with data masking turned on to avoid accidental logging of sensitive data. This policy is applied by default to all new targets during registration. This includes all the new monitoring points configured later for the specific target database.

This Default policy can be copied and customized like any other policy.

Note: After an upgrade, existing Database Firewall monitoring points will continue to have their previously assigned Database Firewall policy. This Default policy can be applied after the upgrade.

Log all

Log all statements for offline analysis. All statements are logged in the Audit Vault Server.

Note: If this policy is applied, it can use significant amount of storage for the logged data.

Log all - no mask

Log all statements for offline analysis without masking the data. Every statement is logged into Audit Vault Server without masking the data.

Note: If this policy is applied, then it can use significant amount of storage for the logged data. Sensitive information may be logged if you select this policy.

Log sample

Log a sample of statements for offline analysis. The frequency of logging into Audit Vault Server is every tenth statement having the same cluster ID.

Note: If this policy is applied, then it stores fewer statements than logging all statements. It can still use significant amount of storage for the logged data.

Log unique

Log examples of statements for offline analysis for unique SQL traffic. Unique statements are logged into Audit Vault Server. A SQL statement is considered as unique based on the following parameters:

  1. Cluster ID of the SQL statement
  2. IP address of the client program
  3. Database user
  4. The uniqueness is calculated for a time interval of one hour for a specific session

Note: If this policy is applied, then it stores fewer statements than logging all statements. It can still use significant amount of storage for the logged data.

Log unique - no mask

Log examples of statements for offline analysis covering unique SQL traffic without masking data. This is the same as "Log unique" excluding masking of data.

Note: If this policy is applied, then it stores fewer statements than logging all statements. It can still use significant amount of storage for the logged data. Sensitive information may be logged if you select this policy.

Pass all Pass all statements. No statements are logged into the Audit Vault Server.