Table of Contents

• List of Figures
• List of Tables
• Title and Copyright Information
• Preface
  • Audience
  • Documentation Accessibility
  • Related Documents
  • Conventions
• Changes in This Release for Oracle Database Vault Administrator's Guide
  • Changes in Oracle Database Vault 12c Release 2 (12.2.0.1)
    • New Features
      • Ability to Create Oracle Database Vault Policies
      • Ability to Configure Simulation Mode Protection
      • Privilege Analysis Enhancements
      • Ability to Create Common Realms and Common Command Rules for Oracle Multitenant
      • ALTER SESSION, ALTER SYSTEM, and CONNECT Command Rule Enhancements
      • Enhancements for the Authentication_Method Default Factor
      • Changed Default Value for SQL92_SECURITY Parameter
      • Oracle Database Vault Support for Flashback Technology and ILM
      • Support for Rolling Upgrades for Data Guard Logical Standby Databases
    • Deprecated Features
      • Deprecated Rules and Rule Sets
      • Deprecated UTL_FILE_DIR Parameter
• 1 Introduction to Oracle Database Vault
  • 1.1 What Is Oracle Database Vault?
    • 1.1.1 About Oracle Database Vault
    • 1.1.2 Controls for Privileged Accounts
    • 1.1.3 Controls for Database Configuration
    • 1.1.4 Enterprise Applications Protection Policies
    • 1.1.5 Run-time Privilege Analysis for Users and Applications
  • 1.2 What Privileges Do You Need to Use Oracle Database Vault?
  • 1.3 Components of Oracle Database Vault
    • 1.3.1 Oracle Database Vault Access Control Components
    • 1.3.2 Oracle Enterprise Manager Cloud Control Database Vault Administrator Pages
    • 1.3.3 Oracle Database Vault DVSYS and DVF Schemas
    • 1.3.4 Oracle Database Vault PL/SQL Interfaces and Packages
    • 1.3.5 Oracle Database Vault Reporting and Monitoring Tools
  • 1.4 How Oracle Database Vault Addresses Compliance Regulations
  • 1.5 How Oracle Database Vault Protects Privileged User Accounts
  • 1.6 How Oracle Database Vault Allows for Flexible Security Policies
  • 1.7 How Oracle Database Vault Addresses Database Consolidation Concerns
  • 1.8 How Oracle Database Vault Works in a Multitenant Environment
• 2 What to Expect After You Enable Oracle Database Vault
  • 2.1 Initialization and Password Parameter Settings That Change
  • 2.2 How Oracle Database Vault Restricts User Authorizations
  • 2.3 New Database Roles to Enforce Separation of Duties
  • 2.4 Privileges That Are Revoked from Existing Users and Roles
  • 2.5 Privileges That Are Prevented for Existing Users and Roles
  • 2.6 Modified AUDIT Statement Settings for a Non-Unified Audit Environment
• 3 Getting Started with Oracle Database Vault
  • 3.1 Manually Installing Oracle Database Vault in a Multitenant Environment
  • 3.2 Registering Oracle Database Vault with an Oracle Database
    • 3.2.1 About Registering Oracle Database Vault with an Oracle Database
    • 3.2.2 Registering Database Vault in a Non-Multitenant Environment
    • 3.2.3 Registering Database Vault with Common Users to Manage the CDB Root
    • 3.2.4 Registering Database Vault Common Users to Manage Specific PDBs
    • 3.2.5 Creating Common Database Vault Accounts for a Plugged in Database Vault PDB
    • 3.2.6 Creating a Profile to Protect the DV_OWNER and DV_ACCTMGR Users
    • 3.2.7 Verifying That Database Vault Is Configured and Enabled
  • 3.3 Logging into Oracle Database Vault
  • 3.4 Quick Start Tutorial: Securing a Schema from DBA Access
    • 3.4.1 About This Tutorial
    • 3.4.2 Step 1: Log On as SYSTEM to Access the HR Schema
    • 3.4.3 Step 2: Create a Realm
    • 3.4.4 Step 3: Create the SEBASTIAN User Account
    • 3.4.5 Step 4: Have User SEBASTIAN Test the Realm
    • 3.4.6 Step 5: Create an Authorization for the Realm
    • 3.4.7 Step 6: Test the Realm
    • 3.4.8 Step 7: If Unified Auditing Is Not Enabled, Then Run a Report
    • 3.4.9 Step 8: Remove the Components for This Tutorial
• 4 Performing Privilege Analysis to Find Privilege Use
  • 4.1 What Is Privilege Analysis?
    • 4.1.1 About Privilege Analysis
    • 4.1.2 How Privilege Analysis Works with Pre-Compiled Database Objects
    • 4.1.3 Who Can Perform Privilege Analysis?
    • 4.1.4 Types of Privilege Analysis
    • 4.1.5 Benefits and Use Cases of Privilege Analysis
      • 4.1.5.1 Unnecessarily Granted Privileges of Applications
      • 4.1.5.2 Development of Secure Applications
    • 4.1.6 How Does a Multitenant Environment Affect Privilege Analysis?
  • 4.2 Creating and Managing Privilege Analysis Policies
    • 4.2.1 About Creating and Managing Privilege Analysis Policies
    • 4.2.2 General Steps for Managing Privilege Analysis
    • 4.2.3 Creating a Privilege Analysis Policy
      • 4.2.3.1 About Creating a Privilege Analysis Policy
      • 4.2.3.2 Creating a Privilege Analysis Policy in Enterprise Manager Cloud Control
      • 4.2.3.3 Creating a Privilege Analysis Policy Using DBMS_PRIVILEGE_CAPTURE
    • 4.2.4 Examples of Privilege Analysis Policies
      • 4.2.4.1 Example: Privilege Analysis of Database-Wide Privileges
      • 4.2.4.2 Example: Privilege Analysis of Privilege Usage of Two Roles
      • 4.2.4.3 Example: Privilege Analysis of Privileges During SQL*Plus Use
      • 4.2.4.4 Example: Privilege Analysis of PSMITH Privileges During SQL*Plus Access
    • 4.2.5 Enabling a Privilege Analysis Policy
      • 4.2.5.1 About Enabling a Privilege Analysis Policy
      • 4.2.5.2 Enabling a Privilege Analysis Policy Using Cloud Control
      • 4.2.5.3 Enabling a Privilege Analysis Policy Using DBMS_PRIVILEGE_CAPTURE
    • 4.2.6 Disabling a Privilege Analysis Policy
      • 4.2.6.1 About Disabling a Privilege Analysis Policy
      • 4.2.6.2 Disabling a Privilege Analysis Policy Using Cloud Control
      • 4.2.6.3 Disabling a Privilege Analysis Policy Using DBMS_PRIVILEGE_CAPTURE
    • 4.2.7 Generating a Privilege Analysis Report
      • 4.2.7.1 About Generating a Privilege Analysis Report
      • 4.2.7.2 Generating a Privilege Analysis Report Using Cloud Control
      • 4.2.7.3 Accessing Privilege Analysis Reports Using Cloud Control
      • 4.2.7.4 Generating a Privilege Analysis Report Using DBMS_PRIVILEGE_CAPTURE
    • 4.2.8 Dropping a Privilege Analysis Policy
      • 4.2.8.1 About Dropping a Privilege Analysis Policy
      • 4.2.8.2 Dropping a Privilege Analysis Policy Using Cloud Control
      • 4.2.8.3 Dropping a Privilege Analysis Policy Using the DBMS_PRIVILEGE_CAPTURE Package
  • 4.3 Creating Roles and Managing Privileges Using Cloud Control
    • 4.3.1 Creating a Role from a Privilege Analysis Report in Cloud Control
    • 4.3.2 Revoking and Regranting Roles and Privileges Using Cloud Control
    • 4.3.3 Generating a Revoke or Regrant Script Using Cloud Control
      • 4.3.3.1 About Generating Revoke and Regrant Scripts
      • 4.3.3.2 Generating a Revoke Script
      • 4.3.3.3 Generating a Regrant Script
  • 4.4 Tutorial: Using Capture Runs to Analyze ANY Privilege Use
    • 4.4.1 Step 1: Create User Accounts
    • 4.4.2 Step 2: Create and Enable a Privilege Analysis Policy
    • 4.4.3 Step 3: Use the READ ANY TABLE System Privilege
    • 4.4.4 Step 4: Disable the Privilege Analysis Policy
    • 4.4.5 Step 5: Generate and View a Privilege Analysis Report
    • 4.4.6 Step 6: Create a Second Capture Run
    • 4.4.7 Step 7: Remove the Components for This Tutorial
  • 4.5 Tutorial: Analyzing Privilege Use by a User Who Has the DBA Role
    • 4.5.1 Step 1: Create User Accounts
    • 4.5.2 Step 2: Create and Enable a Privilege Analysis Policy
    • 4.5.3 Step 3: Perform the Database Tuning Operations
    • 4.5.4 Step 4: Disable the Privilege Analysis Policy
    • 4.5.5 Step 5: Generate and View Privilege Analysis Reports
    • 4.5.6 Step 6: Remove the Components for This Tutorial
  • 4.6 Privilege Analysis Policy and Report Data Dictionary Views
• 5 Configuring Realms
  • 5.1 What Are Realms?
    • 5.1.1 About Realms
    • 5.1.2 Mandatory Realms to Restrict User Access to Objects within a Realm
    • 5.1.3 Realms in a Multitenant Environment
    • 5.1.4 Object Types That Realms Can Protect
  • 5.2 Default Realms
    • 5.2.1 Oracle Database Vault Realm
    • 5.2.2 Database Vault Account Management Realm
    • 5.2.3 Oracle Enterprise Manager Realm
    • 5.2.4 Oracle Default Schema Protection Realm
    • 5.2.5 Oracle System Privilege and Role Management Realm
    • 5.2.6 Oracle Default Component Protection Realm
  • 5.3 Creating a Realm
  • 5.4 About Realm-Secured Objects
  • 5.5 About Realm Authorization
  • 5.6 Realm Authorizations in a Multitenant Environment
  • 5.7 Modifying the Enablement Status of a Realm
  • 5.8 Deleting a Realm
  • 5.9 How Realms Work
  • 5.10 How Authorizations Work in a Realm
    • 5.10.1 About Authorizations in a Realm
    • 5.10.2 Examples of Realm Authorizations
      • 5.10.2.1 Example: Unauthorized User Trying to Create a Table
      • 5.10.2.2 Example: Unauthorized User Trying to Use the DELETE ANY TABLE Privilege
      • 5.10.2.3 Example: Authorized User Performing DELETE Operation
  • 5.11 Access to Objects That Are Protected by a Realm
  • 5.12 Example of How Realms Work
  • 5.13 How Realms Affect Other Oracle Database Vault Components
  • 5.14 Guidelines for Designing Realms
  • 5.15 How Realms Affect Performance
  • 5.16 Realm Related Reports and Data Dictionary Views
• 6 Configuring Rule Sets
  • 6.1 What Are Rule Sets?
  • 6.2 Rule Sets and Rules in a Multitenant Environment
  • 6.3 Default Rules and Rule Sets from Releases Earlier Than Release 12.2
  • 6.4 Default Rule Sets
  • 6.5 Creating a Rule Set
  • 6.6 Creating a Rule to Add to a Rule Set
    • 6.6.1 About Creating Rules
    • 6.6.2 Default Rules
    • 6.6.3 Creating a New Rule
    • 6.6.4 Adding Existing Rules to a Rule Set
    • 6.6.5 Removing a Rule from a Rule Set
  • 6.7 Removing Rule Set References to Oracle Database Vault Components
  • 6.8 Deleting a Rule Set
  • 6.9 How Rule Sets Work
    • 6.9.1 How Oracle Database Vault Evaluates Rules
    • 6.9.2 Nested Rules within a Rule Set
    • 6.9.3 Creating Rules to Apply to Everyone Except One User
  • 6.10 Tutorial: Creating an Email Alert for Security Violations
    • 6.10.1 About This Tutorial
    • 6.10.2 Step 1: Install and Configure the UTL_MAIL PL/SQL Package
    • 6.10.3 Step 2: Create an Email Security Alert PL/SQL Procedure
    • 6.10.4 Step 3: Configure an Access Control List File for Network Services
    • 6.10.5 Step 4: Create a Rule Set and a Command Rule to Use the Email Security Alert
    • 6.10.6 Step 5: Test the Email Security Alert
    • 6.10.7 Step 6: Remove the Components for This Tutorial
  • 6.11 Tutorial: Configuring Two-Person Integrity, or Dual Key Security
    • 6.11.1 About This Tutorial
    • 6.11.2 Step 1: Create Users for This Tutorial
    • 6.11.3 Step 2: Create a Function to Check if User patch_boss Is Logged In
    • 6.11.4 Step 3: Create Rules, a Rule Set, and a Command Rule to Control User Access
    • 6.11.5 Step 4: Test the Users' Access
    • 6.11.6 Step 5: Remove the Components for This Tutorial
  • 6.12 Guidelines for Designing Rule Sets
  • 6.13 How Rule Sets Affect Performance
  • 6.14 Rule Set and Rule Related Reports and Data Dictionary Views
• 7 Configuring Command Rules
  • 7.1 What Are Command Rules?
    • 7.1.1 About Command Rules
    • 7.1.2 Command Rules in a Multitenant Environment
    • 7.1.3 Types of Command Rules
      • 7.1.3.1 CONNECT Command Rule
      • 7.1.3.2 ALTER SESSION and ALTER SYSTEM Command Rules
  • 7.2 Default Command Rules
  • 7.3 SQL Statements That Can Be Protected by Command Rules
  • 7.4 Creating a Command Rule
  • 7.5 Modifying the Enablement Status of a Command Rule
  • 7.6 Deleting a Command Rule
  • 7.7 How Command Rules Work
  • 7.8 Tutorial: Using a Command Rule to Control Table Creations by a User
    • 7.8.1 Step 1: Create a Table
    • 7.8.2 Step 2: Create a Command Rule
    • 7.8.3 Step 3: Test the Command Rule
    • 7.8.4 Step 4: Remove the Components for this Tutorial
  • 7.9 Guidelines for Designing Command Rules
  • 7.10 How Command Rules Affect Performance
  • 7.11 Command Rule Related Reports and Data Dictionary View
• 8 Configuring Factors
  • 8.1 What Are Factors?
  • 8.2 Default Factors
  • 8.3 Creating a Factor
    • 8.3.1 Accessing the Create Factors Page
    • 8.3.2 Completing the General Page for Factor Creation
    • 8.3.3 Configurations Page for Factor Creation
      • 8.3.3.1 Setting the Factor Identification Information
      • 8.3.3.2 How Factor Identities Work
      • 8.3.3.3 Setting the Evaluation Information for a Factor
      • 8.3.3.4 Setting the Oracle Label Security Labeling Information for a Factor
      • 8.3.3.5 Setting the Retrieval Method for a Factor
      • 8.3.3.6 How Retrieval Methods Work
      • 8.3.3.7 Setting the Validation Method for a Factor
    • 8.3.4 Options Page of Factor Creation
      • 8.3.4.1 Assigning a Rule Set to a Factor
      • 8.3.4.2 Setting Error Options for a Factor
      • 8.3.4.3 Setting Audit Options for a Factor
      • 8.3.4.4 How Factor Auditing Works
  • 8.4 Adding an Identity to a Factor
    • 8.4.1 About Factor Identities
    • 8.4.2 About Trust Levels
    • 8.4.3 About Label Identities
    • 8.4.4 Creating and Configuring a Factor Identity
    • 8.4.5 Deleting a Factor Identity
    • 8.4.6 Using Identity Mapping to Configure an Identity to Use Other Factors
      • 8.4.6.1 About Identity Mapping
      • 8.4.6.2 Mapping an Identity to a Factor
  • 8.5 Deleting a Factor
  • 8.6 How Factors Work
    • 8.6.1 How Factors Are Processed When a Session Is Established
    • 8.6.2 How Factors Are Retrieved
    • 8.6.3 How Factors Are Set
  • 8.7 Tutorial: Preventing Ad Hoc Tool Access to the Database
    • 8.7.1 About This Tutorial
    • 8.7.2 Step 1: Enable the HR and OE User Accounts
    • 8.7.3 Step 2: Create the Factor
    • 8.7.4 Step 3: Create the Rule Set and Rules
    • 8.7.5 Step 4: Create the CONNECT Command Rule
    • 8.7.6 Step 5: Test the Ad Hoc Tool Access Restriction
    • 8.7.7 Step 6: Remove the Components for This Tutorial
  • 8.8 Tutorial: Restricting User Activities Based on Session Data
    • 8.8.1 About This Tutorial
    • 8.8.2 Step 1: Create an Administrative User
    • 8.8.3 Step 2: Add Identities to the Domain Factor
    • 8.8.4 Step 3: Map the Domain Factor Identities to the Client_IP Factor
    • 8.8.5 Step 4: Create a Rule Set to Set the Hours and Select the Factor Identity
    • 8.8.6 Step 5: Create a Command Rule That Uses the Rule Set
    • 8.8.7 Step 6: Test the Factor Identity Settings
    • 8.8.8 Step 7: Remove the Components for This Tutorial
  • 8.9 Guidelines for Designing Factors
  • 8.10 How Factors Affect Performance
  • 8.11 Factor Related Reports and Data Dictionary Views
• 9 Configuring Secure Application Roles for Oracle Database Vault
  • 9.1 What Are Secure Application Roles in Oracle Database Vault?
  • 9.2 Creating an Oracle Database Vault Secure Application Role
  • 9.3 Enabling Oracle Database Secure Application Roles to Work with Oracle Database Vault
  • 9.4 Security for Oracle Database Vault Secure Application Roles
  • 9.5 Deleting an Oracle Database Vault Secure Application Role
  • 9.6 How Oracle Database Vault Secure Application Roles Work
  • 9.7 Tutorial: Granting Access with Database Vault Secure Application Roles
    • 9.7.1 About This Tutorial
    • 9.7.2 Step 1: Create Users for This Tutorial
    • 9.7.3 Step 2: Enable the OE User Account
    • 9.7.4 Step 3: Create the Rule Set and Its Rules
    • 9.7.5 Step 4: Create the Database Vault Secure Application Role
    • 9.7.6 Step 5: Grant the SELECT Privilege to the Secure Application Role
    • 9.7.7 Step 6: Test the Database Vault Secure Application Role
    • 9.7.8 Step 7: Remove the Components for This Tutorial
  • 9.8 How Secure Application Roles Affect Performance
  • 9.9 Secure Application Role Related Reports and Data Dictionary View
• 10 Configuring Oracle Database Vault Policies
  • 10.1 What Are Database Vault Policies?
    • 10.1.1 About Oracle Database Vault Policies
    • 10.1.2 Oracle Database Vault Policies in a Multitenant Environment
  • 10.2 Default Oracle Database Vault Policies
  • 10.3 Creating an Oracle Database Policy
  • 10.4 Modifying an Oracle Database Vault Policy
  • 10.5 Deleting an Oracle Database Vault Policy
  • 10.6 Related Data Dictionary Views
• 11 Using Simulation Mode for Logging Realm and Command Rule Activities
  • 11.1 About Simulation Mode
  • 11.2 Simulation Mode Use Cases
  • 11.3 Tutorial: Tracking Violations to a Realm Using Simulation Mode
    • 11.3.1 About This Tutorial
    • 11.3.2 Step 1: Create Users for This Tutorial
    • 11.3.3 Step 2: Create a Realm and an Oracle Database Vault Policy
    • 11.3.4 Step 3: Test the Realm and Policy
    • 11.3.5 Step 4: Query the DBA_DV_SIMULATION_LOG View for Violations
    • 11.3.6 Step 5: Enable and Re-test the Realm
    • 11.3.7 Step 6: Remove the Components for This Tutorial
• 12 Integrating Oracle Database Vault with Other Oracle Products
  • 12.1 Integrating Oracle Database Vault with Enterprise User Security
    • 12.1.1 About Integrating Oracle Database Vault with Enterprise User Security
    • 12.1.2 Configuring an Enterprise User Authorization
    • 12.1.3 Configuring Oracle Database Vault Accounts as Enterprise User Accounts
  • 12.2 Integrating Oracle Database Vault with Transparent Data Encryption
  • 12.3 Attaching Factors to an Oracle Virtual Private Database
  • 12.4 Integrating Oracle Database Vault with Oracle Label Security
    • 12.4.1 How Oracle Database Vault Is Integrated with Oracle Label Security
    • 12.4.2 Requirements for Using Oracle Database Vault with Oracle Label Security
    • 12.4.3 Using Oracle Database Vault Factors with Oracle Label Security Policies
      • 12.4.3.1 About Using Oracle Database Vault Factors with Oracle Label Security Policies
      • 12.4.3.2 Configuring Factors to Work with an Oracle Label Security Policy
    • 12.4.4 Tutorial: Integrating Oracle Database Vault with Oracle Label Security
      • 12.4.4.1 About This Tutorial
      • 12.4.4.2 Step 1: Create Users for This Tutorial
      • 12.4.4.3 Step 2: Create the Oracle Label Security Policy
      • 12.4.4.4 Step 3: Create Oracle Database Vault Rules to Control the OLS Authorization
      • 12.4.4.5 Step 4: Update the ALTER SYSTEM Command Rule to Use the Rule Set
      • 12.4.4.6 Step 5: Test the Authorizations
      • 12.4.4.7 Step 6: Remove the Components for This Tutorial
    • 12.4.5 Related Reports and Data Dictionary Views
  • 12.5 Integrating Oracle Database Vault with Oracle Data Guard
    • 12.5.1 Step 1: Configure the Primary Database
    • 12.5.2 Step 2: Configure the Standby Database
    • 12.5.3 How Auditing Works After an Oracle Database Vault-Oracle Active Data Guard Integration
    • 12.5.4 Disabling Oracle Database Vault in an Oracle Data Guard Environment
  • 12.6 Registering Oracle Internet Directory Using Oracle Database Configuration Asssitant
• 13 DBA Operations in an Oracle Database Vault Environment
  • 13.1 Performing DDL Operations in Oracle Database Vault
    • 13.1.1 Restrictions on Performing DDL Operations in Oracle Database Vault
    • 13.1.2 Impact of the DV_PATCH_ADMIN Role on DDL Operations
  • 13.2 Using Oracle Database Vault with Oracle Enterprise Manager
    • 13.2.1 Propagating Oracle Database Vault Configurations to Other Databases
    • 13.2.2 Enterprise Manager Cloud Control Alerts for Oracle Database Vault Policies
    • 13.2.3 Oracle Database Vault-Specific Reports in Enterprise Manager Cloud Control
    • 13.2.4 Changing the DBSNMP Account Password in a Database Vault Environment
  • 13.3 Using Oracle Data Pump with Oracle Database Vault
    • 13.3.1 About Using Oracle Data Pump with Oracle Database Vault
    • 13.3.2 Authorizing Users for Data Pump Regular Export and Import Operations
      • 13.3.2.1 About Authorizing Users for Oracle Data Pump Regular Operations
      • 13.3.2.2 Levels of Database Vault Authorization for Oracle Data Pump Regular Operations
      • 13.3.2.3 Authorizing Users for Oracle Data Pump Regular Operations in Database Vault
      • 13.3.2.4 Revoking Oracle Data Pump Authorization from Users
    • 13.3.3 Authorizing Users for Data Pump Transportable Export and Import Operations
      • 13.3.3.1 About Authorizing Users for Oracle Data Pump Transportable Operations
      • 13.3.3.2 Levels of Database Vault Authorization for Data Pump Transportable Operations
      • 13.3.3.3 Authorizing Users for Data Pump Transportable Operations in Database Vault
      • 13.3.3.4 Revoking Transportable Tablespace Authorization from Users
    • 13.3.4 Guidelines for Exporting or Importing Data in a Database Vault Environment
  • 13.4 Using Oracle Scheduler with Oracle Database Vault
    • 13.4.1 About Using Oracle Scheduler with Oracle Database Vault
    • 13.4.2 Granting a Job Scheduling Administrator Authorization for Database Vault
    • 13.4.3 Revoking Authorization from Job Scheduling Administrators
  • 13.5 Using Information Lifecycle Management with Oracle Database Vault
    • 13.5.1 About Using Information Lifecycle Management with Oracle Database Vault
    • 13.5.2 Authorizing Users for ILM Operations in Database Vault
    • 13.5.3 Revoking Information Lifecycle Management Authorization from Users
  • 13.6 Executing Preprocessor Programs with Oracle Database Vault
    • 13.6.1 About Executing Preprocessor Programs with Oracle Database Vault
    • 13.6.2 Authorizing Users to Execute Preprocessor Programs
    • 13.6.3 Revoking Execute Preprocessor Authorization from Users
  • 13.7 Oracle Recovery Manager and Oracle Database Vault
  • 13.8 Privileges for Using Oracle Streams with Oracle Database Vault
  • 13.9 Privileges for Using XStream with Oracle Database Vault
  • 13.10 Privileges for Using Oracle GoldenGate with Oracle Database Vault
  • 13.11 Using Data Masking in an Oracle Database Vault Environment
    • 13.11.1 About Data Masking in an Oracle Database Vault Enabled Database
    • 13.11.2 Adding Data Masking Users to the Data Dictionary Realm Authorizations
    • 13.11.3 Giving Users Access to Tables or Schemas That They Want to Mask
    • 13.11.4 Creating a Command Rule to Control Data Masking Privileges
  • 13.12 Converting a Standalone Oracle Database to a PDB and Plugging It into a CDB
  • 13.13 Using the ORADEBUG Utility with Oracle Database Vault
  • 13.14 Performing Patch Operations in an Oracle Database Vault Environment
• 14 Oracle Database Vault Schemas, Roles, and Accounts
  • 14.1 Oracle Database Vault Schemas
    • 14.1.1 DVSYS Schema
    • 14.1.2 DVF Schema
  • 14.2 Oracle Database Vault Roles
    • 14.2.1 About Oracle Database Vault Roles
    • 14.2.2 Privileges of Oracle Database Vault Roles
    • 14.2.3 Granting Oracle Database Vault Roles to Users
    • 14.2.4 DV_OWNER Database Vault Owner Role
    • 14.2.5 DV_ADMIN Database Vault Configuration Administrator Role
    • 14.2.6 DV_MONITOR Database Vault Monitoring Role
    • 14.2.7 DV_SECANALYST Database Vault Security Analyst Role
    • 14.2.8 DV_AUDIT_CLEANUP Audit Trail Cleanup Role
    • 14.2.9 DV_DATAPUMP_NETWORK_LINK Data Pump Network Link Role
    • 14.2.10 DV_STREAMS_ADMIN Oracle Streams Configuration Role
    • 14.2.11 DV_XSTREAM_ADMIN XStream Administrative Role
    • 14.2.12 DV_GOLDENGATE_ADMIN GoldenGate Administrative Role
    • 14.2.13 DV_GOLDENGATE_REDO_ACCESS GoldenGate Redo Log Role
    • 14.2.14 DV_PATCH_ADMIN Database Vault Database Patch Role
    • 14.2.15 DV_ACCTMGR Database Vault Account Manager Role
    • 14.2.16 DV_REALM_OWNER Database Vault Realm DBA Role
    • 14.2.17 DV_REALM_RESOURCE Database Vault Application Resource Owner Role
    • 14.2.18 DV_POLICY_OWNER Database Vault Owner Role
    • 14.2.19 DV_PUBLIC Database Vault PUBLIC Role
  • 14.3 Oracle Database Vault Accounts Created During Registration
  • 14.4 Backup Oracle Database Vault Accounts
• 15 Oracle Database Vault Realm APIs
  • 15.1 ADD_AUTH_TO_REALM Procedure
  • 15.2 ADD_OBJECT_TO_REALM Procedure
  • 15.3 CREATE_REALM Procedure
  • 15.4 DELETE_AUTH_FROM_REALM Procedure
  • 15.5 DELETE_OBJECT_FROM_REALM Procedure
  • 15.6 DELETE_REALM Procedure
  • 15.7 DELETE_REALM_CASCADE Procedure
  • 15.8 RENAME_REALM Procedure
  • 15.9 UPDATE_REALM Procedure
  • 15.10 UPDATE_REALM_AUTH Procedure
• 16 Oracle Database Vault Rule Set APIs
  • 16.1 DBMS_MACADM Rule Set Procedures
    • 16.1.1 ADD_RULE_TO_RULE_SET Procedure
    • 16.1.2 CREATE_RULE Procedure
    • 16.1.3 CREATE_RULE_SET Procedure
    • 16.1.4 DELETE_RULE Procedure
    • 16.1.5 DELETE_RULE_FROM_RULE_SET Procedure
    • 16.1.6 DELETE_RULE_SET Procedure
    • 16.1.7 RENAME_RULE Procedure
    • 16.1.8 RENAME_RULE_SET Procedure
    • 16.1.9 UPDATE_RULE Procedure
    • 16.1.10 UPDATE_RULE_SET Procedure
  • 16.2 Oracle Database Vault PL/SQL Rule Set Functions
    • 16.2.1 DV_SYSEVENT Function
    • 16.2.2 DV_LOGIN_USER Function
    • 16.2.3 DV_INSTANCE_NUM Function
    • 16.2.4 DV_DATABASE_NAME Function
    • 16.2.5 DV_DICT_OBJ_TYPE Function
    • 16.2.6 DV_DICT_OBJ_OWNER Function
    • 16.2.7 DV_DICT_OBJ_NAME Function
    • 16.2.8 DV_SQL_TEXT Function
• 17 Oracle Database Vault Command Rule APIs
  • 17.1 CREATE_COMMAND_RULE Procedure
  • 17.2 CREATE_CONNECT_COMMAND_RULE Procedure
  • 17.3 CREATE_SESSION_EVENT_CMD_RULE Procedure
  • 17.4 CREATE_SYSTEM_EVENT_CMD_RULE Procedure
  • 17.5 DELETE_COMMAND_RULE Procedure
  • 17.6 DELETE_CONNECT_COMMAND_RULE Procedure
  • 17.7 DELETE_SESSION_EVENT_CMD_RULE Procedure
  • 17.8 DELETE_SYSTEM_EVENT_CMD_RULE Procedure
  • 17.9 UPDATE_COMMAND_RULE Procedure
  • 17.10 UPDATE_CONNECT_COMMAND_RULE Procedure
  • 17.11 UPDATE_SESSION_EVENT_CMD_RULE Procedure
  • 17.12 UPDATE_SYSTEM_EVENT_CMD_RULE Procedure
• 18 Oracle Database Vault Factor APIs
  • 18.1 DBMS_MACADM Factor Procedures and Functions
    • 18.1.1 ADD_FACTOR_LINK Procedure
    • 18.1.2 ADD_POLICY_FACTOR Procedure
    • 18.1.3 CHANGE_IDENTITY_FACTOR Procedure
    • 18.1.4 CHANGE_IDENTITY_VALUE Procedure
    • 18.1.5 CREATE_DOMAIN_IDENTITY Procedure
    • 18.1.6 CREATE_FACTOR Procedure
    • 18.1.7 CREATE_FACTOR_TYPE Procedure
    • 18.1.8 CREATE_IDENTITY Procedure
    • 18.1.9 CREATE_IDENTITY_MAP Procedure
    • 18.1.10 DELETE_FACTOR Procedure
    • 18.1.11 DELETE_FACTOR_LINK Procedure
    • 18.1.12 DELETE_FACTOR_TYPE Procedure
    • 18.1.13 DELETE_IDENTITY Procedure
    • 18.1.14 DELETE_IDENTITY_MAP Procedure
    • 18.1.15 DROP_DOMAIN_IDENTITY Procedure
    • 18.1.16 GET_SESSION_INFO Function
    • 18.1.17 GET_INSTANCE_INFO Function
    • 18.1.18 RENAME_FACTOR Procedure
    • 18.1.19 RENAME_FACTOR_TYPE Procedure
    • 18.1.20 UPDATE_FACTOR Procedure
    • 18.1.21 UPDATE_FACTOR_TYPE Procedure
    • 18.1.22 UPDATE_IDENTITY Procedure
  • 18.2 Oracle Database Vault Run-Time PL/SQL Procedures and Functions
    • 18.2.1 About Oracle Database Vault Run-Tine PL/SQL Procedures and Functions
    • 18.2.2 SET_FACTOR Procedure
    • 18.2.3 GET_FACTOR Function
    • 18.2.4 GET_FACTOR_LABEL Function
    • 18.2.5 GET_TRUST_LEVEL Function
    • 18.2.6 GET_TRUST_LEVEL_FOR_IDENTITY Function
    • 18.2.7 ROLE_IS_ENABLED Function
  • 18.3 Oracle Database Vault DVF PL/SQL Factor Functions
    • 18.3.1 About Oracle Database Vault DVF PL/SQL Factor Functions
    • 18.3.2 F$AUTHENTICATION_METHOD Function
    • 18.3.3 F$CLIENT_IP Function
    • 18.3.4 F$DATABASE_DOMAIN Function
    • 18.3.5 F$DATABASE_HOSTNAME Function
    • 18.3.6 F$DATABASE_INSTANCE Function
    • 18.3.7 F$DATABASE_IP Function
    • 18.3.8 F$DATABASE_NAME Function
    • 18.3.9 F$DOMAIN Function
    • 18.3.10 F$ENTERPRISE_IDENTITY Function
    • 18.3.11 F$IDENTIFICATION_TYPE Function
    • 18.3.12 F$LANG Function
    • 18.3.13 F$LANGUAGE Function
    • 18.3.14 F$MACHINE Function
    • 18.3.15 F$NETWORK_PROTOCOL Function
    • 18.3.16 F$PROXY_ENTERPRISE_IDENTITY Function
    • 18.3.17 F$SESSION_USER Function
• 19 Oracle Database Vault Secure Application Role APIs
  • 19.1 DBMS_MACADM Secure Application Role Procedures
    • 19.1.1 CREATE_ROLE Procedure
    • 19.1.2 DELETE_ROLE Procedure
    • 19.1.3 RENAME_ROLE Procedure
    • 19.1.4 UPDATE_ROLE Procedure
  • 19.2 DBMS_MACSEC_ROLES Secure Application Role Procedure and Function
    • 19.2.1 CAN_SET_ROLE Function
    • 19.2.2 SET_ROLE Procedure
• 20 Oracle Database Vault Oracle Label Security APIs
  • 20.1 CREATE_MAC_POLICY Procedure
  • 20.2 CREATE_POLICY_LABEL Procedure
  • 20.3 DELETE_MAC_POLICY_CASCADE Procedure
  • 20.4 DELETE_POLICY_FACTOR Procedure
  • 20.5 DELETE_POLICY_LABEL Procedure
  • 20.6 UPDATE_MAC_POLICY Procedure
• 21 Oracle Database Vault Utility APIs
  • 21.1 DBMS_MACUTL Constants
    • 21.1.1 DBMS_MACUTL Listing of Constants
    • 21.1.2 Example: Creating a Realm Using DBMS_MACUTL Constants
    • 21.1.3 Example: Creating a Rule Set Using DBMS_MACUTL Constants
    • 21.1.4 Example: Creating a Factor Using DBMS_MACUTL Constants
  • 21.2 DBMS_MACUTL Package Procedures and Functions
    • 21.2.1 CHECK_DVSYS_DML_ALLOWED Procedure
    • 21.2.2 GET_CODE_VALUE Function
    • 21.2.3 GET_SECOND Function
    • 21.2.4 GET_MINUTE Function
    • 21.2.5 GET_HOUR Function
    • 21.2.6 GET_DAY Function
    • 21.2.7 GET_MONTH Function
    • 21.2.8 GET_YEAR Function
    • 21.2.9 IS_ALPHA Function
    • 21.2.10 IS_DIGIT Function
    • 21.2.11 IS_DVSYS_OWNER Function
    • 21.2.12 IS_OLS_INSTALLED Function
    • 21.2.13 IS_OLS_INSTALLED_VARCHAR Function
    • 21.2.14 USER_HAS_OBJECT_PRIVILEGE Function
    • 21.2.15 USER_HAS_ROLE Function
    • 21.2.16 USER_HAS_ROLE_VARCHAR Function
    • 21.2.17 USER_HAS_SYSTEM_PRIVILEGE Function
    • 21.2.18 ROLE_GRANTED_ENABLED_VARCHAR Function
• 22 Oracle Database Vault General Administrative APIs
  • 22.1 DBMS_MACADM General System Maintenance Procedures
    • 22.1.1 ADD_NLS_DATA Procedure
    • 22.1.2 AUTHORIZE_DATAPUMP_USER Procedure
    • 22.1.3 AUTHORIZE_DDL Procedure
    • 22.1.4 AUTHORIZE_DIAGNOSTIC_ADMIN Procedure
    • 22.1.5 AUTHORIZE_MAINTENANCE_USER Procedure
    • 22.1.6 AUTHORIZE_PROXY_USER Procedure
    • 22.1.7 AUTHORIZE_SCHEDULER_USER Procedure
    • 22.1.8 AUTHORIZE_TTS_USER Procedure
    • 22.1.9 UNAUTHORIZE_DATAPUMP_USER Procedure
    • 22.1.10 UNAUTHORIZE_DDL Procedure
    • 22.1.11 UNAUTHORIZE_DIAGNOSTIC_ADMIN Procedure
    • 22.1.12 UNAUTHORIZE_MAINTENANCE_USER Procedure
    • 22.1.13 UNAUTHORIZE_PROXY_USER Procedure
    • 22.1.14 UNAUTHORIZE_SCHEDULER_USER Procedure
    • 22.1.15 UNAUTHORIZE_TTS_USER Procedure
    • 22.1.16 DISABLE_DV Procedure
    • 22.1.17 DISABLE_DV_DICTIONARY_ACCTS Procedure
    • 22.1.18 DISABLE_DV_PATCH_ADMIN_AUDIT Procedure
    • 22.1.19 DISABLE_ORADEBUG Procedure
    • 22.1.20 ENABLE_DV Procedure
    • 22.1.21 ENABLE_DV_PATCH_ADMIN_AUDIT Procedure
    • 22.1.22 ENABLE_DV_DICTIONARY_ACCTS Procedure
    • 22.1.23 ENABLE_ORADEBUG Procedure
  • 22.2 CONFIGURE_DV General System Maintenance Procedure
• 23 Oracle Database Vault Policy APIs
  • 23.1 ADD_CMD_RULE_TO_POLICY Procedure
  • 23.2 ADD_OWNER_TO_POLICY Procedure
  • 23.3 ADD_REALM_TO_POLICY Procedure
  • 23.4 CREATE_POLICY Procedure
  • 23.5 DELETE_CMD_RULE_FROM_POLICY Procedure
  • 23.6 DELETE_OWNER_FROM_POLICY Procedure
  • 23.7 DELETE_REALM_FROM_POLICY Procedure
  • 23.8 DROP_POLICY Procedure
  • 23.9 RENAME_POLICY Procedure
  • 23.10 UPDATE_POLICY_DESCRIPTION Procedure
  • 23.11 UPDATE_POLICY_STATE Procedure
• 24 Oracle Database Vault API Reference
  • 24.1 DBMS_MACADM PL/SQL Package Contents
  • 24.2 DBMS_MACSEC_ROLES PL/SQL Package Contents
  • 24.3 DBMS_MACUTL PL/SQL Package Contents
  • 24.4 CONFIGURE_DV PL/SQL Procedure
  • 24.5 DVF PL/SQL Interface Contents
• 25 Oracle Database Vault Data Dictionary Views
  • 25.1 About the Oracle Database Vault Data Dictionary Views
  • 25.2 CDB_DV_STATUS View
  • 25.3 DBA_DV_CODE View
  • 25.4 DBA_DV_COMMAND_RULE View
  • 25.5 DBA_DV_DATAPUMP_AUTH View
  • 25.6 DBA_DV_DDL_AUTH View
  • 25.7 DBA_DV_DICTIONARY_ACCTS View
  • 25.8 DBA_DV_FACTOR View
  • 25.9 DBA_DV_FACTOR_TYPE View
  • 25.10 DBA_DV_FACTOR_LINK View
  • 25.11 DBA_DV_IDENTITY View
  • 25.12 DBA_DV_IDENTITY_MAP View
  • 25.13 DBA_DV_JOB_AUTH View
  • 25.14 DBA_DV_MAC_POLICY View
  • 25.15 DBA_DV_MAC_POLICY_FACTOR View
  • 25.16 DBA_DV_MAINTENANCE_AUTH View
  • 25.17 DBA_DV_ORADEBUG View
  • 25.18 DBA_DV_PATCH_ADMIN_AUDIT View
  • 25.19 DBA_DV_POLICY View
  • 25.20 DBA_DV_POLICY_LABEL View
  • 25.21 DBA_DV_POLICY_OBJECT View
  • 25.22 DBA_DV_POLICY_OWNER View
  • 25.23 DBA_DV_PROXY_AUTH View
  • 25.24 DBA_DV_PUB_PRIVS View
  • 25.25 DBA_DV_REALM View
  • 25.26 DBA_DV_REALM_AUTH View
  • 25.27 DBA_DV_REALM_OBJECT View
  • 25.28 DBA_DV_ROLE View
  • 25.29 DBA_DV_RULE View
  • 25.30 DBA_DV_RULE_SET View
  • 25.31 DBA_DV_RULE_SET_RULE View
  • 25.32 DBA_DV_STATUS View
  • 25.33 DBA_DV_SIMULATION_LOG View
  • 25.34 DBA_DV_TTS_AUTH View
  • 25.35 DBA_DV_USER_PRIVS View
  • 25.36 DBA_DV_USER_PRIVS_ALL View
  • 25.37 DVSYS.DV$CONFIGURATION_AUDIT View
  • 25.38 DVSYS.DV$ENFORCEMENT_AUDIT View
  • 25.39 DVSYS.DV$REALM View
  • 25.40 DVSYS.POLICY_OWNER_COMMAND_RULE View
  • 25.41 DVSYS.POLICY_OWNER_POLICY View
  • 25.42 DVSYS.POLICY_OWNER_REALM View
  • 25.43 DVSYS.POLICY_OWNER_REALM_AUTH View
  • 25.44 DVSYS.POLICY_OWNER_REALM_OBJECT View
  • 25.45 DVSYS.POLICY_OWNER_RULE View
  • 25.46 DVSYS.POLICY_OWNER_RULE_SET View
  • 25.47 DVSYS.POLICY_OWNER_RULE_SET_RULE View
  • 25.48 SYS.DV$CONFIGURATION_AUDIT View
  • 25.49 SYS.DV$ENFORCEMENT_AUDIT View
• 26 Monitoring Oracle Database Vault
  • 26.1 About Monitoring Oracle Database Vault
  • 26.2 Monitoring Security Violations and Configuration Changes
• 27 Oracle Database Vault Reports
  • 27.1 About the Oracle Database Vault Reports
  • 27.2 Who Can Run the Oracle Database Vault Reports?
  • 27.3 Running the Oracle Database Vault Reports
  • 27.4 Oracle Database Vault Configuration Issues Reports
    • 27.4.1 Command Rule Configuration Issues Report
    • 27.4.2 Rule Set Configuration Issues Report
    • 27.4.3 Realm Authorization Configuration Issues Report
    • 27.4.4 Factor Configuration Issues Report
    • 27.4.5 Factor Without Identities Report
    • 27.4.6 Identity Configuration Issues Report
    • 27.4.7 Secure Application Configuration Issues Report
  • 27.5 Oracle Database Vault Auditing Reports
    • 27.5.1 Realm Audit Report
    • 27.5.2 Command Rule Audit Report
    • 27.5.3 Factor Audit Report
    • 27.5.4 Label Security Integration Audit Report
    • 27.5.5 Core Database Vault Audit Trail Report
    • 27.5.6 Secure Application Role Audit Report
  • 27.6 Oracle Database Vault General Security Reports
    • 27.6.1 Object Privilege Reports
      • 27.6.1.1 Object Access By PUBLIC Report
      • 27.6.1.2 Object Access Not By PUBLIC Report
      • 27.6.1.3 Direct Object Privileges Report
      • 27.6.1.4 Object Dependencies Report
    • 27.6.2 Database Account System Privileges Reports
      • 27.6.2.1 Direct System Privileges By Database Account Report
      • 27.6.2.2 Direct and Indirect System Privileges By Database Account Report
      • 27.6.2.3 Hierarchical System Privileges by Database Account Report
      • 27.6.2.4 ANY System Privileges for Database Accounts Report
      • 27.6.2.5 System Privileges By Privilege Report
    • 27.6.3 Sensitive Objects Reports
      • 27.6.3.1 Execute Privileges to Strong SYS Packages Report
      • 27.6.3.2 Access to Sensitive Objects Report
      • 27.6.3.3 Public Execute Privilege To SYS PL/SQL Procedures Report
      • 27.6.3.4 Accounts with SYSDBA/SYSOPER Privilege Report
    • 27.6.4 Privilege Management - Summary Reports
      • 27.6.4.1 Privileges Distribution By Grantee Report
      • 27.6.4.2 Privileges Distribution By Grantee, Owner Report
      • 27.6.4.3 Privileges Distribution By Grantee, Owner, Privilege Report
    • 27.6.5 Powerful Database Accounts and Roles Reports
      • 27.6.5.1 WITH ADMIN Privilege Grants Report
      • 27.6.5.2 Accounts With DBA Roles Report
      • 27.6.5.3 Security Policy Exemption Report
      • 27.6.5.4 BECOME USER Report
      • 27.6.5.5 ALTER SYSTEM or ALTER SESSION Report
      • 27.6.5.6 Password History Access Report
      • 27.6.5.7 WITH GRANT Privileges Report
      • 27.6.5.8 Roles/Accounts That Have a Given Role Report
      • 27.6.5.9 Database Accounts With Catalog Roles Report
      • 27.6.5.10 AUDIT Privileges Report
      • 27.6.5.11 OS Security Vulnerability Privileges Report
    • 27.6.6 Initialization Parameters and Profiles Reports
      • 27.6.6.1 Security Related Database Parameters Report
      • 27.6.6.2 Resource Profiles Report
      • 27.6.6.3 System Resource Limits Report
    • 27.6.7 Database Account Password Reports
      • 27.6.7.1 Database Account Default Password Report
      • 27.6.7.2 Database Account Status Report
    • 27.6.8 Security Audit Report: Core Database Audit Report
    • 27.6.9 Other Security Vulnerability Reports
      • 27.6.9.1 Java Policy Grants Report
      • 27.6.9.2 OS Directory Objects Report
      • 27.6.9.3 Objects Dependent on Dynamic SQL Report
      • 27.6.9.4 Unwrapped PL/SQL Package Bodies Report
      • 27.6.9.5 Username/Password Tables Report
      • 27.6.9.6 Tablespace Quotas Report
      • 27.6.9.7 Non-Owner Object Trigger Report
• A Auditing Oracle Database Vault
  • A.1 About Auditing in Oracle Database Vault
  • A.2 Protection of the Unified Audit Trail in an Oracle Database Vault Environment
  • A.3 Oracle Database Vault Specific Audit Events
    • A.3.1 Oracle Database Vault Policy Audit Events
    • A.3.2 Oracle Database Vault Audit Trail Record Format
  • A.4 Archiving and Purging the Oracle Database Vault Audit Trail
    • A.4.1 About Archiving and Purging the Oracle Database Vault Audit Trail
    • A.4.2 Archiving the Oracle Database Vault Audit Trail
    • A.4.3 Purging the Oracle Database Vault Audit Trail
  • A.5 Oracle Database Audit Settings Created for Oracle Database Vault
• B Disabling and Enabling Oracle Database Vault
  • B.1 When You Must Disable Oracle Database Vault
  • B.2 Step 1: Disable Oracle Database Vault
  • B.3 Step 2: Perform the Required Tasks
  • B.4 Step 3: Enable Oracle Database Vault
• C Postinstallation Oracle Database Vault Procedures
  • C.1 Configuring Oracle Database Vault on Oracle RAC Nodes
  • C.2 Adding Languages to Oracle Database Vault
  • C.3 Deinstalling Oracle Database Vault
  • C.4 Reinstalling Oracle Database Vault
• D Oracle Database Vault Security Guidelines
  • D.1 Separation of Duty Guidelines
    • D.1.1 How Oracle Database Vault Handles Separation of Duty
    • D.1.2 Separation of Tasks in an Oracle Database Vault Environment
    • D.1.3 Separation of Duty Matrix for Oracle Database Vault
    • D.1.4 Identification and Documentation of the Tasks of Database Users
  • D.2 Managing Oracle Database Administrative Accounts
    • D.2.1 SYSTEM User Account for General Administrative Uses
    • D.2.2 SYSTEM Schema for Application Tables
    • D.2.3 Limitation of the SYSDBA Administrative Privilege
    • D.2.4 Root and Operating System Access to Oracle Database Vault
  • D.3 Accounts and Roles Trusted by Oracle Database Vault
  • D.4 Accounts and Roles That Should be Limited to Trusted Individuals
    • D.4.1 Management of Users with Root Access to the Operating System
    • D.4.2 Management of the Oracle Software Owner
    • D.4.3 Management of SYSDBA Access
    • D.4.4 Management of SYSOPER Access
  • D.5 Guidelines for Using Oracle Database Vault in a Production Environment
  • D.6 Secure Configuration Guidelines
    • D.6.1 General Secure Configuration Guidelines
    • D.6.2 UTL_FILE and DBMS_FILE_TRANSFER Package Security Considerations
      • D.6.2.1 About Security Considerations for the UTL_FILE and DBMS_FILE_TRANSFER Packages
      • D.6.2.2 Securing Access to the DBMS_FILE_TRANSFER Package
      • D.6.2.3 Example: Creating a Command Rule to Deny Access to CREATE DATABASE LINK
      • D.6.2.4 Example: Creating a Command Rule to Enable Access to CREATE DATABASE LINK
      • D.6.2.5 Example: Command Rules to Disable and Enable Access to CREATE DIRECTORY
    • D.6.3 CREATE ANY JOB Privilege Security Considerations
    • D.6.4 CREATE EXTERNAL JOB Privilege Security Considerations
    • D.6.5 LogMiner Package Security Considerations
    • D.6.6 ALTER SYSTEM and ALTER SESSION Privilege Security Considerations
      • D.6.6.1 About ALTER SYSTEM and ALTER SESSION Privilege Security Considerations
      • D.6.6.2 Example: Adding Rules to the Existing ALTER SYSTEM Command Rule
• E Troubleshooting Oracle Database Vault
  • E.1 Using Trace Files to Diagnose Oracle Database Vault Events
    • E.1.1 About Using Trace Files to Diagnose Oracle Database Vault Events
    • E.1.2 Types of Oracle Database Vault Trace Events That You Can and Cannot Track
    • E.1.3 Levels of Oracle Database Vault Trace Events
    • E.1.4 Performance Effect of Enabling Oracle Database Vault Trace Files
    • E.1.5 Enabling Oracle Database Vault Trace Events
      • E.1.5.1 Enabling Trace Events for the Current Database Session
      • E.1.5.2 Enabling Trace Events for All Database Sessions
      • E.1.5.3 Enabling Trace Events in a Multitenant Environment
    • E.1.6 Finding Oracle Database Vault Trace File Data
      • E.1.6.1 Finding the Database Vault Trace File Directory Location
      • E.1.6.2 Using the Linux grep Command to Search Trace Files for Strings
      • E.1.6.3 Using the ADR Command Interpreter (ADRCI) Utility to QueryTrace Files
    • E.1.7 Example: Low Level Oracle Database Vault Realm Violations in a Trace File
    • E.1.8 Example: High Level Trace Enabled for Oracle Database Vault Authorization
    • E.1.9 Example: Highest Level Traces on Violations on Realm-Protected Objects
    • E.1.10 Disabling Oracle Database Vault Trace Events
      • E.1.10.1 Disabling Trace Events for the Current Database Session
      • E.1.10.2 Disabling Trace Events for All Database Sessions
      • E.1.10.3 Disabling Trace Events in a Multitenant Environment
  • E.2 General Diagnostic Tips
  • E.3 Configuration Problems with Oracle Database Vault Components
  • E.4 Resetting Oracle Database Vault Account Passwords
    • E.4.1 Resetting the DV_OWNER User Password
    • E.4.2 Resetting the DV_ACCTMGR User Password
• Index