1. Index

Index

Symbols  Numerics  A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  

Symbols

  • "all permissions" A.3

Numerics

  • 12C password hash version
  • 12C password version

A

  • about 6.1.1, 9.8.1, B.1.2, B.1.3
  • about connection 6.2.1
  • ACCEPT_MD5_CERTS sqlnet.ora parameter B.4.12
  • ACCEPT_SHA1_CERTS sqlnet.ora parameter B.4.12
  • access configuration, DBCA 6.2.2.7.3
  • access configuration, silent mode 6.2.2.7.4
  • access configuration, system parameters 6.2.2.7.2
  • access control
    • encryption, about manual 19.1
    • encryption, problems not solved by 19.2.1
    • enforcing A.11.1
    • object privileges 4.14.1
    • password encryption 3.2.1
  • access control list (ACL) 10.5.1
    • examples
      • external network connection for email alert 32.4.1
      • external network connections 10.7
      • wallet access 10.7
    • external network services
      • about 10.2
      • advantages 10.1
      • affect of upgrade from earlier release 10.4
      • email alert for audit violation tutorial 32.4.1
      • finding information about 10.13
      • network hosts, using wildcards to specify 10.8
      • ORA-06512 error 10.12
      • ORA-24247 error 10.12
      • ORA-24247 errors 10.4
      • order of precedence, hosts 10.9
      • port ranges 10.10
      • privilege assignments, about 10.11.1
      • privilege assignments, database administrators checking 10.11.2
      • privilege assignments, users checking 10.11.4
      • revoking privileges 10.5.4
    • wallet access
      • about 10.3
      • advantages 10.3
      • client certificate credentials, using 10.6.1
      • finding information about 10.13
      • non-shared wallets 10.6.1
      • password credentials 10.6.1
      • password credentials, using 10.6.1
      • revoking 10.6.5
      • revoking access 10.6.5
      • shared database session 10.6.1
      • wallets without sensitive information 10.6.1
      • wallets with sensitive information 10.6.1
  • accounting, RADIUS 27.5.4
  • account locking
  • activating checksumming and encryption 21.6.1
  • adapters 23.5
  • ADG_ACCOUNT_INFO_TRACKING initialization parameter
    • guideline for securing A.11.1
  • ad hoc tools
    • database access, security problems of 4.11.7.1
  • ADM_PARALLEL_EXECUTE_TASK role
  • ADMINISTER FINE GRAINED AUDIT POLICY system privilege 4.8.1
  • ADMINISTER REDACTION POLICY system privilege 4.8.1
  • ADMINISTER ROW LEVEL SECURITY POLICY system privilege 4.8.1
  • administrative accounts
  • administrative privileges
  • administrative user passwords
    • default, importance of changing A.4
  • administrative users
  • administrator privileges
    • access A.11.2
    • operating system authentication 3.3.3
    • passwords 3.3.4, A.4
    • SYSDBA and SYSOPER access, centrally controlling 3.3.2.1
    • write, on listener.ora file A.11.2
  • ADMIN OPTION
  • Advanced Encryption Standard (AES)
  • Advanced Networking Option (ANO) (Oracle native encryption) 21.6.3.3.1
  • AES256 algorithm
    • converting to in Oracle wallets B.3.9
  • alerts, used in fine-grained audit policy 32.4.1
  • algorithms
    • weaker keys C.6
  • ALTER ANY LIBRARY statement
    • security guidelines A.3
  • ALTER DATABASE DICTIONARY DELETE CREDENTIALS statement 12.6.2
  • ALTER DATABASE DICTIONARY ENCRYPT CREDENTIALS statement 12.6.2
  • ALTER DATABASE DICTIONARY REKEY CREDENTIALS statement 12.6.2
  • altering users 2.3.1
  • ALTER PROCEDURE statement
    • used for compiling procedures 4.18.4
  • ALTER PROFILE statement
  • ALTER RESOURCE COST statement 2.4.4.6, 2.4.4.7
  • ALTER ROLE statement
    • changing authorization method 4.11.3.5
  • ALTER SESSION statement
  • ALTER USER privilege 2.3.1
  • ALTER USER statement
  • ANO encryption
  • ANONYMOUS user account 2.6.2
  • ANSI operations
    • Oracle Virtual Private Database affect on 15.5.3
  • ANY system privilege
    • guidelines for security A.7
  • application common users
  • application containers
    • application contexts 14.1.6
    • Virtual Private Database policies 15.1.6
  • application contexts 14.4.1
    • See also: client session-based application contexts, database session-based application contexts, global application contexts
  • application developers
  • applications
    • about security policies for 12.1
    • database users 12.2.1
    • DB_DEVELOPER_ROLE role 12.3
    • enhancing security with 4.11.1.3
    • object privileges 12.12.1
    • object privileges permitting SQL statements 12.12.2
    • One Big Application User authentication
    • Oracle Virtual Private Database, how it works with 15.5.4
    • password handling, guidelines 12.4.1.2
    • password protection strategies 12.4
    • privileges, managing 12.7
    • roles
      • multiple 4.11.1.5
      • privileges, associating with database roles 12.10
    • security 4.11.7, 12.2.2
    • security considerations for use 12.2
    • security limitations 15.5.4
    • security policies 15.3.7.3
    • validating with security policies 15.3.7.5
  • application security
    • finding privilege use by users 5.1.2.1
    • restricting wallet access to current application 10.6.1
    • revoking access control privileges from Oracle wallets 10.6.5
    • sharing wallet with other applications 10.6.1
    • specifying attributes 14.3.3.3
  • application users who are database users
    • Oracle Virtual Private Database, how it works with 15.5.10
  • APPQOSSYS user account 2.6.2
  • architecture 6.1.3
  • archiving
  • ASMSNMP user account 2.6.2
  • asymmetric key operations 19.5
  • asynchronous authentication mode in RADIUS 27.3.2
  • attacks
    • See: security attacks
  • AUDIT_ADMIN role 4.11.2
  • AUDIT_VIEWER role 4.11.2
  • audit files
    • operating system audit trail
    • operating system file
    • standard audit trail
  • auditing 30.5
    • See also: unified audit policies
    • administrators, Database Vault 31.8.2.2
    • audit configurations 30.6, 31.6.2.2
    • audit options 30.5
    • audit policies 30.6, 31.6.2.2
    • audit trail, sensitive data in A.13
    • CDBs 29.7
    • committed data A.13.2
    • common objects 30.6, 31.6.2.2
    • cursors, affect on auditing 33.1.9
    • databases, when unavailable 33.1.6
    • database user names 3.7.1.2
    • Database Vault administrators 31.8.2.2
    • disk space size for unified audit records 33.1.2
    • distributed databases and 29.8
    • DV_ADMIN role user 31.8.2.2
    • DV_OWNER role user 31.8.2.2
    • finding information about audit management 33.4
    • finding information about fine-grained auditing 32.5
    • finding information about usage 30.7
    • finding information about usage in custom audit policies 31.11
    • fine-grained
      • See fine-grained auditing 32.1.1
    • functions 31.4.4.13
    • functions, Oracle Virtual Private Database 31.4.4.15
    • general steps
      • commonly used security-relevant activities 30.5.1
      • specific fine-grained activities 30.5.3
      • SQL statements and other general activities 30.5.2
    • general steps for 30.5
    • guidelines for security A.13
    • historical information A.13.2
    • INHERIT PRIVILEGE privilege 9.5.8
    • keeping information manageable A.13.1
    • loading audit records to unified audit trail 33.1.6
    • mandatory auditing 30.3
    • multitier environments
      • See standard auditing 31.6.1
    • One Big Application User authentication, compromised by 12.2.1
    • operating-system user names 3.7.1.2
    • Oracle Virtual Private Database policy functions 31.4.4.15
    • packages 31.4.4.13
    • performance 29.3
    • PL/SQL packages 31.4.4.13
    • predefined policies
      • general steps for using 30.5.1
    • privileges required 29.5
    • procedures 31.4.4.13
    • purging records
    • range of focus 30.5
    • READ object privileges in policies 31.4.5.2
    • READ privileges
    • recommended settings A.13.5
    • Sarbanes-Oxley Act
      • auditing, meeting compliance through 29.1
    • SELECT privileges
    • sensitive data A.13.4
    • suspicious activity A.13.3
    • triggers 31.4.4.13
    • unified audit trail
    • VPD predicates
    • when audit options take effect 33.1.1
    • when records are created 33.1.1
  • auditing, purging records
  • audit policies 29.1
    • See also: unified audit policies
  • audit policies, application contexts
  • audit records
    • when written to OS files 33.1.5
  • audit trail
    • archiving 33.2.2
    • capturing syslog records 33.1.4.2
    • capturing Windows Event Viewer records 33.1.4.2
    • finding information about audit management 33.4
    • finding information about fine-grained audit usage 32.5
    • finding information about usage 30.7
    • finding information about usage in custom audit policies 31.11
    • SYSLOG records 33.1.4.1
    • unified
  • AUDSYS user account 2.6.2
  • AUTHENTICATEDUSER role 4.11.2
  • authentication 3.2.1, 23.5
    • See also: passwords, proxy authentication
  • authentication types 6.1.4
  • AUTHID DEFINER clause
    • used with Oracle Virtual Private Database functions 15.1.4
  • authorization
  • automatic reparse
    • Oracle Virtual Private Database, how it works with 15.5.5
  • AVTUNE_PKG_ROLE role 4.11.2

B

  • banners
    • auditing user actions, configuring 12.13.5
    • unauthorized access, configuring 12.13.5
  • BDSQL_ADMIN role 4.11.2
  • BDSQL_USER role 4.11.2
  • BFILEs
    • guidelines for security A.7
  • bind variables
  • BLOBS

C

  • CAPTURE_ADMIN role 4.11.2
  • cascading revokes 4.21.3
  • catpvf.sql script (password complexity functions) 3.2.6.2
  • CDB_DBA role 4.11.2
  • CDB common users
  • CDBs
  • Center for Internet Security (CIS) 30.4.5
    • ORA_CIS_PROFILE user profile 2.4.4.2
    • ORA_LOGIN_LOGOUT predefined unified audit policy 30.4.6.3
  • centrally managed users
    • Oracle Autonomous Database 6.6
  • Centrally managed users
  • certificate authority (CA) B.1.3
  • certificate key algorithm
    • Transport Layer Security A.11.3
  • certificate revocation list (CRL)
  • certificate revocation lists
  • certificate revocation status checking
  • certificates 6.2.2.5, B.1.2
    • adding to wallet using orapki B.4.13.1
    • creating SHA-2 with orapki B.4.4
    • creating signed with orapki B.4.3
    • general process of management B.1.5
    • Oracle Real Application Clusters components that need certificates 22.4.1.3.1
    • tools to manage B.1.4
  • certificate store location
  • certificate validation error message
    • CRL could not be found 22.3.8.7
    • CRL date verification failed with RSA status 22.3.8.7
    • CRL signature verification failed with RSA status 22.3.8.7
    • Fetch CRL from CRL DP
    • OID hostname or port number not set 22.3.8.7
  • challenge-response authentication in RADIUS 27.3.2
  • change_on_install default password A.4
  • character sets
    • role names, multibyte characters in 4.11.3.1
    • role passwords, multibyte characters in 4.11.4.1
  • Cipher Block Chaining (CBC) mode, defined 21.1.2
  • cipher suites
    • Transport Layer Security A.11.3
  • ciphertext data
  • CLIENT_IDENTIFIER USERENV attribute 3.10.2.4
    • See also: USERENV namespace
    • setting and clearing with DBMS_SESSION package 3.10.2.6
    • setting with OCI user session handle attribute 3.10.2.5
  • client connections
  • CLIENTID_OVERWRITE event 3.10.2.6
  • client identifier
    • setting for applications that use JDBC 3.10.2.5
  • client identifiers 14.4.2
    • See also: nondatabase users
    • about 3.10.2.1
    • auditing users 31.6.1
    • consistency between DBMS_SESSION.SET_IDENTIFIER and DBMS_APPLICATION_INFO.SET_CLIENT_INFO 3.10.2.6
    • global application context, independent of 3.10.2.4
    • setting with DBMS_SESSION.SET_IDENTIFIER procedure 14.4.3
  • client session-based application contexts 14.5.1
    • See also: application contexts
    • about 14.5.1
    • CLIENTCONTEXT namespace, clearing value from 14.5.5
    • CLIENTCONTEXT namespace, setting value in 14.5.2
    • retrieving CLIENTCONTEXT namespace 14.5.3
  • CMU_WALLET database property
  • code based access control (CBAC)
    • about 9.7.1
    • granting and revoking roles to program unit 9.7.6
    • how works with definers rights 9.7.4
    • how works with invoker’s rights 9.7.3
    • privileges 9.7.2
    • tutorial 9.7.7
  • column masking behavior 15.3.6.4
  • columns
  • command line recall attacks 12.4.1.1, 12.4.1.4
  • committed data
  • common privilege grants 4.2.6, 4.2.10
  • common roles 4.12.2
  • common user accounts
  • common users
  • configuration
    • guidelines for security A.9
  • configuration files
  • configuring
    • Kerberos authentication service parameters 25.2.6.1
    • RADIUS authentication 27.5.1
  • connecting
    • with username and password 28.1
  • connection pooling
  • CONNECT role
  • CONTAINER_DATA objects
    • viewing information about 4.10.6
  • container database (CDB)
    • See: CDBs
  • container data objects
  • context profiles
    • privilege analysis 5.1.4
  • controlled step-in procedures 9.3
  • CPU time limit 2.4.2.3
  • CREATE ANY LIBRARY statement
    • security guidelines A.3
  • CREATE ANY PROCEDURE system privilege 4.18.3
  • CREATE CONTEXT statement
  • CREATE LOCKDOWN PROFILE statement 4.13.2, 4.13.7
  • CREATE PROCEDURE system privilege 4.18.3
  • CREATE PROFILE statement
  • CREATE ROLE statement 4.12.2
  • CREATE SCHEMA statement
  • CREATE SESSION statement
  • CREATE USER statement
    • explicit account locking 3.2.4.9
    • IDENTIFIED BY option 2.2.5
    • IDENTIFIED EXTERNALLY option 2.2.5
  • creating Oracle service directory user account 6.2.2.1
  • credentials
  • CRLAdmins directory administrative group B.6.7
  • CRLs
  • cryptographic libraries
    • FIPS 140-2 C.1
  • CTXAPP role 4.11.2
  • CTXSYS user account 2.6.2
  • cursors
    • affect on auditing 33.1.9
    • reparsing, for application contexts 14.3.5
    • shared, used with Virtual Private Database 15.1.5

D

  • database administrators (DBAs)
    • access, controlling 19.2.2
    • authentication 3.3.1
    • malicious, encryption not solved by 19.2.2
  • Database Configuration Assistant (DBCA)
    • default passwords, changing A.4
    • user accounts, automatically locking and expiring A.3
  • database links 6.1.7
    • application contexts 14.3.4.6
    • application context support 14.3.10.1
    • authenticating with Kerberos 3.7.1.3
    • definer’s rights procedures 9.8.1
    • object privileges 4.14.1
    • operating system accounts, care needed 3.7.1.2
    • Oracle DBaaS-to-IAM connections 7.7
    • RADIUS not supported 27.1
    • sensitive credential data
      • about 17.1
      • data dictionary views 17.7
      • deleting 17.5
      • encrypting 17.3
      • multitenant environment 17.2
      • rekeying 17.4
      • restoring functioning of after lost keystore 17.6
    • session-based application contexts, accessing 14.3.4.6
  • databases
    • access control
      • password encryption 3.2.1
    • additional security products 1.2
    • authentication 3.4
    • database user and application user 12.2.1
    • default password security settings 3.2.4.5
    • default security features, summary 1.1
    • granting privileges 4.20
    • granting roles 4.20
    • limitations on usage 2.4.1
    • schema-only accounts 3.5
    • security and schemas 12.11
    • security embedded, advantages of 12.2.2
    • security policies based on 15.1.2.1
  • database session-based application contexts 14.3.1
    • See also: application contexts
  • database upgrades and CONNECT role A.14.2.1
  • data definition language (DDL)
  • data dictionary
  • data encryption and integrity parameters
  • data files A.7
    • guidelines for security A.7
  • data manipulation language (DML)
    • privileges controlling 4.16.1
  • DATAPUMP_EXP_FULL_DATABASE role 4.11.2
  • DATAPUMP_IMP_FULL_DATABASE role 4.11.2
  • data security
    • encryption, problems not solved by 19.2.3
  • DB_DEVELOPER_ROLE role
  • DBA_CONTAINER_DATA data dictionary view 4.10.6.1
  • DBA_ROLE_PRIVS view
    • application privileges, finding 12.8
  • DBA_ROLES data dictionary view
  • DBA role
  • DBFS_ROLE role 4.11.2
  • DBJAVASCRIPT role 4.11.2
  • DBMS_CREDENTIAL.CREATE_CREDENTIAL procedure 12.5.4
  • DBMS_CREDENTIAL package 3.6.2, 4.13.3
  • DBMS_CRYPTO
    • FIPS-supported cipher suites C.2.7
  • DBMS_CRYPTO package
    • asymmetric key operations 19.5
    • data encryption storage 19.4
    • examples 19.6.1
    • supported cryptographic algorithms 19.4
  • DBMS_CRYPTO PL/SQL package
    • enabling for FIPS 140-2 C.3.2
  • DBMS_FGA package
  • DBMS_MDX_INTERNAL role 4.11.2
  • DBMS_NETWORK_ACL_ADMIN.REMOVE_HOST_ACE procedure 10.5.4
  • DBMS_PRIVILEGE_CAPTURE PL/SQL package 5.2.1
  • DBMS_RLS.ADD_POLICY
  • DBMS_RLS.ADD_POLICY procedure
    • transparent sensitive data protection polices 16.12.2
  • DBMS_SESSION.SET_CONTEXT procedure
  • DBMS_SESSION.SET_IDENTIFIER procedure
    • client session ID, setting 14.4.3
    • DBMS_APPLICATION.SET_CLIENT_INFO value, overwritten by 3.10.2.6
  • DBMS_SESSION package
  • DbNest
  • DBNEST_ENABLE initialization parameter 18.2.5.1
  • DBNEST_PDB_FS_CONF initialization parameter 18.2.5.1
  • DBSFWUSER user account 2.6.2
  • DBSNMP user account
  • DDL
    • See: data definition language
  • debugging
    • Java stored procedures 10.12
    • PL/SQL stored procedures 10.12
  • decryption
    • number strings using DBMS_CRYPTO 19.6.4
  • default command rules
    • ORA_DV_DEFAULT_PROTECTION predefined audit policy for 30.4.10
  • default passwords A.4
    • change_on_install or manager passwords A.4
    • changing, importance of 3.2.4.2
    • finding 3.2.4.2
  • default permissions A.7
  • default profiles
  • default realms
    • ORA_DV_DEFAULT_PROTECTION predefined audit policy for 30.4.10
  • default roles
  • defaults
  • default users
    • accounts A.3
    • Enterprise Manager accounts A.3
    • passwords A.4
  • definers’s rights, database links
  • definer’s rights
    • about 9.2
    • code based access control
      • about 9.7.1
      • granting and revoking roles to program unit 9.7.6
      • how code based access control works 9.7.4
    • compared with invoker’s rights 9.1
    • example of when to use 9.2
    • procedure privileges, used with 9.2
    • procedure security 9.2
    • schema privileges for 9.2
    • secure application roles 12.9.2.1
    • used with Oracle Virtual Private Database functions 15.1.4
    • views 9.6.1
  • definer’s rights, database links
    • grants of INHERIT ANY REMOTE PRIVILEGES 9.8.4
    • grants of INHERIT ANY REMOTE PRIVILEGES on connected user to current user, example 9.8.3
    • grants of INHERIT REMOTE PRIVILEGES to other users 9.8.2
    • revokes of INHERIT [ANY] REMOTE PRIVILEGES 9.8.5
    • revoking INHERIT REMOTE PRIVILEGES from PUBLIC, example 9.8.7
    • revoking INHERIT REMOTE PRIVILEGES on connecting user from procedure owner, example 9.8.6
    • tutorial 9.8.8.1
  • denial of service (DoS) attacks
    • about
  • denial-of-service (DoS) attacks
    • bad packets, preventing 12.13.1
    • networks, securing A.11.2
    • password concurrent guesses 3.2.1
  • Department of Defense Database Security Technical Implementation Guide 3.2.6.4, 3.2.6.5
  • DGPDB_INT user account 2.6.2
  • DGPDB_ROLE role 4.11.2
  • diagnostics
    • DIAGNOSTICS_CONTROL initialization parameter 4.9
    • restricting use to SYSDBA and ENABLE DIAGNOSTICS 4.9
  • dictionary privileges
  • dictionary protection
    • disabling for Oracle-maintained schema 4.15.3
    • enabling for Oracle-maintained schema 4.15.2
  • dictionary tables
  • Diffie-Hellman key negotiation algorithm 21.5
  • DIP user account 2.6.3
  • directories
  • directory authentication, configuring for SYSDBA or SYSOPER access 3.3.2.2
  • directory objects
    • granting EXECUTE privilege on 4.20.1.3
  • direct path load
    • fine-grained auditing effects on 32.1.1
  • disabling unnecessary services
  • dispatcher processes (Dnnn)
    • limiting SGA space for each session 2.4.2.5
  • distributed databases
  • DML
    • See: data manipulation language
  • driving context 14.6
  • DROP PROFILE statement
  • DROP ROLE statement
  • DROP USER statement
    • about 2.5.3
    • schema objects of dropped user 2.5.4
  • dsi.ora file
  • DV_ACCTMGR role 4.11.2
  • DV_ADMIN role 4.11.2
  • DV_AUDIT_CLEANUP role 4.11.2
  • DV_DATAPUMP_NETWORK_LINK role 4.11.2
  • DV_GOLDENGATE_ADMIN role 4.11.2
  • DV_GOLDENGATE_REDO_ACCESS role 4.11.2
  • DV_MONITOR role 4.11.2
  • DV_OWNER role 4.11.2
  • DV_PATCH_ADMIN role 4.11.2
  • DV_POLICY_OWNER role 4.11.2
  • DV_ role 4.11.2
  • DV_SECANALYST role 4.11.2
  • DV_STREAMS_ADMIN role 4.11.2
  • DV_XSTREAMS_ADMIN role 4.11.2
  • DVF schema
    • ORA_DV_SCHEMA_CHANGES predefined audit policy for 30.4.9
  • DVSYS schema
    • ORA_DV_SCHEMA_CHANGES predefined audit policy for 30.4.9
  • dynamic Oracle Virtual Private Database policy types 15.3.8.2
  • DYNAMIC policy type 15.3.8.2

E

  • editions
    • application contexts, how affects 14.1.5
    • fine-grained auditing packages, results in 14.4.6.2
    • global application contexts, how affects 14.4.6.2
    • Oracle Virtual Private Database packages, results in 14.4.6.2
  • EJBCLIENT role 4.11.2
  • email alert example 32.4.1
  • enable_fips.py script C.2.5
  • encrypting information in 17.1
  • encryption
  • encryption and checksumming
  • encryption of data dictionary sensitive data 17.1
  • ENFORCE_CREDENTIAL configuration parameter
    • security guideline A.12
  • enterprise directory service 4.11.4.6
  • enterprise roles 4.11.4.6
  • enterprise user management 12.2.1
  • enterprise users
    • global role, creating 4.11.4.6
    • One Big Application User authentication, compromised by 12.2.1
    • Oracle SQL Firewall 13.3.5
    • proxy authentication 3.10.1.1
    • shared schemas, protecting users 12.11.2
  • Enterprise User Security
    • application context, globally initialized 14.3.11.3
    • proxy authentication
      • Oracle Virtual Private Database, how it works with 15.5.10
  • error messages
  • errors
  • example, basic 31.4.6.3
  • example, comparison 31.4.6.4
  • examples 15.4
    • See also: tutorials
    • access control lists
      • external network connections 10.7
      • wallet access 10.7
    • account locking 3.2.4.8
    • auditing GRANT operations 31.4.4.7
    • auditing REVOKE operations 31.4.4.7
    • auditing user SYS 31.4.2.5
    • audit trail, purging unified trail 33.3.6
    • data encryption
      • encrypting and decrypting BLOB data 19.6.3
      • encrypting and decrypting procedure with AES 256-Bit 19.6.2
    • decrypting a number using DBMS_CRYPTO 19.6.4
    • directory objects, granting EXECUTE privilege on 4.20.1.3
    • encrypting a number using DBMS_CRYPTO 19.6.4
    • encrypting procedure 19.6.1
    • Java code to read passwords 12.4.4
    • locking an account with CREATE PROFILE 3.2.4.8
    • login attempt grace period 3.2.4.14
    • nondatabase user authentication 14.4.6.7
    • passwords
    • privileges
    • procedure privileges affecting packages 4.18.5.2, 4.18.5.3
    • profiles, assigning to user 2.2.9
    • roles
    • secure external password store 3.2.9.2
    • session ID of user
    • system privilege and role, granting 4.20.1.2
    • tablespaces
    • type creation 4.19.5
    • users
  • exceptions
    • WHEN NO DATA FOUND, used in application context package 14.3.9.3
    • WHEN OTHERS, used in triggers
      • development environment (debugging) example 14.3.8
      • production environment example 14.3.7
  • Exclusive Mode
    • SHA-2 password hashing algorithm, enabling 3.2.8.2
  • EXECUTE_CATALOG_ROLE role
    • SYS schema objects, enabling access to 4.6.3.2
  • EXECUTE ANY LIBRARY statement
    • security guidelines A.3
  • EXEMPT ACCESS POLICY privilege
    • Oracle Virtual Private Database enforcements, exemption 15.5.7.2
  • EXP_FULL_DATABASE role
  • expiring a password
  • exporting data
    • direct path export impact on Oracle Virtual Private Database 15.5.7.2
    • policy enforcement 15.5.7.2
  • extended data objects
    • views and Virtual Private Database 15.3.2
  • external network services
    • enabling listener for 10.5.2
  • external network services, fine-grained access to
    • See: access control list (ACL)
  • external network services, syntax for 10.5.1
  • external procedures
    • configuring extproc process for 12.5.4
    • credentials 12.5.1
    • DBMS_CREDENTIAL.CREATE_CREDENTIAL procedure 12.5.4
    • legacy applications 12.5.5
    • security guideline A.12
  • external roles 4.11.3.4
  • external tables A.7
  • extproc process

F

  • failed login attempts
  • fallback authentication, Kerberos 25.6
  • Fast Ingest
    • Oracle SQL Firewall, used for 13.2.3.3
  • Federal Information Processing Standard (FIPS)
    • DBMS_CRYPTO package C.3.2
    • FIPS 140-2
      • postinstallation checks C.4
      • SQLNET.FIPS_140 C.3.4
      • SSLFIPS_140 C.3.3
      • SSLFIPS_LIB C.3.3, C.3.4
      • verifying connections for DBMS_CRYPTO C.5.4
      • verifying connections for network native encryption C.5.3
      • verifying connections for TLS C.5.2
      • verifying connections when using FIPS_140 parameter C.5.1
    • Transparent Data Encryption C.3.2
  • files
    • BFILEs
      • operating system access, restricting A.7
    • BLOB 19.3.6
    • keys 19.3.4.3
    • listener.ora file
    • restrict listener access A.11.2
    • server.key encryption file A.11.3
    • symbolic links, restricting A.7
    • tnsnames.ora A.11.3
  • fine-grained access control
    • See: Oracle Virtual Private Database (VPD)
  • fine grained auditing
    • Data Redaction
      • schema system privileges 4.8.1
    • schema system privileges 4.8.1
  • fine-grained auditing
  • FIPS
    • weaker deprecated algorithm keys C.6
  • FIPS_140 parameter
  • fips.ora file C.2.2, C.3.4
  • FIPS 140-2
    • approved DBMS_CRYPTO cipher suites C.2.7
    • approved network native encryption algorithms C.2.9
    • approved TDE algorithms C.2.6
    • approved TLS cipher suites C.2.8
  • FIPS 140-2 cryptographic libraries
  • firewalls
  • flashback query
    • Oracle Virtual Private Database, how it works with 15.5.6
  • forcetcp parameter in krb5.conf 25.2.6.4
  • foreign keys
    • privilege to use parent key 4.16.2
  • FTP protocol messages, auditing 31.8.8.1
  • FTP service A.11.2
  • functions

G

  • GATHER_SYSTEM_STATISTICS role 4.11.2
  • GDS_CATALOG_SELECT role 4.11.2
  • GLOBAL_AQ_USER_ROLE role 4.11.2
  • GLOBAL_EXTPROC_CREDENTIAL configuration parameter
  • global application contexts 14.4.1
    • See also: application contexts
  • global authorization
  • global roles 4.11.3.4
  • grace period for login attempts
  • grace period for password expiration 3.2.4.14
  • gradual database password rollover
    • about 3.2.5.1
    • actions permitted during 3.2.5.7
    • changing password during rollover period 3.2.5.5
    • changing password to begin rollover period 3.2.5.4
    • enabling 3.2.5.3
    • finding users who use old passwords 3.2.5.12
    • manually ending the password before rollover period 3.2.5.6
    • Oracle Data Guard 3.2.5.11
    • Oracle Data Pump exports 3.2.5.10
    • password change life cycle 3.2.5.2
    • passwords, compromised 3.2.5.9
    • server behavior after rollover ends 3.2.5.8
  • GRANT ALL PRIVILEGES statement
    • SELECT ANY DICTIONARY privilege, exclusion of A.7
  • GRANT ANY PRIVILEGE system privilege 4.6.2
  • GRANT CONNECT THROUGH clause
    • consideration when setting FAILED_LOGIN_ATTEMPTS parameter 3.2.4.3
    • for proxy authorization 3.10.1.5
  • granting privileges and roles
  • GRANT statement 4.20.1.1
  • GRAPH_ADMINISTR ATOR role 4.11.2
  • GRAPH_DEVELOPER role 4.11.2
  • GRAPH_USER role 4.11.2
  • GSM_OGG_CAPTURE role 4.11.2
  • GSM_POOLADMIN_ROLE role 4.11.2
  • GSMADMIN_ROLE role 4.11.2
  • GSMCATUSER_ROLE role 4.11.2
  • GSMROOTUSER_ROLE role 4.11.2
  • GSMROOTUSER user account 2.6.2
  • GSMUSER_ROLE role 4.11.2
  • guidelines
    • handling compromised passwords 3.2.5.9
  • guidelines for security
    • auditing A.13
    • custom installation A.9
    • data files and directories A.7
    • encrypting sensitive data A.7
    • guidelines for security
      • custom installation A.9
    • installation and configuration A.9
    • networking security A.11
    • operating system accounts, limiting privileges A.7
    • operating system users, limiting number of A.7
    • ORACLE_DATAPUMP access driver A.8
    • Oracle home default permissions, disallowing modification A.7
    • passwords A.4
    • PDBs A.10
    • products and options
      • install only as necessary A.9
    • sample schemas A.9
    • Sample Schemas
      • remove or relock for production A.9
      • test database A.9
    • symbolic links, restricting A.7
    • Transport Layer Security
    • user accounts and privileges A.3
    • Windows installations A.5

H

  • hackers
    • See: security attacks
  • how it works 6.1.2
  • HS_ADMIN_EXECUTE_ROLE role
  • HS_ADMIN_ROLE role
  • HS_ADMIN_SELECT_ROLE role
  • HTTP authentication
    • See: access control lists (ACL), wallet access
  • HTTP protocol messages, auditing 31.8.8.1
  • HTTPS
    • port, correct running on A.11.3
  • HTTP verifier removal A.4

I

  • IMP_FULL_DATABASE role
  • INACTIVE_ACCOUNT_TIME profile parameter 3.2.4.6
  • inactive user accounts, locking automatically 3.2.4.6
  • indexed data
  • indirectly granted roles 4.11.1.2
  • INHERIT ANY PRIVILEGES privilege
  • INHERIT ANY REMOTE PRIVILEGES 9.8.1
  • INHERIT PRIVILEGES privilege
  • INHERIT REMOTE PRIVILEGES
  • initialization parameter file
    • parameters for clients and servers using Kerberos 25.1.5
    • parameters for clients and servers using RADIUS 27.4.1
  • initialization parameters
  • initial ticket, defined 25.2.9
  • INSERT privilege
  • installation
    • guidelines for security A.9
  • intruders
    • See: security attacks
  • invoker’s rights
    • about 9.3
    • code based access control
      • about 9.7.1
      • granting and revoking roles to program unit 9.7.6
      • how code based access control works 9.7.3
      • tutorial 9.7.7
    • compared with definer’s rights 9.1
    • controlled step-in 9.3
    • procedure privileges, used with 9.2
    • procedure security 9.3
    • secure application roles 12.9.2.1
    • secure application roles, requirement for enabling 12.9.2.1
    • security risk 9.5.1
    • views
      • about 9.6.1
      • finding user who invoked invoker’s right view 9.6.3
  • IP addresses

J

  • JAVA_ADMIN role 4.11.2
  • JAVA_RESTRICT initialization parameter
    • security guideline A.7
  • java.security file C.2.4
  • JAVADEBUGPRIV role 4.11.2
  • Java Debug Wire Protocol (JDWP)
    • network access for debugging operations 10.12
  • JAVAIDPRIV role 4.11.2
  • Java schema objects
  • Java stored procedures
    • network access for debugging operations 10.12
  • JAVASYSPRIV role 4.11.2
  • JAVAUSERPRIV role 4.11.2
  • JDBC connections
    • JDBC/OCI proxy authentication 3.10.1.1
    • JDBC Thin Driver proxy authentication
  • JDeveloper
    • debugging using Java Debug Wire Protocol 10.12
  • JMXSERVER role 4.11.2

K

  • Kerberos 23.4.1
    • authentication adapter utilities 25.3
    • authentication fallback behavior 25.6
    • authentication in Oracle Database 25.1.6
    • components 25.1.1
    • configuring authentication 25.2, 25.2.6.1
    • configuring for database server 25.2.2
    • configuring for Windows Server Domain Controller KDC 25.5
    • connecting to database 25.4
    • how Oracle Database works with 25.1.4
    • interoperability with Windows Server Domain Controller KDC 25.5.1
    • Kerberos server (KDC) 25.1.3
    • kinstance 25.2.2
    • kservice 25.2.2
    • Oracle Database parameters 25.1.5
    • realm 25.2.2
    • sqlnet.ora file sample 21.3.2
    • system requirements 23.6
    • tickets
  • Kerberos authentication 3.7.1.3
    • configuring for SYSDBA or SYSOPER access 3.3.2.3
    • password management A.4
  • Kerberos Key Distribution Center (KDC) 25.5
  • key generation
  • key storage
  • key transmission
  • kinstance (Kerberos) 25.2.2
  • krb5.conf
    • configuring TCP or UDP connection 25.2.6.4
  • kservice (Kerberos) 25.2.2

L

  • large objects (LOBs)
  • LBAC_DBA role 4.11.2
  • LBACSYS.ORA_GET_AUDITED_LABEL function
  • LBACSYS schema
    • ORA_DV_SCHEMA_CHANGES predefined audit policy for 30.4.9
  • LBACSYS user account 2.6.2
  • ldap.ora
    • which directory SSL port to use for no authentication 22.3.8.5.4
  • ldap.ora file
  • least privilege principle A.3
    • about A.3
    • granting user privileges A.3
    • middle-tier privileges 3.10.1.9
  • libraries
  • lightweight users
    • example using a global application context 14.4.8.1
    • Lightweight Directory Access Protocol (LDAP) 15.4.2.9
  • listener
    • not an Oracle owner A.11.2
    • preventing online administration A.11.2
    • restrict privileges A.11.2
    • secure administration A.11.2
  • listener.ora file
  • lists data dictionary
    • See: views
    • data dictionary views
      • See: views
    • granting privileges and roles
      • finding information about 4.26.1
    • privileges
      • finding information about 4.26.1
    • roles
      • finding information about 4.26.1
    • views
  • LOB_SIGNATURE_ENABLE initialization parameter 12.6.1
  • LOBs
  • local privilege grants
  • local privileges
  • local roles 4.2.3, 4.12.9
  • local user accounts
  • local users
  • lock and expire
    • default accounts A.3
    • predefined user accounts A.3
  • lockdown profiles
  • lockdown profiles, PDB 4.13.1
  • locking inactive user accounts automatically 3.2.4.6
  • log files
    • owned by trusted user A.7
  • logical reads limit 2.4.2.4
  • logon triggers
    • externally initialized application contexts 14.3.5
    • for application context packages 14.3.5
    • running database session application context package 14.3.5
    • secure application roles 4.11.8
  • LOGSTDBY_ADMINISTRATOR role 4.11.2

M

  • malicious database administrators 19.2.2
    • See also: security attacks
  • manager default password A.4
  • managing roles with RADIUS server 27.5.8
  • materialized views
  • MD5 message digest algorithm 21.4
  • MDDATA user account 2.6.3
  • MDSYS user account 2.6.2
  • memory
  • MERGE INTO statement, affected by DBMS_RLS.ADD_POLICY statement_types parameter 15.3.4
  • metadata links
  • methods
    • privileges on 4.19
  • Microsoft Active Directory services 6.1.3, 6.1.4, 6.1.5, 6.2.1, 6.2.2.1, 6.2.2.5, 6.2.2.7.2, 6.2.2.7.3
    • about configuring connection 6.2.2.7.1
    • about password authentication 6.3.1.1
    • access, Kerberos authentication 6.3.3
    • access, PKI authentication 6.3.4
    • access configuration, Oracle wallet verification 6.2.2.8
    • access configuration, testing integration 6.2.2.9
    • account policies 6.5
    • administrative user configuration, exclusive mapping 6.4.6.2
    • administrative user configuration, shared access accounts 6.4.6.1
    • dsi.ora file, about 6.2.2.4.2
    • dsi.ora file, compared with ldap.ora 6.2.2.4.1
    • extending Active Directory schema 6.2.2.2
    • ldap.ora file, about 6.2.2.4.4
    • ldap.ora file, compared with dsi.ora 6.2.2.4.1
    • ldap.ora file, creating 6.2.2.4.3, 6.2.2.4.5
    • logon user name with password authentication 6.3.1.3
    • multitenant users, how affected 6.1.6
    • user authorization, about 6.4.1
    • user authorization, mapping Directory user group to global role 6.4.3
    • user authorization, verifying 6.4.7
    • user management, altering mapping definition 6.4.5
    • user management, exclusively mapping Directory user to database global user 6.4.4
    • user management, mapping group to shared global user 6.4.2
    • user management, migrating mapping definition 6.4.5
  • Microsoft Active Directory services integration 6.1.1, 6.1.2, 6.1.7
  • Microsoft Active Directory services proxy authentication 6.3.2.3
  • Microsoft Directory Access services 6.2.2.7.4
  • Microsoft Entra ID token
    • checking version of 8.7.3
  • Microsoft Windows
    • Kerberos
      • configuring for Windows Server Domain Controller KDC 25.5
  • middle-tier systems
  • mining models
  • mkstore utility
    • createALO command B.7.2
    • create command B.7.1
    • createCredential command B.7.3
    • createEntry command B.7.4
    • createUserCredential command B.7.5
    • delete command B.7.6
    • deleteCredential command B.7.7
    • deleteEntry command B.7.8
    • deleteSSO command B.7.9
    • deleteUserCredential command B.7.10
    • list command B.7.11
    • listCredential command B.7.12
    • modifyCredential command B.7.13
    • modifyEntry command B.7.14
    • modifyUserCredential command B.7.15
    • SQL*Loader object store credentials 3.2.9.7
    • viewEntry command B.7.16
  • monitoring user actions 29.1
    • See also: auditing, standard auditing, fine-grained auditing
  • multiplex multiple-client network sessions A.11.2
  • multitenant container database (CDB)
    • See: CDBs
  • multitenant option
    • centrally managed users, how affected 6.1.6
    • Oracle SQL Firewall 13.3.7
  • My Oracle Support
    • security patches, downloading A.2.1
    • user account for logging service requests 2.6.3

N

  • native network encryption
    • checking if enabled in surrent session 21.7.1
    • compared with Transport Layer Security 21.1.3
    • FIPS library location setting (SSLFIPS_LIB) C.3.4
    • FIPS mode setting (FIPS_140) C.3.4
    • troubleshooting 21.7
  • native network encryption and integrity
  • native network enryption
  • Net8
    • See: Oracle Net
  • network authentication
    • guidelines for securing A.4
    • roles, granting using 4.23.1
    • smart cards A.4
    • token cards A.4
    • X.509 certificates A.4
  • network connections
  • network encryption
  • network IP addresses
    • guidelines for security A.11.2
  • network native encryption
    • FIPS-supported algorithms C.2.9
  • network traffic encryption A.11.2
  • nondatabase users 14.4.2
    • See also: application contexts, client identifiers

O

  • object privileges 4.14.1, A.3
    • See also: schema object privileges
  • objects
    • applications, managing privileges in 12.12
    • granting privileges 12.12.2
    • privileges
    • protecting in shared schemas 12.11.2
    • protecting in unique schemas 12.11.1
    • SYS schema, access to 4.6.3.2
  • object types
  • OEM_ADVISOR role 4.11.2
  • OEM_MONITOR role 4.11.2
  • OGG_APPLY_PROCREP role 4.11.2
  • OGG_APPLY role 4.11.2
  • OGG_SHARED_CAPTURE role 4.11.2
  • OJVMSYS user account 2.6.2
  • okcreate
    • Kerberos adapter utility 25.3
  • okcreate options 25.3.4
  • okdstry
    • Kerberos adapter utility 25.3
  • okdstry options 25.3.3
  • okinit
    • Kerberos adapter utility 25.3
  • okinit utility options 25.3.1
  • oklist
    • Kerberos adapter utility 25.3
  • OLAPSYS user account 2.6.2
  • One Big Application User authentication
    • See: nondatabase users
  • openssl utility
    • creating PKCS#12 wallet with B.3.2
  • operating system
    • audit files written to 33.1.5
  • operating systems 3.6.1
  • operating system users
    • configuring for PDBs 3.6.3
    • setting default credential 3.6.4
  • OPTIMIZER_PROCESSING_RATE role 4.11.2
  • ORA_ACCOUNT_MGMT predefined unified audit policy 30.4.4
  • ORA_ALL_TOPLEVEL_ACTIONS predefined unified audit policy 30.4.6.2
  • ORA_CIS_RECOMMENDATIONS predefined unified audit policy 30.4.5
  • ORA_DATABASE_PARAMETER predefined unified audit policy 30.4.3
  • ORA_DV_DEFAULT_PROTECTION predefined unified audit policy 30.4.10
  • ORA_DV_SCHEMA_CHANGES predefined unified audit policy 30.4.9
  • ORA_LOGIN_LOGOUT predefined unified audit policy 30.4.6.3
  • ORA_OLS_SCHEMA_CHANGES predefined unified audit policy 30.4.11
  • ORA_SECURECONFIG predefined unified audit policy 30.4.2
  • ORA_STIG_PROFILE profile 3.2.6.4
  • ORA_STIG_RECOMMENDATIONS predefined unified audit policy 30.4.6.1
  • ORA$DEPENDENCY profile 5.1.6
  • ORA$DICTIONARY_SENS_COL_ACCESS predefined unified audit policy 30.4.7
  • ORA-01017 errors in Oracle Cloud Infrastructure-IAM integration 7.8.3
  • ORA-01017 errors in Oracle DBaaS-IAM integration
    • client-side 7.8.1
    • IAM administrator actions to remedy 7.8.6
    • IAM user configurations 7.8.4
  • ORA-01720 error 4.17.1
  • ORA-01741 error 32.2.1
  • ORA-01994 2.3.4.1
  • ORA-03114 error 7.8.5, 8.7.2
  • ORA-06512 error 10.12, 32.4.6
  • ORA-06598 error 9.5.2
  • ORA-12008 error 32.2.1
  • ORA-12599 error 7.8.5, 8.7.2
  • ORA-1536 error 2.2.7.3
  • ORA-24247 error 10.4, 10.12, 32.4.6
  • ORA-28017 error 2.3.4.1
  • ORA-28040 error 3.2.8.3, 3.4.1
  • ORA-28046 error 2.3.4.1
  • ORA-28575 error 12.5.3
  • ORA-29024 error 10.6.6
  • ORA-45622 errors 16.6.6.2
  • ORA-64219: invalid LOB locator encountered 12.6.1
  • ORACLE_DATAPUMP access driver
    • guidelines for security A.8
  • ORACLE_OCM user account 2.6.3
  • Oracle Advanced Security
    • checksum sample for sqlnet.ora file 21.3.2
    • encryption sample for sqlnet.ora file 21.3.2
    • network authentication services A.4
    • TLS features 26.1
    • user access to application schemas 12.11.2
  • Oracle Audit Vault and Database Firewall
    • schema-only accounts 3.5.1
  • Oracle Autonomous Database
    • centrally managed users 6.6
  • Oracle Call Interface (OCI)
    • application contexts, client session-based 14.5.1
    • proxy authentication 3.10.1.1
      • Oracle Virtual Private Database, how it works with 15.5.10
    • proxy authentication with real user 3.10.1.8
    • security-related initialization parameters 12.13
  • Oracle Connection Manager
    • securing client networks with A.11.2
  • Oracle Database Enterprise User Security
    • password security threats 3.2.8.1
  • Oracle Database Real Application Clusters
  • Oracle Database Real Application Security
  • Oracle Database-to-Entra ID authorizations
  • Oracle Database-to-IAM
    • trace files for client side 8.7.1.2
  • Oracle Database-to-Microsoft Azure Active Directory client connections
  • Oracle Database-to-Microsoft Azure Entra ID
    • creating Entra ID app roles 8.2.4.1
  • Oracle Database-to-Microsoft Entra ID
    • about 8.1.1
    • architecture 8.1.2
    • assigning app role to service principal 8.2.4.3
    • assigning users and groups to Entra ID app roles 8.2.4.2
    • configuring v2 tokens 8.2.3
    • Entra ID token, checking version of 8.7.3
    • exclusive mapping between database schema and Azure user 8.3.1
    • mapping Oracle roles with Entra ID roles 8.3.3
    • on-premises requirements 8.2.1
    • operational flow 8.4.2
    • Oracle schema-to-Entra ID application role mapping 8.3.2
    • registering database instance to Microsoft Azure tenancy 8.2.2
    • trace files for client, levels 8.7.1.1
    • trace files for client, setting 8.7.1.2
    • use cases 8.1.4
    • user and group mappings 8.1.3, 8.1.5
  • Oracle Database-to-Microsoft Entra ID client connections
    • about 8.4.1
    • confidential client registration 8.4.4.1
    • configuring to work with Entra ID token 8.4.5.1
    • creating a client app registration 8.4.4.2
    • direct token retrievals 8.4.5.2
    • enabling client to retrieve token from file location 8.4.5.3
    • examples of retrieving OAuth2 tokens 8.4.6.1
    • example using Python script for MSAL library 8.4.6.2
    • net naming for Azure 8.4.8
    • net naming for IAM 7.5.3
    • network proxy for default database 8.4.7.3
    • network proxy for Oracle Real Application Clusters 8.4.7.4
    • network proxy for Windows 8.4.7.5
    • public client registration 8.4.4.1
    • requesting tokens using Azure CLI 8.4.6.4
    • retrieving token using Entra ID CLI 8.4.6.3
    • secrets for Azure 8.4.8
    • secrets for IAM 7.5.3
    • supported drivers 8.4.3
    • testing Azure endpoint accessibility 8.4.7.2
  • Oracle Database Vault
  • Oracle Data Guard
    • gradual database password rollover 3.2.5.11
    • SYSDG administrative privilege 4.5.6
  • Oracle Data Pump
  • Oracle DBaaS client connections
    • supported drivers 7.5.2
  • Oracle DBaaS-to-Entra ID proxy authentication
  • Oracle DBaaS-to-IAM
    • about 7.1.1, 7.5.1
    • about token requests using passwords or SEPS 7.5.5.1
    • architecture 7.1.2
    • cross-tenancy, about 7.6.1
    • cross-tenancy access examples 7.6.2.3
    • database clients for cross-tenancy access 7.6.4
    • parameters for setting password or SEPS token requests 7.5.5.2
    • requesting cross-tenancy tokens 7.6.5
    • trace files for client side 7.8.2
    • troubleshooting client side 7.8.2
  • Oracle DBaaS-to-IAM authorizations
    • about 7.2.2.1
    • altering 7.2.2.5
    • creating IAM database password 7.3.2
    • creating policies for authenticating users 7.3.1
    • enabling 7.2.1
    • IAM group to database global role 7.2.2.3
    • IAM user to database global user 7.2.2.4
    • instance principals 7.2.2.6
    • mapping schemas and roles to users and groups in another tenancy 7.6.3
    • migrating 7.2.2.5
    • resource principals 7.2.2.6
    • shared database global user 7.2.2.2
    • source user tenancy 7.6.2.1
    • target database resource tenancy 7.6.2.2
    • token requested by IAM user name and password 7.5.5.4
    • token requested by IAM user name and secure external password store (SEPS) 7.5.5.3
    • user authorization, verifying 7.2.2.7
  • Oracle DBaaS-to-IAM client connections
  • Oracle DBaaS-to-IAM connections
    • about 7.1.3
    • connection pools using instance or resource principals 7.4
    • database links 7.7
    • direct token retrievals 7.5.8
    • walletless connections 7.5.7
  • Oracle DBaaS-to-IAM proxy authentication
  • Oracle DBaaS-to-Power BI SSO
  • Oracle Developer Tools For Visual Studio (ODT)
    • debugging using Java Debug Wire Protocol 10.12
  • Oracle E-Business Suite
    • schema-only accounts 3.5.1
  • Oracle Enterprise Manager
  • Oracle Flashback Data Archive
    • Oracle Virtual Private Database 15.5.9
  • Oracle home
    • default permissions, disallowing modification A.7
  • Oracle Internet Directory
  • Oracle Internet Directory (OID)
    • SYSDBA and SYSOPER access, controlling 3.3.2.1
    • Transport Layer Security authentication 26.2
  • Oracle Java Virtual Machine
    • JAVA_RESTRICT initialization parameter security guideline A.7
  • Oracle Java Virtual Machine (OJVM)
    • permissions, restricting A.3
  • Oracle Label Security
  • Oracle Label Security (OLS)
    • Oracle Virtual Private Database, using with 15.5.7.1
  • Oracle Machine Learning for SQL
  • OracleMetaLink
    • See: My Oracle Support
  • Oracle native encryption
  • Oracle Net
  • Oracle parameters
    • authentication 28.4
  • Oracle RAC
  • Oracle Real Application Clusters
    • components that need certificates 22.4.1.3.1
    • global application contexts 14.4.4
    • SYSRAC administrative privilege 4.5.8
  • Oracle Real Application Security
    • auditing internal predicates in policies 31.4.4.14
    • Oracle SQL Firewall 13.3.4
  • Oracle Recovery Manager
  • Oracle Scheduler
    • excluding from Oracle SQL Firewall 13.3.2
    • sensitive credential data
      • about 17.1
      • data dictionary views 17.7
      • deleting 17.5
      • encrypting 17.3
      • multitenant environment 17.2
      • rekeying 17.4
      • restoring functioning of lost keystore 17.6
  • Oracle SQL*Loader
    • Direct Load Path audit events 31.8.7.2
  • Oracle SQL Firewall
  • Oracle Technology Network
  • Oracle Virtual Private Database
    • exporting data using Data Pump Export 15.5.8
    • Oracle Flashback Data Archive 15.5.9
    • Oracle SQL Firewall 13.3.6
  • Oracle Virtual Private Database (VPD)
  • Oracle Virtual Private Datebase (VPD)
    • predicates
      • audited in fine-grained audit policies 32.1.4
      • audited in unified audit policies 31.4.4.14
  • Oracle wallets
  • orapki
    • running in FIPS mode C.2.3
  • orapki utility
    • adding a certificate request to a wallet with B.4.2
    • adding a root certificate to a wallet with B.4.5
    • adding a trusted certificate to a wallet with B.4.5
    • adding certificate to wallet B.4.13.1
    • adding user certificates to a wallet with B.4.8
    • adding user-supplied certificate to wallet B.4.13.1
    • cert create command B.6.1
    • cert display command B.6.2
    • certificate revocation lists 22.3.8.5.1
    • changing the wallet password with B.3.8
    • converting wallet to use AES256 algorithm B.3.9
    • creating a local auto-login wallet with B.3.5
    • creating an auto-login only wallet with B.3.4
    • creating an auto-login wallet with B.3.6
    • creating a wallet with B.3.1
    • creating SHA-2 certificates for testing B.4.4
    • creating signed certificates for testing B.4.3
    • crl delete command B.6.3
    • crl display command B.6.4
    • crl hash command B.6.5
    • crl list command B.6.6
    • crl upload command B.6.7
    • examples B.5
    • exporting a certificate from a wallet with B.4.13.2
    • exporting a certificate request from a wallet with B.4.13.2
    • importing a wallet with B.3.3
    • managing certificate revocation lists B.4.14
    • secretstore create_credential command B.6.8
    • secretstore create_entry command B.6.9
    • secretstore create_user_credential command B.6.10
    • secretstore delete_credential command B.6.11
    • secretstore delete_entry command B.6.12
    • secretstore delete_user_credential command B.6.13
    • secretstore list_credentials command B.6.14
    • secretstore list_entries_unsorted command B.6.16
    • secretstore list_entries command B.6.15
    • secretstore modify_credential command B.6.17
    • secretstore modify_entry command B.6.18
    • secretstore modify_user_credential command B.6.19
    • syntax B.2.2
    • viewing a certificate with B.4.11
    • viewing a wallet with B.3.7
    • wallet add command B.6.20
    • wallet change_pwd command B.6.21
    • wallet convert command B.6.22
    • wallet create command B.6.23
    • wallet delete command B.6.24
    • wallet display command B.6.25
    • wallet export_private_key command B.6.27
    • wallet export command B.6.26
    • wallet import_pkcs12 command B.6.28
    • wallet import_private_key command B.6.29
    • wallet jks_to_pkcs12 command B.6.30
    • wallet pkcs12_to_jks command B.6.31
    • wallet remove command B.6.32
  • ORAPWD utility
  • ORDDATA user account 2.6.2
  • ORDPLUGINS user account 2.6.2
  • ORDSYS user account 2.6.2
  • OS_AUTHENT_PREFIX parameter 28.4.2
  • OS_ROLES initialization parameter
  • OSAK_ADMIN_ROLE role 4.11.2
  • outer join operations
    • Oracle Virtual Private Database affect on 15.5.3
  • OUTLN user account 2.6.2

P

Q

R

S

  • SAGA_ADM_ROLE role 4.11.2
  • SAGA_CONNECT_ROLE role 4.11.2
  • SAGA_PARTICIPANT_ROLE role 4.11.2
  • salt 3.2.8.1
  • Sarbanes-Oxley Act
    • auditing to meet compliance 29.1
  • SCHEDULER_ADMIN role
  • schema-independent users 12.11.2
  • schema object privileges 4.14.1
  • schema objects
  • schema-only accounts 3.5
  • schema privileges
    • about 4.7.1
    • ADMINISTER FINE GRAINED AUDIT POLICY system privilege 4.8.1
    • ADMINISTER REDACTION POLICY system privilege 4.8.1
    • ADMINISTER ROW LEVEL SECURITY POLICY system privilege 4.8.1
    • administrative privileges excluded from 4.7.2
    • granting 4.7.3
    • revoking 4.7.4
    • system privileges excluded from 4.7.2
    • system privileges for security policies, about 4.8.1
    • system privileges for security policies, granting 4.8.2
    • system privileges for security policies, revoking 4.8.3
    • tutorial using privilege analysis 5.6
  • schemas
    • auditing, recommended settings for A.13.5
    • shared, protecting objects in 12.11.2
    • unique 12.11
    • unique, protecting objects in 12.11.1
  • schema user accounts, predefined 2.6.1
  • SCOTT user account
    • restricting privileges of A.6
  • SEC_MAX_FAILED_LOGIN_ATTEMPTS initialization parameter 12.13.3
  • SEC_PROTOCOL_ERROR_FURTHER_ACTION initialization parameter 12.13.2
  • sec_relevant_cols_opt parameter 15.3.6.5
  • SEC_RETURN_SERVER_RELEASE_BANNER initialization parameter 12.13.4
  • SEC_USER_AUDIT_ACTION_BANNER initialization parameter 12.13.5
  • SEC_USER_UNAUTHORIZED_ACCESS_BANNER initialization parameter 12.13.5
  • secconf.sql script
  • secret key
  • secure application roles
  • secure external password store
  • Secure Sockets Layer on Oracle RAC
    • remote client, testing configuration 22.4.1.8
  • SecurID 27.3.1.2
  • security A.3
    • See also: security risks
    • application enforcement of 4.11.1.3
    • default user accounts
      • locked and expired automatically A.3
      • locking and expiring A.3
    • domains, enabled roles and 4.11.5.1
    • enforcement in application 12.2.2
    • enforcement in database 12.2.2
    • multibyte characters in role names 4.11.3.1
    • multibyte characters in role passwords 4.11.4.1
    • passwords 3.4.1
    • policies
    • procedures enhance 9.2
    • products, additional 1.2
    • roles, advantages in application use 12.8
  • security alerts A.2.1
  • security attacks 3.10.1.7
    • See also: security risks
    • access to server after protocol errors, preventing 12.13.2
    • application context values, attempts to change 14.3.3.2
    • application design to prevent attacks 12.4
    • command line recall attacks 12.4.1.1, 12.4.1.4
    • denial of service A.11.2
    • denial-of-service
    • denial-of-service attacks through listener A.11.2
    • disk flooding, preventing 12.13.1
    • eavesdropping A.11.1
    • encryption, problems not solved by 19.2.2
    • falsified IP addresses A.11.1
    • falsified or stolen client system identities A.11.1
    • hacked operating systems or applications A.11.1
    • intruders 19.2.2
    • password cracking 3.2.1
    • password protections against 3.2.1
    • preventing malicious attacks from clients 12.13
    • preventing password theft with proxy authentication and secure external password store 3.10.1.7
    • session ID, need for encryption 14.4.7.3.2
    • shoulder surfing 12.4.1.4
    • SQL injection attacks 12.4.1.2
    • unlimited authenticated requests, preventing 12.13.3
    • user session output, hiding from intruders 14.3.7
  • security domains
  • security isolation
    • guidelines for A.10
  • security patches
  • security policies
    • See: Oracle Virtual Private Database, policies
  • security risks 3.10.1.7
    • See also: security attacks
    • ad hoc tools 4.11.7.1
    • applications enforcing rather than database 12.2.2
    • application users not being database users 12.2.1
    • bad packets to server 12.13.1
    • database version displaying 12.13.4
    • encryption keys, users managing 19.3.4.4
    • invoker’s rights procedures 9.5.1
    • password files 3.3.5
    • passwords, exposing in programs or scripts 12.4.1.4
    • passwords exposed in large deployments 3.2.9.1
    • positional parameters in SQL scripts 12.4.1.4
    • privileges carelessly granted 4.6.5
    • remote user impersonating another user 4.11.4.5
    • sensitive data in audit trail A.13
    • server falsifying identities A.11.3
    • users with multiple roles 12.10.1
  • security settings scripts
    • password settings
  • Security Technical Implementation Guide (STIG)
    • ORA_ALL_TOPLEVEL_ACTIONS predefined unified audit policy 30.4.6.2
    • ORA_LOGIN_LOGOUT predefined unified audit policy 30.4.6.3
    • ORA_STIG_PROFILE user profile 2.4.4.3
    • ORA_STIG_RECOMMENDATIONS predefined unified audit policy 30.4.6.1
    • ora12c_stig_verify_function password complexity function 3.2.6.6
  • SELECT_CATALOG_ROLE role
    • SYS schema objects, enabling access to 4.6.3.2
  • SELECT ANY DICTIONARY privilege
    • data dictionary, accessing A.7
    • exclusion from GRANT ALL PRIVILEGES privilege A.7
  • SELECT FOR UPDATE statement in Virtual Private Database policies 15.5.2
  • SELECT object privilege
  • sensitive data, auditing of A.13.4
  • separation of duty concepts
  • sequences
  • server.key file
    • pass phrase to read and parse A.11.3
  • SESSION_ROLES data dictionary view
  • SESSION_ROLES view
  • sessions
    • listing privilege domain of 4.26.6
    • memory use, viewing 2.7.5
    • time limits on 2.4.2.5
    • when auditing options take effect 33.1.1
  • SET ROLE statement
    • application code, including in 12.10.2
    • associating privileges with role 12.10.1
    • disabling roles with 4.24.2
    • enabling roles with 4.24.2
    • when using operating-system roles 4.23.5
  • SGA
    • See: System Global Area (SGA)
  • SHA-512 cryptographic hash function
  • SHARDED_SCHEMA_OWNER role 4.11.2
  • Shared Global Area (SGA)
    • See: System Global Area (SGA)
  • shared server
    • limiting private SQL areas 2.4.2.5
    • operating system role management restrictions 4.23.6
  • shoulder surfing 12.4.1.4
  • SI_INFORMTN_SCHEMA user account 2.6.2
  • single sign-on (SSO)
  • smartcards 23.4.2
  • smart cards
    • guidelines for security A.4
  • SODA_APP role 4.11.2
  • SQL_FIREWALL_ADMIN role 4.11.2
  • SQL_FIREWALL_VIEWER role 4.11.2
  • SQL*Loader
    • object store credential creation 3.2.9.7
  • SQL*Net
    • See: Oracle Net Services
  • SQL*Plus
  • SQL92_SECURITY initialization parameter
  • SQL Developer
    • debugging using Java Debug Wire Protocol 10.12
  • SQL Firewall
  • SQL injection attacks 12.4.1.2
  • SQLNET.ALLOWED_LOGON_VERSION_CLIENT
    • target databases from earlier releases 3.2.8.4
  • SQLNET.ALLOWED_LOGON_VERSION_SERVER
    • target databases from earlier releases 3.2.8.4
    • using only 12C password version 3.2.8.3
  • SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter
  • SQLNET.AUTHENTICATION_KERBEROS5_SERVICE parameter 25.2.6.1
  • SQLNET.AUTHENTICATION_SERVICES parameter 25.2.6.1, 27.5.1.1, 27.5.1.2.2, 28.2, 28.3, A.11.3
  • SQLNET.CRYPTO_CHECKSUM_CLIENT parameter 21.6.3.2
  • SQLNET.CRYPTO_CHECKSUM_SERVER parameter 21.6.3.2
  • SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter 21.6.3.2
  • SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER parameter 21.6.3.2
  • SQLNET.ENCRYPTION_CLIENT
    • with ANO encryption and TLS authentication 21.6.3.3.1
  • SQLNET.ENCRYPTION_CLIENT parameter 21.6.3.1, 28.2
  • SQLNET.ENCRYPTION_SERVER
    • with ANO encryption and TLS authentication 21.6.3.3.1
  • SQLNET.ENCRYPTION_SERVER parameter 21.6.3.1, 28.2
  • SQLNET.ENCRYPTION_TYPES_CLIENT parameter 21.6.3.1
  • SQLNET.ENCRYPTION_TYPES_SERVER parameter 21.6.3.1
  • SQLNET.IGNORE_ANO_ENCRYPTION_FOR_TCPS
  • SQLNET.KERBEROS5_CC_NAME parameter 25.2.6.3
  • SQLNET.KERBEROS5_CLOCKSKEW parameter 25.2.6.3
  • SQLNET.KERBEROS5_CONF parameter 25.2.6.3
  • SQLNET.KERBEROS5_REALMS parameter 25.2.6.3
  • sqlnet.ora file
    • Common sample 21.3.2
    • Kerberos sample 21.3.2
    • Oracle Advanced Security checksum sample 21.3.2
    • Oracle Advanced Security encryption sample 21.3.2
    • parameters for clients and servers using Kerberos 25.1.5
    • parameters for clients and servers using RADIUS 27.4.1
    • PDBs 3.2.8.3
    • RADIUS sample 21.3.2
    • sample 21.3.2
    • SQLNET.AUTHENTICATION_KERBEROS5_SERVICE parameter 25.2.6.1
    • SQLNET.AUTHENTICATION_SERVICES parameter 25.2.6.1, 28.2, 28.3, A.11.3
    • SQLNET.CRYPTO_CHECKSUM_CLIENT parameter 21.6.3.2
    • SQLNET.CRYPTO_CHECKSUM_SERVER parameter 21.6.3.2
    • SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter 21.6.3.2
    • SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER parameter 21.6.3.2
    • SQLNET.ENCRYPTION_CLIEN parameter 28.2
    • SQLNET.ENCRYPTION_SERVER parameter 21.6.3.1, 28.2
    • SQLNET.ENCRYPTION_TYPES_CLIENT parameter 21.6.3.1
    • SQLNET.ENCRYPTION_TYPES_SERVER parameter 21.6.3.1
    • SQLNET.KERBEROS5_CC_NAME parameter 25.2.6.3
    • SQLNET.KERBEROS5_CLOCKSKEW parameter 25.2.6.3
    • SQLNET.KERBEROS5_CONF parameter 25.2.6.3
    • SQLNET.KERBEROS5_REALMS parameter 25.2.6.3
    • SSL sample 21.3.2
    • Trace File Set Up sample 21.3.2
  • SQLNET.RADIUS_ALTERNATE_PORT parameter 27.5.1.3.3
  • SQLNET.RADIUS_ALTERNATE_RETRIES parameter 27.5.1.3.3
  • SQLNET.RADIUS_ALTERNATE_TIMEOUT parameter 27.5.1.3.3
  • SQLNET.RADIUS_ALTERNATE_TLS_HOST parameter 27.5.1.3.3
  • SQLNET.RADIUS_ALTERNATE_TLS_PORT parameter 27.5.1.3.3
  • SQLNET.RADIUS_ALTERNATE parameter 27.5.1.3.3
  • SQLNET.RADIUS_AUTHENTICATION_PORT parameter 27.5.1.3.1
  • SQLNET.RADIUS_AUTHENTICATION_RETRIES parameter 27.5.1.3.1
  • SQLNET.RADIUS_AUTHENTICATION_TIMEOUT parameter 27.5.1.3.1
  • SQLNET.RADIUS_AUTHENTICATION_TLS_HOST parameter 27.5.1.2.2
  • SQLNET.RADIUS_AUTHENTICATION_TLS_PORT parameter 27.5.1.2.2
  • SQLNET.RADIUS_SEND_ACCOUNTING parameter 27.5.4.1
  • SQLNET.RADIUS_TRANSPORT_PROTOCOL parameter 27.5.1.2.2
  • SQL statements
  • SQL statements, top-level in unified audit policies 31.4.6.1
  • SSL_VERSION
    • See: SSL_VERSION
  • standard auditing
  • standard audit trail
  • statement_types parameter of DBMS_RLS.ADD_POLICY procedure 15.3.4
  • storage
  • stored procedures
    • using privileges granted to PUBLIC role 4.22
  • strong authentication
    • centrally controlling SYSDBA and SYSOPER access to multiple databases 3.3.2.1
    • disabling 28.2
    • guideline A.4
  • symbolic links
    • restricting A.7
  • synchronous authentication mode, RADIUS 27.3.1
  • synonyms
    • object privileges 4.14.5
    • privileges, guidelines on A.3
  • SYS_CONTEXT function
  • SYS_DEFAULT Oracle Virtual Private Database policy group 15.3.7.3
  • SYS_SESSION_ROLES namespace 14.3.4.1
  • SYS.AUD$ table
  • SYS.FGA_LOG$ table
  • SYS.LINK$ system table 17.1
  • SYS.SCHEDULER$_CREDENTIAL system table 17.1
  • SYS$UMF user account 2.6.2
  • SYS account
  • SYS and SYSTEM
    • passwords A.4
  • SYS and SYSTEM accounts
  • SYSASM privilege
  • SYSBACKUP privilege
  • SYSBACKUP user account
  • SYSDBA administrative privilege
    • forcing oracle user to enter password 4.5.4
  • SYSDBA privilege 4.5.3
  • SYSDG privilege
  • SYSDG user account
  • SYSKM privilege
  • SYSKM user account
  • SYSLOG
  • SYSMAN user account A.4
  • SYS objects
  • SYSOPER privilege 4.5.3
  • SYSRAC privilege
    • operations supported 4.5.8
  • SYS schema
  • System Global Area (SGA)
    • application contexts, storing in 14.1.3
    • global application context information location 14.4.1
    • limiting private SQL areas 2.4.2.5
  • system privileges A.3
  • system requirements
  • SYSTEM user account
  • SYS user
  • SYS user account

T

  • table encryption
    • transparent sensitive data protection policy settings 16.15.2
  • tables
  • tablespaces
  • TCP connection
    • Kerberos krb5.conf configuration 25.2.6.4
  • TCPS protocol
    • tnsnames.ora file, used in A.11.3
    • Transport Layer Security, used with A.11.2
  • TELNET service A.11.2
  • TFTP service A.11.2
  • token cards 23.4.2, A.4
  • trace file
    • set up sample for sqlnet.ora file 21.3.2
  • trace files
    • access to, importance of restricting A.7
    • bad packets 12.13.1
    • location of, finding 14.6
    • Oracle DBaaS-to-IAM client side tracing 7.8.2
    • Oracle SQL Firewall 13.2.3.6
  • traditional auditing
  • Transparent Data Encryption
    • about 19.3.4.5
    • enabling for FIPS 140-2 C.3.2
    • FIPS-supported algorithms C.2.6
    • SYSKM administrative privilege 4.5.7
  • Transparent Data Encryption (TDE) 17.1
    • TSDP with TDE column encryption 16.15.1
  • transparent sensitive data protection (TSDP
    • unified auditing
  • transparent sensitive data protection (TSDP)
  • transparent sensitive data protection (TSDP);
    • fine-grained auditing
  • transparent tablespace encryption
  • Transport Layer Security
    • compared with native network encryption 21.1.3
    • FIPS-supported cipher suites C.2.8
  • Transport Layer Security, X.509 Certificates
    • about 26.4.1
    • about configuring MCS on client 26.4.3.3.1
    • configuring MCS on client 26.4.3.3.3
    • configuring sqlnet.ora on client 26.4.3.1
    • configuring sqlnet.ora on server 26.4.2.3
    • configuring TNS_NAMES on client 26.4.3.3.2
    • configuring tnsnames.ora on client 26.4.3.2
    • creating and configuring server wallet 26.4.2.1
    • external user 26.4.2.7
    • Grid Infrastructure, listener.ora on server 26.4.2.5
    • initialization parameters on server 26.4.2.6
    • logical volumne management, listener.ora on server 26.4.2.4
    • restarting and checking listener on server 26.4.2.8
    • shutting down listener on server 26.4.2.2
    • testing MCS confgiguration, SQL*Plus 26.4.3.3.5
    • testing MCS confgiguration, tnsping 26.4.3.3.4
  • Transport Layer Security (SSL)
    • sqlnet.ora file sample 21.3.2
  • Transport Layer Security(TLS)
    • configuring for SYSDBA or SYSOPER access 26.3
  • Transport Layer Security (TLS) 23.4.3
  • Transport Layer Security (TLS) troubleshooting
    • checking connection 26.6.1
    • checking sqlnet.ora and listener.ora wallet settings 26.6.4
    • checking SSL_VERSION parameter 26.6.2
    • checking wallet file permissions 26.6.3
    • SQL*Net and listener tracing 26.6.5
  • Transport Layer Security on Oracle RAC
  • triggers
  • troubleshooting 25.7.3
    • finding errors by checking trace files 14.6
    • Kerberos common configuration problems 25.7.1
    • ORA-01017 connection errors in CMU configuration 6.7.1
    • ORA-01017 errors in Kerberos configuration 25.7.4
    • ORA-12631 errors in Kerberos configuration 25.7.2
    • ORA-12650 and ORA-12660 errors in native network encryption configuration 21.7.2
    • ORA-28030 connection errors in CMU configuration 6.7.4
    • ORA-28274 connection errors in CMU configuration 6.7.2
    • ORA-28276 connection errors in CMU configuration 6.7.3
    • trace files for in CMU connection errors 6.7.5
  • trusted procedure
    • database session-based application contexts 14.1.2
  • tsnames.ora configuration file A.11.3
  • tutorials 14.3.9
    • See also: examples
    • application context, database session-based 14.3.9
    • auditing
      • creating policy to audit nondatabase users 31.10
      • creating policy using email alert 32.4.1
    • definer’s rights, database links 9.8.8.1
    • external network services, using email alert 32.4.1
    • global application context with client session ID 14.4.8.1
    • invoker’s rights procedure using CBAC 9.7.7
    • nondatabase users
      • creating Oracle Virtual Private Database policy group 15.4.3.1
      • global application context 14.4.8.1
    • Oracle Virtual Private Database
    • privilege analysis 5.5
    • privilege analysis for ANY privileges 5.4
    • schema privilege use 5.6
    • TSDP with VPD 16.12.3
  • types

U

  • UDP and TCP ports
    • close for ALL disabled services A.11.2
  • UDP connection
    • Kerberos krb5.conf configuration 25.2.6.4
  • UGA
    • See: User Global Area (UGA)
  • UNIFIED_AUDIT_COMMON_SYSTEMLOG initialization parameter
  • UNIFIED_AUDIT_SYSTEMLOG initialization parameter
  • UNIFIED_AUDIT_TRAIL data dictionary view
    • best practices for using A.13.6
  • unified auditing
    • benefits 29.4
    • purging records
    • traditional audit desupport 29.6
    • transparent sensitive data protection policy settings 16.13.2
    • tutorial 31.10
  • unified audit policies
  • unified audit policies, administrative users
  • unified audit policies, altering
  • unified audit policies, application common polices 31.6.2.3
  • unified audit policies, application containers
  • unified audit policies, CDBs
  • unified audit policies, column level auditing 31.4.4.3
  • unified audit policies, conditions
  • unified audit policies, disabling
  • unified audit policies, enabling
  • unified audit policies, object actions
  • unified audit policies, objects actions
  • unified audit policies, Oracle Database Real Application Security
  • unified audit policies, Oracle Database Vault
  • unified audit policies, Oracle Data Miner
  • unified audit policies, Oracle Data Pump
  • unified audit policies, Oracle Firewall
  • unified audit policies, Oracle Label Security
  • unified audit policies, Oracle Machine Learning for SQL
  • unified audit policies, Oracle Recovery Manager
  • unified audit policies, Oracle SQL*Loader
  • unified audit policies, Oracle XML DB HTTP and FTP protocols
  • unified audit policies, privileges
  • unified audit policies, roles
  • unified audit policies, SQL Firewall
    • how events appear in audit trail 31.8.1.3
  • unified audit policies, top-level statements 31.4.6.1
  • unified audit policies, virtual columns 31.4.4.3
  • unified audit session ID, finding 31.5.7
  • unified audit trail
  • unified audit trail, object actions
  • unified audit trail, Oracle Machine Learning for SQL
  • unified audit trail, top-level statements 31.4.6.3, 31.4.6.4
  • unified audit trial
    • Oracle Database Real Application Security ALL audit events 31.8.3.6
    • Oracle Database Real Application Security security class and ACL audit events 31.8.3.4
    • Oracle Database Real Application Security session audit events 31.8.3.5
    • Oracle Database Real Application Security user, privilege, and role audit events 31.8.3.3
    • Oracle Database Vault command rule events 31.8.2.6
    • Oracle Database Vault Data Pump events 31.8.2.10
    • Oracle Database Vault enable and disable events 31.8.2.11
    • Oracle Database Vault factor events 31.8.2.7
    • Oracle Database Vault OLS events 31.8.2.9
    • Oracle Database Vault realm events 31.8.2.4
    • Oracle Database Vault rule set and rule events 31.8.2.5
    • Oracle Database Vault secure application role events 31.8.2.8
    • Oracle Data Pump audit events 31.8.6.2
    • Oracle Label Security audit events 31.8.5.2
    • Oracle Label Security user session label events 31.8.5.3
    • Oracle Machine Learning for SQL audit events 31.8.9.2
    • Oracle Recovery Manager audit events 31.8.4.2
    • Oracle SQL*Loader Direct Load Path audit events 31.8.7.2
  • unified audting
  • UNLIMITED TABLESPACE privilege 2.2.7.4
  • UPDATE privilege
  • user accounts
    • administrative user passwords A.4
    • application common user
    • CDB common user
    • common
    • default user account A.4
    • local
    • local user
    • password guidelines A.4
    • passwords, encrypted A.4
    • predefined
    • predefined sample schemas 2.6.4
    • predefined schema 2.6.1
    • privileges required to create 2.2.2
    • proxy users 3.10.1.3
  • user accounts, predefined
  • USERENV function
  • USERENV namespace 3.10.2.4
    • See also: CLIENT_IDENTIFIER USERENV attribute
  • User Global Area (UGA)
    • application contexts, storing in 14.1.3
  • user names
  • user privileges
  • USER pseudo column 4.17.3
  • users
    • administrative option (ADMIN OPTION) 4.20.1.4
    • altering 2.3.1
    • altering common users 2.3.2
    • altering local users 2.3.2
    • application users not known to database 3.10.2.1
    • assigning unlimited quotas for 2.2.7.4
    • auditing 31.9.2.1
    • database role, current 12.10.1
    • default roles, changing 2.2.11
    • default tablespaces 2.2.6.1
    • dropping 2.5.1, 2.5.3
    • dropping profiles and 2.4.4.7
    • dropping roles and 4.11.6
    • enabling roles for 12.10
    • enterprise 4.11.4.6
    • enterprise, shared schema protection 12.11.2
    • external authentication
    • finding information about 2.7.1
    • finding information about authentication 3.11
    • global
    • hosts, connecting to multiple
      • See external network services, fine-grained access to 10.1
    • information about, viewing 2.7.2
    • listing roles granted to 4.26.4
    • memory use, viewing 2.7.5
    • names
    • nondatabase 14.4.2, 14.4.6.7
    • objects after dropping 2.5.1
    • Oracle SQL Firewall, allowed IP address 13.4.3
    • Oracle SQL Firewall, allowed SQL 13.4.2
    • Oracle SQL Firewall violations 13.4.4
    • password encryption 3.2.1
    • privileges
    • profiles
    • profiles, CDB or application 2.4.4.5
    • proxy authentication 3.10.1.1
    • proxy users, connecting as 3.10.1.1
    • PUBLIC role 4.11.1.7, 4.22
    • quota limits for tablespace 2.2.7.3
    • read-only configuration 4.25
    • restricting application roles 4.11.7
    • restrictions on user names 2.2.4.1
    • roles and 4.11.1.3
    • schema-independent 12.11.2
    • security, about 2.1
    • security domains of 4.11.1.7
    • tablespace quotas 2.2.7.1
    • tablespace quotas, viewing 2.7.3
    • user accounts, creating 2.2.3
    • user models and Oracle Virtual Private Database 15.5.10
    • user name, specifying with CREATE USER statement 2.2.4.2
    • views for finding information about 2.7
  • user sessions, multiple within single database connection 3.10.1.8
  • users supported 6.1.5
  • utlpwdmg.sql

V

  • validating 6.3.2.3
  • valid node checking A.11.2
  • views
    • about 4.17
    • access control list data
      • external network services 10.13
      • wallet access 10.13
    • application contexts 14.6
    • audited activities 30.7
    • audited activities from custom audit policies 31.11
    • auditing 31.4.4.2
    • audit management settings 33.4
    • audit trail usage 30.7
    • audit trail usage for fine grained auditing 32.5
    • authentication 3.11
    • bind variables in TSDP sensitive columns 16.10.3
    • custom audit policy audit trail usage 31.11
    • DBA_COL_PRIVS 4.26.5
    • DBA_HOST_ACES 10.13
    • DBA_HOST_ACLS 10.13
    • DBA_ROLE_PRIVS 4.26.4
    • DBA_ROLES 4.26.7
    • DBA_SCHEMA_PRIVS 4.26.3
    • DBA_SYS_PRIVS 4.26.2
    • DBA_TAB_PRIVS 4.26.5
    • DBA_USERS_WITH_DEFPWD 3.2.4.2
    • DBA_WALLET_ACES 10.13
    • DBA_WALLET_ACLS 10.13
    • definer’s rights 9.6.1
    • fine-grained audited activities 32.5
    • invoker’s rights 9.6.1
    • Oracle Virtual Private Database policies 15.6
    • privileges 4.17
    • privileges to query views in other schemas 4.17.2
    • profiles 2.7.1
    • ROLE_SYS_PRIVS 4.26.8
    • ROLE_TAB_PRIVS 4.26.8
    • security applications of 4.17.3
    • SESSION_PRIVS 4.26.6
    • SESSION_ROLES 4.26.6
    • transparent sensitive data protection 16.16
    • USER_HOST_ACES 10.13
    • USER_WALLET_ACES 10.13
    • users 2.7.1
  • Virtual Private Database
    • See: Oracle Virtual Private Database
  • VPD
    • See: Oracle Virtual Private Database
  • vulnerable run-time call A.3
    • made more secure A.3

W

  • wallets 10.2
    • See also: access control lists (ACL), wallet access
  • Web applications
  • Web-based applications
    • Oracle Virtual Private Database, how it works with 15.5.10
  • WHEN OTHERS exceptions
    • logon triggers, used in 14.3.7
  • Windows Event Viewer
    • capturing audit trail records 33.1.4.2
  • Windows installations
    • security guideline A.5
  • Windows native authentication 3.3.3
  • WITH GRANT OPTION clause
  • WM_ADMIN_ROLE role 4.11.2
  • WMSYS user account 2.6.2

X

  • X.509 certificates 26.4.1
    • guidelines for security A.4
  • XDB_SET_INVOKER role 4.11.2
  • XDB_WEBSERVICES_OVER_HTTP role
  • XDB_WEBSERVICES_WITH_PUBLIC role 4.11.2
  • XDB_WEBSERVICES role 4.11.2
  • XDBADMIN role 4.11.2
  • XDB user account 2.6.2
  • XS_CACHE_ADMIN role 4.11.2
  • XS_NAMESPACE_ADMIN role 4.11.2
  • XS_NSATTR_ADMIN role 4.11.2
  • XS_RESOURCE role 4.11.2
  • XS$NULL user account 2.6.3
  • XSTREAM_APPLY role 4.11.2
  • XSTREAM_CAPTURE role 4.11.2