1. Security Guide for Oracle Exadata
  2. Overview of Oracle Exadata Security

1 Overview of Oracle Exadata Security

Oracle Exadata is an engineered system that combines the optimized database performance of Oracle Database integrated with Oracle Exadata Storage Servers.

These core components are connected over a redundant RDMA Network Fabric that enables low latency, and high throughput network communication. There are 3 networks:

  • Private Network - uses the RDMA Network Fabric for communications between database and storage servers in one or many physical racks.
  • Client Network - used for communication from the client applications to services running on Oracle Exadata.
  • Administration Network - used for managing the hardware of the Oracle Exadata components including database and storage servers, PDUs, and switches.

Within this framework, there are basic security principles that should be adhered to for all software and hardware. The following are the principles:

  • Authentication: Authentication is how a user is identified, typically through confidential information such as user name and password, or shared keys. All components use authentication to ensure that users are who they say they are. By default, local user names and passwords are used for authentication. Shared key-based authentication is also available.
  • Authorization: Authorization allows administrators to control what tasks or privileges a user may perform or use. Personnel can only access the tasks and privileges that have been given to them. Oracle Exadata system administrators can configure resources with permissions to control user access to commands, disk space, devices, and applications.
  • Accounting and Auditing: Accounting and auditing maintain a record of a user's activity on the system. Oracle Exadata software and hardware features allow administrators to monitor login activity, and maintain hardware inventories.
    • User logons are monitored through system logs. System administrators and service accounts have access to commands that used incorrectly could cause harm and data loss. Access and commands should be carefully monitored through system logs.
    • Hardware assets are tracked through serial numbers. Oracle part numbers are electronically recorded on all cards, modules, and mother boards, and can be used for inventory purposes.

In addition to the basic security principles, Oracle Exadata addresses survivability, defense in depth, least privilege, and accountability. Oracle Exadata delivers a well-integrated set of security capabilities that help organizations address their most-pressing security requirements and concerns.

An example of how these and following security principles should be applied to the separate networks is:
  • Management Network requires a boundary level security, where only trusted administrators can access this network
  • Data Network requires securing data flow using encryption when multiple tenants or secure information is sent across this network
  • As the "front end" to the database, the Client Network requires the strongest security requirements, restricting access to this network connection ensures outside threats can be mitigated.