Oracle Cloud Infrastructure Documentation

Crypto Posture Assessment Overview

Crypto posture is the overall state of an organization’s cryptographic protections, including its algorithms, key lengths, certificates, protocols, and compliance settings. It helps identify weaknesses and assess whether systems are using strong, current, and appropriate security controls.

Crypto Posture Assessment in Oracle Data Safe provides a centralized view of the cryptographic posture of your registered target databases. It evaluates network and data encryption, certificates, wallets, backups, FIPS compliance, and quantum readiness to identify weaknesses and recommend remediation. You can review overall and target-level summaries, investigate prioritized findings, view historical trends, generate reports, and manage assessment schedules.

Overview Tab

The Overview tab in the Crypto posture assessment feature in Oracle Data Safe shows a broad assessment of the crypto posture of your database fleet. You can view four charts, totals, and a table that provide insights into your target databases’ network encryption, certificate expiration, quantum readiness, FIPS compliance, and issues requiring your attention.

For each chart, you can drill down to view more detail about the relevant target databases. For most of the charts, you can view the number of assessed target databases in the selected compartment (if applicable). When viewing the charts, the total number of targets refers to the number of distinct registered Oracle Data Safe target databases in the requested compartment scope, excluding targets in DELETING or DELETED states. The total number of assessed targets refers to the the number of distinct target databases with a LATEST crypto assessment record in that scope, regardless of the assessment lifecycle state or available posture data.

Network Encryption Chart

Network encryption protects sensitive data while it travels between systems, reducing the risk of unauthorized interception or exposure. It helps organizations maintain secure communications and meet security and compliance requirements.

The Network encryption bar chart shows how assessed target databases are distributed across enabled encryption protocols, including deprecated protocols.

The Y-axis displays the number of target databases. The X-axis displays TLS (1.2 and 1.3), Native Network Encryption (NNE), and deprecated protocols (TLS 1.0 and 1.1 are grouped together as one bar in the chart).

Certificate Status Chart

Knowing whether certificates are active or inactive helps prevent service interruptions, failed secure connections, and authentication issues caused by expired certificates. Proactive monitoring gives teams an opportunity to renew certificates and maintain security and compliance.

The Certificate status pie chart shows you the percentage of active and inactive certificates on your target databases. You can drill-down to view the list target databases with only active or inactive certificates as well as the certificate type, age, expiration date, and status of the certificates.

Quantum Readiness Chart

Quantum-resistant databases help protect sensitive data and secure connections against future quantum attacks that could break widely used public-key cryptography. Preparing in advance also helps protect long-lived data from “harvest now, decrypt later” attacks and gives organizations time to plan their migration to post-quantum cryptography.

The Quantum readiness pie chart provides insight into the current crypto state of your target databases. The potential categories in the chart are as follows:

  • Quantum resistant means that the target databases are in a good state and no action is needed
  • Quantum capable means that the target databases have all of the requirements that are needed to become quantum resistant, but they are not yet at the appropriate version
  • Release upgrade recommended means that the target databases require a release upgrade to be quantum resistant

FIPS Compliance Chart

Knowing a database’s FIPS compliance status helps determine whether its cryptographic protection meets FIPS 140-2 or FIPS 140-3 requirements. This is important for government, regulated, or security-sensitive workloads and helps identify databases that may need remediation to satisfy policy or audit requirements.

The FIPS compliance pie chart shows how many target databases have FIPS enabled and which version they use.

The chart compares target databases using FIPS 140-2 and FIPS 140-3. Target databases that do not support FIPS are not represented.

Findings Requiring Action Section

The Findings requiring action section shows you the following high-level information about your database fleet:

  • The number of target databases using deprecated TLS protocols (for example, TLS 1.0 or TLS 1.1)
  • The number of certificates expiring in the next 30 days

For each, you can select View to list the relevant target databases and additional information.

Findings Across Target Databases Section

The Findings across target databases section provides a list of discoveries on affected target databases in your fleet in the selected compartment. The findings are sorted by severity, where critical is the highest severity level. Here are some examples:

  • Weak certificate signature algorithms are allowed for TLS
  • Clients using weak cryptography are allowed
  • Default RMAN backup encryption algorithm is not AES256
  • NNE integrity checking is not enforced

“Each finding row shows the finding name, category, severity level, number of affected databases, and a summary of the finding and its remediation.

You can select the name of a finding to view the list of relevant target databases. From there, you can select the name of a target database to view its details (issue, target name, category, summary, remediation, and help links).

At the top of this section are the following totals:

  • Certificates and key management
  • Network encryption
  • Data encryption
  • Backup and export encryption

Prerequisites for Using Crypto Posture Assessment

Crypto Posture Assessment requires registered, properly provisioned target databases. Users must be granted specific permissions in Oracle Cloud Infrastructure Identity and Access Management (IAM).

These are the prerequisites for Crypto Posture Assessment:

  • Register the target databases where you want to run Crypto Posture Assessment. After you register a target database, Oracle Data Safe automatically runs a crypto posture assessment for your target database and updates the assessment according to the schedule.

    Crypto Posture Assessment supports target databases that are Oracle Database 19.32 or later, or Oracle AI Database 23.26.3 or later.

  • For all database types supported by Oracle Data Safe, except for Autonomous AI Databases, grant the ASSESSMENT role to the Oracle Data Safe service account on the target database. An Autonomous AI Database is automatically provisioned with the equivalent DS$ASSESSMENT_ROLE when it is registered as a target database.

  • If you previously granted the ASSESSMENT role on a target database for Security Assessment or User Assessment, rerun the SQL privileges script for non-Autonomous AI Databases and regrant the updated ASSESSMENT role. See Grant Roles to the Oracle Data Safe Service on a Non-Autonomous Database.

  • Obtain either the view permission or the manage permission on the crypto-assessments resource in IAM.

As an alternative to selectively granting permissions, you can grant permissions on data-safe-assessment-family in the relevant compartments, which would include permissions on all of the resources above as well as security-assessments and user-assessments. For information about granting roles, see the following sources: