Oracle Cloud Infrastructure Documentation

View and Manage Crypto Posture Assessments for a Target Database

When you register a target database, a crypto posture assessment is automatically generated for it. This is called the latest assessment and is available on the Target Summary tab.

Assessment data is refreshed according to its schedule, which you can modify as needed. You can also refresh the data on demand. Each assessment includes a Cryptographic Bill of Materials (CBOM) report that you can download.

About a Crypto Posture Assessment for a Target Database

A crypto posture assessment for a target database is contained in six tabs:

  • Details
  • Network encryption
  • Data encryption
  • Wallets
  • Backups
  • Assessment history

Details Tab

General information on this tab includes the following:

  • Quantum readiness
  • OCID of the crypto posture assessment
  • Target database name
  • OCID of the target database
  • Database name
  • Database version
  • Database architecture (CDB, PDB)
  • Cryptographic module
  • FIPS module
  • Last scan timestamp
  • Scan schedule (Select Edit to change the schedule.)

Crypto configuration status information on this tab includes the following:

  • TLS (Enabled, Not enabled)
  • TLS server certificate (In use, Not in use)
  • NNE (Enabled, Not enabled)
  • TDE (Enabled, Not enabled)
  • Number of encrypted tablespaces
  • Number of unencrypted tablespaces
  • Backups (for example, ENCRYPTED)
  • FIPS (Enabled, Disabled)

The Findings section lists the findings specific to the target database. Each row in the table shows the issue name and category by default.

Network Encryption Tab

TLS server configuration details include the following:

  • Status (Enabled, Not enabled)
  • Quantum readiness (Resistant, Not resistant)
  • FIPS (Enabled, Disabled)
  • TLS version
  • TLS cipher suites
  • Client authentication (Enabled, Not enabled)
  • Wallet encryption algorithm
  • Wallet location

NNE server configuration details include the following:

  • Status (Enabled, Not enabled, Not configured, Not available, Not applicable, Not supported)
  • Quantum readiness (Resistant, Not resistant)
  • FIPS
  • Server encryption (Required, Requested, Accepted, Rejected, Not supported) - Not supported is shown if the database version does not support Crypto Posture Assessment.
  • Encryption algorithm
  • Server checksum (Required, Not required)
  • Checksum algorithm
  • Key exchange

Server certificate details include the following:

  • Status (Valid, Expiring soon, Expired, Invalid, In use)
  • Subject
  • Subject public key type
  • Issuer
  • Issuer signature algorithm
  • Certificate Authority
  • Issue date
  • Expiration date

SQLNET.ORA encryption parameters include the following:

This table includes all of the sqlnet.ora parameters. Each row contains the parameter name, value, and whether or not the parameter is resistant.

Transparent Data Encryption Tab

Configuration details include the following:

  • Status (Enabled, Not enabled)
  • Quantum readiness (Resistant, Not resistant)
  • FIPS
  • DB credential encryption algorithm
  • REDO encryption algorithm

Key details include the following:

  • Master key encryption algorithm name
  • Master key last rotation timestamp
  • Master key ID
  • Primary key store type
  • Secondary key store type
  • Wallet location

The Tablespace encryption summary consists of a table where each row shows the following by default:

  • Tablespace
  • Encryption
  • Mode
  • Size
  • Tablespace category
  • Quantum readiness

The Column encryption summary consists of a table where each row shows the following by default:

  • Table
  • Column
  • Schema
  • Algorithm
  • Encryption mode values

Wallets Tab

The Wallets tab consists of a table where each row shows the feature (for example, TLS, TDE), wallet location, wallet encryption algorithm, and creation timestamp values by default.

You can select the value in the feature column to view more detail.

  • For TLS, you can view general information and details for server certificates, user certificates, and trusted certificates. Details for the certificates include subject, issuer, status, age, expiration date, public key type, signature algorithm, and serial number, by default.

  • For TDE, you can view general information and keys. For each master key ID, you can view its status, algorithm, created timestamp, and last password rotation timestamp values, by default.

Backups Tab

The Backups tab consists of a table listing the backups for the target database. Each row consists of the following information, by default:

  • Backup set key
  • Set stamp
  • Backup type
  • Created timestamp
  • Status (Available, Not available)
  • Encrypted (Yes, No)
  • Encryption mode
  • Algorithm
  • Size
  • Number of backup pieces

Assessment History Tab

The Assessment history tab consists of a table listing the assessments generated by the schedule. Assessments are created once per month. Each row in the table consists of the following information by default:

  • Assessment name
  • Quantum readiness
  • Database version
  • Network encryption
  • Vulnerable tablespaces
  • Number of total issues
  • Updated timestamp

View the Latest Crypto Posture Assessment for a Target Database

  1. In the left navigation pane, select Crypto posture assessment.

  2. On the right, select the Target summary tab.

  3. Select a target database name to view its latest crypto posture assessment.

  4. Select the following tabs to view the latest assessment:

    • Details
    • Network encryption
    • Data encryption
    • Wallets
    • Backups
    • Assessment history

Refresh the Latest Crypto Posture Assessment for a Target Database

  1. On the left navigation pane, select Crypto posture assessment.

  2. On the right, select the Target summary tab.

  3. Under Target summary, select the name of the target database that you want to refresh.

    The latest crypto posture assessment for the target database opens.

  4. From the Actions menu, select Refresh.

    The Refresh panel opens.

  5. (Optional) Enter a name for the saved latest assessment or leave the default name as is.

  6. Select Refresh.

    The assessment is updated. You can find the saved assessment in the Assessment History.

View the CBOM Report for a Target Database

The Cryptographic Bill of Materials (CBOM) report for a target database consists of a table with the following columns:

  • Type
  • Cryptographic function
  • Cryptographic properties
  • Location

  1. Under Data Safe - Database Security, select Crypto posture assessment.

  2. On the right, select the Target summary tab, and then select a target database.

  3. In the upper-right corner, select View CBOM report.

    The Cryptographic Bill of Materials (CBOM) report panel opens.

  4. View the Cryptographic Bill of Materials (CBOM) report.

  5. Select Close to close the panel.

Generate and Download the CBOM Report for a Target Database

You can generate and then download a PDF or XLS file of the Cryptographic Bill of Materials (CBOM) report.

  1. Under Data Safe - Database Security, select Crypto posture assessment.

  2. On the right, select the Target summary tab, and then select a target database.

  3. From the Actions menu, select Generate & download CBOM report.

    The Generate & download CBOM report panel opens.

  4. To generate the report, do the following:

    a. Under Report action, select Generate report.

    b. Under Report format, select PDF or XLS.

    c. Select Generate report and wait for the report to generate.

  5. To download the report, do the following:

    a. Under Report action, select Download report.

    b. Under Report format, select PDF or XLS, depending on the report format that you generated earlier.

    c. Select Download report. The report is downloaded to your browser.

  6. Select Close to close the panel.

Related Topics