Introduction to Oracle AI Database Security

Oracle Database provides a rich set of default security features to manage user accounts, authentication, privileges, application security, encryption, network traffic, and auditing.

It is important to secure data to help protect sensitive information from access and interception by unauthorized parties. Without the appropriate security measures in place, data can be vulnerable to many types of attack vectors, such as man-in-the-middle attacks, packet sniffing, or data tampering. Leadership across various lines of business such as, technology, information security, and legal and compliance tend to be concerned about data breaches for three reasons:

1. Since data and data-driven information elements are critical assets in a digital economy, safeguarding this asset set is paramount to staying competitive.

2. The bad press associated with data breaches does more intangible damage than direct financial damages in the form of fines, penalties, and retribution costs. Lingering impacts include missed new revenue opportunities, pipeline conversion rate drops, failed cost avoidance measures, and so on.

3. They need to comply with the requirements of national and state laws, industry regulations, contractual agreements, and organizational policies.

• About Oracle AI Database Security
  Use Oracle AI Database’s security features to reduce risk and protect data from theft, destruction, or misuse.

• Additional Oracle AI Database Security Products
  In addition to the security resources that are available in a default database installation, Oracle AI Database provides several other database security products.

About Oracle AI Database Security

Use Oracle AI Database’s security features to reduce risk and protect data from theft, destruction, or misuse.

A few popular areas to focus security efforts on include:

• User accounts. When a schema is created, it comes with a local database user account that has privileges in that schema. When you create user accounts, you can secure them in a variety of ways. You can also create password profiles and resource limits to better secure password policies for your site. Oracle AI Database provides a set of predefined schemas that provide database functionality and other predefined schemas with administrative privileges.

  For more information see Managing Security for Oracle AI Database Users.

• Authentication methods. Oracle AI Database provides several ways to configure authentication for users and database administrators. For example, you can authenticate users on the database level, from the operating system, and on the network, and for multitier, global users, and application servers. If you use Microsoft Active Directory, you can authenticate and authorize Microsoft Active Directory users with the database directly.

  You can configure your databases to use strong authentication with Oracle authentication adapters that support various third-party authentication services with digital certificates. Oracle AI Database provides the following strong authentication support:

  • Centralized authentication and single sign-on.

  • Kerberos

  • Remote Authentication Dial-in User Service (RADIUS)

  • Certificate-based authentication

  For more information see Configuring Authentication andConfiguring Centrally Managed Users with Microsoft Active Directory.

• Privileges and roles. You can use privileges and roles to restrict user access to data in the following ways:

  • Creating and granting privileges and roles to users or other roles.

    For more information see Configuring Privilege and Role Authorization.

  • Performing privilege analysis to find information about how privileges are used in your site

    For more information see Performing Privilege Analysis to Identify Privilege Use.

  • Configure definer’s rights and invoker’s rights for your applications

    For more information see Managing Security for Definer’s Rights and Invoker’s Rights.

  • Manage fine-grained access in PL/SQL packages and types

    For more information see Managing Fine-Grained Access in PL/SQL Packages and Types.

  • Use Enterprise Manager to manage security

    For more information see Managing Security for a Multitenant Environment in Enterprise Manager.

• Application security. The first step to creating a database application is to ensure that it you have properly incorporated application security into your application security policies.

  For more information see Managing Security for Application Developers.

• User session information using application context. An application context is a name-value pair that holds the session information. You can retrieve session information about a user, such as the user name or terminal, and restrict database and application access for that user based on this information.

  For more information see Using Application Contexts to Retrieve User Information.

• Classify and protect data in different categories. You can create Transparent Sensitive Data Protection policies to find all table columns in a database that hold sensitive data (such as credit card or Social Security numbers), classify this data, and then create a policy that protects this data as a whole for a given class.

  For more information see Using Transparent Sensitive Data Protection.

• Network data encryption. You can use Transport Layer Security (TLS) and native network encryption to encrypt data as it travels on the network to prevent unauthorized access to that data. You can configure native Oracle Net Services data encryption for both servers and clients.

  For more information see Configuring Oracle AI Database Native Network Encryption and Data Integrity andConfiguring Transport Layer Security Encryption.

• Thin JDBC client network configuration. You can configure thin Java Database Connectivity (JDBC) clients to securely connect to Oracle AI Databases.

• Auditing database activities. Auditing provides the most accurate record of any database activity, not just from connections that take place over the wire but also through direct local logins, recursive SQL, dynamic SQLs, and stored procedures. Database auditing involves creating and enabling unified audit policies to track activities such as user actions, schema changes, logon events. Unified auditing further enables you to audit selectively by adding various conditions including application context values and simple built-in functions. This helps you to reduce the volume of your audit data, and at the same time helping you detect malicious activities in a timely manner.

  For more information see Monitoring Database Activity with Auditing.

Additional Oracle AI Database Security Products

In addition to the security resources that are available in a default database installation, Oracle AI Database provides several other database security products.

These products are as follows:

• Oracle Advanced Security enables you to protect sensitive data by using Transparent Data Encryption and Oracle Data Redaction.

• Oracle Label Security applies classification labels to data, allowing you to filter user access to data at the row level.

• Oracle Database Vault provides fine-grained access control to your sensitive data, including protecting data from privileged users. For example, you can restrict database administrators from having access to employee information such as salaries.

• Oracle Data Safe enables you to analyze the sensitivity and risks of data in your Oracle AI Databases, and based on these findings, create policies that mask sensitive data, create and monitor security controls, assess user security, and monitor user activity.

• Oracle Enterprise User Security enables you to manage user security at the enterprise level. Enterprise User Security (EUS) is deprecated with Oracle AI Database 26ai.

  Oracle recommends that you migrate to using Centrally Managed Users (CMU). This feature enables you to directly connect with Microsoft Active Directory without an intervening directory service for enterprise user authentication and authorization to the database. If your Oracle Database is in the cloud, you can also choose to move to one of the newer integrations with a cloud identity provider.

• Oracle Enterprise Manager Data Masking and Subsetting Pack can irreversibly replace the original sensitive data with fictitious data so that production data can be shared safely with IT developers or offshore business partners.

• Oracle Audit Vault and Database Firewall collects database audit data from sources such as Oracle AI Database audit trail tables, database operating system audit files, and database redo logs. Using Oracle Audit Vault and Database Firewall, you can create alerts on suspicious activities, and create reports on the history of privileged user changes, schema modifications, and even data-level access.

• Oracle Key Vault enables you to accelerate security and encryption deployments by centrally managing encryption keys, Oracle wallets, Java keystores, and credential files. It is optimized for Oracle wallets, Java keystores, and Oracle Advanced Security Transparent Data Encryption (TDE) master keys. Oracle Key Vault supports the OASIS KMIP standard. The full-stack, security-hardened software appliance uses Oracle Linux and Oracle AI Database technology for security, availability, and scalability, and can be deployed on your choice of compatible hardware.

In addition to these products, you can find the latest information about Oracle AI Database security, such as new products and important information about security patches and alerts, by visiting the Security Technology Center on Oracle Technology Network at http://www.oracle.com/technetwork/topics/security/whatsnew/index.html