Something important to take into account when talking about security, is the problem with "if you don't know it's happening you can't stop it..." .. Remember to read/analyze logs for unusual stuff (Oracle or FW logs)... preferably with an IDS, as it makes the job of finding out whether you have a security breach a whole lot easier.
-----Original Message----- Pete Finnigan Sent: Saturday, January 10, 2004 2:59 PM To: Multiple recipients of list ORACLE-L Hi Paula, Paul and Steve have given some good ideas on this but also you should lock down the database as hard as you can. Even if the database is only accessed via the application server its data is still available from the internet. Issues such as SQL Injection and cross site scripting can come into play. use least privilege principles and remove all excess privileges. There are many papers on Oracle security on my site http://www.petefinnigan.com/orasec.htm including some very good checklists. You will find the SANS S.C.O.R.E. and cisecurity benchmarks linked in the checklist section of this page. Both follow the SANS step- by-step quite closely. Also if the server the application server is on is breached then the database is in much bigger trouble from the DMZ than it would normally be from the net. You need therefore to ensure that the application server is also hardened. Have a look at the cisecurity OS benchmarks as well as a start for hardening the OS. Encrypting the data between the application server and database is admirable and an extra expense but there are other issues to look at as well. As Steve said firewalls are needed. If your application allows it data wise / operationally then it can sometimes be better to not expose the database at all to the net but expose a subset of data that is needed by your net based users. Do this by replicating the relevant data to a second database and expose that to the application server. two way replication could be needed depending on what your application does. anyway have a look at some of the Oracle security info on my site http://www.petefinnigan.com/orasec.htm including SQL injection papers, and checklists etc - it might help you. hth kind regards Pete -- Pete Finnigan email:[EMAIL PROTECTED] Web site: http://www.petefinnigan.com - Oracle security audit specialists Book:Oracle security step-by-step Guide - see http://store.sans.org for details. -- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: Pete Finnigan INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). -- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: nelson flores INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
