Best Practices for Using the Oracle Database Security Assessment Tool

Collector - OS Commands

As a general best practice, you should not put username or password credentials in cleartext in an application or file. When you provide the password on the command line while executing dbsat collect, someone can retrieve credentials, either using history or executing the ps Unix command or any similar Windows command. Therefore, Oracle recommends that you enter the password when prompted.

Collector - Database User Account

Oracle recommends that you run DBSAT collect and discoverer with a user that has the minimum set of privileges required to execute the assessments. The user shall also have a strong password. This will help reduce the attack surface and the potential impact of stolen DBSAT user account credentials, account misuse, and human error.

You can create a user with the required minimum privileges to run the Oracle Database Security Assessment Tool with the script provided in the pre-requisites section.

See this Sample Script to Create a User with Minimum Privileges.

Securing DBSAT Output Files

DBSAT encrypts output files by default to protect potentially sensitive database security and configuration information. Oracle recommends that you keep enable encryption enabled whenever possible.

Use the -n option to generate unencrypted output only when required for a specific operation, such as due to platform limitations, specialized troubleshooting, or integration. For standard diagnostic logging, use the -d option instead.

Any unencrypted DBSAT output must be protected with restrictive file permissions, transferred only through secure channels, and securely deleted when no longer needed.

Excluding Sensitive User Accounts

DBSAT allows you to exclude users from the security assessment report. If there are critical users that you do not want to show in the report, you can exclude them by using the -u option in dbsat report execution.