# Oracle Database Security Assessment Tool User Guide This file contains the text from each Oracle Database Security Assessment Tool User Guide article landing page, release 4.3. # About the Oracle Database Security Assessment Tool ## Why the Need for a Security Assessment In today's data-driven world, organizations must ensure the security of their databases to protect sensitive information and maintain compliance with privacy regulations. The Oracle Database Security Assessment Tool (DBSAT) is a valuable solution, offering a comprehensive evaluation of database security. It identifies misconfigurations and potential risks, helping organizations mitigate threats and improve their security posture. By analyzing database settings, user access, and sensitive data locations, DBSAT provides recommendations to enhance security practices and reduce the likelihood of breaches. This tool is especially crucial given the impact of human errors and malicious attacks on database security. Read More: [Why the Need for a Security Assessment](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/about-the-oracle-database-security-assessment-tool/why-the-need-for-a-security-assessment.html) ## Oracle Database Security Assessment Tool Components The DBSAT consists of three key components: Collector, Reporter, and Discoverer. The Collector gathers data from the system by executing SQL queries and operating system commands, primarily querying database dictionary views. This data is then written to a JSON file for analysis. The Reporter analyzes the collected data and generates assessment reports in various formats, offering insights into the database's security status. The Discoverer, on the other hand, collects metadata from the database and generates sensitive data assessment reports. These components work together to provide a comprehensive security assessment, with the flexibility to run on different machines, ensuring a thorough evaluation of the database's security posture. Read More: [Oracle Database Security Assessment Tool Components](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/about-the-oracle-database-security-assessment-tool/oracle-database-security-assessment-tool-components.html) # Prerequisites ## Supported Operating Systems and Database Versions DBSAT supports various operating systems, including Linux x86-64, Linux 64-bit ARM, and Windows x64. It can run on Oracle Database 11.2.0.4 and later releases, both on-premises and in the cloud, with specific editions and services. The tool collects database configuration queries and provides targeted recommendations for different database types. For Unix/Linux systems, DBSAT requires the BASH shell to execute. Read More: [Supported Operating Systems and Database Versions](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/supported-operating-systems-and-database-versions.html) ## Security Requirements The output files generated by DBSAT are sensitive and should be handled securely. Directories containing these files must have appropriate permissions, and the files should be deleted securely after implementing recommendations. Sharing and encrypting the files is recommended, and user permissions for the DBSAT user should be granted on a short-term basis. Read More: [Security Requirements](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/security-requirements.html) ## Collector Prerequisites The DBSAT Collector gathers data by querying database views and using OS commands. It requires an OS user with read permissions on `ORACLE_HOME` files and directories. Privileges such as `CREATE SESSION`, `SELECT` on specific views, and roles like `SELECT_CATALOG_ROLE` and `DV_SECANALYST` (if Database Vault is enabled) must be granted to the DBSAT user. Read More: [Collector Prerequisites](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/collector-prerequisites.html) ## Sample Script To Create A User With Minimum Privileges A sample script is provided to create a DBSAT user with the required minimum privileges. This user will have the necessary permissions to run the DBSAT Collector script. Read More: [Sample Script To Create A User With Minimum Privileges](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/sample-script-to-create-a-user-with-minimum-privileges.html) ## Reporter Prerequisites The Reporter component of DBSAT requires Oracle Java Runtime Environment (Oracle JRE) 17 (Oracle JDK 17) or later. Oracle recommends using Oracle JDK 21 or later for optimal performance. The `JAVA_HOME` environment variable must be set to the installation directory containing the `bin` and `lib` directories. Read More: [Reporter Prerequisites](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/reporter-prerequisites.html) ## Discoverer Prerequisites Similar to the Reporter, the Discoverer component also requires Oracle JRE 17 (Oracle JDK 17) or later. The `JAVA_HOME` environment variable setup is the same. The Discoverer collects metadata from database dictionary views and relies on accurate table statistics, so a `DBMS_STATS` execution is recommended before running. Read More: [Discoverer Prerequisites](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/prerequisites/discoverer-prerequisites.html) # Installing The Oracle Database Security Assessment Tool **Steps to Install the Oracle Database Security Assessment Tool** The installation process for the Oracle Database Security Assessment Tool (DBSAT) involves a few simple steps. First, log in to the database server and create the 'dbsat' directory using the 'mkdir' command. Then, download or transfer the 'dbsat.zip' file to the server and extract its contents into the newly created directory. The provided commands are tailored for Linux/Unix environments, but similar commands can be used for Windows installations. Once completed, the DBSAT is ready for use on the database server, and its components can be accessed from the designated directory. Additionally, users can add this directory to their PATH for easier access without navigating to it each time. Read More: [Steps to Install the Oracle Database Security Assessment Tool](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/installing-the-oracle-database-security-assessment-tool/steps-to-install-the-oracle-database-security-assessment-tool.html) # Using The Collector And Reporter ## Collector and Reporter Architecture The Collector and Reporter components generate security assessment reports for Oracle databases. The Collector queries the database for data, which the Reporter then analyses and uses to make security recommendations. Read More: [Collector and Reporter Architecture](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/collector-and-reporter-architecture.html) ## Running The Collector The Collector requires a running database and listener. It can be run using the `dbsat collect` command with various options, including specifying the database connection string and output file. It's recommended to use secure authentication methods, such as SEPS authentication, to avoid entering passwords on the command line. Read More: [Running The Collector](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/running-the-collector.html) ## Running The Reporter The Reporter requires Oracle Java Runtime Environment (Oracle JRE) 17 or later. It can be invoked with the `dbsat report` command, which takes various options to specify the input file, output format, and other parameters. The Reporter analyses the data collected by the Collector and generates reports in HTML, Excel, JSON, and Text formats. Read More: [Running The Reporter](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/running-the-reporter.html) ## Oracle Database Security Assessment Report The Oracle Database Security Assessment Report provides a comprehensive analysis of database security, including user accounts, privileges, auditing, encryption, authorization control, and more. It offers recommendations to improve security and is available in different formats for easy navigation and analysis. Read More: [Oracle Database Security Assessment Report](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report.html) ## Oracle Database Security Assessment Report- Summary The Summary section provides an overview of the assessment, including the assessment and report generation dates, database details, and a summary of findings. Read More: [Oracle Database Security Assessment Report- Summary](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report--summary.html) ## Oracle Database Security Assessment Report - User Accounts This section details user accounts, including their profiles, authentication types, and other attributes. It highlights findings related to default passwords, expired passwords, inactive users, sample schemas, and more. Read More: [Oracle Database Security Assessment Report - User Accounts](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---user-accounts.html) ## Oracle Database Security Assessment Report - Privileges and Roles The Privileges and Roles section covers administrative privileges, roles, and system privileges granted to users. It identifies powerful roles, system privileges granted to PUBLIC, and other potential security concerns. Read More: [Oracle Database Security Assessment Report - Privileges and Roles](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---privileges-and-roles.html) ## Oracle Database Security Assessment Report - Auditing The Auditing section focuses on audit trails, unified audit policies, and fine-grained audit. It checks if administrative actions, database connections, and other activities are audited. Read More: [Oracle Database Security Assessment Report - Auditing](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---auditing.html) ## Oracle Database Security Assessment Report - Encryption This section covers Transparent Data Encryption, encryption key wallets, and FIPS mode for TDE and DBMS\_CRYPTO. It provides information on whether encryption is in use and the status of encryption keys. Read More: [Oracle Database Security Assessment Report - Encryption](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---encryption.html) ## Oracle Database Security Assessment Report - Authorization Control The Authorization Control section discusses Oracle Database Vault, privilege analysis, and data masking. It checks if Database Vault is enabled, and if privilege analysis and data masking are properly configured. Read More: [Oracle Database Security Assessment Report - Authorization Control](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---authorization-control.html) ## Oracle Database Security Assessment Report - Fine-Grained Access Control This section covers data redaction, Virtual Private Database, Real Application Security, and Label Security. It provides information on the status of these fine-grained access control mechanisms. Read More: [Oracle Database Security Assessment Report - Fine-Grained Access Control](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---fine-grained-access-control.html) ## Oracle Database Security Assessment Report - Database Configuration The Database Configuration section covers initialization parameters, pre-authenticated request URLs, authentication configuration, and other database settings. It checks for best practices and potential security concerns. Read More: [Oracle Database Security Assessment Report - Database Configuration](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---database-configuration.html) ## Oracle Database Security Assessment Report - Network Configuration The Network Configuration section focuses on network encryption, client nodes, connection limits, and listener configuration. It provides information on network security settings and potential vulnerabilities. Read More: [Oracle Database Security Assessment Report - Network Configuration](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---network-configuration.html) ## Oracle Database Security Assessment Report - Operating System The Operating System section covers installation accounts, OS authentication, segregation of production and development databases, and process ownership. It checks for potential security issues related to the operating system. Read More: [Oracle Database Security Assessment Report - Operating System](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---operating-system.html) ## Oracle Database Security Assessment Report - Diagnostics The Diagnostics section provides information on checks that could not be executed. It offers a summary of potential issues and recommendations for further analysis. Read More: [Oracle Database Security Assessment Report - Diagnostics](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-collector-and-reporter/oracle-database-security-assessment-report---diagnostics.html) # Using the Discoverer **Discoverer Architecture and Components** The Discoverer component generates the Oracle Database Sensitive Data Assessment Report. It executes SQL queries and collects data based on configuration and pattern files. The architecture includes components like the Discoverer, configuration files, pattern files, and the ability to customize and configure settings for sensitive data assessment. Read More: [Discoverer Architecture and Components](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/discoverer-architecture-and-components.html) **Configuring Dbsat.Config** To configure the Discoverer, edit the `dbsat.config` file. This file determines the Discoverer's behavior. Settings include database connection details, discovery parameters, and sensitive categories. The configuration file can be customized to specify patterns, exclusion lists, and SSL settings for secure connections. Read More: [Configuring Dbsat.Config](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/configuring-dbsat.config.html) **Configuration Settings** Configuration settings are organized into sections like `[Database]`, `[Discovery Parameters]`, and `[Sensitive Categories]`. Each section has keys and values to configure various aspects of the Discoverer. These settings control database connections, sensitive data patterns, and exclusion lists. Read More: [Configuration Settings](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/configuration-settings.html) **Pattern File Configuration** Pattern files define sensitive data types and patterns to search for. They are grouped into sections with sensitive type names. Each sensitive type has parameters like `COL_NAME_PATTERN`, `COL_COMMENT_PATTERN`, and `SENSITIVE_CATEGORY`. Pattern files can be customized to add or modify sensitive types. Read More: [Pattern File Configuration](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/pattern-file-configuration.html) **Customizing The Pattern File** To customize the pattern file, create a copy of the `sensitive.ini` file and rename it. The `Discover/conf` directory contains language-specific files for discovering sensitive data in different languages. The customized pattern file can be included in the Discoverer scan by adding a reference to it in the `dbsat.config` file. Read More: [Customizing The Pattern File](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/customizing-the-pattern-file.html) **About Regular Expressions** Regular expressions are used in search parameters and consist of strings based on common characteristics. They can include character classes, capturing groups, quantifiers, boundary matchers, and logical operators. Regular expressions allow for complex pattern matching and can be customized to suit specific needs. Read More: [About Regular Expressions](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/about-regular-expressions.html) **Configuring The Exclusion List File** The Exclusion List file specifies schemas, tables, or columns to exclude from the Discoverer scan. This file can be created and saved in the `Discover/conf` directory. Exclusion entries are specified in a specific format, and the Discoverer CSV report can be used to create the exclusion list file contents. Read More: [Configuring The Exclusion List File](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/configuring-the-exclusion-list-file.html) **Configuring Certificates And Wallets** The Discoverer supports Secure External Password Store for retrieving login credentials from a wallet. It also supports SSL encryption for secure connections. Configuration parameters for SSL can be found in the `dbsat.config` file. Configuring certificates and wallets is optional and required only when using SSL. Read More: [Configuring Certificates And Wallets](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/configuring-certificates-and-wallets.html) **Running The Discoverer** To run the Discoverer, specify arguments like the configuration file and output file. The Discoverer can be run with encryption or without. After running, an encrypted `.dbsat` file is created, and the contents can be extracted using the `dbsat extract` command. Read More: [Running The Discoverer](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/running-the-discoverer.html) **Oracle Database Sensitive Data Assessment Report** The Discoverer generates the Oracle Database Sensitive Data Assessment Report in HTML, CSV, and JSON formats. The report provides a high-level summary, a summary of sensitive data, and detailed information about sensitive data, schemas, tables, columns, and rows. It includes sections for sensitive data assessment, schema view, and sensitive column details. Read More: [Oracle Database Sensitive Data Assessment Report](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/using-the-discoverer/oracle-database-sensitive-data-assessment-report.html) # **Best Practices** **Best Practices for Using the Oracle Database Security Assessment Tool - 4.3** This guide outlines essential practices for utilizing the Oracle Database Security Assessment Tool (DBSAT) effectively. It emphasizes the importance of securing credentials, minimizing privileges, and protecting output files. To enhance security, it is advised to avoid cleartext storage of usernames and passwords, instead opting for interactive password entry. Running DBSAT with a user possessing minimal required privileges and a strong password reduces potential risks. The tool's default encrypted output files further safeguard sensitive information. Additionally, DBSAT enables the exclusion of specific users from assessment reports, ensuring critical user accounts remain confidential. Following these best practices ensures a robust and secure assessment process. Read More: [Best Practices for Using the Oracle Database Security Assessment Tool](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/best-practices/best-practices-for-using-the-oracle-database-security-assessment-tool.html) # Appendix A ## Improved DBSAT Target Specific Checks and Recommendations The DBSAT tool now offers enhanced target-specific checks and recommendations for various database types, including on-premises, Oracle Autonomous AI, and Oracle Cloud DBCS. This improvement ensures tailored guidance for each database, as evidenced by the comprehensive table outlining the specific findings and recommendations. The table provides a clear overview, highlighting the checks executed and the corresponding suggestions for each database category. This advancement in DBSAT's capabilities ensures more precise and relevant advice, catering to the unique needs of different database environments. Read More: [Improved DBSAT Target Specific Checks and Recommendations](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/appendix-a/improved-dbsat-target-specific-checks-and-recommendations.html) # Appendix B ## Troubleshooting This section provides guidance on troubleshooting the Oracle Database Security Assessment Tool (DBSAT). It covers enabling diagnostics to diagnose errors, handling issues with the DBSAT Reporter, and resolving problems related to the DBSAT process. Users can refer to this section to address common errors and improve the tool's performance. The diagnostics feature helps capture vital information for debugging, and users can enable it using the `-d` option. Additionally, specific error scenarios are addressed, such as the "No JSON object could be decoded" issue, which can be resolved by granting execute privilege on `DBMS_SQL` to the DBSAT database user. The section also highlights potential issues with running DBSAT on IBM AIX platforms and provides solutions, including installing the `bash` shell or running DBSAT collect remotely. To address long-running or incomplete DBSAT collect processes, users can limit the number of rows collected using the `-r` option. Finally, if a DBSAT process ends unexpectedly, restarting the command is recommended to refresh the results. Read More: [Troubleshooting](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/appendix-b/troubleshooting.html) # Appendix C ## Attribution for Third-Party Licenses This page outlines the process for obtaining source code for third-party technology received from Oracle in binary form. It provides instructions on how to submit a request for the source code, including the required details such as component name, Oracle product details, and contact information. The page also includes licenses for XlsxWriter, Eclipse Public License, and The GNU General Public License (GPL), detailing the terms and conditions for copying, distribution, and modification of the respective programs. Additionally, it provides licensing information for Oracle GraalVM for JDK 25.1.3. Read More: [Attribution for Third-Party Licenses](https://docs.oracle.com/en/database/oracle/security-assessment-tool/4.3/satug/appendix-c/attribution-for-third-party-licenses.html)