Oracle Database Security Assessment Report - Authorization Control

Displays whether Oracle Database Vault is enabled, details realms, command rules, their status, and protected objects.

Database Vault provides for configurable policies to control the actions of database accounts with elevated privileges such as those accounts used by administrative users, applications and utilities. Attacks (originating from external as well as internal sources) leverage privileged account credentials to access sensitive information. Database Vault realms prevent unauthorized access to sensitive data objects, even by user accounts with system privileges. Database Vault Command rules limit the accidental or malicious execution of SQL commands. Also it provides trusted paths to further restrict access to sensitive data using system factors such as IP address, program name, time of day and user name. Database Vault operations control can be used to restrict common users from accessing pluggable database (PDB) local data in autonomous, regular Cloud, or on-premises environments.

• What is Oracle Database Vault
• Restrict common users from seeing PDB data
• Database Vault roles
• DBA Operations in an Oracle Database Vault Environment
• AUTHORIZE_PROXY_USER Procedure

• Performing Privilege Analysis to Identify Privilege Use
• Who Can Perform Privilege Analysis
• AUTHORIZE_PROXY_USER Procedure

Displays Privilege Analysis policies and users with privileges to start the capture process.

Privilege Analysis records the privileges used during a real or simulated workload. After collecting data about the privileges that are actually used, this information can be used to revoke privilege grants that are no longer needed or to create roles with only the privileges that are used by the user or role. This helps implement Least Privilege Model and minimizes risk from intentional or accidental abuse of privileges.

• Performing Privilege Analysis to Identify Privilege Use
• Who Can Perform Privilege Analysis
• Use Database Vault with ADB-S

• Managing Secrets and Credentials for SQL*Plus
• Managing the Secure External Password Store for Password Credentials

Lists tables with sensitive data that should be masked when transferred to non-production systems.

This check lists tables marked sensitive by TSDP or in DBA_TABLES and users that can transfer data via DATAPUMP_EXP_FULL_DATABASE or DATAPUMP_IMP_FULL_DATABASE.

• Why Data Masking and Subsetting