Oracle Database Security Assessment Report - Encryption
The Oracle Database Security Assessment Report - Encryption section displays the following information:
| Name | Finding ID | Description | Link(s) |
|---|---|---|---|
| Transparent Data Encryption | ENCRYPT.TDE | Displays whether column or tablespace encryption is in use. Also, shows encrypted and unencrypted tablespaces along with the number of days since the master encryption key was last rotated. Encryption of sensitive data is a requirement in most regulated environments. Transparent Data Encryption automatically encrypts data as it is stored and decrypts it upon retrieval. This protects sensitive data from attacks that bypass the database and read data files directly. | |
| Encryption Key Wallet | ENCRYPT.WALLET | Displays wallet information. Wallets are encrypted files used to store encryption keys, passwords, and other sensitive data. Wallet files should not be stored in the same directory with database data files, to avoid accidentally creating backups that include both encrypted data files and the wallet containing the master key protecting those files. For maximum separation of keys and data, consider storing encryption keys in Oracle Key Vault instead of wallet files. | |
| FIPS Mode for TDE and DBMS_CRYPTO | ENCRYPT.DBFIPS | Displays information whether TDE and DBMS_CRYPTYO run in a FIPS-compliant mode. Federal Information Processing Standard (140-2) is a U.S. government security standard that specifies security requirements. It is used to approve cryptographic modules. Setting parameter DBFIPS_140 = TRUE enables Transparent Data Encryption (TDE) and DBMS_CRYPTO PL/SQL package program units to run in a FIPS-compliant mode. FIPS mode is mostly used by departments and agencies of the United States federal government looking to meet FIPS and/or STIG compliance. Be aware that this setting and thus using the underlying FIPS-certified library incurs a slight amount of overhead when the library is first loaded. This is due to the verification of the library signature and the execution of the self-test. | |
| FIPS mode for TLS | ENCRYPT.TLSFIPS | Federal Information Processing Standard (140-2) is a U.S. government security standard that specifies security requirements. The SSLFIPS_140 parameter configures the Transport Layer Security (TLS) adapter to run in FIPS mode. SSLFIPS_LIB sets the location of the FIPS library. |
The following figure displays an example of the Oracle Database Security Assessment Report - Encryption section:
Description of the illustration Oracle Database Security Assessment Report - Encryption
Description of the illustration Oracle Database Security Assessment Report - Encryption Key Wallet