Oracle Database Security Assessment Report - Network Configuration

The Oracle Database Security Assessment Report - Network Configuration section displays the following information:

Name	Finding ID	Description	Link(s)
Security Related SQLNET Parameters	-	Displays the security-related SQLNET parameters: Parameter — Displays the parameter name. Value — Displays the value set for the parameter.	-
Network Encryption	NET.ENCRYPTION	Displays information about network encryption. Network encryption protects the confidentiality and integrity of communication between the database server and its clients. Either Native Encryption or TLS should be enabled. For Native Encryption, both `ENCRYPTION_SERVER` and `CRYPTO_CHECKSUM_SERVER` should be set to `REQUIRED`. If TLS is used, TCPS should be specified for all network ports and `SSL_CERT_REVOCATION` should be set to `REQUIRED`.	Securing Data for Oracle Database Connections Data Encryption
Client Nodes	NET.INVITEDNODES	Displays whether the database accepts connections from any client. `TCP.VALIDNODE_CHECKING` should be enabled to control which client nodes can connect to the database server. Either an allowlist of client nodes allowed to connect (`TCP.INVITED_NODES`) or a blocklist of nodes that are not allowed (`TCP.EXCLUDED_NODES`) may be specified. Configuring both lists is an error; only the invited node list will be used in this case.	TCP.VALIDNODE_CHECKING TCP.INVITED_NODES TCP.EXCLUDED_NODES
Connection Limits Configuration	NET.CONNECTIONLIMITS	Check value of parameters governing termination of unauthenticated connections: SQLNET.INBOUND_CONNECT_TIMEOUT INBOUND_CONNECT_TIMEOUT_LISTENER SQLNET.EXPIRE_TIME	SQLNET.INBOUND_CONNECT_TIMEOUT INBOUND_CONNECT_TIMEOUT_listener_name SQLNET.EXPIRE_TIME
Network Listener Configuration	NET.LISTENERCONFIG	Displays information about network listener configuration. These parameters are used to limit changes to the network listener configuration. `ADMIN_RESTRICTIONS` should be enabled to prevent parameter changes to the running listener. One of the following restrictions on service registration should be implemented: Prevent changes by disabling `DYNAMIC_REGISTRATION` Limit the nodes that can make changes by enabling `VALID_NODE_CHECKING_REGISTRATION` Limit the network sources for changes using the `COST` parameters `SECURE_PROTOCOL`, `SECURE_CONTROL`, and `SECURE_REGISTER`. `CONNECTION_RATE` determines rate enforced across all the endpoints that are rate limited	-
Listener Logging Control	NET.LISTENERLOG	Displays information about network listener logging configuration. The `LOGGING_LISTENER` parameter enables logging of listener activity. Log information can be useful for troubleshooting and to provide early warning of attempted attacks.	Net Listener Parameters in the listener.ora File - LOGGING_listener_name

The following figure displays an example of the Oracle Database Security Assessment Report - Network Configuration section:

Description of the illustration Oracle Database Security Assessment Report - Network Configuration