1. Oracle Database Security Assessment Tool User Guide
  2. Oracle Database Security Assessment Report

Oracle Database Security Assessment Report

The Collector and Reporter components are used to generate the Oracle Database Security Assessment (DBSAT) Report in HTML, Excel, JSON, and Text formats. All reports contain similar information but in different formats.

The HTML report provides detailed assessment results in a format that is easy to navigate. The Excel format provides a high-level summary of each finding without the detailed output included in the HTML report. It also allows you to add columns for your tracking and prioritization purposes. A report in text format makes it convenient to copy portions of the output for other usages. Finally, a JSON document containing the report contents is provided for easier filtering, comparison, aggregation, and integration with other tools.

The following Database Security Assessment Report sections will use the HTML report as an example and highlight the findings along with the sections they belong to, the rule ID, and a short description.

At the top of the report, you will find information about the Collector and Reporter run details, such as the data collection and report generation dates, along with the reporter version. Follows the Database Identity information, where you will find details about the target database. Then, the Summary table presents all the findings per section or domain and their severity level.

Findings

DBSAT reporter resulting analysis is reported in units called Findings, and in each Finding, you see:

  1. Rule ID: The Rule ID has two parts: the prefix identifies the report section, and the suffix identifies the specific rule.
  2. One-line summary: One-line summary highlighting the objective and context of each check.

  3. Status: The Status helps you prioritize implementing DBSAT recommendations. It indicates the level of risk associated with the finding, allowing you to make informed decisions about remediation.

    • High Risk

      Needs immediate attention.

    • Medium Risk

      Plan to address these in the short term.

    • Low Risk

      Might be fixed during scheduled downtime or bundled with other maintenance activities.

    • Evaluate

      Needs manual analysis.

    • Advisory

      Poses an opportunity for improvement and raises awareness about other security controls available in the Oracle Database.

    • Pass

      No risks were found.

  4. Summary: Provides a summary of the Finding. When the Finding is informational, the summary typically reports only the number of examined data elements.
  5. Details: Provides detailed information to explain the finding summary, typically results from the assessed database, followed by any recommendations for changes.
  6. Remarks: Explain the reason for the rule and recommended actions for remediation.
  7. References: If the finding is an Oracle Recommended Practice (ORP) related to an Oracle Database 19c STIG V1R1, Oracle Database 19c CIS Benchmark v1.2 recommendation, or related to a GDPR Article/Recitals, it will be mentioned here
  8. Documentation: When the assessed Oracle Database is version 19c or 26ai, DBSAT will display documentation links relevant to each finding's remarks.

Security Frameworks and Recommended Practices

DBSAT integrates Oracle Recommended Practices, Center for Internet Security (CIS) Benchmark, and the US Department of Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for the Oracle Database to identify potential security risks in Oracle databases.

Initially, DBSAT primarily focused on STIGs and CIS benchmarks, but with version 3.0 and later, it also highlights findings aligned or that are Oracle's own recommended practices.

Some checks are designated as Oracle Recommended Practices (ORP) only. This could be due to various factors, such as differences in release cycles or a deeper understanding of Oracle's inner workings. For example, while Oracle releases new features or capabilities, it can take years for standards to include them. For instance, Oracle introduced Gradual Password Rollover in Oracle Database 19c in 2021, but until April 2024, it was not reflected in STIG or CIS.

Multiple security frameworks often cover similar requirements, and DBSAT tags findings accordingly. For instance, if both CIS and STIG recommend avoiding default passwords for database user accounts, DBSAT marks that finding with both frameworks' tags, and as this is an Oracle recommended practice, it would be as well flagged with the ORP tag.

DBSAT's tagging system lets users focus on findings relevant to their compliance standards. Whether seeking STIG compliance, adherence to CIS benchmark, or alignment with Oracle's best practices, users can easily find and prioritize findings based on their specific requirements.

DBSAT maps findings to:

  • STIG 19c V1R1
  • Oracle Database 19c CIS Benchmark v1.2.
  • Oracle Recommended Practices
  • European Union General Data Protection Regulation (EU GDPR) 2016/679 articles and recitals

Note:

Recommendations reflect best practices for database security and should be part of any strategy for data protection by design and by default.

EU GDPR tagged findings highlight technology that may help you address EU GDPR articles and recitals and other data privacy regulations with similar requirements. Technical controls alone are not sufficient for compliance. Passing all findings does not guarantee compliance.

Sections

DBSAT Security Assessment report starts with a Summary and follows with findings organized in the following categories:

  • Database Security Basics
  • User Accounts
  • Privileges and Roles
  • Auditing
  • Encryption
  • Authorization Control
  • Fine-Grained Access Control
  • Database Configuration
  • Network Configuration
  • Operating System