Hi,
I will explain you about Oracle Database Security , Database and Profile Security Parameters in this article.
You should read the following articles before this to understand Oracle database security very well.
https://ittutorial.org/data-redaction-in-oracle-database-2/
https://ittutorial.org/transparent-data-encryption-in-oracle/
There are lots of Security solutions in the Oracle database as follows.
One of the most basic security solution is the User Password policy and rules. User password is managed by User profiles.
The Oracle database requires password checks based on profiles.
Multiple profiles can be defined in the database that allow for differences in controls between users that require different levels of security.
Parameters and descriptions in the User profiles defined for Oracle users are as follows.
PASSWORD LIFE TIME: it displays number of days the password is valid before expiry
PASSWORD GRACE TIME: it displays number of grace days for user to change password
PASSWORD REUSE MAX: it displays number of times the user can use the already used password
PASSWORD REUSE TIME: it displays number of day after the user can use the already used password
PASSWORD VERIFY FUNCTION: Provides the use of complex passwords. This includes the use of passwords with both alphabetic and numeric characters, the length of the password, and the determination of passwords that do not belong to non-allowed word lists. The value of this profile option can be changed later. This value can be unique for each defined profile. A NULL value indicates that the control is not enabled.
FAILED LOGIN ATTEMPTS: it displays maximum times the user is allowed in fail login before locking the user account
PASSWORD LOCK TIME: it displays number of days the user account remains locked after failed login. If this values is set to UNLIMITED and FAILED LOGIN ATTEMPTS is not UNLIMITED, the account is locked indefinitely.
In cases When database users are not subject to password security rules, access to passwords by brute force attack or lucky estimates will increase the risk of unauthorized access to the database. The brute force attack method is a very common method of attacking the database and is performed by running a program that attempts to connect words to the database by using specific words (Known passwords such as “12345” “hello” and etc. ) in the dictionary as passwords.
In case of insufficient or weak password uses, there will be database security problem. This increases the risk that data kept within the database may be changed by unauthorized users, irregularity is possible, and important operational decisions can be made on the basis of incorrect information.
The existing password security rules should be reviewed to ensure that they are consistent with the organization’s objectives and the companies’ security policy.
The Database Administrator should solve the issue of using secure user profiles to perform password security checks of users in the database. This will ensure that account passwords are changed regularly and cannot be repeated again, subject to complexity and minimum length, and failed entries will be blocked.
The creation of multiple custom database profiles will allow changes in password checks between users that require different levels of security.
The following table lists some of the parameters that provides Oracle database security.
| NAME | VALUE | DESCRIPTION |
| audit_trail | NONE | enable system auditing |
| db_name | MUH | database name specified in CREATE DATABASE |
| 07_DICTIONARY_ACCESSIBILITY | FALSE | Version 7 Dictionary Accessibility Support |
| os_roles | FALSE | retrieve roles from the operating system |
| remote_login_passwordfile | EXCLUSIVE | password file usage parameter |
| remote_os_authent | FALSE | allow non-secure remote clients to use auto-logon accounts |
| remote_os_roles | FALSE | allow non-secure remote clients to use os roles |
| sql92_security | FALSE | require select privilege for searched update/delete |
| utl_file_dir | /oracle/app/file/utl1 | utl_file accessible directories list |
The definition of these parameters is as follows.
AUDIT_TRAIL: Determines whether the database audit is enabled or not. If NONE is selected, the audit records are not kept.
DB_NAME: Displays the name of the database.
DB_LINK_ENCRYPT_LOGIN: Indicates that encrypted passwords should be used in connection attempts to remote Oracle database through database links. A value of FALSE indicates that this is not enabled.
OS_ROLES: Specifies whether operating system is used to determine user privileges. The FALSE value indicates that it is not enabled.
REMOTE_LOGIN_PASSWORDFILE: Specifies whether a separate password file is used for login of Remote connections. The password file can contain SYS as well as non-SYS users. A value of NONE indicates that it is not enabled.
REMOTE_OS_AUTHENT: Specifies whether remote clients will be authenticated with the value of the OS_AUTHENT_PREFIX parameter.
REMOTE_OS_ROLES – specifies whether operating system roles are allowed for remote clients.
Without appropriate database security rules, security risk in applications can be exploited to provide controlled access that increases the risks of authorized access and misuse of database. In cases where secure passwords are not used in database, user identifiers and passwords may be sent in clear text over the network and may be captured by unauthorized persons.
Each security setting in the database should be made more difficult. The audit settings must be enabled using audit trail records and triggers, the passwords must be encrypted, the O7_DICTIONARY_ACCESSIBILITY parameter should be as FALSE, and the parameter SQL92_SECURITY should be enabled.
DBAs should review all users who have database administrator rights and verify their eligibility. A database user should only have the rights actually required to perform tasks efficiently and quickly, mostly the lowest level of priviliges should be granted.
“Generic” database users should be dropped, each user should use their own (unique) user.
Do you want to learn Advanced Oracle database, then read the following articles.
https://ittutorial.org/advanced-oracle-database-tutorials/