-
My company is expaning it's services, and we need to prepare for storing sensitive data (on the database).
FYI: Oracle 8.1.6 on Solaris 2.7
I don't mean like Credit Cards or anything (so don't bother hacking in) but simple client customer lists, etc. which the client views as sensitive. We need to make them feel comfortable that the data is being guarded.
I am asking for the ways to make the data and the server as secure as possible. This includes 3rd party products or Oracle software add-ons.
I am already aware (the IT guys are handling this) of network security (firewall, ftp, telnet, etc) which we already handle, and file/directory security (to our logical/physical exports, etc).
We need to be sure that the database has that level of security beyond the normal as defined above.
I welcome all comments and ideas.
Thanks!
p.s. Our database may have to talk to another database (via db link, jdbc, etc) and that communication also needs to be secure (anything above Net8)?. Better encryption?
-
If you can get your application developers to add encrypt/decrypt functions when writing/reading data, you could store everything encrypted, but that might be overkill.
If it's web based, of course you would want the database server inaccessible from the web, so outside people only see the web server. The web server can get into the firewall and pull the data.
Net8 apparently supports encryption algorithms but other than naming which ones are supported I didn't find any information in the Net8 Admin guide, you might try looking deeper.
If not you could always define your interfaces so they can be done through files or messages instead of a database link, then transfer those files through an encrypted protocol (like SCP), or encrypt the files and transfer over a normal protocol, or both.
Of course you would want to do and metion things like routine password changes, limited admin access, etc. Put the data in a schema inaccessable from anyone except those who need to see the data.
-
There is some thing called "fine grained access" in oracle 8i. See whether that can be of any help to you.
Note: I don't think it will encrypt the data, but it will restrcit who can view what
-
regarding fine grained access:
it gives the same as views (like USER_TABLES vs ALL_TABLES vs DBA_TABLE in Oracle dictionary) but:
1) if contexts are used, then Optimizer knows about it and does not call the contect function for every row
2) one can define policies which gives the same as if view is created: the SQL engine adds implicit where clause when one queries some table on which the policy is defined.
(Personally I fell better with views since these are objects one can easily view in most GUI tools. Onthe other hand, one do not need to play with grants if policies are used - it is more centralized approach)
