Oracle Vulnerability Scanning
Total Page:16
File Type:pdf, Size:1020Kb
BOOKS FOR PROFESSIONALS BY PROFESSIONALS® Wright RELATED Protecting Oracle Database 12c Protecting Oracle Database 12c helps you solve the problem of maximizing the safety, resilience, and security of an Oracle database whilst preserving performance, availability, and integration despite ongoing and new security issues in the software. The book demonstrates, through coded examples, how you can enable the consolidation features of Oracle Database 12c without increasing risk of either internal corruption or external vulnerability. In addition, new protections not publicly available are included, so that you can see how demonstrable risk improvements can be achieved, measured, and reported through Enterprise Manager 12c. Most importantly, the challenge of privileged access control within a consolidation environment is addressed, thus enabling a safe move to greater efficiency. You’ll learn about the following: • Oracle database security issues and how to defend against new risks and pre-existing architectural vulnerabilities, such as incoming DBlinks • Controlling and auditing the use of SYS privilege over a large estate using native tools • Using Oracle native audit as an IPS to block threats in real-time • Leveraging root segregation to secure Oracle DB • Securing privileged access control and break-glass sessions • Scaling automated security controls through Enterprise Manager to a large estate • Improving your ability to pass audits and stay compliant Shelve in ISBN 978-1-4302-6211-4 Databases/Oracle 55999 User level: Intermediate–Advanced SOURCE CODE ONLINE 9781430 262114 www.apress.com For your convenience Apress has placed some of the front matter material after the index. Please use the Bookmarks and Contents at a Glance links to access them. Contents at a Glance About the Author .............................................................................................................. xvii About the Technical Reviewer ........................................................................................... xix Acknowledgments ............................................................................................................. xxi Foreword ......................................................................................................................... xxiii ■ Part 1: Security Overview and History ......................................................... 1 ■ Chapter 1: Oracle Security History ....................................................................................3 ■ Chapter 2: Current State of the Art ....................................................................................7 ■ Chapter 3: Extrapolating Current Trends .........................................................................25 ■ Part 2: Defense Cookbook .......................................................................... 31 ■ Chapter 4: Managing Users in Oracle ..............................................................................33 ■ Chapter 5: Oracle Vulnerability Scanning ........................................................................43 ■ Chapter 6: Centralized Native Auditing and IPS ..............................................................55 ■ Chapter 7: Pluggable Database Primer ...........................................................................65 ■ Part 3: Security in the 12c Release ............................................................ 71 ■ Chapter 8: New Security Features in 12C ........................................................................73 ■ Chapter 9: Design Flaws, Fixed and Remaining in 12C ...................................................83 ■ Chapter 10: Security Issues in 12c ..................................................................................93 ■ Chapter 11: Advanced Defense and Forensic Response ................................................119 v ■ CONTENTS AT A GLANCE ■ Part 4: Security in Consolidation .............................................................. 143 ■ Chapter 12: Privileged Access Control Foundations .....................................................145 ■ Chapter 13: Privileged Access Control Methods ...........................................................151 ■ Chapter 14: Securing Privileged Access Control Systems ............................................163 ■ Chapter 15: Rootkit Checker and Security Monitoring ..................................................181 ■ Part 5: Architectural Risk Management ................................................... 205 ■ Chapter 16: Oracle Security Architecture Foundations .................................................207 ■ Chapter 17: Enterprise Manager 12C as a Security Tool ...............................................215 ■ Chapter 18: Defending Enterprise Manager 12C ...........................................................261 ■ Chapter 19: “The Cloud” and Privileged Access ............................................................287 ■ Chapter 20: Management and Conclusions ...................................................................297 Index .................................................................................................................................303 vi PART 1 Security Overview and History CHAPTER 1 Oracle Security History The notion of “Oracle Security” could be said to have started with Amun’s Temple at the Siwa Oasis in Egypt. The protection of the temple building was used to shield the knowledgeable priest or “Oracle,” as well as their symbolic power. This knowledge and power was so prized that in 331 BC Alexander the Great sought guidance from the Oracle before embarking on his tour of the East. This priority for physical security was shared by the first computer-based “Oracle” in the United States at Oak Ridge National Laboratory in 1951. ORACLE was the most powerful computer in the world but was only accessible by a single human user locally, thus electronic security was not yet the main concern. Figure 1-1. Single local user of ORACLE; Courtesy of Oak Ridge National Laboratory, U.S. Dept. of Energy 3 CHAPTER 1 ■ ORACLE SECURITY HISTORY The first multi-user computing machines, which arrived at MIT in 1962, began to raise security concerns by 1967, mainly regarding the protection of one user’s process from another, as described by Bernard Peters of the NSA. Peters’ paper was a seminal requirements document for much of what followed in computer security and is available at the following URL: http://bit.ly/16n1SZM Concurrently, at MIT a debate was raging. Richard Greenblatt disagreed with the need for stringent security controls in the new MIT multi-user OS, MULTICS (predecessor of UNIX). His team preferred a less controlled, more creative environment without incessant restrictions such as entering passwords. This point in time is credited as the start of “hacker” culture, later extended by Richard Stallman’s rejection of controls that limited users’ freedoms, and resulted in the founding of the GPL that protected those freedoms. There is still legitimate debate as to whether security measures that limit and hide information from users are as effective as other measures that introduce visibility and accountability to a system. Folks interested in full disclosure often refer to the famous quote by the American lock designer A.C. Hobbs, who believed safe designs should not be too secret: “It cannot be too earnestly urged that an acquaintance with real facts will, in the end, be better for all parties.” However, increased public network access to multi-user machines and requirements from military sponsors necessitated greater security and secrecy controls, which were implemented by SDC for the military in the ADEPT-50 system, as documented by Clark Weissman in 1969. You can read Weissman’s paper at the following URL: http://bit.ly/1436OvH These early security implementations later fed into the seminal Rainbow Series of books by MITRE, which laid the foundation for information security practice and can be read freely at this URL: http://www.fas.org/irp/nsa/rainbow.htm In the 1970s Larry Ellison read Dr. Edgar Codd’s IBM paper on relational databases and cleverly saw the potential for data integrity, disk space, and group membership inference. You can find Codd’s paper at: http://bit.ly/118hrj1 In 1978, Larry and colleagues at SDL worked on a CIA project looking to implement a relational database using SQL, namely Oracle Version 1. That effort is described by Scott Hollows in his presentation at: http://bit.ly/ZMC9Vc I am reliably informed by an Oracle employee that the original Oracle project actually started at the NSA, thus pre-dating the CIA reference above, which makes sense. Version 2 of Oracle was released in 1979 as the first commercially available SQL RDBMS, with the first customer being Wright-Patterson Air Base. Like ORNL’s ORACLE hardware in the previous photo, the Oracle relational database was restricted to local access until 1985, when version 5 introduced client/server. Version 6 brought PL/SQL in 1988, and 1992’s Version 7 introduced “Trusted Oracle,” a.k.a. Label Security. Oracle 8i in 1998 introduced Internet-related capabilities such as a JVM and Linux support. The popularization of Internet access in the late ’90s fueled an interest in computer security, similar to that already experienced at the OS level by Peters and Weissman. This again necessitated greater security controls. 4 CHAPTER 1 ■ ORACLE SECURITY HISTORY Therault and Heney’s book Oracle Security, published by O’Reilly Media