Questions to ask on an oracle security audit (multiple platforms)

[Deoncia Grayson_1]

another thing you might want to check to expound on Peter's answer... you might want to get very database intrusive, which users are granted what rights, who are given write access to what tables, does everyone have read write access?? also who are permitted to add rows outside of the database admins, what procedures do you follow before making a change to database, do they have a change control policy in place?

especially if this is a financial database, you want to get as intrusive as possible because the auditors will show no mercy.

[Yogeeraj_1]

hi SEP,

Concerning auditing, i should be important to know how many users have dba rights or how many users know accounts that have dba rights.

to be noted that in the Next release of Oracle 10g, there will be a new option named ORACLE AUDIT which will allow you to create realms such that even the DBAs don't have full access! It will also audit every break-in attempts.

You may also include questions on RMAN Backup and how often RMAN recovery is being tested.


will think some more about it during the break!

kind regards
yogeeraj

[Steve Lewis]

Tape handling procedures. If it gets backed up to disk elsewhere then this may not apply. If its only backed up to disk on-site then what happens when the building is unavailable.

1. Is the tape data encrypted? If so, how are the keys managed and kept separate from the data?
2. Do the tapes go off-site to secure storage? Where is the backup inventory kept?
3. Are the tapes in a locked box?
4. How secure are the backups from being intercepted and read?
5. What is the lifetime of the data? i.e. how long are the tapes kept for?
6. Is there any tape testing, to ensure that the backup tape really does hold the data you think it does?
7. How often do you audit the support from your Oracle supplier? Service levels etc?
8. Check the table and column privileges within the schemas, to ensure that only authorised users have rights to select/update/delete/insert.
9. Oracle user and password standards vs. corporate authentication/user access control policy.
10. Does the DB server sit behind a firewall? Which ports are open and listening?
11. Your database patching and upgrade policy wrt oracle security alerts and operating system security alerts. - you must prove that you have procedures to back up the policy and that these procedures are being followed.

[Patti Johnson]

Oracle also provides a script to check for default passwords for all their products. Download Patch 4926128 to verify if you still have any known userid/password combinations.

Patti

[Alzhy]

Only one from me from an experience sometime ago when I got hold of a surplus disk, it contained database export files - and they were not encrypted!

So one question to ask: Do you encrypt export files...?

[Peter Nikitka]

Hi Steven,

- which logins are member of the dba and 'orainst' group?
- in which way are passwords applied, which are used by cronjobs or shel scripts (for export purposes e.g.)?
- are they protected against visibility from the ps-command?

mfG Peter

[Steve Lewis]

By the way, I am sure you are aware of this already, but just in case, I noticed that a lot of answers are related to confidentiality. That is only one third of security. The other 2 thirds are:

data integrity
data availability

So you should also consider things like change control process over your schema, code and data fixes, checking / monitoring of systems, problem investigation and resolution, DR procedures, etc...

Security is a huge area when you get into it.

[Volker Borowski]

Hi SEP,

trying to throw in stuff that has not been mentioned yet or getting more detailed about others:

- Listener Security Guide, quite good stuff:
http://www.integrigy.com/security-resources/whitepapers/Integrigy_Oracle_Listener_TNS_Security.pdf

- If the Application handles the User Connection (i.e. like SAP) there is no need to let the DB be accessible remotely by various SQLPLUS clients in the wild. Firewall-protect the Listener and/or just bind the Listener-port to private LAN adapters for internal use of the application Servers.

- documented procedures how Oracle CPU-patches (critical patch updates) [one every three months] are reviewed and implemented after they become available.

- dbverify procedures and result checks

- periodical restore verification sessions

- Authorized use of the oracle dba-account. This can be done i.e. by completely keep the password of this user a secret, and permit access to this user by granting a sudo access to command "su - oracle" to those who are permitted. If nobody knows the password, nobody can login at all !
Everybody has to login himself first and the sudo action to become oracle is logged.

- Depending on how much "sqlplus" is the standard administration tool -> enforce to use "script" for logging purposes when sqlplus is used. If other tools in place (like SAP brtools) enable personalized logging procedures for these tools.

- the password aspects that have already been mentioned of course.

just my 0.02â ¬ input
Volker

[Pete Randall]

Steve,

I realize this is a multiple answer and therefore not worthy of points - that's fine, but I thought it important enough that I should mention it.

I was going through my "SANS NewsBites" newletter this morning and ran across this bite:

"Oracle Security Hardening Checklist Release Announced at NS2006
Security researcher Paul Wright released a draft of the SANS Oracle Security Hardening Checklist, Version 3.1 at his Oracle Security talk at Network Security 2006. This is the most comprehensive document on Oracle Security available on the Internet and is based on the work of Wright, Finnigan, Litchfield, and the SANS SCORE research team. The draft document is released with a 30-day review period; please send comments to score@san.org.
http://www.sans.org/score/oraclechecklist.php "


Pete