?
Solved

Encrypting Oracle tablespace

Posted on 2011-09-12
8
Medium Priority
?
391 Views
Last Modified: 2012-05-12
Hello,

I have written an application using Perl and Oracle 11g,
I would like to hide the internal database of the application from my clients.
What is the best way to achieve that?
Can it be possible even if they have sys/system access to the DB?

Many thanks
Tamir
0
Comment
Question by:tamirmilo
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 35

Expert Comment

by:johnsone
ID: 36524403
The only way that I am aware of to keep users with elevated privileges from accessing data is with the Database Vault product.

http://www.oracle.com/technetwork/database/options/database-vault/index-085211.html
0
 
LVL 78

Expert Comment

by:slightwv (䄆 Netminder)
ID: 36524621
My Oracle Vault knowledge is limited so I could be way off.  Just going from memory on something I think I read a while back.

Even using Vault you might not be able to do it unless you want called every time the database is started.

The way I understand this to work is a Wallet Manager, separate person from the DBA, needs to open the wallet for the database to open.
0
 
LVL 35

Accepted Solution

by:
johnsone earned 668 total points
ID: 36524916
I didn't set it up, but we used it on a couple of projects.  There needs to be a separate Vault administrator.

I don't really recall, but the Vault administrator may be able to see some things, but the DBAs definitely could not.

In this case, if they set up and maintain the vault, the client DBAs cannot see any of the data.  To me, that sounded like what they were looking for.

Again, I don't know any other way to do it, so that is why I put Vault out there.
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 48

Assisted Solution

by:schwertner
schwertner earned 668 total points
ID: 36527816
Vault is expensive product - the license was (and possibly is 50K $).

It depends what are you hiding:

1. The contents of the tables - in this case encrypt the tables - DBMS_CRYPTO package.

2. The structure of the DB and the possibility to change data - hard tasl (vault) or no SYS DBA rights.
0
 

Author Comment

by:tamirmilo
ID: 36528967
Hi,
So VAULT is not really an option for me...
I will useDBMS_CRYPTO...
Can the users able to decrypt it?
Many thanks,
Tamir
0
 
LVL 78

Assisted Solution

by:slightwv (䄆 Netminder)
slightwv (䄆 Netminder) earned 664 total points
ID: 36529070
Any application that has the encryption key should be able to decrypt the data.

Depending on how you use the tools, the DBA still might be able to see the data.  For example, the DBA can see ALL SQL executed against the database.  You need to make sure none of the SQL uses the encryption key.

I realize there are some situations where there is trust issues between the data owners and administrators of the data.  Before you go down a path of trying to keep the DBAs out of sensitive data, you need to see if the trust issues are real or perceived.

For example:  I used to be the DBA of a payroll system.  Salaries and Personal information like Social Security numbers were considered 'sensitive' and HR Management didn't want ANYONE outside of HR to be able to access the data.

After many meetings to address these concerns it was decided that the Admin Staff were just as trustworthy as HR secretaries/clerks.

You can also enable auditing to look for unauthorized access.

If not, time to find new admin staff.

Normally your DBAs and System Administrators have higher clearances than many other employees because of the keys to the kingdom they hold.

In a nutshell:  You will likely NEVER stop malicious intent of a privileged user even by encrypting your data.  If the person wants to see the data, they can probably find a way.

This is why products like Vault are expensive.  It takes a LOT to minimize the risk.
0
 
LVL 35

Expert Comment

by:johnsone
ID: 36529247
Yes, vault is expensive.  Encrypting hides it to a certain extent from the admins, but they still have access to it and most likely could decrypt it if they really wanted to take the time.

If you absolutely want them out of the data, vault is the only way I know to keep them out.

If you want to make it difficult for them to view the real data, then encrypting it should be sufficient.
0
 

Author Closing Comment

by:tamirmilo
ID: 36550926
Thank you very much. All the best
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to protecting Oracle Database servers and systems, there are a ton of myths out there. Here are the most common.
Shell script to create broker configuration file using current broker Configuration, solely for purpose of backup on Linux. Script may need to be modified depending on OS-installation. Please deploy and verify the script in a test environment.
Via a live example, show how to take different types of Oracle backups using RMAN.
This video explains what a user managed backup is and shows how to take one, providing a couple of simple example scripts.
Suggested Courses
Course of the Month17 days, 2 hours left to enroll

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question