Solved

Encrypting Oracle tablespace

Posted on 2011-09-12
8
385 Views
Last Modified: 2012-05-12
Hello,

I have written an application using Perl and Oracle 11g,
I would like to hide the internal database of the application from my clients.
What is the best way to achieve that?
Can it be possible even if they have sys/system access to the DB?

Many thanks
Tamir
0
Comment
Question by:tamirmilo
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 35

Expert Comment

by:johnsone
ID: 36524403
The only way that I am aware of to keep users with elevated privileges from accessing data is with the Database Vault product.

http://www.oracle.com/technetwork/database/options/database-vault/index-085211.html
0
 
LVL 77

Expert Comment

by:slightwv (䄆 Netminder)
ID: 36524621
My Oracle Vault knowledge is limited so I could be way off.  Just going from memory on something I think I read a while back.

Even using Vault you might not be able to do it unless you want called every time the database is started.

The way I understand this to work is a Wallet Manager, separate person from the DBA, needs to open the wallet for the database to open.
0
 
LVL 35

Accepted Solution

by:
johnsone earned 167 total points
ID: 36524916
I didn't set it up, but we used it on a couple of projects.  There needs to be a separate Vault administrator.

I don't really recall, but the Vault administrator may be able to see some things, but the DBAs definitely could not.

In this case, if they set up and maintain the vault, the client DBAs cannot see any of the data.  To me, that sounded like what they were looking for.

Again, I don't know any other way to do it, so that is why I put Vault out there.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 48

Assisted Solution

by:schwertner
schwertner earned 167 total points
ID: 36527816
Vault is expensive product - the license was (and possibly is 50K $).

It depends what are you hiding:

1. The contents of the tables - in this case encrypt the tables - DBMS_CRYPTO package.

2. The structure of the DB and the possibility to change data - hard tasl (vault) or no SYS DBA rights.
0
 

Author Comment

by:tamirmilo
ID: 36528967
Hi,
So VAULT is not really an option for me...
I will useDBMS_CRYPTO...
Can the users able to decrypt it?
Many thanks,
Tamir
0
 
LVL 77

Assisted Solution

by:slightwv (䄆 Netminder)
slightwv (䄆 Netminder) earned 166 total points
ID: 36529070
Any application that has the encryption key should be able to decrypt the data.

Depending on how you use the tools, the DBA still might be able to see the data.  For example, the DBA can see ALL SQL executed against the database.  You need to make sure none of the SQL uses the encryption key.

I realize there are some situations where there is trust issues between the data owners and administrators of the data.  Before you go down a path of trying to keep the DBAs out of sensitive data, you need to see if the trust issues are real or perceived.

For example:  I used to be the DBA of a payroll system.  Salaries and Personal information like Social Security numbers were considered 'sensitive' and HR Management didn't want ANYONE outside of HR to be able to access the data.

After many meetings to address these concerns it was decided that the Admin Staff were just as trustworthy as HR secretaries/clerks.

You can also enable auditing to look for unauthorized access.

If not, time to find new admin staff.

Normally your DBAs and System Administrators have higher clearances than many other employees because of the keys to the kingdom they hold.

In a nutshell:  You will likely NEVER stop malicious intent of a privileged user even by encrypting your data.  If the person wants to see the data, they can probably find a way.

This is why products like Vault are expensive.  It takes a LOT to minimize the risk.
0
 
LVL 35

Expert Comment

by:johnsone
ID: 36529247
Yes, vault is expensive.  Encrypting hides it to a certain extent from the admins, but they still have access to it and most likely could decrypt it if they really wanted to take the time.

If you absolutely want them out of the data, vault is the only way I know to keep them out.

If you want to make it difficult for them to view the real data, then encrypting it should be sufficient.
0
 

Author Closing Comment

by:tamirmilo
ID: 36550926
Thank you very much. All the best
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As a financial services provider, your business is impacted by two of the strictest federal regulations on record: the Sarbanes-Oxley Act and the Gramm-Leach-Bliley Act. Correctly implementing faxing into your organization to provide secure, real-ti…
Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
This video shows how to copy a database user from one database to another user DBMS_METADATA.  It also shows how to copy a user's permissions and discusses password hash differences between Oracle 10g and 11g.
Video by: Steve
Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…

697 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question