Solved

Encrypting Oracle tablespace

Posted on 2011-09-12
8
379 Views
Last Modified: 2012-05-12
Hello,

I have written an application using Perl and Oracle 11g,
I would like to hide the internal database of the application from my clients.
What is the best way to achieve that?
Can it be possible even if they have sys/system access to the DB?

Many thanks
Tamir
0
Comment
Question by:tamirmilo
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 34

Expert Comment

by:johnsone
ID: 36524403
The only way that I am aware of to keep users with elevated privileges from accessing data is with the Database Vault product.

http://www.oracle.com/technetwork/database/options/database-vault/index-085211.html
0
 
LVL 76

Expert Comment

by:slightwv (䄆 Netminder)
ID: 36524621
My Oracle Vault knowledge is limited so I could be way off.  Just going from memory on something I think I read a while back.

Even using Vault you might not be able to do it unless you want called every time the database is started.

The way I understand this to work is a Wallet Manager, separate person from the DBA, needs to open the wallet for the database to open.
0
 
LVL 34

Accepted Solution

by:
johnsone earned 167 total points
ID: 36524916
I didn't set it up, but we used it on a couple of projects.  There needs to be a separate Vault administrator.

I don't really recall, but the Vault administrator may be able to see some things, but the DBAs definitely could not.

In this case, if they set up and maintain the vault, the client DBAs cannot see any of the data.  To me, that sounded like what they were looking for.

Again, I don't know any other way to do it, so that is why I put Vault out there.
0
 
LVL 47

Assisted Solution

by:schwertner
schwertner earned 167 total points
ID: 36527816
Vault is expensive product - the license was (and possibly is 50K $).

It depends what are you hiding:

1. The contents of the tables - in this case encrypt the tables - DBMS_CRYPTO package.

2. The structure of the DB and the possibility to change data - hard tasl (vault) or no SYS DBA rights.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:tamirmilo
ID: 36528967
Hi,
So VAULT is not really an option for me...
I will useDBMS_CRYPTO...
Can the users able to decrypt it?
Many thanks,
Tamir
0
 
LVL 76

Assisted Solution

by:slightwv (䄆 Netminder)
slightwv (䄆 Netminder) earned 166 total points
ID: 36529070
Any application that has the encryption key should be able to decrypt the data.

Depending on how you use the tools, the DBA still might be able to see the data.  For example, the DBA can see ALL SQL executed against the database.  You need to make sure none of the SQL uses the encryption key.

I realize there are some situations where there is trust issues between the data owners and administrators of the data.  Before you go down a path of trying to keep the DBAs out of sensitive data, you need to see if the trust issues are real or perceived.

For example:  I used to be the DBA of a payroll system.  Salaries and Personal information like Social Security numbers were considered 'sensitive' and HR Management didn't want ANYONE outside of HR to be able to access the data.

After many meetings to address these concerns it was decided that the Admin Staff were just as trustworthy as HR secretaries/clerks.

You can also enable auditing to look for unauthorized access.

If not, time to find new admin staff.

Normally your DBAs and System Administrators have higher clearances than many other employees because of the keys to the kingdom they hold.

In a nutshell:  You will likely NEVER stop malicious intent of a privileged user even by encrypting your data.  If the person wants to see the data, they can probably find a way.

This is why products like Vault are expensive.  It takes a LOT to minimize the risk.
0
 
LVL 34

Expert Comment

by:johnsone
ID: 36529247
Yes, vault is expensive.  Encrypting hides it to a certain extent from the admins, but they still have access to it and most likely could decrypt it if they really wanted to take the time.

If you absolutely want them out of the data, vault is the only way I know to keep them out.

If you want to make it difficult for them to view the real data, then encrypting it should be sufficient.
0
 

Author Closing Comment

by:tamirmilo
ID: 36550926
Thank you very much. All the best
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
Video by: Steve
Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…
Via a live example, show how to take different types of Oracle backups using RMAN.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now