Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Oracle segregation/separation of duties

Posted on 2011-09-22
10
Medium Priority
?
620 Views
Last Modified: 2012-06-27
Oracle Expert$$$$$$$

how to technically enforce SOD in an Oracle Database environment

i have one DBA who is controlling every thing.

goal: DBA can not read data (useful info) from the tables, DBA should do only Admin job
0
Comment
Question by:osloboy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
10 Comments
 
LVL 7

Expert Comment

by:Jacobfw
ID: 36579727
Consider data encription for key/sensitive table columns.
0
 
LVL 7

Expert Comment

by:Jacobfw
ID: 36579937
0
 
LVL 77

Expert Comment

by:slightwv (䄆 Netminder)
ID: 36579948
The only way I know of to ensure the DBA cannot see data is using Oracle Vault.  There is an encryption Wallet Admin that is necessary to properly open the database.

This is a separately licensed product.

http://www.oracle.com/us/products/database/options/database-vault/index.html


There comes a time in every organization when they realize that they have to eventually trust someone with the keys.  DBAs and System Administrator typically hold the keys.

If you have a trust issue with your DBA it may be time to find another DBA.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 77

Expert Comment

by:slightwv (䄆 Netminder)
ID: 36579961
From the link provided by Jacobfw

Principle 1: Encryption Does Not Solve Access Control Problems
Principle 2: Encryption Does Not Protect Against a Malicious DBA
Principle 3: Encrypting Everything Does Not Make Data Secure
0
 
LVL 7

Expert Comment

by:Jacobfw
ID: 36579965
Oracle Database does support limited partitioning of DBA privileges. Oracle Database provides native support for SYSDBA and SYSOPER users. SYSDBA has all privileges, but SYSOPER has a limited privilege set (such as startup and shutdown of the database).

0
 

Author Comment

by:osloboy
ID: 36589917
slightwv: problem is not trust but security Standardization, to have SOD is batter, you can not make one person as ORACLE GOD.

thanks guys for giving great tips but my problem still stands if Encryption is not right call and buying new solution can be out of question at this point.

is there any alternatives    
0
 
LVL 7

Expert Comment

by:Jacobfw
ID: 36590959
Two Options:

1) custom roles for speciallized individuals to enforce SOD

Furthermore, an organization can create smaller roles encompassing a number of system privileges. A JR_DBA role might not include all system privileges, but only those appropriate to a junior DBA (such as CREATE TABLE, CREATE USER, and so on).

2) enable auditing to secure location to ensure SOD compliance

Oracle Database also enables auditing the actions taken by SYS (or SYS-privileged users) and storing that audit trail in a secure operating system location. Using this model, a separate auditor who has root privileges on the operating system can audit all actions by SYS, enabling the auditor to hold all DBAs accountable for their actions.

However, in the end someone has to be be ORACLE GOD in a small shop, just like in a small town somebody plays sheriff and carries the GUN.
0
 

Author Comment

by:osloboy
ID: 36592023
Jacobfw: thanks a lot, Sheriff must be systematic :p

option 1 seems to be cool but you need additional resources.

where as option 2 can be carried out even with 3rd party auditor.
any good documentation on OPTION 2  
0
 
LVL 7

Accepted Solution

by:
Jacobfw earned 2000 total points
ID: 36592257
0
 

Author Closing Comment

by:osloboy
ID: 36814092
good one
0

Featured Post

Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
Ready to get certified? Check out some courses that help you prepare for third-party exams.
Video by: Steve
Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…
This video shows how to Export data from an Oracle database using the Datapump Export Utility.  The corresponding Datapump Import utility is also discussed and demonstrated.

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question