Oracle segregation/separation of duties

Oracle Expert$$$$$$$

how to technically enforce SOD in an Oracle Database environment

i have one DBA who is controlling every thing.

goal: DBA can not read data (useful info) from the tables, DBA should do only Admin job
osloboyAsked:
Who is Participating?
 
JacobfwCommented:
Consider data encription for key/sensitive table columns.
0
Network Scalability - Handle Complex Environments

Monitor your entire network from a single platform. Free 30 Day Trial Now!

 
slightwv (䄆 Netminder) Commented:
The only way I know of to ensure the DBA cannot see data is using Oracle Vault.  There is an encryption Wallet Admin that is necessary to properly open the database.

This is a separately licensed product.

http://www.oracle.com/us/products/database/options/database-vault/index.html


There comes a time in every organization when they realize that they have to eventually trust someone with the keys.  DBAs and System Administrator typically hold the keys.

If you have a trust issue with your DBA it may be time to find another DBA.
0
 
slightwv (䄆 Netminder) Commented:
From the link provided by Jacobfw

Principle 1: Encryption Does Not Solve Access Control Problems
Principle 2: Encryption Does Not Protect Against a Malicious DBA
Principle 3: Encrypting Everything Does Not Make Data Secure
0
 
JacobfwCommented:
Oracle Database does support limited partitioning of DBA privileges. Oracle Database provides native support for SYSDBA and SYSOPER users. SYSDBA has all privileges, but SYSOPER has a limited privilege set (such as startup and shutdown of the database).

0
 
osloboyAuthor Commented:
slightwv: problem is not trust but security Standardization, to have SOD is batter, you can not make one person as ORACLE GOD.

thanks guys for giving great tips but my problem still stands if Encryption is not right call and buying new solution can be out of question at this point.

is there any alternatives    
0
 
JacobfwCommented:
Two Options:

1) custom roles for speciallized individuals to enforce SOD

Furthermore, an organization can create smaller roles encompassing a number of system privileges. A JR_DBA role might not include all system privileges, but only those appropriate to a junior DBA (such as CREATE TABLE, CREATE USER, and so on).

2) enable auditing to secure location to ensure SOD compliance

Oracle Database also enables auditing the actions taken by SYS (or SYS-privileged users) and storing that audit trail in a secure operating system location. Using this model, a separate auditor who has root privileges on the operating system can audit all actions by SYS, enabling the auditor to hold all DBAs accountable for their actions.

However, in the end someone has to be be ORACLE GOD in a small shop, just like in a small town somebody plays sheriff and carries the GUN.
0
 
osloboyAuthor Commented:
Jacobfw: thanks a lot, Sheriff must be systematic :p

option 1 seems to be cool but you need additional resources.

where as option 2 can be carried out even with 3rd party auditor.
any good documentation on OPTION 2  
0
 
osloboyAuthor Commented:
good one
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.