Oracle segregation/separation of duties
Oracle Expert$$$$$$$
how to technically enforce SOD in an Oracle Database environment
i have one DBA who is controlling every thing.
goal: DBA can not read data (useful info) from the tables, DBA should do only Admin job
how to technically enforce SOD in an Oracle Database environment
i have one DBA who is controlling every thing.
goal: DBA can not read data (useful info) from the tables, DBA should do only Admin job
Jacobfw
Consider data encription for key/sensitive table columns.
The only way I know of to ensure the DBA cannot see data is using Oracle Vault. There is an encryption Wallet Admin that is necessary to properly open the database.
This is a separately licensed product.
http://www.oracle.com/us/products/database/options/database-vault/index.html
There comes a time in every organization when they realize that they have to eventually trust someone with the keys. DBAs and System Administrator typically hold the keys.
If you have a trust issue with your DBA it may be time to find another DBA.
This is a separately licensed product.
http://www.oracle.com/us/products/database/options/database-vault/index.html
There comes a time in every organization when they realize that they have to eventually trust someone with the keys. DBAs and System Administrator typically hold the keys.
If you have a trust issue with your DBA it may be time to find another DBA.
From the link provided by Jacobfw
Principle 1: Encryption Does Not Solve Access Control Problems
Principle 2: Encryption Does Not Protect Against a Malicious DBA
Principle 3: Encrypting Everything Does Not Make Data Secure
Principle 1: Encryption Does Not Solve Access Control Problems
Principle 2: Encryption Does Not Protect Against a Malicious DBA
Principle 3: Encrypting Everything Does Not Make Data Secure
Oracle Database does support limited partitioning of DBA privileges. Oracle Database provides native support for SYSDBA and SYSOPER users. SYSDBA has all privileges, but SYSOPER has a limited privilege set (such as startup and shutdown of the database).
ASKER
slightwv: problem is not trust but security Standardization, to have SOD is batter, you can not make one person as ORACLE GOD.
thanks guys for giving great tips but my problem still stands if Encryption is not right call and buying new solution can be out of question at this point.
is there any alternatives
thanks guys for giving great tips but my problem still stands if Encryption is not right call and buying new solution can be out of question at this point.
is there any alternatives
Two Options:
1) custom roles for speciallized individuals to enforce SOD
Furthermore, an organization can create smaller roles encompassing a number of system privileges. A JR_DBA role might not include all system privileges, but only those appropriate to a junior DBA (such as CREATE TABLE, CREATE USER, and so on).
2) enable auditing to secure location to ensure SOD compliance
Oracle Database also enables auditing the actions taken by SYS (or SYS-privileged users) and storing that audit trail in a secure operating system location. Using this model, a separate auditor who has root privileges on the operating system can audit all actions by SYS, enabling the auditor to hold all DBAs accountable for their actions.
However, in the end someone has to be be ORACLE GOD in a small shop, just like in a small town somebody plays sheriff and carries the GUN.
1) custom roles for speciallized individuals to enforce SOD
Furthermore, an organization can create smaller roles encompassing a number of system privileges. A JR_DBA role might not include all system privileges, but only those appropriate to a junior DBA (such as CREATE TABLE, CREATE USER, and so on).
2) enable auditing to secure location to ensure SOD compliance
Oracle Database also enables auditing the actions taken by SYS (or SYS-privileged users) and storing that audit trail in a secure operating system location. Using this model, a separate auditor who has root privileges on the operating system can audit all actions by SYS, enabling the auditor to hold all DBAs accountable for their actions.
However, in the end someone has to be be ORACLE GOD in a small shop, just like in a small town somebody plays sheriff and carries the GUN.
ASKER
Jacobfw: thanks a lot, Sheriff must be systematic :p
option 1 seems to be cool but you need additional resources.
where as option 2 can be carried out even with 3rd party auditor.
any good documentation on OPTION 2
option 1 seems to be cool but you need additional resources.
where as option 2 can be carried out even with 3rd party auditor.
any good documentation on OPTION 2
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
good one