Autonomous Database Security Features

March, 2020
Oracle Autonomous Database
Security Features
1 © 2020 Oracle

Passionate about
Cloud & Database
Technologies
Sinan PetrusToma
Senior Solution Engineer
EMEA Solution Engineering Hub

Safe harbor statement
The following is intended to outline our general product direction. It is intended for information purposes
only, and may not be incorporated into any contract. It is not a commitment to deliver any material,
code, or functionality, and should not be relied upon in making purchasing decisions.
The development, release, timing, and pricing of any features or functionality described for Oracle’s
products may change and remains at the sole discretion of Oracle Corporation.
3 © 2020 Oracle

Agenda
4 © 2020 Oracle
 Encryption (Data, Backup,Connections)
 Network Access Control
 System & Data Protection
 Sensitive Data Discovery & Masking
 Auditing

5 © 2020 Oracle
Data | Your Most Valuable Asset

6 © 2020 Oracle
Examples of where data was not very well protected
Jul 2019: records of more than 5 million Bulgarians got stolen by hackers from the country’s tax
revenue office *
* https://edition.cnn.com/2019/07/21/europe/bulgaria-hack-tax-intl/index.html
** https://edition.cnn.com/2019/07/29/business/capital-one-data-breach/index.html
*** https://www.cnbc.com/2018/11/30/marriott-says-its-starwood-database-was-breached-onapproximately-500-million-guests-.html
Jul 2019: hacker gained access to 100 millionCapital One credit card applications and accounts **
Nov 2018: Marriott said the Starwood guest reservation database was breached, potentially exposing
information on about 500 million guests ***

7 © 2020 Oracle
Database in focus
NAMES
ADDRESSES
CREDIT CARDS
HEALTH RECORD
OTHER PII
SECRETS
Applications
Users
System, App
and DB Admins
Social
Engineering
Attack Apps
Bypass Database
Target
Data Copies
Attack Network
Test Dev
DB Clones
Social
Engineering
Transparent Data Encryption Data Masking
Command
Restrictions
DatabaseVault
Access Control
Net Encryption
Data Safe
Auditing
Data Redaction
Label Security

Agenda
8 © 2020 Oracle
 Auditing

9 © 2020 Oracle
Encryption | Transparent Data Encryption (TDE)
Encryption of Application Data on media
Enabled by default
Encryption keys are managed automatically

10 © 2020 Oracle
Encryption | Transparent Data Encryption (TDE)
WithoutTDE
WithTDE
In the event that the storage
media or data file is stolen, it
is not possible to read the
data

11 © 2020 Oracle
Encryption | Backups
All Backups are encrypted

12 © 2020 Oracle
Encryption | SQL*Net Connections
All connections MUST useTCP/IP + SSL (TCPS)
Customer‘s responsibility
 Store wallet files in a secure location
 Share wallet files only with authorized users

Agenda
13 © 2020 Oracle
 Auditing

14 © 2020 Oracle
10.0.0.3
138.1.64.0
138.1.64.192
138.1.66.3
IP Notation Type IP Addresses
IP Address 141.143.193.77
ACL
OCI RegionOn-Premise
141.143.193.77
Internet
TCP/IP : 1522
SSL
XTNS:listener
x.x.x.x
Basement
X
Oracle Services Network
Access Control List (ACL)
Wallet Rotation

15 © 2020 Oracle
Without ACL
With ACL
Access Control List (ACL)

16 © 2020 Oracle
OCI Region
NSG
Rule Stateless Source
Ingress No 10.0.2.0/24
private:10.0.2.0/24
VCN: 10.0.0.0/16
10.0.2.2
X
Oracle Services Network
10.0.2.3
SLpublic:10.0.1.0/24
Ingress
Egress
No
No
0.0.0.0/0
10.0.2.0/24
Internet
Gateway
Internet
Load Balancer
ADB Private
Endpoint
Ingress
Egress
No
No
10.0.1.0/24
10.0.3.0/24
private:10.0.3.0/24SL
RT
Private Endpoints & Network Security Groups
https://www.linkedin.com/pulse/implement-private-endpoint-your-autonomous-database-sinan-petrus-toma/

Agenda
17 © 2020 Oracle
 Auditing

18 © 2020 Oracle
Database Vault
 Stolen privileged user credentials are one of the most common attack vectors used by hackers
 Database Vault restricts access to application data by privileged users
 Prevent malicious or accidental changes that disrupt operations by privileged users
 Reduce the risk of insider and outside threats
 Address compliance with data privacy laws and standards such as the EU General Data Protection Regulation
(GDPR)

19 © 2020 Oracle
Database Vault
Without DBVault
With DBVault

20 © 2020 Oracle
High Privileges Restrictions
No OS/root logon or SYSDBA privileges
Prevent installing or modifying any software on the system

21 © 2020 Oracle
SQL Command Restrictions
Disable Encryption
Unlimited Failed Logins
DropTablespace

Agenda
22 © 2020 Oracle
 Auditing

23 © 2020 Oracle
Data Redaction
Mask (redact) data that is returned from queries issued by applications
Redaction at runtime! Data itself is not changed!
Redaction of Credit card, personal IDs, birth dates
comply with industry regulations such as Payment Card Industry Data Security
Standard (PCI DSS) and the Sarbanes-Oxley Act.
Policies can be implemented by the customer

24 © 2020 Oracle
Data Redaction
Without Data Redaction
With Data Redaction

25 © 2020 Oracle
Oracle Label Security (OLS)
Label their data using different sensitivity levels
Users are allowed to access only those data records with the
correspondent sensitivity level

26 © 2020 Oracle
Oracle Label Security (OLS)
Without OLS – All Users
With OLS – User 1
With OLS – User 2

27 © 2020 Oracle
Data Safe
Databases in Oracle CloudDatabases in Oracle Cloud
Audit …..Users DiscoverAssess Mask
 Unified Database Security Control Center
 Security Assessment
 User Assessment
 User Activity Auditing
 Sensitive Data Discovery
 Sensitive Data Masking
 Saves time and mitigates security risks
 Defense in Depth for all customers
 No special security expertise needed

Data Masking
28 © 2020 Oracle
Production Test
Development
Full Clone
Sensitive
Data Discover
Data Safe
Sensitive
Data Masking

30 © 2020 Oracle
Database Auditing
Selective and effective auditing inside the Database using policies and conditions
Predefined policies to monitor any abnormal activity
Additional audit policies can be configured to audit based on specific IP addresses,
programs, time periods, or connection types
Enabled by default
Can NOT be disabled!

33 © 2020 Oracle
API Audit Logs
Audit provides records of API operations performed against supported services
Audit logs are maintained for 90 days
Can be configured for up to 365 days

34 © 2020 Oracle
VCN Flow Logs
View connection information for traffic within yourVCN
Keeps detailed records of every flow that passes through yourVCN and presents this data
for analysis
 Source and destination of the traffic
 Quantity of traffic
 Permit or Deny action taken
Information can be used for:
 Network monitoring
 Troubleshooting
 Compliance

Copyright © 2019 Oracle and/or its affiliates.
OCI Compliance: Current Audit ProgramsGlobalGovernmentIndustryRegional
27001 : 27017 : 27018SOC 1 : SOC 2 : SOC 3
Level 1
Self-Assessment
PIPEDA -
Canada
DoD DISA SRG IL2 Moderate – Agency ATO VPAT – Section 508 G-Cloud 11 - UK Model Clauses - EU
US Privacy Shield
HIPAA PCI DSS FISC - Japan IGToolkit - UK
Cloud Security
Principles - UK
My Number -
Japan
Cyber Essentials
Plus - UK
TISAX - GermanyBSI C5 - GermanyGDPR - EU
C5

Autonomous Database | Security Features
36 © 2020 Oracle
Encryption
Transparent Data
Encryption
Backup Encryption
SQL*Net
Encryption
Access Control
Access Control Lists
Private Endpoints
System & Data
Protection
DatabaseVault
High Privileges
Restrictions
Sensitive Data
Oracle Label Security
Data Redaction
Data Safe
Auditing
DatabaseAuditing
API Audit Logs*
VCN Flow Logs*
SQLCommand
Restrictions
Network Security
Groups*
* OCI Security Features
Wallet Rotation
Data Masking
Self Patching

37 © 2020 Oracle
* Verizon - 2018 Data Breach Investigation Report
85%
of security breaches occurred
after the CVE was published*
Patch Available
On-PremiseAutonomous
 Downtime Restrictions
 Takes LongTime
 Human Resources
 No Downtime
 Applied Immediately
 No Customer Interaction

38 © 2020 Oracle
Security is Shared Responsibility
 Network security and monitoring
 OS and platform security
 Database patches and upgrades
 Data encryption by default
 Adminstrative separation of duties
 Ongoing security assessments
 Users and privileges
 Sensitive data discovery
 Data protection
 Activity auditing
Oracle Responsibility Customer Responsibility
Tools provided by Oracle

Thank you
Sinan PetrusToma
Senior Solution Engineer
Oracle DatabaseCloud Services
39

Autonomous Database Security Features

More Related Content

What's hot (20)

Similar to Autonomous Database Security Features (20)

Recently uploaded (20)

Autonomous Database Security Features