© 2007 by Prentice Hall12-1
Introduction to Oracle 10gChapter 12Maintaining Database Security
James Perry and Gerald Post
© 2007 by Prentice Hall12-2
Chapter Outline
• Creating and Editing User Accounts• Controlling User Access to Objects• Enforcing Privileges through Views and
Procedures• Protecting Data with Encryption• Auditing the Database
© 2007 by Prentice Hall12-3
12.1 Creating a user with Enterprise Manager
Creating and editing user accounts
© 2007 by Prentice Hall12-4
User Accounts
Role: Agent
Permissions:
Add customer
Add listings
Add offers
…
Database
StewartMRole: Agent
12.2 User roles
© 2007 by Prentice Hall12-5
Table 12.1 Some common system privileges
• ALTER SESSION• ALTER SYSTEM• ALTER USER• AUDIT ANY• BACKUP ANY TABLE• CREATE PROCEDURE• CREATE ROLE• CREATE SEQUENCE• CREATE TABLE• CREATE TRIGGER• CREATE TYPE• CREATE USER• CREATE VIEW• DROP USER• FORCE TRANSACTION
© 2007 by Prentice Hall12-6
Table 12.2 Common object privileges
Privilege Table View Sequence Procedure, Function, or Package
User Defined Type
ALTER X X
DELETE X X
EXECUTE X X
DEBUG X X X X
FLASHBACK X X
INDEX X
INSERT X X
ON COMMIT REFRESH X
QUERY REWRITE X
REFERENCES X X
SELECT X X X
UNDER X X
UPDATE X X
© 2007 by Prentice Hall12-7
Purchasing clerkplaces order
Purchasing managerverifies new supplier
Supplier
Supplier Table
INSERT
Purchase TablePurchase Item Table INSERT
Receiving clerkaccepts items
UPDATEQuantity Received
Accounting clerkauthorizes payment
SELECT
SELECT
AccountsPayableCash
INSERT
12.3 Separation of duties
© 2007 by Prentice Hall12-9
Table 12.3 Desired permissions by object and role
Database Object
Agent role Manager role
TablesAgentsContactReasonCustAgentListCustomersLicenseStatusListingsPropertiesSaleStatus
SelectSelectAllAllSelect?AllAllSelect
AllAllAllAllAllAllAllAll
FormsAgentContactsAgentListingsAgentsContactReasonCustomersLicenseStatusListingActivityListingsManagementPropertiesSaleStatusSearch4Startup
AllAllNoneNoneAllNoneAllAllNoneAllNoneAllAll
AllAllAllAllAllAllAllAllAllAllAllAllAll
Database Object Agent role Manager role
ReportsAgentSalesCustomerListListingsAndOffersSalesByCityAndAgentSalesByMonthAndAgent
Maybe for selfAllAllMaybe for selfMaybe for self
AllAllAllAllAll
© 2007 by Prentice Hall12-11
Management button is not available
12.6 Startup form run by an agent without the Manager role
© 2007 by Prentice Hall12-12
https://server
Client Browser
Server
Server’s public key
Data encrypted with server’s public key
Data decryptedwith server’s private key
Public keyPrivate key
CertificateAuthority
Security
certif
icate
Database
Data
12.7 Public key encryption
Securing Internet transmissions
© 2007 by Prentice Hall12-14
Table 12.4 Oracle auditing types
Type of Auditing Description
Statement Auditing Tracks activity by the type of statement. For example, AUDIT TABLE tracks several DDL statements regardless of the table involved. A broad-based tracking but it can be applied to individual users or to everyone.
Privilege Auditing Monitors the use of system privileges such as AUDIT CREATE TABLE. Can be assigned to track individual users or everyone.
Schema Object Auditing Records the usage of specific statements on individual objects. For instance, AUDIT SELECT ON customers records a note every time someone retrieves data from the customer table. Always applies to all users.
Fine-Grained Auditing The most detailed specifications, you can create any Boolean condition based on individual columns or specific rows of data. Or example, you might track all orders with a value > 100,000.
Auditing the database