Information Technology, Control, Audit and Security Experience

Column Level VPD In my previous post we did a practical on how to perform Row level restriction using VPD policies. This practical will focus on the Column level restriction. And as said earlier we will be using the HR sample schema. In this tutorial we are going to secure some columns in the HR table “EMPLOYMENT” data.

In our previous post we learnt what the Oracle Virtual Database was all about. If you haven't read it click here . Without wasting much of your time, let get busy with our practicals What is needed W orking Oracle database (10g and above) HR sample schema. Sql work environment (SQL Navigator, Toad, etc) Today's tutorial will look at the following types of Virtual Private Databases: Row level VPD which restricts access to specific rows in a table Column Level VPD  which restricts access to specific columns in a table

Oracle  Virtual Private Database  (VPD)  enables you to create security policies or group policies to control database access at the row and column level. It allows multiple users to access a single schema while preventing them from accessing data which is not relevant to them. VPD uses Fine-Grained Access Control to limit visibility of the data to the specific users. In this post I will be showing you how a VPD is used with its advantages

In my previous post I talked about Auditing UTL_FILE_DIR parameter file entry. If you haven't read it, you can check it out here . In this post I will be focusing on how the UTL_FILE package is actually used to transfer files to the host operating system from the database. This post will be showing you exactly how dangerous the package can be in the hands of a malicious person. Note that EXECUTE on the UTL_FILE package is granted to PUBLIC by default. What this means is that any user created in the database automatically has the right to use this package. Enough of the stories. Now lets get straight to business

UTL_FILE_DIR in the database initialization parameter the Oracle Database is used to determine what operating system directories and files PL/SQL packages, functions, and procedures may be read from or written to when using the standard UTL_FILE database package. Security Concerns The UTL_FILE database package is used to read from and write to operating system directories and files.  By default, PUBLIC is granted execute permission on UTL_FILE. Therefore, any database account may read from and write to files in the directories specified in the UTL_FILE_DIR database initialization parameter. When UTL_FILE_DIR is set to “*”, all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively disables directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should ...

Oracle Initialization Parameters are used to setup or configure the Oracle Instance. The initialization parameters can be used to optimize performance of the database and set database-wide defaults and limits, I have complied a list of important parameters that can control many of the security risks within the database. Let us look at them in details :

Static code analysis, is a method in computer program debugging that is done by examining the code without actually executing the program. The process provides an understanding of the code structure, and can help to ensure that the code adheres to laid down standards. Automated tools can assist programmers and developers and auditors in carrying out static analysis. The process of scrutinising code by visual inspection alone (by looking at a printout, for example), without the assistance of automated tools, is sometimes called program understanding or program comprehension. This post will look at the techniques of static code analysis in order to understand the concept of static code analysis