Information Technology, Control, Audit and Security Experience

Mobile phones have transcended from just making calls to being used as a private vault. Nowadays mobile phones are used to store extremely sensitive data including authentication to corporate and personal emails and most especially banking credentials. A high proportion of bank customers now have mobile phone numbers linked with their bank accounts due to the availability of several alternate banking channels (eg USSD, Mobile Banking etc.). The risk is also heightened now that most mobile phones serve as a device for Multifactor Authentication to mostly banking transactions. These mobile phones contain a small device called  Subscriber Identity Module (SIM) which enables the transmitting and receiving of the signals to and from the network provider.   In recent times, the financial industry has experienced a surge in SIM Swap and SIM Cloning related fraud   SIM Swap VS SIM Cloning attacks. SIM swap is achieved by convincing the mobile phone provider represe...

Column Level VPD In my previous post we did a practical on how to perform Row level restriction using VPD policies. This practical will focus on the Column level restriction. And as said earlier we will be using the HR sample schema. In this tutorial we are going to secure some columns in the HR table “EMPLOYMENT” data.

In our previous post we learnt what the Oracle Virtual Database was all about. If you haven't read it click here . Without wasting much of your time, let get busy with our practicals What is needed W orking Oracle database (10g and above) HR sample schema. Sql work environment (SQL Navigator, Toad, etc) Today's tutorial will look at the following types of Virtual Private Databases: Row level VPD which restricts access to specific rows in a table Column Level VPD  which restricts access to specific columns in a table

Oracle  Virtual Private Database  (VPD)  enables you to create security policies or group policies to control database access at the row and column level. It allows multiple users to access a single schema while preventing them from accessing data which is not relevant to them. VPD uses Fine-Grained Access Control to limit visibility of the data to the specific users. In this post I will be showing you how a VPD is used with its advantages

In my previous post I talked about Auditing UTL_FILE_DIR parameter file entry. If you haven't read it, you can check it out here . In this post I will be focusing on how the UTL_FILE package is actually used to transfer files to the host operating system from the database. This post will be showing you exactly how dangerous the package can be in the hands of a malicious person. Note that EXECUTE on the UTL_FILE package is granted to PUBLIC by default. What this means is that any user created in the database automatically has the right to use this package. Enough of the stories. Now lets get straight to business

UTL_FILE_DIR in the database initialization parameter the Oracle Database is used to determine what operating system directories and files PL/SQL packages, functions, and procedures may be read from or written to when using the standard UTL_FILE database package. Security Concerns The UTL_FILE database package is used to read from and write to operating system directories and files.  By default, PUBLIC is granted execute permission on UTL_FILE. Therefore, any database account may read from and write to files in the directories specified in the UTL_FILE_DIR database initialization parameter. When UTL_FILE_DIR is set to “*”, all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively disables directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should ...

Oracle Initialization Parameters are used to setup or configure the Oracle Instance. The initialization parameters can be used to optimize performance of the database and set database-wide defaults and limits, I have complied a list of important parameters that can control many of the security risks within the database. Let us look at them in details :