Eddie Carter and Orrin Char, Oracle

• Identity management and security and access management.
• Eddie wore a UGA shirt. Guy in front of me made fun of him obviously not wanting to sell to Georgia Tech. Turns out he’s from  Kennesaw. The GT-UGA rivalry knows no bounds. Love it!
• Handout: Database firewall more auditing and ACLs than enterprise firewalls access to many hosts.
• 67% records breached from servers. 76% breached through weak or stolen credentials. Discovered by an external party. 97% preventable with basic controls. Source: 2013 Data Breach Investigations Report.
• Pre-1997: security issues mistakes. 1998-2007: Privilege abuse. Curiosity. Leakage. 2008-2009: Malicious. Social engineering. Sophisticated attacks. Business data theft. Loss of reputation.
• Can be fined. Buy services for people affected by the breach.
• DBAs are the targets. Phishing to get credentials.
• Change is where gaps are opened. Being more available means more highly privileged users. Consultants and vendors claim they need DBA level access.
• 80% of IT security programs do not address db security. They address outside computers such as with firewalls. More and more attacks exploit legitimate access applications and user credentials.
• Supports SQL Server and MySQL.
• Preventative
  • encryption : If data stolen in encrypted form, then do not have report the breach? Application should not even know it is encrypted. Network encryption now free to us. Autonegotiates with destination. No application changes. Little overhead. Integrated with Oracle technologies. Key management 2 layers. Master in hardware module or in a wallet. Wallet can be tied to hardware and accessed at restart. Data encrypted with table or column key. Table and column keys encrypted with master key.
  • redaction : Use ACLs to determine who can see. It will replace text such as on credit card numbers, SSNs, so can only see a full, partial, fixed.
  • data masking for nonproduction use : copy of production data in test with test being less secure. Masking means no longer valuable data. Finds sensitive columns through templates and convert the data so meaningless. Shuffle salaries. ID numbers randomized even partial. Randomize all but first two characters of last name. Can be two way so change for sending to a partner for process but then revert back when returned.
  • privileged user controls : Compartmentalization of commands. Prevent consultants from querying certain tables. Creates protective zones around schema objects.
• Detective
  • activity monitoring :
  • database firewall : sits on the network. Parses SQL to determine the intent. Whitelist and Blacklist and exception list. If none, then alerts security to it and potentially added to a list. Have a learning and blocking mode. Can return empty result list to a hacker so thinks there are no records.
  • auditing and reporting : analyze audit-event data. Central audit repository so hacker unaware. Default and custom reports.
  • conditional auditing framework : if-this-then-that
• Administrative
  • privilege analysis : privilege capture mode. report on what actual privileges and roles that are used. Revoke unnecessary.
  • sensitive data discovery : scan Oracle for sensitive fields. data definitions.
  • configuration management : discover and classify databases. scan for secure config.