The number of security threats related to operating systems and databases are increasing every day, and this trend is expected to continue. Therefore, effective countermeasures to reduce or eliminate these threats must be found and applied.
"Oracle 11g Anti-hacker's Cookbook" covers all the important security measures that can be deployed to protect hackers from attacking your Oracle database. It provides many useful tips and tricks. As such, you should add this book to your arsenals of Oracle security.
Connecting to the Database
There are different ways of connecting to an Oracle database (i.e., creating an Oracle session):
- Programmers
- Use ODBC, JDBC and OCI
- Database Administrators
- Use SQL*Plus and Oracle Enterprise Manager (OEM)
The Weakest Link
Security practitioners[2] often point out that security is a chain; and just as a chain is only as strong as the weakest link, a database security system is only as secure as its weakest component.
Therefore, there are no short-cuts for Oracle protection. In this book, it describes lots of tips and tricks which can be deployed to fortify components along this connection chain.
Types of attacks
There can exist many types of attacks on an Oracle session. Here are some of them as covered in this book:
- Man-in-the-middle-type (MITM) attack
- Attack in which an interposed attacker hijacks a client connection
- TCP and UDP protocol-level attack
- Targeted towards the network traffic and the data in flight
- TNS poison attack[3]
- TNS poison attack is classified as a man-in-the-middle-type attack
- Replay attack
- An attack in which a valid data transmission is maliciously or fraudulently repeated or delayed
- DoS attack
- To fill up the the file systems on the disk with useless log messages
- To send a succession of SYN requests
- To send large numbers of IP packets with the source address faked to appear to be the address of the victim
- IP Spoofing
- To create Internet Protocol (IP) packets with a forged source IP address, with the purpose of concealing the identity of the sender or impersonating another computing system
- Dictionary and pattern matching type attack
- Password cracking
- Other attacks
- Target the database, listener, and configuration files
And lastly and the most importantly, the weakest part of your Oracle system will be administrators, users or tech support people who fall prey to social engineering.
General vs. Oracle Specific Recipes
In this book, many recipes are provided to show how those security risks could be mitigated or reduced. To sum up, recipes can be classified into general or Oracle specific security measures. For example, to confront different interception-type attacks, you can use either Oracle Advanced Security encryption and integrity, or alternatives such as IPSEC, stunnel, and SSH tunneling.
For general measures, topics such as OS security and Securing the network and data in transit are covered in Chapter 1 and 2. Starting from Chapter 3, security measures using Oracle products start emerging, which includes the following:
- Oracle RMAN
- Oracle Enterprise Manager
- Oracle Virtual Private Database
- Oracle Label Security
- Oracle Database Vault
- Oracle Audit
- Oracle Cryptographic API
- Oracle Wallets
Other Recommendations
In the book, it also make suggestions such as:
- You should implement data audits to detect the origin of the attack or the source of the inappropriate data access or modification
- You should develop and implement appropriate alerting systems to proactively detect and prevent attacks on systems and data
- You should test these security measures first before their final deployment
- You should perform security assessments regularly on your system
Picture Credit
- Figure 3-2 Remote Connection in Oracle® Database Express Edition 2 Day DBA 10g Release 2 (10.2)
References
- Oracle 11g Anti-hacker's Cookbook
- Viega, John & McGraw, Gary. Building Secure Software: How to Avoid Security Problems the Right Way. Boston, MA: Addison-Wesley, 2002.
- Oracle Database TNS Listener Poison Attack
- Replay Attack (wikipedia)
- Oracle® Database Installation Guide 11g Release 2 (11.2) for Linux
- Securing the Weakest Link
- The Onion Model
No comments:
Post a Comment