Good network security is accomplished by utilizing port and protocol screening with routers, firewalls, and Intrusion Detection Systems.Port and protocol screening with routers, firewalls, and Intrusion Detection Systems create a bastion against network attacks. A device that routes and translates information between interconnected networks is called a firewall. Firewalls have a different function Routers, not firewalls, use destination address and origin address to select the best path to route traffic. When installing a firewall, the first action is to stop all communication. After installation, the System Administrator adds rules that allow specific types of traffic to pass through the new firewall. After installation of a firewall, the System Administrator adds rules that allow specific types of traffic to pass through the new firewall A switch is a data link layer device that forwards traffic based on MAC addresses. Switching is performed in hardware instead of software, so it is significantly faster. Network Security Wizards Dragon 4.0 is an example of vendors that offer Intrusion Detection Systems or IDS 1. Authentication is the process of verifying the identity of a user, device, or other entity. Once the identity is verified, a trust relationship is established and further network interaction is possible. 2. Authorization is the process of assigning various levels of access and capabilities for the authenticated user. In other words, authorization allows assigned levels of access in the database environment. 3. Oracle 8i supports 3 models for storing Authorizations in a centralized directory service. Public Key Infrastructure, Microsoft Active Directory, or Distributed Computing Environment. PKI together with Oracle Internet Directory is the optimal method. 4. Most issues of data security can be handled by Oracle8i authentication mechanisms. 5. The init.ora file, or instance configuration file, is one of the key configuration files in an Oracle database environment that must be protected. This file contains all the initialization parameters: the configurable parameters that are applied when an instance is started up. 6. A file transfer copy of the tnsnames.ora configuration file is a common way for hackers to discover whether the AUDIT function is enabled. If they determine that AUDIT is enabled, they can take steps to cover their activities, or even delete the audit trail. 7. To protect the key configuration files at the operating system level, the system administrator should ensure that UNIX file permissions and the umask environment variable are set for the optimal combination of file restrictions in that environment. The default value of umask is 022, but the UNIX system administrator responsible for that environment may decide that a more restrictive value is appropriate. 8. In Sun Solaris UNIX environments, a low level of security can be achieved using access control utilities such as GETFACL and SETFACL. These access control list utilities are specific to the Sun Solaris UNIX platform 9. Controlling access by using database object privileges is called DAC, or discretionary access control. DAC controls access to any given object by granting specific privileges to user objects or roles. 10. Giving a database user object the authority to perform INSERT or DELETE commands in a given table is an example of a privilege. This privilege applies to a given user object, unlike a role which applies to a group of user objects. 11. Virtual Private Database technology allows security access controls to be applied directly to views or tables. Unlike other access control methods, defined access controls apply directly to the table or view, not the user object. 12. Oracle Label Security provides fine-grained access control within the database by using access control tables and a security policy. Label Security augments Virtual Private Databases to provide a tighter security for data. 13. The transformation of data by using cryptography to make it unintelligible is known as encryption. To encrypt a file is to render that file completely unreadable until it has been properly decrypted. 14. DES and RC4 are examples of symmetric key encryption. 3DES, DES40 and RC2 are additional symmetrical encryption algorithms. 15. Cryptography that requires key agreement, or keys on both sides of the session, is known as Diffie-Hellman cryptography. This allows mutual authentication with the same common key. Advanced Security Option uses Diffie-Hellman cryptography. 16. Cryptography that provides for private communications within a public network without trusting anyone to keep secrets is called public key infrastructure, or PKI. HTTP and LDAP protocols are included within the public key infrastructure. 17. The most widely used PKI application that supplies data integrity and encryption in the transport layer of the Open Systems Interconnection (OSI) model is the secure sockets layer, or SSL, protocol. SSL is typically used for authenticating servers and for the traffic encryption of credit cards and passwords. 18. A data dictionary table called sys.aud$ is the database audit trail. The database audit trail stores records which audit database statements, schema objects, and privileges. 19. An entry in the operating system audit trail is always created when instance startup or instance shutdown occurs, or when the sys user object logs in. The instance startup entry is necessary in order to maintain a complete audit trail when the data dictionary is not available. 20. The type of audit trail that efficiently consolidates audit records from multiple sources (including Oracle databases and other applications which use the audit trail) is the operating system audit trail. Operating system audit trails allow all audit records to reside in one place, including database audit trails. 21. You can use Oracle Reports to create customized reports of audit information when the database audit trail is in use. You can analyze database audit trail information and produce good reports from that analysis, which is an advantage over using the operating system audit trail method. 22. To protect the database audit trail from unauthorized deletions, grant the Delete Any Table system privilege to security administrators only. An unauthorized user with this system privilege can severely damage a database security trail, or even delete all the data. Assign this privilege very carefully. 23. Advanced Security Option provides a single source of integration with network encryption, single-sign-on services, and security protocols. ASO is the centralized source for all of these security features. 24. ASO ensures that data is not disclosed or stolen during Net8 transmissions by means of RSA encryption, DES encryption, and Triple-DES encryption. 25. The SSL feature of ASO allows you to use the SHA, or secure hash algorithm. The SHA is slightly slower than MD5, but it is more secure against brute-force collision and inversion attacks. 26. he SSO, or single sign-on, feature of ASO allows access to multiple accounts and applications with a single password. SSO simplifies the management of user accounts and passwords for system administrators. 27. LDAP stands for Lightweight Directory Access Protocol, which is a directory service standard based on the ISO X.500 specification. LDAP is a protocol defined and maintained by the same task force which defined the HTTP and TCP/IP protocols. 28. OID means Oracle Internet Directory, which is the LDAP directory available from Oracle. OID is a directory service compliant with LDAP v. 3, and it offers scalability, security, and high availability. 29. The scalability of OID allows thousands of LDAP clients to be connected together without harming performance. Much of this scalability is accomplished using connection pooling and multithreaded server implementations. 30. The Java-based tool for administering OID is called Directory Manager. The Directory Manager tool provides administrative transparency for the Oracle environment, and is based on Oracle Enterprise Manager. 32. OID security controls data access at the authentication level, by using access control lists. Data access is controlled with anonymous authentication methods, either password-based or certificate-based (through SSL). 33. An enterprise user is defined and managed in a directory. All enterprise users have a unique identity which spans the enterprise. 34. Enterprise User Security Management allows large user communities to access multiple applications with a single sign-on. User credentials and authorizations are stored in a directory. This allows single sign-ons using x.509v3 certificates over SSL. 35. Groups of global roles are called enterprise roles, which are assigned to enterprise users in order to avoid granting roles to hundreds or thousands of individual users. 36. You can remove the need to create duplicate user objects in every database by using the shared schemas feature. The benefit of shared schemas is fewer user accounts. 37. The current user database link feature allows user objects to connect to another database instance as the procedure owner. A current user database link requires global users and SSL. 38. The Login server provides a single, enterprisewide authentication mechanism. This authentication mechanism allows users to identify themselves securely to multiple applications through a single authentication step, or single sign-on (SSO). 39. The single sign-on feature allows the storage of passwords in LDAP-compliant directory services such as Oracle Internet Directory. Storing usernames and passwords in a directory improves efficiency by centralizing this administrative duty. 40. A partner application can accept authentication directly from the Login server. Partner applications are modified to work within the SSO framework. 41. External applications are not modified to work within the SSO framework. The Login server does not store the username and password, but only supplies this native information from the external application. The benefits of LDAP directories are not available to external applications. 42. During Oracle product installations, user objects are created with default passwords. SYS, SYSTEM, and ORACLE are the most critical to examine, but all objects that may have default passwords should be examined. 43. V_$PWFILE_USERS is the view that shows which user objects have been granted SYSDBA or SYSOPER privileges. It is normal for INTERNAL and SYS objects to have the privileges, but suspect any other user objects that have these privileges. When in doubt, revoke the privilege and monitor the change. 44. Users with unlimited tablespace can accidentally or intentionally use 100 percent of available tablespace. Review this ability by examining the DBA_TS_QUOTES view. User objects have unlimited tablespace if that object displays MAX_BLOCKS or MAX_BYTES columns equal to -1. Any user object that has this privilege should be examined closely for verification of need. 45. Invoke SQL*Plus with the NOLOG switch to remove the plain-text password entry from the UNIX process table. Sessions started with this /nolog SQL*Plus switch cannot reveal the password when another session uses the Ps -ef|grep SQL*Plus command. 46. The data dictionary view, DBA_ROLES, will reveal the names of all roles and their current password status. It is a good view for reviewing any potential security risks related to roles and their respective passwords. Review this view regularly to verify that these roles are not being misused, and that a secure password policy is in place for all roles. 47. Virtual Private Databases is a good security product but requires programming to implement. Oracle Label Security provides similar row-level security out-of-the-box without this same need. Oracle Label Security provides row-level security in databases without the need for programming that VPD requires. 48. The Oracle Label Security administrative tool that allows you to quickly implement a security policy on a table is named Policy Manager. Oracle Policy Manager allows administrators to use predefined security policies to quickly implement row-level security on any table. 49. Oracle Label Security controls access to rows in database tables based on a label contained in the row and the label privileges given to each user session. Beyond Directory Access Controls restrictions, row-level security provides a finer level of security by using these two labels to implement further restrictions and provide ease of administration. 50. The user label specifies the data that a user or stored program unit has access to. This is one element of security using Oracle Label Security. 51. The row label specifies the sensitivity of the data placed under control. The row label has a different function than the user label. The row label provides security on the data, not the user session or stored program unit. 52. Oracle AUDIT performs the monitoring and recording of selected user database actions. Oracle AUDIT is used to watch over user actions in a database instance. 53. The AUDIT_TRAIL init.ora parameter is used to stop, start, and configure the AUDIT function for any given instance. NONE is the default value of this parameter; the OS value of this parameter enables all audit records to go to the operating system's audit trail, and the dB value of this parameter enables database auditing. 54. Minimize auditing. If only user login monitoring is required, listener log monitoring is an alternative to using AUDIT. All sessions route through the listener, and an entry is made in the listener log for each session. 55. To maintain optimal performance, you should periodically issue the SQL command truncate on the audit table. Old, unnecessary data should be purged regularly. The length of time between truncate command invocations that will maintain the optimal audit table size will vary by the volume of audit information retained. 56. The most critical role to control is the DELETE_ANY_CATALOG role. Only DBAs should have this role. This is key to protecting the audit trail. Restricting this role will ensure that the audit trail is protected from deletion. Hackers will often remove or edit the audit trail to cover their activities. 57. Advanced Security Option (ASO) encrypts all protocols in the database. Net8 connections to the database are encrypted, as are all connections to the database. 58. Data integrity is provided by the checksumming algorithm. The checksumming technique detects replay attacks, where a valid $100.00 withdrawal is resubmitted 100 unauthorized times. 59. DES is an example of native ASO cryptography. An example of an SSL cryptography that expands on DES is the 3 DES cryptography. Triple Data Encryption Standard (DES) makes three passes during the cryptography process, providing a higher level of security. 60. A system that uses polices and procedures to establish a secure information exchange is called the public key infrastructure, or PKI. Several elements of PKI include SSL, x.509v3 certificates, and the Certificate Authority. 61. Benefits of using the public key infrastructure include the ability to scale to the Internet and accommodate millions of users. Efficiency is paramount when millions of users are part of the community.