This checklist is to be used to audit an Oracle database
installation. This checklist is just that “a checklist” and does not
contain any specific SQL or shell commands because it is intended to
be just a list rather than a “how to” document otherwise. It is also
important that the Oracle database is not checked in isolation and
the surrounding elements such as the operating system used, the
network configuration, web access, application servers and clients
are considered.
The page has a huge checklist of step-by-step security checks broken
down into areas:
· Host
Operating System – Although this checklist includes items that
specifically relate to the operating system hosting the Oracle
installation they are included because they have a direct effect on
Oracle. It is imperative that the host operating system is secured
before any applications (in this case Oracle). The same applies to
network components and other applications hosted on the same
servers. Please consult other S.C.O.R.E documents (
http://www.sans.org/score ), center for internet security
(CIS) benchmarks and tools (
http://cisecurity.org )
and SANS step-by-step guides (
http://store.sans.org )
for more information.
· Procedural
– It is important to also consider physical security of the servers
hosting the Oracle database and also to employ security procedures
and policies and to develop standards for change and control.
·
Findings
and data sensitivity – Establish the sensitivity of the data stored
within the Oracle database and establish rules for reporting any
security findings back to the organization. This should take into
account availability, confidentiality and the integrity of the data.
This is important to be able to place any findings within the
correct context when reporting back results of an audit.
·
Practicality
of the checklist – This list is the culmination of the knowledge of
many Oracle database security practitioners and as such includes
every issue thought to be relevant to somebody. To some
organizations some items are important to be fixed and to others not
relevant because of mitigating circumstances. Oracle can be
configured in many differing ways and this affects how it is
secured. The list has been provided with severity levels to allow
the audit to be conducted to a specified level and also includes OS
and Oracle versions relevancies.
Oracle database security standards - This
checklist could also be used to define a
company.
Also, for complete auditing details, see Arup Nanda's book "Oracle
Privacy Security Auditing" for complete coverage of this important
topic:
and include the URL for the page.
