Best practice for select access to users

Question

Not sure if this is the correct forum to post, if not then let me know where should I post.
From my understanding this is the best forum to ask this questions.
Are you aware of any "Best Practice Document" to grant select accesses to users on databases. These users are developers which select data out of database for the investigation and application bug fix.
From time to time user want more and more access to different tables so that they can do investigation properly.
Let me know if there exists a best practice document around this space.
Asked in this forum as this is related to PL/SQL access.

Answer 1

Welcome to the forum!
Whenever you post provide your 4 digit Oracle version.
>
Are you aware of any "Best Practice Document" to grant select accesses to users on databases. These users are developers which select data out of database for the investigation and application bug fix.
From time to time user want more and more access to different tables so that they can do investigation properly.
Let me know if there exists a best practice document around this space.
>
There are many best practices documents about various aspects of security for Oracle DBs but none are specific to developers doing invenstigation.
Here is the main page for Oracles' OPAC white papers about security.
http://www.oracletechnetwork-ap.com/topics/201207-Security/resources_whitepaper.cfm
Take a look at the ones on 'Oracle Identity Management' and on 'Developers and Identity Services'.
http://www.dbspecialists.com/files/presentations/implementing_oracle_11g_enterprise_user_security.pdf
This paper by Database Specialists shows how to use Oracle Identity Management to limit access to users such as developers through the use of roles. It shows some examples of users using their own account but having limited privileges based on the role they are given.
http://www.dbspecialists.com/files/presentations/implementing_oracle_11g_enterprise_user_security.pdf
And this Oracle White Paper, 'Oracle Database Security Checklist', is a more basic security doc that discusses the entire range of security issues that should be considered for an Oracle Database.
http://www.oracle.com/technetwork/database/security/twp-security-checklist-database-1-132870.pdf
You don't mention what environment (PROD/QA/TEST/DEV) you are even talking about or whether the access is to deal with emergency issues or general reproduction and fixing of bugs.
Many sites create special READONLY roles, eg. READ_ONLY_APP1, and then grant privileges to those roles for tables/objects that application uses. Then that role can be granted to users that need privileges for that application and can be revoked when they no longer need it.
Some sites prefer creating special READONLY users that have those read only roles. If a user needs access the DBA changes the password and provides the account info to the user. When the user has completed their duties the DBA resets the password to something no one else knows.
Those special users have auditing on them and the user using them is responsible for all activity recorded in the logs during the time the user has access to that account.
In general you grant the minimum privileges needed and revoke them when they are no longer needed; generally through the use of roles.
>
Asked in this forum as this is related to PL/SQL access.
>
Please explain that. Your question was about 'access to different tables'. How does PL/SQL access fit into that?
The important reason for the difference is that access is easily controlled thru the use of roles but in named PL/SQL blocks roles are disabled. So those special roles and accounts mentioned above are well-suited to allowing developers to query data but are not well-suited if the user needs to execute PL/SQL code belonging to another schema (the app schema).