Best Practice Internet Security with ADO / OraMTS / OraOLEDB and 9i?

Hi people,
I have the following scenario to support and I URGENTLY need some information regarding the security model vs performance envelope of these platforms.
We currently are developing a web-application using IE 5.0^ as our browser, IIS 5.0 as our server, ASP (JScript) as our component glue, custom C++ COM+ middle tier components using ADO / Oracle OLE DB to talk to a Solaris based Oracle 9i instance.
Now it comes to light from the application requirements that the system should, if at all possible, be supporting Virtual Private Databases for subscribers [plus we need to ease backend data service development and row-level security combined with fine grained audit seems the way to go].
How does one use Oracle's superior row-level security model in this situation?
How does one get the MS middle tier to authenticate with the database given that our COM+ ADO components are all required to go through ONE connection string? [Grrrr]
Can we somehow give proxy rights to this identity so that it can "become" and authenticate with an OID/LDAP as an "Enterprise User"? If so, how?
I have seen a few examples of JDBC and OCI middle-tier authentication but how does one achieve the same result as efficiently as possible from the MS platform?
It almost appears, due to connection pooling that each call to the database on each open connection could potentially be requiring a different application context - how does one achieve this efficiently?
If this is not the way to go - how could it work?
What performance tradeoffs do we have using this architecture? (And potentially how will we migrate to .Net on the middle tier?)
As you can see, my questions are both architectural and technical. So, are there any case studies, white papers or best practice monographs on this subject that are available to either Technet members or Oracle Partners?
Alternatively, anyone else come up against this issue before?
Thanks for your attention,
Lachlan Pitts
Developer DBA (Oracle)
SoftWorks Australia Pty Ltd

Similar Messages

What are some best practices to work with Compressor 3 droplets and new Compressor 4?

I have purchased Final Cut Pro X / Motion 5 and Compressor 4 from the App Store. My installation of Final Cut Studio 6.0.6 / Motion 3.0.2 / Compressor 3.0.5 has been moved to a new folder "Final Cut Studio". I have started the old version of Motion first as advised in this document.
I just tried to use my old Compressor 3 droplets and i am able to convert as before.
I am wondering what I should do now and what the best practices are
Use the old droplets and stick with Compressor 3?
Import the droplets to a new location to be able to use them in Compressor 4?
Recreate new droplets with similar settings within Compressor 4?
What are the changes I can expect from using Compressor 4?

I've found that it helps to meet with each person in your new org that you'll be supporting. Start with the Eloqua Admin(s) and ask for an overview of standard reports, naming conventions, folder structure, processes, etc. Make sure to do the same with sales operations, too. If you're moving into an admin role ask for the data dictionary so you can study it to understand how the data maps from front end CMS to MAP to CRM.
The next phase would be to meet with field marketing and campaign managers. Ask them about current projects, future projects and how you'll support their success with Eloqua.
And last but certainly not least - process documentation! Ask for all of those things and you'll be rocking and rolling in no time.
Good luck in your new role!

Best Practice for Securing Web Services in the BPEL Workflow

What is the best practice for securing web services which are part of a larger service (a business process) and are defined through BPEL?
They are all deployed on the same oracle application server.
Defining agent for each?
Gateway for all?
BPEL security extension?
The top level service that is defined as business process is secure itself through OWSM and username and passwords, but what is the best practice for security establishment for each low level services?
Regards
Farbod

It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
You can enforce rules at your network layer to allow access to the App server only from Gateway.
When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
The next BPEL developer in your project may not be aware of Security extensions
Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
Thanks
Ram

What is the best practice in securing deployed source files

hi guys,
Just yesterday, I developed a simple image cropper using ajax
and flash. After compiling the package, I notice the
package/installer delivers the same exact source files as in
developed to the installed folder.
This doesnt concern me much at first, but coming to think of
it. This question keeps coming out of my head.
"What is the best practice in securing deployed source
files?"
How do we secure application installed source files from
being tampered. Especially, when it comes to tampering of the
source files after it's been installed. E.g. modifying spraydata.js
files for example can be done easily with an editor.

Hi,
You could compute a SHA or MD5 hash of your source files on
first run and save these hashes to EncryptedLocalStore.
On startup, recompute and verify. (This, of course, fails to
address when the main app's swf / swc / html itself is
decompiled)

Best practices to secure out of bound management access

What are the best practices to secure Out Of Bound Management (OOBM) access?
I planning to put in an DSL link for OOBM. I have a console switch which supports SSH and VPN based on IPSec with NAT traversal. My questions are -
Is it secure enough?
Do I need to have a router/firewall in front of the console switch?
Im planing to put a Cisco 1841 router as an edge router. What do you think?
Any suggestions would be greatly appreciated.

Hi,
You're going to have an OOB access via VPN?
This is pretty secure (if talking about IPsec)
An 1841 should work fine.
You can check the design recommendations here:
www.cisco.com/go/srnd
Chose the security section...
Hope it helps.
Federico.

Error while Connecting report Best Practices v1.31 with SAP

Hello experts,
I'm facing an issue while trying to connect some of my reports from Best Practices for BI with SAP.
It only happens when it's about info sets, the other ones that are with SAP tables go smoothly without a problem.
The most interesting is I have already one of the reports connected to SAP info sets.
I have already verified the document of steps of creation of additional database that comes with BP pack. They seem ok.
Here goes what Crystal Reports throws to me after changing the data source to SAP:
For report "GL Statement" one of the Financial Analysis one which uses InfoSet: /KYK/IS_FIGL_I3:
- Failed to retrieve data from the database; - click ok then...
- Database connector error: It wasn't indicated any variant for exercise (something like this after translating) - click ok then
- Database connector error: RFC_INVALID_HANDLE
For report "Cost Analysis: Planned vs. Actual Order Costs" one of the Financial Analysis one which uses InfoSet: ZBPBI131_INFO_ODVR and ZBPBI131_INFO_COAS; and also the Query CO_OM_OP_20_Q1:
- Failed to retrieve data from the database; - click ok then...
- Database connector error: check class for selections raised errors - click ok then
- Database connector error: RFC_INVALID_HANDLE
Obs.: Those "Z" infosets are already created in SAP environment.
The one that works fine is one of the Purchasing Analysis reports:
- Purchasing Group Analysis -> InfoSet: /KYK/IS_MCE1
I'm kind of lost to solve this, because I'm not sure if it can be in the SAP JCO or some parameter that was done wrongly in SAP and I have already check possible solutions for both.
Thanks in advance,
Carlos Henrique Matos da Silva - SAP BusinessObjects BI - Brazil.

I re-checked step 3.2.3 - Uploading Crystal User Roles (transaction PFCG) - of the manual where it talks about CRYSTAL_ENTITLEMENT and CRYSTAL_DESIGNER roles, I noticed in the Authorizations tab that the status was saying it hadn't been generated and I had a yellow sign, so then that was what I did (I generated) as it says in the manual.
Both statuses are now saying "Authorization profile is generated" and the sign is now green on the tab.
I had another issue in the User tab (it was yellow as Authorizations one before generating)....all I needed to do to change to green was comparing user (User Comparison button).
After all that, I tried once more to refresh the Crystal report and I still have the error messages being thrown.
There's one more issue in one of the tabs of PFCG transaction, it is on the Menu one where it is with a red sign, but there's nothing talking about it in the manual. I just have a folder called "Role menu" without anything in it.
Can it be the reason why I'm facing errors when connecting the report to SAP infoSets? (remember one of my reports which is connected to an infoSet works good)
Thanks in advance,
Carlos Henrique Matos da Silva - SAP BusinessObjects BI - Brazil.

Best Practice for Security Point-Multipoint 802.11a Bridge Connection

I am trying to get the best practice for securing a point to multi-point wireless bridge link. Link point A to B, C, & D; and B, C, & D back to A. What authenication is the best and configuration is best that is included in the Aironet 1410 IOS. Thanks for your assistance.
Greg

The following document on the types of authentication available on 1400 should help you
http://www.cisco.com/univercd/cc/td/doc/product/wireless/aero1400/br1410/brscg/p11auth.htm

Best practice for dealing with Recordsets

Hi all,
I'm wondering what is best practice for dealing with data retrieved via JDBC as Recordsets without involving third part products such as Hibernate etc. I've been told to NOT use RecordSets throughout in my applications since they are taking up resources and are expensive. I'm wondering which collection type is best to convert RecordSets into. The apps I'm building are webbased using JSPs as presentation layer, beans and servlets.
Many thanks
Erik

There is no requirement that DAO's have a direct mapping to Database Tables. One of the advantages of the DAO pattern is that the business layer isn't directly aware of the persistence layer. If the joined data is used in the business code as if it were an unnormalized table, then you might want to provide a DAO for the joined data. If the joined data provides a subsiduray object within some particular object, you might add the access method to the DAO for the outer object.
eg:
In a user permissioning system where:
1 user has many userRoles
1 role has many userRoles
1 role has many rolePermissions
1 permission has many rolePermissions
ie. there is a many to many relationship between users and roles, and between roles and permissions.
The administrator needs to be able to add and delete permissions for roles and roles for users, so the crud for the rolePermissions table is probably most useful in the RoleDAO, and the crud for the userRoles table in the UserDAO. DOA's also can call each other.
During operation the system needs to be able to get all permissions for a user at login, so the UserDAO should provide a readPermissions method that does a rather complex join across the user, userRole, rolePermission and permission tables..
Note that f the system I just described were done with LDAP, a Hierarchical database or an Object database, the userRoles and rolePermissions tables wouldn't even exist, these are RDBMS artifacts since relational databases don't understand many to many relationships. This is good reason to avoid providing DAO's that give access to those tables.

Best practice when dealing with long clips

I have some long clips that I want to use more than once with different in and out points. I know this can't be done so is the best practice to make duplicates of the clips and set different edit points or somehow roughly split the large clip into smaller clips and name them accordingly.

Not certain what you think you can't do. Take a long clip and open it in the Viewer. Set In and Out points. Drop that into the Timeline. Now you can move along in the Viewer clip and set new Ins and Outs and drop that into the Timeline. Clips in the Timeline are created from the Ins and Outs you set in the Viewer.
Is that what you want to do? If it is, I don't where making copies of the clip would work for you
Later, if you want to match up a clip in the Timeline to that master clip, just use Match Clip (find) in the timeline to find where it correaltes to your main clip
You can have FCE automatically create subclips at camera cut points by using DV Stop/Start Detect if that is what you're looking for

Best practice to deal with computer or departed employee

Dear All,
I would like to inquire about the best practice to deal with computer and computer account of a departed employee. should be disabled, reset, deleted, or just kept as it is until it is needed by another user?
Regards
hiam
Hiam

Ultimately your needs for their identities and equipment after they leave are what dictate how you should design this policy.
First off, I recommend disabling the account immediatly following the employee's departure. This prevents the user from using their credentials to log on again. Personally I have a "Disabled Users" OU in Active Directory. When I disable accounts
I move them here for easy future retrieval.
It is possible the user may return, or if they have access to certain systems you may need the account again. I would keep the accounts for a specific amount of time (e.g. 6 months, but this depends on your needs) and then delete them after this period of
time.
If the employee knows the passwords to any shared accounts (not a good idea though many organizations have these) or has accounts in other systems that do not use Active Directory authentication, immediately change the passwords to these accounts again following
the employee's departure.
If the employee had administrative access to their computer (not a good idea, though is the reality in most cases) you should disable the computer account and remove it from the network. This will prevent the employee from remotely accessing the machine
until you are able to rebuild or inspect it for unapproved changes.
Ask the user's manager, team members, and subordinates if there are any files that the employee would have stored on their computer. Back these up as necessary.
Most likely you will reuse the computer for another employee. For best results you should use an image so you can re-image their machine and not have to worry whether they had installed any unwanted software (backdoors, viruses, illegal software, etc).
Hope this helps.
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights

Best practices of integration with SAP Netweaver

Hi All,
I'm totally new to SAP Netweaver but I have a task to integrate our system with SAP ECC (R/3). We are using SAP Netweaver 6.4. The goal of integration is to provide for user list of available modules (Sales and Distribution, Human Resource, Payroll, etc) and when user selected for example Payroll we need to display list of available BAPIs. In general weare able to create Enterprise Web Service for some BAPI and consume it. But the problem is that everytime when administrator changed BAPI process (for example added new field to Business Object) we need to regenerate wsdl and change our client application. Does Netweaver provide some Web Service which can retrieve list of applications, list of BAPI processes and can retrieve meta data of some BAPI? Something like Partner Web Service interface?
We are looking for best practices of integration with SAP Netweaver. We are trying to develop something like adapter which will be able to pull data into SAP ECC system is there any generic way to develop this adapter?
Thanks in advance for your help.
Yura.

Hi Yura !!
As far as I know, this is not possible yet. Using SAP Netweaver XI/PI, although it adds value to the webservice scenario exposing BAPI functionality, it also needs to maintain a refreshed version of the BAPI definition in its repository. Depeding the complexity of the change in the BAPI structure, maybe PI may allow you to continue working without changes.
Maybe a good practice is not to make too much changes to a production BAPI, instead make a review in development environment, and once it is stable, use it in production. Other good practice is to keep older versions of BAPIs and add the changed ones as new versions to have back-compatibility
Regards,
Matias.

Internet Security, Anti-Virus, Anti-Spyware and Anti-Malware

What is the best internet security, anti-virus, anti-spyware and anti-malware software to use on a MacBook Pro 13' (Late 2011 model) on both Mac and Windows 7 (Parallel 7) without slowing down or effecting the operating system too much ? Do I need to get the free or paid version ?

Although anti-virus software is not necessary on a Mac, you do need to be aware of what's out there and how to protect yourself against possible new threats. See my Mac Malware Guide.
As for running anti-virus in Windows 7, that's a Windows issue. I personally put AVG Free on the Windows machines used by my family, but I'm no Windows expert. I'm sure different folks here will have different recommendations, and a few of those folks may even be Windows experts! (In other words, that may be a question better suited for other forums where a higher percentage of Windows users hang out.)

Is Adobe Connect part of Adobe Creative Cloud? Are there any best practices ideas from people who use Connect and Creative Cloud?

Is Adobe Connect part of Adobe Creative Cloud? Are there any best practices ideas from people who use Connect and Creative Cloud?
I have an Adobe Connect account and I'm are also in the early stages of developing a webinar. I am looking for any tips and advice from anyone who uses both of these services.

As the £27, was an introductory offer. Upon the completion of one year, the price will change to the normal creative cloud cost which is at £46.88. However if you have the previous versions of the creative suites like CS 3, 4, 5, 5.5 or the CS 6. You can avail the offer at £27.34 per month incl. VAT. However this Requires annual commitment; billed monthly.

Best practice for securing confidential legal documents in DMS?

We have a requirement to store confidential legal documents in DMS and are looking at options to secure access to those documents. We are curious to know. What is the best practice? And how are other companies doing it?
TIA,
Margie
Perrigo Co.

Hi,
The standard practice for such scenarios is to use 'authorization' concept.You can give every user to use authorization to create,change or display these confidential documents. In this way, you can control access authorization.SAP DMS system monitors how you work, and prevents you from displaying or changing originals if you do not have the required authorization.
The below link will provide you with an improved understanding of authorization concept and its application in DMS
http://help.sap.com/erp2005_ehp_04/helpdata/en/c1/1c24ac43c711d1893e0000e8323c4f/frameset.htm
Regards,
Pradeepkumar Haragoldavar

Best Practices of security for develop applications

I need information about a model to use for develop application using Forms and Reports. I read many documents about best security practices for database, but I donÂ´t find information about how can I join the database security with my software, and how can I establish an standard for my programmers.
Thanks you for your help.

There are a number of levels of implementation pain here-- best practices in a Fortune 500 company, for example, are likely to require a lot more infrastructure than best practices in a 5000 person organization. A Fortune 500 is also much more likely to have requirements based on the needs of a security team separate from the DBA group, requirements about auditing, etc.
At the high end, everyone in your organization might be an enterprise user authenticated against a LDAP repository (such as Active Directory) with a variety of functional roles granted to those users and potentially something like fine-grained access control in the database. Depending on how applications are deployed, you might also be using proxy authentication to authenticate these individual users.
Deploying this sort of infrastructure, though, will be somewhat time intensive and will create a degree of administrative overhead that you may not need. It will also potentially require a decent investment in development costs. Your needs may be far simpler (or more complex), so your security model ought to reflect that.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Best Practice Internet Security with ADO / OraMTS / OraOLEDB and 9i?

Similar Messages

Maybe you are looking for