Confused re Oracle Security Products - Help

Question

Right. I'm experienced with Oracle Discoverer, AS, CMSDK, OC4J, SSO, OID , I am very good on the database and good on RAC
I did a lot of work on various sites enabling SSO /OID ..
Now I go to look at new and improved security /IM products. I have to say I am completely lost.
What goes where ? Is SSO still available, is OID still used. What is all this eSSO . I understand Kerberos and GSSAPI , LDAP and SSL what are all the authentication products.
What is obsolete, what is current, what is coming. Is there any coherent document that lays out strategy in this area, because most of our customers are just as confused

Answer 1

If you declared a fine-grained auditing policy on just the 5 or 6 tables you say you are interested in, why would you expect that to cause a performance issue?
Why would you expect it to be more efficient to send an email when those tables are accessed rather than having FGA write a row to an audit table?
That doesn't make sense. Connecting over the network to the SMTP server and exchanging dozens of packets with the SMTP server to send an email is going to be orders of magnitude less efficient than writing a row to an audit table. If you're writing so many rows to the audit table that this becomes a performance bottleneck, you'd be filling the inbox of whoever received these emails with far more messages than they could possibly handle.
I haven't read the particular book you reference. Most books and papers that discuss auditing will discuss the performance implications. And they generally caution that you should be thoughtful about what you audit because if you make the mistake of trying to audit every action, you're going to end up spending most of your time writing audit records. And your audit trail is going to be so large that you won't be able to do anything with it because it's too annoying to query. That doesn't mean that Oracle's auditing is inherently problematic, it simply means that you need to be aware that auditing requires the database to do more work and that you should be judicious about auditing things that you actually care about.
Justin