Database Security against 'connect internal'

Question

Hi Dba's
Is there any way to set up a password authentication while connecting as
oracle(unix)user during 'connect internal' connection?. The reason is though oracle owner password can be kept properly, still the system admin(unix)can still use su (unix)command to become oracle user and connect to oracle without validating password.
What is the best way to set up a password by which the password will be validated during the connection time.
Please note ....!!!! Creation of exclusive password file, changes in init parameters everything has been tried.
Hence, looking for any better solution.
Regards
_RamV
null

Answer 1

There certainly is a need for securing your database from administrators. The idea that you MUST trust your dba or your sys admins is no longer a reasonable one. Just to give you an example, let's say a government stores its most confidential secrets in an Oracle database. Trusting the dba is not an option in this situation.
This certainly is an exterme case, but there certainly are many, many other situations that have similar requirements. I'm not sure that everyone's medical records should be available to the dba just because he's in charge of doing backups. The truth of the matter is that many, many dbas are kids straight out of college or independent consultants. This is this way in every industry, including the medical and banking industry.
There are solutions that alleviate the problem, but they are not as good as they should be. For Oracle there are encryption solutions (www.appsecinc.com) that help you prevent dbas from reading the data, but they do not help prevent the data from being destroyed. A good backup plan can help alleviate this problem.
Other possible solutions include setting up good policies that include seperation of duties and the use of a change management department. For a more thorough discourse on security policies for Oracle, check out the Oracle Security Handbook (http://www.amazon.com/exec/obidos/ASIN/0072133252/qid%3D998406055/107-7202182-0758137).
HTH,
[email protected]