DB links and Security

Question

DB Version:10gR2
To connect to a remote DB, we create only one DB link for that DB. We create a public DB Link like
create public database link wmat
connect to SYSTEM identified by jklf
using '(DESCRIPTION =
     (ADDRESS_LIST =
          (ADDRESS = (PROTOCOL = TCP)(HOST = 10.80.16.314)(PORT = 1521))
     (CONNECT_DATA =
          (SID = wmat)
)';Since we are connecting as SYSTEM user of the remote DB, we only have to prefix the remote schema name and access the DB object over there.
But, isn't this a security threat for that remote DB since we are connecting as SYSTEM over there?
Question1.
If you did a security Audit in these two DBs, what would you say?
Question2.
Is creating a DB Link for every schema or one DB link connected to the SYSTEM (as mentioned above) of the remote DB the standard practice?

Answer 1

Insignificant wrote:
But, isn't this a security threat for that remote DB since we are connecting as SYSTEM over there?Most definitely yes.
Question1.
If you did a security Audit in these two DBs, what would you say? Be very concerned. As DBA I would refuse to implement such a link as it exposes the entire database to the whims of developers and end-users.
Question2.
Is creating a DB Link for every schema or one DB link connected to the SYSTEM (as mentioned above) of the remote DB the standard practice?Each Oracle schema represents a logical container for data and code objects - think of it as a logical database. Each schema should have its own privs. Own resource profiles. Etc.
This ensures a lot of things. Better security. Increase robusteness. Better isolation. Better transportability. Etc. (and in all aspects, from development to deployment to operation)
By the same token, if that logical container needs a database object called a db link to communicate with a remote database container - than that must be a secure and private link for that container (schema) only.
One should only use the public "shared" container for common data and code objects. For example, for PL/SQL exception management PL/SQL libraries. Message log PL/SQL libraries. Etc. (this is similar to the shared object/dynamic link library concept of Linux/Windows applications - where common code resides in a sharable format)