Safest Way to Penetration Test an Oracle DB with Potential Data Loss

Question

Hi,
I was wondering what the safest way to protect Oracle from data loss when running a web application scan. We currently have an external company about to perform a web application scan and they warned us of potential data loss. However, we can't afford much downtime and our storage doesn't support things such as Copy on Write. What would you recommend? Do you think that something like putting the database in read-only mode for the duration of the test (2 hours) and enabling audit on all actions would be sufficient (we could then review the audit to see if any unauthorized calls were made)? Thanks.

Answer 1

If not running live you might consider restoring your database to before the test. But you need to have confidence this would work.
I assume your running live for the duration of the test.
Going read only might invalid the test, and your application might not be able to run read only without generating errors.
Examine and be aware of the flashback technologies available to you at your database version and which ones might be useful. In this context increase undo space/retention target might be helpful but dont dash off doing something at last minute.
Ensure you have checked out how to use logminer.
Consider not continously updating and standby database you have until test is complete.
Ensure your more recent backup is successful and you have checked your restore procedures and have contingency places in place.
In practice the web peneration test may attempt to change a small amount of data in a small number of records, but the agreement probably means they are not liabable if they dropped schema in the database!
If you have to correct data following their test then do so carefully. Doing the wrong thing (especially in a panic) can make a sitation worse, especially if you are doing something you are not familiar with. Often it may be better the data loss through the application itself.
If you do turn on auditing be aware of what it gives you before you turn in on, and beware any space implications.
I notice your are recently registered on the site ... this may mean you dont have much experience with oracle, you may be more of a system administrator for instance. No disrespect in that whatsoever. However especially if this is the case then remember in my opinion dashing to change something last minute statisically often does more harm than good overall and may be harder to undo.
Hope this helps.
bigdelboy
Edited by: bigdelboy on 28-Mar-2009 01:18
Edited by: bigdelboy on 28-Mar-2009 01:22