Securing our customer database

Please,
We're concerning about securing our database customer 10g/windows base
The fact is that we're not admin of the server(own by the customer), but databases within are installed and administered by us. but we need to secure:
1. our dump file ( now using windzip 11 with passwd)
2. data files as well as the whole database to prevent the server admin to connect to the database ( we remove admin user from ORA_DBA group and changed the SQLNET.AUTHENTIFICATION_SERVICES to NONE)
3. We also locked most of some default account
Does anyone have ideas on how we should control our database?
or a nice link related to database security or good book that I can Read?
Thank you

Certainly, it is pretty hard to protect your environment from the sysadmin in a windows or a unix like environment, since this role has access to every single byte in your database. It is pretty lengthy to try to explain a whole strategy to protect your environment, but at a glance it would be to classify your information and encrypt the most sensitive data. You can also, starting from 10gR2 use database backup encryption.
I suggest you to refer to the advanced security for further technical details:
Oracle® Database Advanced Security Administrator's Guide
10g Release 2 (10.2)
Part Number B14268-02
You may consider techniques such as using label security.
Oracle® Label Security Administrator's Guide
10g Release 2 (10.2)
Part Number B14267-02
There are many other advices you can read at the advanced security manual
~ Madrid
http://hrivera99.blogspot.com/

Similar Messages

Linking to individual custom database portlets

When we create menu items in Portal normally we can link to an individual form or report component created in oracle portal and exposed via url for show or other routine. We need to setup menu items each to link to our custom database portlets. Is there any API or any other way of invoking this programatically?
For e.g. if I have a portlet helloworld_portlet can I invoke helloworld_portlet.show directly? Any examples would help.
Also there are undocumented API's to link to tabs or to pages or via query of sbr views. Are there any documented API's to link to tabs or subtabs?

Hi,
I dont think what you want is possible, the whole idea of a portlet is that its part (building block) of a page and not being a webpage by itself.
There are perhaps some workarounds
- try displaying the portlet in detail modus
- perhaps create a hybrid portlet, that is a servlet & portlet at the same time
In one of my portlets im also linking to a portlet on another page. I keep the durable link of the page where the second portlet resides as a setting in my database

Error in updating custom database table using UPDATE SET Command

Hi,
I developed an automated collection system program in one of our clients simulating FBE1 (Payment Advice Creation) and F-28 (Posting of Incoming Payments) transaction codes. Upon posting, we encountered an error in PRD server wherein, for some of the posted items, the STATUS field in our custom table was not successfully updated. We tried to reverse the clearing document and debug the program. Upon posting, we were able to successfully update the status. We could not simulate the error in QAS since all the postings in QAS were successful and all status' relating to these postings were updated as well. We tried posting multiple times and the program seems to be working fine. In PRD, this behavior is just random and there is no specific pattern as to how the error occured. Provided below is the code I used for updating custom table ZFIACSF28. The STATUS field should be equal to '4' once the posting is successful. We are not sure if this is a database related issue. 7 users are authorized to do the postings in PRD and they are using the same user account.
CODE:
CALL TRANSACTION 'F-28' USING gt_bdcdata
                          MODE   'E'
                          UPDATE 'S'
                          MESSAGES INTO gt_messtab.
READ TABLE gt_messtab INTO wa_messtab WITH KEY msgtyp = 'S'
                                                 msgnr = '312'.
IF sy-subrc EQ 0.
update status for items cleared bearing the same OR Number*
    UPDATE zfiacsf28 SET status       = '4'
                         zsapdocument = wa_messtab-msgv1(10)
                         zruntime     = sy-uzeit
                         zrundate     = sy-datum
                   WHERE zor          = gv_zor
                   AND   customer     = gv_customer.
    COMMIT WORK.
ENDIF.

Hi,
it's not possible that status isn't updated in zfiacsf28 while date and time are updated there, because it's hard coded.
There must be other programs that also change your table zfiacsf28 and maybe clear those fields. Maybe the key fields zor and customer cannot provide duplicate access, what is the meaning of field zor ?
Please check the where used list of table zfiacsf28 to find other update programs.
Regards,
Klaus

Where does WebLogic fit with/beside our custom web-server?

Hi,
I'm just getting started with the WebLogic Application Server and wondering
what it can do for our setup, which looks like the following:
Our web server has a plug-in which parses each html file requested, and
if it contains any of our "custom" tags, passes it on to another "engine".
This "engine" uses our own database, and object server to make queries,
and turn the custom tags into standard HTML. Some custom-tags include
custom links to other "extended" pages, which the "web server extension"
converts to normal HTML links to the custom pages, which will of course
be caught in turn by the intermediary parser when navigated to.
There are probably ways we can stream-line and minimize the steps required
to assemble the standard HTML. However, if anyone has some ideas,
I'm basically just wondering how WebLogic can help improve our architechture
and the performance, with minimal changes at first. Since we do so much
page assembly by parsing the custom tags, I have difficulty seeing how
WebLogic could do caching. The HTML that a custom tag "expands" to
may be state dependent on the underlying database/object server!
Any comments/ideas much appreciated.
Thanks,
Andy

If you need an extra "ZAP" to get people to return,
your site is probably lacking good content. People
won't go to your site just for your fancy applets and
flash animations, you need to have content. Why do so
many people use Google instead of Yahoo? Because
Google's homepage loads faster without all the ads and
other crap that you get on other search sites. Also,
because google performs searches faster than any other
site. Basically you need good content and good
service without distractions.I get the 'content is king' bit although I tend to disagree with the effect that multimedia has on users. I have a MSc by research which looked at the effects of animation on users of e-commerce sites. It does have a positive effect (it did with my results anyway) - hence I would like to build more multimedia into the web site (under construction).
A combination of fast download, intuitive navigation and clear layout can improve usability.
I disagree with the Jakob Nielsen school of thought i.e. text-only web sites with no graphics are the ultimate. He is a usability expert but usability per se does not improve web site stickiness. I digress.
I want to do the server side stuff mentioned above - it is not a question of just pointing at files on the server...if it were that easy, I would not be posting and would hook all my pages to a tight back-end. The much higher wages of web developers compared with web designers should highlight this skill difference.
Also, not many web sites generate dynamic web pages completely differently to each individual user. Broadband (DSL) will bury the text-only 14.4 kbs modem type site (a disgusting remnant of 1995 which was severly restricted due to low modem speeds).

Moving Custom Database to Native Sharepoint Database Server

Hi,
What are Microsoft recommendations on moving custom database from one SQL node to native node containing sharepoint content database.
Are there any limitations or disadvantages of moving the custom database to content database server.
Regards, Ketan Gandhi

The general advice is not to. SharePoint doesn't play nicely with other applications (at least at the SQL level) and you're complicating the performance analysis aspects a lot.
It also often involves harming the SharePoint security model by granting other service accounts and support staff permissions on the SharePoint databases. You've then got potential performance problems when either of the two applications is heavily loaded.
Your SharePoint SQL instance may be using a custom Collation, which probably won't hurt anything but you can get odd behaviour if you end up with multiple DBs from different collations.
You must keep the Max Degree of Parallelism at 1 for SharePoint, even if this hurts your custom App.

Custom database functoid to return multiple rows from database

Hi,
I have created a custom database fucntoid to execute a stored procedure which returns just single row from the database.But I could not manage to return multiple rows from the database.
Does anyone know how to return multiple rows from DB and create a node with that many occurrences in the target schema?
Thanks
JB

If you want to do this in messaging-only way without orchestration, then only option let to you is using .NET in BizTalk:
We had similar requirement with one of our clients, where they didn’t want to use orchestration (though we emphasised on less impact orch would have compared to manageability),
they still wanted to have pure-messaging only.
We extended the custom XslTransform component that ships with BizTalk SDK (<BizTalk installation directory>\SDK\Samples\Pipelines\XslTransformComponent)).
Created a custom disassembler pipeline component, used the XslTransform component from SDK to execute the map’s XSLT. Here we created a map with every links except the database ones. After executing the map, access the database, execute the store procedure
which returns more than one row/dataset, enrich the XSLT transformed message with the dataset from your database in disassembler.
Since .NET gives you the flexibility of access the dataset with more than one row, you can enrich the message in custom pipeline code.
Other option is code the message transformation completely in .NET code in custom disassembler by passing the received message to method/code which would code the map/enrichment.
While enriching you can execute the store procedure which returns more than one row/dataset, enrich the message further with the dataset from db.
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

How do i purchase license for lightroom 5? When i tried to process payment, it says There was a problem processing your order, please contact our Customer Service team on 800 448 1642 for assistance.

How do i purchase license for lightroom 5? When i tried to process payment, it says There was a problem processing your order, please contact our Customer Service team on 800 448 1642 for assistance.

In this forum, we can't help with purchasing issues.
My suggestion is to call that phone number.

You want to know the amount of space the transaction log for the Customer database is using. Which T-SQL command would you use?

You want to know the amount of space the transaction log for the Customer database is using. Which T-SQL command would you use?

Forced me to do a little research.
DBCC SQLPERF(logspace)
See also
http://stackoverflow.com/questions/198343/how-can-i-get-the-size-of-the-transaction-log-in-sql-2005-programmatically
For every expert, there is an equal and opposite expert. - Becker's Law
My blog
My TechNet articles

There was a problem processing your order, please contact our Customer Service team for assistance.

when i waned to buy and finished filling all the (*), i clicked on conifirm membership they worte this in a red color:
There was a problem processing your order, please contact our Customer Service team for assistance.Middle East & North AfricaBahrain: 80081097Egypt: 08000000447Jordan/Kuwait/Lebanon/Qatar/Yemen: English +44 207 365 0735Jordan/Kuwait/Lebanon/Qatar/Yemen: Arabic/French +44 203 564 4145Oman: 80077173Saudi Arabia: 8008446638Tunisia, Morocco and Algeria: +33 157324642United Arab Emirates: 80004443085Commonthwealth of Independent States (CIS): +44 207 365 0735

Asmaa,
Other than using the suppport phone number, you may try a chat here:
Creative Cloud support (all Creative Cloud customer service issues)
http://helpx.adobe.com/x-productkb/global/service-ccm.html

When i waned to buy and finished filling all the (*), i clicked on conifirm membership they worte this in a red color: There was a problem processing your order, please contact our Customer Service team for assistance.Middle East

when i waned to buy and finished filling all the (*), i clicked on conifirm membership they worte this in a red color:
There was a problem processing your order, please contact our Customer Service team for assistance.Middle East & North AfricaBahrain: 80081097Egypt: 08000000447Jordan/Kuwait/Lebanon/Qatar/Yemen: English +44 207 365 0735Jordan/Kuwait/Lebanon/Qatar/Yemen: Arabic/French +44 203 564 4145Oman: 80077173Saudi Arabia: 8008446638Tunisia, Morocco and Algeria: +33 157324642United Arab Emirates: 80004443085Commonthwealth of Independent States (CIS): +44 207 365 0735

Verify that everything about your Adobe ID and your country and your credit card match exactly
Change/Verify Account https://forums.adobe.com/thread/1465499 may help
-http://helpx.adobe.com/x-productkb/policy-pricing/change-country-associated-with-adobe-id. html
-Credit card https://helpx.adobe.com/utilities/credit-card.html
-wrong email https://forums.adobe.com/thread/1446019

I can't renew my plan. It always say"There was a problem processing your order, please contact our Customer Service team on 30714922 for assistance."

I can't renew my plan. It always say"There was a problem processing your order, please contact our Customer Service team on 30714922 for assistance."
I can't find my payment info and renew button. Please help me!

In this forum, we can't help with purchasing issues.
My suggestion is to call that phone number.

Utl_http package from our custom pl/sql package.

We have a requirement to invoke a thrid party Url that uses HTTPS. For this we are using the call to utl_http package from our custom pl/sql package. When we invoke the custom package form Oracle Forms it works fine. But when we try to invoke the same from ApplicationModule Class in our custom OA Framework form we get the following error.
ORA-29273: HTTP request failed
ORA-06512: at "SYS.UTL_HTTP", line 1577
ORA-28862: SSL connection failed

Duplicate post.
ApplicationModule class in a custom OA Framework
ApplicationModule class in a custom OA Framework

How to apply row level security against the database administrator

I would like an advice in applying row level security against the database administrator. We need to prevent DBA from editing data in some table rows or have any indication that data was corrupted.
There is no problem in viewing the data so we considered one way hash function or digital signature which will be stored in the same table, but we see following disadvantages:
HASH - DBA may use the same hash function to update the stored data after he changes the sensitive row.
Digital signature - the is a need to manage and keep the private key in a safe place outside of DB
Is there additional ways to achieve the aim?

Does VPD helps to prevent from DBA to edit/view a data in specific rows?Yes.
If I correctly understand, DBA has full access to security policy used by VPD to control the access and can grant himself privileges that I don't want.You can to define which users can be exempt of the politics, for the context or by Grant EXEMPT.
This includes DBAs.
The simple fact of being DBA doesn't guarantee the exemption.
Everything goes to depend of the VPD config.

Invoice amount which is reflecting in our customer ledger

Hi gurus
In few cases Invoice amount which is reflecting in our customer ledger is basic value insted of " net selling value" ( basic price + Tax Price ). Due to which in my customer ledger receivables are showing less as per Invoice value.
Can you solve this problem. and tell me the solution.
Thank you
Anil

Hi
May be the report you are looking is CO-PA report ....if it is the case goto the report form and goto the column of net selling value...and change the formula used over there....if it is a customised (Z report) ...take the ABAPer help....if it is standard report, please let me know the TCODE..so that it will be easy to check the logic
VVR

Home Security horrible customer service

Three exculated trouble tickets on the phone with a suppose supervisor he hangs up on me. Now I have to go through another customer service rep that will want me to let them help before I can get to the supervisor I was just hung up from

sdaneski, we don't want this to be an ongoing issues for you. Have you had a chance to call our customer service department by dialing *611? For your convenience, you can manage your plan and billing online at My Verizon http://bit.ly/xB4iTc
LasinaH_VZW
Follow us on Twitter @VZWSupport

Securing our customer database

Similar Messages

Maybe you are looking for