Oracle Database Audit & Security Course

The course works on the principle that "if you have done it you will understand it". Therefore do expect this course to involve you a great deal in discussions, workshops and especially examination of the system hands on. By the end of the course you will be familiar with Oracle's client interface, the SQL*PLUS monitor and with simple SQL queries. In particular, you will come to understand the technical language surrounding Oracle and will gain immediate credibility talking to the experts you will inevitably have to work with. Furthermore, by understanding the technology, the descriptions of risk will become immediately understood.

This hands-on course is intended for auditors and security specialists who are aware their businesses use Oracle based products, but do not understand the database platform and therefore the risks it may carry. You will learn how Oracle is built and a concept of what the various categories of user do on the database and the risks they carry.

Hands on labs will show you how to scan the system for objects, especially sensitive tables. And to find out who can do what to them. Further more, in this age of web technology, the concept of the authenticated user accessing parts of your data is passing away. It could be anyone!

Before coming on the course, delegates should feel confident inputting instructions on a command line and accessing files on a filing system. Some exposure to a database environment is useful.

Topics covered on the 3 day Oracle Database Audit & Security course

Introduction

• The Oracle security model, database design, SQL*PLUS client

Oracle system files

• Log files, datafiles, Init.ora, the control file, the external password file

User security

• User creation issues, categories of users, profiles, roles. permissions and privileges, passwords, operating system security

Backup and recovery of the database

• Mechanisms, backup plans, hot/cold backup, user requirement

The audit subsystem

• Strategy and tactics, the audit sub-system master switch, creating the audit trail, viewing the audit settings
• triggering tables to obtain audit data
• laying a record-based audit trail
• extracting production data from the system

Advanced security concepts

• distributed data access
• Oracle and the web