Data Protection Report

/live_board/v2/downloads?uid=b0b4ed80-8f83-4aec-8459-571b4763da73&redirect=true

Data Protection Assessment Oracle Database and Platform security overview

1. INTRODUCTION The importance of having data protected

21%

50%

19%

90%

Unprotected data

Abuse/misuse of credentials

Unpatched or poorly configured systems

Attract 90% of attacks User, system and database vulnerabilities

You need to protect data at its source

Network security is not enough

67%

15%

Database

Network

Application

Middleware

Allocation of Resources To Secure IT Layer

52%

34%

11%

Database

Network

Application

Middleware

IT Layers Most Vulnerable To Attacks

Data security

Identity Access Management

11% End Point Security

12% Application Security

14% Network Security

16% Vulnerability Management

Governance and Risk mgmt

18%

20%

Source: Gartner IT Key Metrics Data 2021: IT Security Measures, Worldwide

IT security spending distribution by functional area (2021)THREATS TO DATA INTEGRITY

Spam

Social Engineering

USB Autoexec

Phishing

Black Hat

Virus

Worm

Denial of Service(DDOS)

Hacker

Malicious Apps

Vulnerability

Exploit

Malware

Man in The Middle(MITM)

Privilege Escalation

SQL Injection

Storage Masking

Trojan Horse Identity Theft

Cross-Site Scripting(XSS)

Penetration Testing

Zero-day Attack

Insider Threats

Ransomware

Rootkit

Dumpster Diving

Tailgating

Exfiltration

EMEA Ransomware impact

Average total cost of remediating $1.85M

(source: Sophos)

19-day average downtime

(source: Coveware)

Over 4,000 attacks daily (source: FBI)

66% of security professionals in Spain responded that they were affected by Ransomware in the last 12 months

1,200 security professionals

500+ employees

17 countries 19 industries

https://www.sophos.com/en-us/press-office/press-releases/2021/04/ransomware-recovery-cost-reaches-nearly-dollar-2-million-more-than-doubling-in-a-year.aspx https://www.coveware.com/blog/q3-2020-ransomware-marketplace-report https://www.fbi.gov/file-repository/ransomware-prevention-and-response-for-cisos.pdf

Oracle assisted in the examination of the security overview for the following databases and platforms:

Database Instances: ex1 / ex2 / ex3 / ex4 / ex6

Cluster:

Hosts: B / C / D / E

METHODOLOGY OVERVIEW

Database DBSAT (Database Security Assessment Tool) was used to harvest database security information.

The DBSAT was examined and interpreted by the Oracle Database Security team.

Platform The ORAchk tool was used to harvest platform information.

The ORAchk output was examined and interpreted by the Oracle Cloud Systems team.

Policies and Operational Processes There were no Interviews conducted to obtain data protection governance and operational details.

01 Step 1: Fast implementation by the DB team.

Step 2: Implement data protection policies which include: user management, continuous data protection, data monitoring, and more.

Improve data protection infrastructure

Align to MAA architecture

Encrypt data

Improve Authentication and data

control

Update DB Security Patches

Step 3: Implement Oracle Transparent Data Encryption (TDE)

Step 4: Align to best practices provided by Oracle’s Maximum Availability Architecture

Step 5: Consider using Oracle engineered systems for data storage and recovery

EXECUTIVE OVERVIEW – TOP 5 STEPS TO TAKE

2 0

0 9

2 0

1 0

2 0

1 1

2 0

1 2

2 0

1 3

2 0

1 4

2 0

1 5

2 0

1 6

2 0

1 7

2 0

1 8

2 0

1 9

2 0

2 1

2 0

2 2

2 0

2 3

2 0

2 4

2 0

2 5

2 0

2 6

2 0

2 7

Oracle 18 (12.2.0.2)

EXTENDED

Waived EXTENDEDOracle 11.2

Oracle 12.1

Oracle 12.2.0.1

Oracle 19 (12.2.0.3)

Paid Extended SupportPremier Support Waived Extended Support

MARKET DRIVEN

Market Driven Support

▼

• The database version is up to date. • Please check https://www.oracle.com/us/assets/lifetime-support-technology-069183.pdf

MARKET DRIVEN Current Version

DATABASE VERSION IS 19C

https://www.oracle.com/us/assets/lifetime-support-technology-069183.pdf

2.1 DATABASE OVERVIEW DBSAT report, findings and recommendations

20% High (4)

40% Medium

(8)

40% Low (8)

21% High (3)

36% Medium

(5)

43% Low (6)

Database ex2Database ex1

25% High (3)

41% Medium

(5)

33% Low (4)

Database ex3

High High probability of occurrence Extreme financial impact Extreme brand impact

Medium Strong possibility of occurrence Considerable financial impact Considerable brand impact

Low May occur but likelihood is small

Moderate to little financial impact

8% High (1)

46% Medium

(6)

46% Low (6)

Database ex6

20% High (3)

40% Medium

(6)

40% Low (6)

Database ex4

AREAS WHERE YOU STOOD OUT

✔ No sample schemas found.

✔ No unlocked users found with password expired for more than 30 days.

✔ User accounts are configured to prevent brute force password attacks .

✔ No user granted read on dictionary tables containing password verifiers.

✔ No grants to PUBLIC.

✔ Data inference attacks are properly blocked.

✔ The password file is configured correctly.

✔ Instance name does not contain database version number.

✔ No logon triggers found. No disabled triggers found.

✔ External OS Authorization is correctly configured.

✔ No ACL issues

✔ Listeners logging control is correctly configured.

DBSAT RECOMMENDATIONS Risk Severity Impact Solution

Latest comprehensive patch: Oct 14 2022 (161 days ago) on all instances. High Risk Known database vulnerabilities are left open, lowering the barrier for someone to attack the

database and gain access to sensitive data

Set a standard for applying patches (eg: release + x days)

Recommendation: Subscribe and monitor the calendar for CPUs release dates at: http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Use Database Lifecycle Management Pack for path automation.

5 out of 131 users have been directly or indirectly granted object privileges on Oracle Database restricted objects via 150 grants. 3 grants to PUBLIC. – ex1 High Risk

Users with these privileges can directly modify objects in the SYS, DVSYS, AUDSYS or LBACSYS schemas. Manipulating these system objects may allow security protections to be

circumvented or otherwise interfere with the normal operation of the database. PUBLIC must not be granted access to objects in SYS, DVSYS, AUDSYS and LBACSYS schemas. When

running a Privilege Analysis Capture, be aware of privileges that have been granted to access objects in any Oracle-created schemas.

Review the grants for relevance.

Default database accounts are using well-known default passwords

Found 2 unlocked user accounts with default password on ex6 High Risk

Because these accounts are well known, automated database attack scripts are likely to probe them increasing the likelihood that an attacker could gain access

Lock any default accounts that are NOT in use; Change passwords for default accounts that ARE in use

Regularly scan databases for accounts with default passwords using Enterprise Manager or Oracle Patch 4926128 (Default Password Scanner)

Use Oracle Audit Vault for checking user status.

Found 126 user accounts requiring updated password verifiers. – ex1

Found 8 user accounts requiring updated password verifiers. – ex4

Found 11 user accounts requiring updated password verifiers. – ex6

Found 11 user accounts requiring updated password verifiers. – ex7

High Risk

For each user account, the database may store multiple verifiers, which are hashes of the user password. Each verifier supports a different version of the password authentication

algorithm. Every user account should include a verifier for the latest password version supported by the database so that the user can be authenticated using the latest algorithm

supported by the client. When all clients have been updated, the security of user accounts can be improved by removing the obsolete verifiers. HTTP password verifiers are used for XML

Database authentication.

Use the ALTER USER command to remove these verifiers from user accounts that do not require this access.

Found 125 user accounts that would remain open even if inactive. Found 77 unlocked users inactive for more than 30 days. – ex1

Found 30 user accounts that would remain open even if inactive. Found 18 unlocked users inactive for more than 30 days. – ex4

Found 10 user accounts that would remain open even if inactive. Found 4 unlocked users inactive for more than 30 days. – ex6

Found 22 user accounts that would remain open even if inactive. Found 12 unlocked users inactive for more than 30 days. – ex7

Found 12 user accounts that would remain open even if inactive. Found 8 unlocked users inactive for more than 30 days. – ex9

Medium Risk If a user account is no longer in use, it increases the attack surface of the system

unnecessarily while providing no corresponding benefit.

Immediately lock unneeded accounts; Monitor attempts to login as those accounts to ensure they are not in legitimate

use; Drop unneeded accounts; Conduct quarterly or semi-annual periodic privilege reviews on important

databases. Conduct annual or bi-annual reviews of less sensitive databases

Found 1 user using SYSTEM or SYSAUX tablespace for ex1 Medium Risk

Inappropriate permissions to SYSTEM tablespace may allow malicious or accidental over- allocation of storage space, starving background processes of needed storage space

The SYSTEM and SYSAUX tablespaces are reserved for Oracle-supplied user accounts. To avoid a possible denial of service caused by exhausting these resources, regular user

accounts should not use these tablespaces

Prior to Oracle Database 12.2, the SYSTEM tablespace cannot be encrypted, and this is another reason to avoid user schemas in this tablespace

Alter users to set their default storage to another tablespace Setup a database-wide non-SYSTEM default tablespace

Move any non-default objects out of the SYSTEM tablespace

http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Impact / value view PRIORITIZED ACTION CHART

46 5

Projects

1 Apply latest patches

2 Fix configuration issues(list) including password configuration issues

3 Centralize Database authentication and authorization

4 Encrypt data at rest(tablespace and column)

5 Strengthen access control

6 Enable Network Encryption

Secure production data at lower environment(UAT/staging/testing/developm ent)

8 Monitor database activity

OVERALL DATABASE STATUS

Database Configuration Multiple security issues found

Account Management Multiple account issues found

Encryption No encryption used

Access Control Multiple users with high privileges

Network Configuration Few network parameters to be modified

Authorization Control Needs improvement

Password policy

Auditing No fine grained and traditional audit set up

Based on DBSAT findings

Password policy needs improvement

3. PLATFORM OVERVIEW Highlights from the Orachk reports

System Health Score 94

test

System Health Score is derived using

following formula:

Every check has 10 points

Info will deduct 3 points

Undetermined will deduct 3 points

Skip will deduct 3 points

Critical will deduct 10 points

Failure will deduct 10 points

Warning will deduct 5 points

Heading Description

Cluster Name ex1

OS/Kernel Version LINUX X86-64 OELRHEL 7 4.1.12- 124.49.3.1.el7uek.x86_64

CRS Home - Version /oracle/product/19.0.0/grid - 19.0.0.0.0

EM Agent Home /opt/oracle/agent/agent_13.4.0.0.0

Number of nodes 4

Database Servers a, b ,c d ,r

ORAchk Version 23.2.0_20230302

Collection orachk_041323_093328

Duration 5 mins, 14 seconds

Executed by

Arguments NONE

Collection Date 13-Apr-2023 09:41:29

ORACHK RESULTS Status Type Message Status On Recommendation

CRITICAL OS Check The ORAchk scheduler is not configured correctly All Database Servers

Consider maintaining Oracle Database homes at the latest patch set possible, if administration procedures and testing

policies permit it.

CRITICAL OS Check Critical background ADR processes are not defined to run with real-time priority scheduling Some

FAIL ASM Check Based on best practice recommendations, no hidden ASM initialization parameters should be defined ASM

FAIL Cluster Wide

Check All $ORACLE_HOME should have the same patches on database servers Cluster Wide

FAIL ASM Check ASM credentials are not defined correctly. All ASM Instances

Consider creating a standard for all database and operating system

parameters to be set properly before environment setup, to avoid the need of unsetting/modifying them afterwards.

FAIL OS Check vm.min_free_kbytes settings are not defined as recommended All Database Servers

WARN Patch Check The Perl 33912872 patch was not found in the CRS_HOME directory of version 19c. Test

WARN ASM Check The compatible attribute.asm should be set to recommended values on all disk groups All ASM Instances

WARN ASM Check The compatible.advm attribute must be defined according to recommended values on all disk groups All ASM Instances

Monitor and regularly run diagnostic reports such as AWR and Orachk.

Oracle recommends being in alignment and up to date with all best practices for

Database environments.

WARN OS Check NTP is not running with the correct value Test

WARN OS Check SELinux is being implemented. All Database Servers

WARN OS Check Variable or strict memlock have not been configured as recommended Test

WARN OS Check Not all nodes have active roles in a Flex cluster. All Database Servers

OVERALL PLATFORM STATUS Based on Orachk findings

System Score 94 out of 100

MAA Scorecard 2 critical and 4 failed checks

Database Server There are configuration best practices that need attention

Cluster Verification No data collected

Backup configuration No data collected

Operational best practices No data collected

Consolidation best practices No data collected

Overall configuration System health is overall good, based on the data collected and current findings

4. POLICIES AND OPERATIONAL PROCEDURES Highlights from the Interview data

General Guidelines and Policies Reply Recommendation

Are penetration tests and security assessments performed regularly to identify weaknesses? Could you please elaborate with a comment? No

It is recommended to run periodically penetration tests and security assessments in order to maintain a good level of security for your

database environment. By running penetration tests you can identify vulnerabilities that could be exploted by attackers.

Data Backup & Archiving Operations Reply Recommendation

Type: Data should be organized by the type of data involved (e.g., Tier 1, Tier 2, etc). No Generally, tiered storage is designed to improve performance and

availability of the systems, while also reducing overall storage costs. The most important (production) data must reside on the fastest

storage (flash), while the backups and archiving data should reside on mechanical disks and tapes.

Oracle recommends implementing such a data classification. Oracle ZFS Storage Appliance is the most optimal environment for both

production and archive data.

Are data backups and archiving organized by the relative importance of data (e.g., Tier 1, Tier 2, etc)? No

Is inter-database relational integrity implemented at the application and business process levels? (E.g. if two components or data sets should be recovered to the same point in time to function properly, then consistency mechanisms should be planned and implemented).

Relational integrity for application and business processes is vital for the proper functioning of a system. The recovery of data sets at

different points in time can lead to data alteration and loss. The Oracle Recovery Appliance assures inter-database relational integrity if a

standard for it is set in place.

Are you able to monitor the data loss gap in real time? Are you notified of data gap objective XXX? No It is advised to use a monitoring platform such as Oracle Enterprise Manager or create a custom monitoring setup which enables you to

check in real time the integrity of your data.

Can the immutability of backup, snapshots, clones, copies or point-in-time copies be protected against a compromised administrator or super user account? (E.g. rman delete)

Oracle recommends enforcing multiple security policies on superuser accounts in order to prevent compromising them. Alongside this, it is

advised to use practices from a zero-trust security architecture to prevent critical data to be accessed from a compromised account.

Highlights from the Interview data

Data Backup & Archiving Operations Reply Recommendation

Is continuous data protection (CDP) implemented on an Oracle database transaction level? No Oracle recommends using Oracle Database features such as archive logging, Flashback and Oracle Data Guard in order to minimize data

loss risk and protect your data in a continuous fashion.

Are you able to create immutable copies or archives of data in a cyber vault or cloud location and if so, can the RPOs and RTOs be met with these? No

It is advised to use a dedicated and performant recovery appliance for safely storing backup copies. Oracle Recovery Appliance has the

capability of securing backup copies, based on a hardware infrastructure capable of high-speed recovery.

Restore & Restoration Assurance Reply Comments

Are restore and retrieval testing success rates being logged? Please elaborate on the frequency of testing with a comment. No Oracle recommends keeping a log with the restore and retrieval testing

for backup sets, alongside switchover tests from primary to standby DR sites, which should be executed regularly.

Is the testing sufficient to ensure that required RTO and RPO objectives are met? No

Oracle recommends identifying and analyzing the necessary components required for the RTO and RPO testing to be done

properly, in order to provide accurate results. Having a good testing strategy for RTO and RPO assurance will help in situations in which a

database needs to be restored, avoiding unwanted downtime and ensuring business continuity.

POLICIES AND OPERATIONAL PROCEDURES

POLICIES AND OPERATIONAL STATUS

General Guidelines and Policies

Data Backup & Archiving Operations

Restore & Restoration Assurance

Administration & Access Control

Based on Interview data findings

Penetration testing is recommended

Several new policies need implemented

Restoration testing is recommended to ensure required RTO / RPO

Encryption & Continuous Data Protection Encryption and CDP use for all databases is advised

Better database user management and zero-trust policies are advised

CONCLUSION Oracle’s solution to achieving maximum data protection

• What can be improved:

- Database maintenance practices - Alignment with MAA architecture - User access control and management - Policies for backup and restoration - Isolation of critical data - Implementation of monitoring solutions

• Risks: - Data loss, business continuity - Undertrained staff, Hardware faults - Legal fees, extra repair/support costs

Today: System exposed to vulnerabilities With available tools today

Tommorow: Maximum Data Protection Additional technology measures, based on Oracle’s Maximum Availability architecture and security standards

Current infrastructure/platform What can Oracle help you with

Oracle Advanced Security, Oracle Transparent Data Encryption(TDE), Oracle Data Masking, Oracle Database Firewall, Oracle Database and Audit Vault

Oracle Recovery Appliance ZFS Storage Appliance

Support in design and implementation of all security and data protection related solutions.

Oracle Security Software stack

Oracle Support and Consulting

Oracle Engineered Systems

ORACLE ADVANCED SECURITY - TDE TRANSPARENT DATA ENCRYPTION

Off-Site Facilities

Disks

Exports

• Encrypts columns or entire tablespaces

• Protects the database files on disk and on backups

• High-speed performance

• Integrated with Oracle DB technologies

• Transparent to applications, no changes required

Applications

Encrypte d Data

Backups

Clear Data

d$f8#; !90Wz Yg#3R qR+%@Ue#

3R+%K #

*HH$7 #9Vlka

Oracle Data Masking and Subsetting Pack Oracle Advanced Security Option to mask data dynamically Privileged User and Operational Controls

Oracle Database Vault

Oracle Data Redaction (Dynamic Data Masking) Oracle Advanced Security Option to mask data dynamically .

Audit Server and Database Firewall Audit, Monitor, and Detect

COMPLETE SECURITY SOFTWARE STACK

All slides Slide 1: Data Protection Assessment Slide 2: User, system and database vulnerabilities Slide 3 Slide 4 Slide 5: METHODOLOGY OVERVIEW Slide 6: EXECUTIVE OVERVIEW – TOP 5 STEPS TO TAKE Slide 7 Slide 8 Slide 9: AREAS WHERE YOU STOOD OUT Slide 10: DBSAT RECOMMENDATIONS Slide 11: PRIORITIZED ACTION CHART Slide 12: OVERALL DATABASE STATUS Slide 13 Slide 14 Slide 15: OVERALL PLATFORM STATUS Slide 16 Slide 17 Slide 18: POLICIES AND OPERATIONAL STATUS Slide 19: CONCLUSION Slide 20: ORACLE ADVANCED SECURITY - TDE TRANSPARENT DATA ENCRYPTION Slide 21: Oracle Data Masking and Subsetting Pack

Data Protection Report

Item Type: pdf