All language subtitles for [SubtitleTools.com] Principles Of Database Security - Learning Oracle 12c [Video]

In this lesson, we're going
to be discussing database

security, specifically,
talking about the principles

of security in general, how
those can apply to the database

world as well.

So security is and will
be one of the top concerns

in the computing world for
the foreseeable future.

It is a big hot topic.

There are companies springing
up that focus only on security,

that do things like penetration
testing and scanning

and those types of things.

So security is a major concern.

Of course, there's recent
examples of department stores

and various companies where the
security has been compromised

and the information
has leaked out

and it's been made
available to people

that it doesn't belong to.

And part of this is
because the amount

of information
that we're storing

is increasing and increasing.

If you think of all the social
networking sites, all of that

is what we call PII, or
Personally Identifiable

Information,
information that can

be used to identify
a particular person.

This type of information
is important to companies

like credit card
and loan companies

and such to be able to
identify a person, as well

as just purchasing
things on the internet.

If that information gets
out, then other people

can steal identities and
impersonate that person.

So all of these
things are pointing

to the idea of security
coming to a head

really, where there
will be even more

incidents in the news that
have a big impact on day

to day life.

And the interesting thing
for a database administrator

to consider is that
most of this information

is stored in a
database of some type.

By and large, the information is
stored in relational databases,

although there are other
types of databases that store

some types of information.

And it's also true that security
is often overlooked in the day

to day operations of a
database administrator.

Since so much of a
database administrators day

is spent fighting fires,
performance tuning,

creating objects,
backup and recovery,

all those types of
things, it is safe to say

that there are a lot of
database administrators

that really just don't
consider security in the day

to day operations.

And this is just because
they're overwhelmed

with other types of things.

And, to be honest,
security is one

of those areas where a
database administrator is not

going to get a lot of
support from other parts

of the organization
by and large.

If you're dealing with
developers and users,

and you try to implement
tight security,

that makes it more
difficult for them

to do their jobs, quite simply.

And they don't want
those roadblocks.

But it has to be considered.

DBA has to be the one that
stands up and at least says,

this is a risk, and we need to
mitigate that risk in some way.

Hopefully, the DBA gets
support from their management,

although that's not
always the case as well.

So, for a DBA, you have
to consider the security

and you have to at
least make known

your risks and your findings,
security problems that

exist in the organization.

You have to at least
be able to bring those

to someone's attention,
even for your own sake.

One of the principles
of security

is the principle
of least privilege,

the idea that less is best
as far as privileges go.

There's a myth about
the typical hacker.

And hackers make
the news when they

are some kid in the Ukraine
that attacked a bank

or something of that nature.

But that is a myth
as far as that

being the main
type of attack that

involves computer security.

The majority of attacks against
computer security are internal.

And this has been true
almost since the beginning

of computers.

It isn't the external
attacks, it's

the internal attacks
that are more prevalent.

And that's why database
security is so important.

Because, if a hacker, or
an attacker, or someone who

wants to compromise information,
is internal to a company,

then they may have
access to the database,

and the data that
they're looking for

may be stored in the database.

And so that's why it's not
enough in today's world just

to have strong firewalls
outside of your company.

Firewall security is important.

And it's not the only security
that you have to have.

You have to have
security in layers,

sort of walls inside of walls.

And that's where database
security comes in.

So the principle
of least privilege

states that a user should only
be granted the privileges that

are absolutely necessary
for that user to accomplish