All language subtitles for [SubtitleTools.com] Principles Of Database Security - Learning Oracle 12c [Video]_2

In this lesson, we're going
to be discussing database

security, specifically,
talking about the principles

of security in general, how
those can apply to the database

world as well.

So security is and will
be one of the top concerns

in the computing world for
the foreseeable future.

It is a big hot topic.

There are companies springing
up that focus only on security,

that do things like penetration
testing and scanning

and those types of things.

So security is a major concern.

Of course, there's recent
examples of department stores

and various companies where the
security has been compromised

and the information
has leaked out

and it's been made
available to people

that it doesn't belong to.

And part of this is
because the amount

of information
that we're storing

is increasing and increasing.

If you think of all the social
networking sites, all of that

is what we call PII, or
Personally Identifiable

Information,
information that can

be used to identify
a particular person.

This type of information
is important to companies

like credit card
and loan companies

and such to be able to
identify a person, as well

as just purchasing
things on the internet.

If that information gets
out, then other people

can steal identities and
impersonate that person.

So all of these
things are pointing

to the idea of security
coming to a head

really, where there
will be even more

incidents in the news that
have a big impact on day

to day life.

And the interesting thing
for a database administrator

to consider is that
most of this information

is stored in a
database of some type.

By and large, the information is
stored in relational databases,

although there are other
types of databases that store

some types of information.

And it's also true that security
is often overlooked in the day

to day operations of a
database administrator.

Since so much of a
database administrators day

is spent fighting fires,
performance tuning,

creating objects,
backup and recovery,

all those types of
things, it is safe to say

that there are a lot of
database administrators

that really just don't
consider security in the day

to day operations.

And this is just because
they're overwhelmed

with other types of things.

And, to be honest,
security is one

of those areas where a
database administrator is not

going to get a lot of
support from other parts

of the organization
by and large.

If you're dealing with
developers and users,

and you try to implement
tight security,

that makes it more
difficult for them

to do their jobs, quite simply.

And they don't want
those roadblocks.

But it has to be considered.

DBA has to be the one that
stands up and at least says,

this is a risk, and we need to
mitigate that risk in some way.

Hopefully, the DBA gets
support from their management,

although that's not
always the case as well.

So, for a DBA, you have
to consider the security

and you have to at
least make known

your risks and your findings,
security problems that

exist in the organization.

You have to at least
be able to bring those

to someone's attention,
even for your own sake.

One of the principles
of security

is the principle
of least privilege,

the idea that less is best
as far as privileges go.

There's a myth about
the typical hacker.

And hackers make
the news when they

are some kid in the Ukraine
that attacked a bank

or something of that nature.

But that is a myth
as far as that

being the main
type of attack that

involves computer security.

The majority of attacks against
computer security are internal.

And this has been true
almost since the beginning

of computers.

It isn't the external
attacks, it's

the internal attacks
that are more prevalent.

And that's why database
security is so important.

Because, if a hacker, or
an attacker, or someone who

wants to compromise information,
is internal to a company,

then they may have
access to the database,

and the data that
they're looking for

may be stored in the database.

And so that's why it's not
enough in today's world just

to have strong firewalls
outside of your company.

Firewall security is important.

And it's not the only security
that you have to have.

You have to have
security in layers,

sort of walls inside of walls.

And that's where database
security comes in.

So the principle
of least privilege

states that a user should only
be granted the privileges that

are absolutely necessary
for that user to accomplish

their given tasks.

So this is the
walls within walls.

So, if we say that
an attacker could

be internal to the
organization, then it's

important that that user
internal to the organization

only have the privileges
that they absolutely need.

It is easier to confine
a potential attacker

and still give the person
the kinds of privileges they

need in order to do their job.

But we don't give them more.

And a good example of this
is sometimes managers.

If a manager is managing a
database administration team

and yet does not log
into the database,

oftentimes the manager
will say, well,

since I am the
manager of the DBAs,

I need to have a
database account

with administrative
level access.

And that's just not the
case, because that just

is one more tunnel
into the database that

can be compromised.

Our next principle is auditing.

And the principle of auditing
goes back to the statement

that every action should be
traceable to one and only one

user.

So, if a user goes in
and does an operation,

we should be able to trace that
operation back to the user.

So some violations
of this kind of

include things like shared
passwords, where users

will share their passwords.

Or shared accounts are
created that many users use.

So, if we have a single account
for all of our developers

to log in and use
the database, then,

if something wrong
happens, there's

no way to trace that back
to an individual user.

So that's what
auditing is all about.

A security policy.

Every organization should have
a written security policy.

And this goes back
to the idea that we

said in the beginning,
where security is not

always supported in an
organization at the management

level or at the user level.

It is important that a company
have a security policy.

These are the things
that we allow.

This is the organization
of our security, how

it is with roles and privileges,
who has what privileges, so

on and so forth.

This is true of a lot of
different computer assets,

but especially as it terms
with database security.

And, finally, role
based security.

Security should be based
on job roles rather than

direct permissions.

If you have 100
users, and all of them

are given direct permissions
to 1,000 objects,

that's not even very large in
an organization or a database.

But the management of keeping
all of those permissions

correct is going
to be a nightmare.

And problems are going
to happen security.

Holes are going to
develop from that.

And so that's why security
should be role-based.

So a job role, and that role
is given to a number of people,

and certain permissions
are given to that role.

So role-based security
actually makes an organization

more secure because it limits
the amount of possibility

there are for breaches
with direct permissions.