Using Oracle Database Vault 10gR2 With Apps 11i

I'm very pleased to announce that Oracle Database Vault 10gR2 10.2.0.3 is certified with the E-Business Suite Release 11i.  I've been working on this certification for the last year. In this article I will give you some insight into how Oracle E-Business Suite Release 11i can be configured to use Oracle Database Vault features to protect sensitive transactional data from powerful users like Apps DBAs.

What is Oracle Database Vault?

A key challenge for security administrators is protecting enterprise data from insider attacks.  Oracle Database Vault is an optional database feature that can help you defend against that class of threats, as well as build internal controls to help meet regulatory requirements for privacy and segregation of duties.

Oracle Database Vault can prevent highly privileged users, including powerful application DBAs and others, from accessing sensitive applications and data in Oracle databases outside their authorized responsibilities. You can use customizable Realms and rules to ensure that users, even administrators, have access only to what they need to do their job.

The figure above illustrates how Oracle Database Vault addresses the following database security concerns:

• Administrative privileged account access to application data: In this case, Oracle Database Vault prevents the DBA from accessing the schemas that are protected by the FIN Realm. Although the DBA is the most powerful and trusted user, the DBA does not need access to application data residing within the database.

• Separation of duties for application data access: In this case, the FIN Realm Owner, created in Oracle Database Vault, has access to the FIN Realm schemas.

Protecting Database Objects With Realms and Rules

Oracle Database Vault uses Realms to set up boundaries around set of objects in specific schemas; specific conditions must be met to access data protected by those boundaries. Realms specify a set of conditions that must be met before a given command can be executed on a set of database objects.

This provides very granular control over what can be done to certain objects, and by whom. You can define rules to restrict access based on business-specific factors such as data access connections from particular database, from a particular machine, and from specific IP addresses.  You can also specify the time of day or authentication modes for data access.

For details about various Oracle Database Vault Realms and customizable rules, see:

• Oracle Database 10g Release 2 Vault Administrator's Guide
  

Minimum Requirements

• E-Business Suite 11.5.10 Consolidation Update 2 (11.5.10.2)
• Oracle Applications Technology 11i.ATG_PF.H.delta.5 (RUP 5) (5473858) or higher
  
• Oracle E-Business 11i Database must be at 10gR2 Patch Set 3 (10.2.0.3)

Additional interoperability patches are also required. For complete details, see:

• Integrating Oracle E-Business Suite Release 11i with Oracle Database Vault 10.2.0.3 (Metalink Note 428503.1)

Preseeded Realms for the E-Business Suite

Oracle delivers a set of preseeded Database Vault Realms for your E-Business Suite Release 11i environment via the following patch:

• Oracle E-Business Suite Release 11i Realm Creation Patch (Patch 5999012) 
  

This patch contains the master fnddvebs.sql script. The fnddbvebs.sql script. creates Realms around Oracle E-Business Suite 11i product schemas and gives authorization only to those users required to allow the Oracle E-Business Suite to function normally.

The fnddvebs.sql script. creates six Realms. Each realm protects different product schemas and has its own set of user authorizations.

• EBS Realm
• EBS Realm - Applsys Schema
• EBS Realm - Applsyspub Schema
• EBS Realm - Apps Schema
• EBS Realm - MSC Schema
• CTXSYS Data Dictionary

Extending Oracle-Supplied Realms

Oracle strongly recommends against modifying the preseeded Oracle-supplied Realms for the E-Business Suite. If you're familiar with the E-Business Suite data model, you can create your own realms and secure additional objects as needed. Improperly defined Realms can prevent the E-Business Suite from functioning normally, so careful testing of your custom Realms is advisable.

Metalink Note 428503.1 has a detailed example of extending Oracle E-Business suite 11i realms.

Key Considerations About Realms

The preseeded Realms are not intended to provide:

1. Protection from user logged into the SYSTEM schema
2. Protection during Application mid tier patching

Documentation

• Oracle Database 10g Release 2 Vault Administrator's Guide
• Integrating Oracle E-Business Suite 11i  with Oracle Database Vault 10.2.0.3 (Metalink Note 428503.1)
  

Related Articles

• 10.2.0.3 Database Certified with Apps 11i
• Securing Your E-Business Suite 11i Deployment
• Transparent Data Encryption Certified for Apps 11i

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/22997/viewspace-218046/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/22997/viewspace-218046/