by Sarah Abelow
In our experience as IT auditors who review databases, we wanted to share a few excellent sources of Oracle database best practices.
The two sources are the Center for Internet Security (CIS) \’Security Configuration Benchmark and the US Defense Information Systems Agency (DISA) \’Database Security Technical Implementation Guide\’ (STIG).
In this article we will briefly review each source.
CIS Security Configuration Benchmark. This benchmark for Oracle Database Server 11g is the consensus of industry consultants, auditors, software developers, compliance professionals and government workers.
This benchmark document offers a \’level-I\’ configuration where settings and actions can be implemented by system administrators with any level of security experience. The settings will not have a disruptive impact on an existing database. A \’level-II\’ configuration is more focused on security functionality and network architecture. This level requires a higher level of experience.
Separate sections are dedicated to system specific settings, installation and patching, directory and file permissions, database startup and shutdown, auditing policy, user setup and access settings.
The objective of the benchmark is security against conventional threats. Specific guidance is provided for a secure installation, setup, configuration and operation of an Oracle 11g database environment. \’Best practice\’ processes and procedures relating to data backups, archive logs and hardware security are also included.
DOD DISA Database Security Technical Implementation Guide (STIG). The STIG was published by the US Defense Information Systems Agency (DISA) for the Department of Defense (DOD). The objective of the STIG is to secure DOD database management systems (DBMS). The document covers known security configuration items, vulnerabilities and issues.
The STIG is the most comprehensive and useful version of the DOD documents. It is a configuration standard that consists of \’security elements\’ and \’security requirements\’. Although the STIG is a \’generic\’ document is goes into much more depth than the vendor specific \’checklists\’ discussed below.
The section on \’security elements\’ contains the essentials of database security such as authentication, authorization, data integrity, system auditing, backup and recovery. These security elements are commonly found in the database management system (DBMS) where control resides for security of actual data.
The section on \’security requirements\’ contains the specific requirements for accessing data and operating the database. Guidance is provided on design and configuration, identification and authentication, boundary defense, disaster recovery, vulnerability and incident management, physical and environmental requirements.
DOD DISA Oracle 11 Database Security Checklist. DISA has also published vendor-specific database security checklists for Oracle and Microsoft SQL Server DBMS\’s. The \’Oracle 11 Database Security Checklist\’ is the most current checklist as of the date of this writing – published in August 2010. Separate checklists have also been published for the previous Oracle versions 9 and 10. The Oracle 11 checklist includes security review procedures organized into specific security \’items\’ or \’checks.\’
Conclusion. The two documents discussed above emphasized different aspects of database security. The CIS document provides a basic security configuration (Level I) and an advanced security configuration (Level II). The STIG document provides \’security elements\’ and \’security requirements\’. A more detailed and specific document is the Database Security Checklist.
References. Database Security Technical Implementation Guide (STIG), Version 8, Release 1 (September 2007). US Department of Defense, Defense Information Systems Agency. http://iase.disa.mil/stigs/content_pages/database_security.html
Oracle 11 Database Security Checklist, Version 8, Release 1.8 (August 2010). US Department of Defense, Defense Information Systems Agency. http://iase.disa.mil/stigs/content_pages/database_security.html
Security Confguration Benchmark for Oracle Database Server 11g. Version 1.0.1 (January 2009). The Center for Internet Security. www.cisecurity.org
About the Author:
Looking for certified IT auditors at reasonable rates.
Continental Audit Services, is your provider to control risks, improve security and comply with regulations. IT best practices applied to all major operating systems, databases and other technology. Visit www.continentalaudit.com.