Oracle Database 12c includes more new security capabilities than any other release in Oracle history! In this presentation you will learn about these capabilities, as well as innovative new solutions to protect Oracle Database instances and non-Oracle databases. Hear how Oracle is responding to customer requirements to stay ahead of the evolving threat and regulatory landscape with new preventive controls that include data redaction and a new unified platform that provides database traffic monitoring and enterprise wide auditing.

1. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.1

2. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.2
The following is intended to outline our general product direction. It is intended
for information purposes only, and may not be incorporated into any contract.
It is not a commitment to deliver any material, code, or functionality, and should
not be relied upon in making purchasing decisions. The development, release,
and timing of any features or functionality described for Oracle’s products
remains at the sole discretion of Oracle. Release timing for Oracle Database 12c
is planned for Calendar Year 2013.

3. Security Inside Out
Latest Innovations in Oracle Database 12c
<presenter name>
<presenter title>
<presenter company>

4. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.4
Breached using weak
or stolen credentials
Preventable with
basic controls
76%
97%
Records breached
from servers67%
Over 1.1B Served Discovered by an
external party69%

5. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.5
“We are at the mercy of a new generation of spies who
operate remotely [that] have already shown their
ability to penetrate our power plants, steal our latest
submarine technology, rob our banks, and invade the
Pentagon’s secret communications systems.”
Joel Brenner, former Inspector General of the National Security
Agency and Chief of Counterintelligence for the Director of National
Intelligence
Data Breaches are the Tip of the Iceberg…
Digital Security is the New Battle Ground

6. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.6
“You don’t bother to just simply
hack the organization and its
infrastructure; you focus much
more of your attention on hacking
the employees….”
Anatomy of an Attack
Uri Rivner
CTO, RSA (Security Division of EMC)
Targets Increasing as Attacks Evolve
DBAs, OS Admins, Developers, Multiple Copies of the Data, etc.

7. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.7
Forrester Research Network
Security
SIEM
Endpoint
Security
Web
Application
Firewall
Email Security
Authentication
& User Security
Database
Security
Why Are Databases So Vulnerable?
80% of IT Security Programs Don’t Address Database Security
“Enterprises are taking on risks
that they may not even be aware
of. Especially as more and more
attacks against databases exploit
legitimate access.”

8. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.8
Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
Activity Monitoring
Database Firewall
Auditing and Reporting
DETECTIVE
Redaction and Masking
Privileged User Controls
Encryption
PREVENTIVE ADMINISTRATIVE
Sensitive Data Discovery
Configuration Management
Privilege Analysis

9. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.9
Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
Activity Monitoring
Database Firewall
Auditing and Reporting
DETECTIVE
Redaction and Masking
Privileged User Controls
Encryption
PREVENTIVE ADMINISTRATIVE
Sensitive Data Discovery
Configuration Management
Privilege Analysis

10. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.10
 Transparent data encryption
 Prevents access to data at rest
 Requires no application changes
 Built-in two-tier key management
 “Near Zero” overhead with hardware
 Integrations with Oracle technologies
– e.g. Exadata, Advanced Compression,
ASM, GoldenGate, DataPump, etc.
Oracle Advanced Security
Encryption is the Foundation
Preventive Control for Oracle Databases
Disk
Backups
Exports
Off-Site
Facilities
Applications

11. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.11
 Real-time sensitive data redaction
based on database session context
 Library of redaction policies and point-
and-click policy definition
 Consistent enforcement, policies
applied to data
 Transparent to applications, users, and
operational activities
Oracle Advanced Security
Redaction of Sensitive Data Displayed
Preventive Control for Oracle Database 12c
Credit Card Numbers
4451-2172-9841-4368
5106-8395-2095-5938
7830-0032-0294-1827
Redaction Policy
xxxx-xxxx-xxxx-4368 4451-2172-9841-4368
Billing
Department
Call Center
Application

12. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.12
 Replace sensitive application data
 Referential integrity detected/preserved
 Extensible template library and formats
 Application templates available
 Support for masking data in non-Oracle
databases
Oracle Data Masking
Masking Data for Non-Production Use
Preventive Control for Oracle Databases
LAST_NAME SSN SALARY
ANSKEKSL 323—23-1111 60,000
BKJHHEIEDK 252-34-1345 40,000
LAST_NAME SSN SALARY
AGUILAR 203-33-3234 40,000
BENSON 323-22-2943 60,000
Production
Non-Production
Dev
Test
Production

13. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.13
 Limit DBA access to application data
 Multi-factor SQL command rules
 Realms create protective zones
 Enforce enterprise data governance,
least privilege, segregation of duties
 Out of the box application policies
Oracle Database Vault
Privileged User Controls
Preventive Control for Oracle Databases
Procurement
HR
Finance
select * from finance.customers
Application
DBA
Applications
Security
DBA
DBA

14. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.14
Label Based Access Control
Preventive Control for Oracle Databases
Transactions
Report Data
Reports
Confidential Sensitive
Sensitive
Confidential
Public
 Virtual information partitioning for cloud,
SaaS, hosting environments
 Classify users and data using labels
 Labels based on business drivers
 Automatically enforced row level access
control, transparent to applications
 Labels can be factors in other policies
Oracle Label Security

15. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.15
Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
Activity Monitoring
Database Firewall
Auditing and Reporting
DETECTIVE
Redaction and Masking
Privileged User Controls
Encryption
PREVENTIVE ADMINISTRATIVE
Sensitive Data Discovery
Configuration Management
Privilege Analysis

16. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.16
Oracle Audit Vault and
Database Firewall
Database Activity Monitoring and Firewall
Detective Control for Oracle and non-Oracle Databases
 Monitors network traffic, detect and
block unauthorized activity
 Highly accurate SQL grammar analysis
 Can detect/stop SQL injection attacks
 Whitelist approach to enforce activity
 Blacklists for managing high risk activity
 Scalable secure software appliance
Block
Log
Allow
Alert
SubstituteApps
Whitelist Blacklist
SQL
Analysis Policy
Factors
Users

17. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.17
Oracle Audit Vault and
Database Firewall
Audit, Report, and Alert in Real-Time
Detective Control for Oracle and non-Oracle Databases
Audit Data &
Event Logs
Policies
Built-in
Reports
Alerts
Custom
Reports
!
OS &
Storage
Directories
Databases
Oracle
Database
Firewall
Custom
Security
Analyst
Auditor
SOC
 Centralized secure repository delivered
as secure, scalable software appliance
 Powerful alerting - thresholds, group-by
 Out-of-the box and custom reports
 Consolidated multi-source reporting
 Built-in fine grain segregation of duties

18. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.18
Built-in
Reports
Alerts
Custom
Reports
!
Oracle Audit Vault and Database Firewall
New Solution for Oracle and Non-Oracle Databases
Firewall Events
Users
Applications
Database Firewall
Allow
Log
Alert
Substitute
Block
Audit Data
Audit Vault
OS, Directory, File System &
Custom Audit Logs
Policies
Security
Analyst
Auditor
SOC

19. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.19
Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
Activity Monitoring
Database Firewall
Auditing and Reporting
DETECTIVE
Redaction and Masking
Privileged User Controls
Encryption
PREVENTIVE ADMINISTRATIVE
Sensitive Data Discovery
Configuration Management
Privilege Analysis

20. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.20
Oracle Database Vault
Discover Use of Privileges and Roles
Administrative Control for Oracle Database 12c
Privilege Analysis
Create…
Drop…
Modify…
DBA role
APPADMIN role
 Turn on privilege capture mode
 Report on actual privileges and roles
used in the database
 Helps revoke unnecessary privileges
 Enforce least privilege and reduce risks
 Increase security without disruption

21. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.21
 Scan Oracle for sensitive data
 Built-in, extensible data definitions
 Discover application data models
 Protect sensitive data appropriately:
encrypt, redact, mask, audit…
Oracle Enterprise Manager 12c
Discover Sensitive Data and Databases
Administrative Control for Oracle Database 12c

22. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.22
Oracle Database Lifecycle Management
Configuration Management
Administrative Control for Oracle Databases
Discover
Scan & Monitor
Patch
 Discover and classify databases
 Scan for best practices, standards
 Detect unauthorized changes
 Automated remediation
 Patching and provisioning

23. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.23
Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
Activity Monitoring
Database Firewall
Auditing and Reporting
DETECTIVE
Redaction and Masking
Privileged User Controls
Encryption
PREVENTIVE ADMINISTRATIVE
Sensitive Data Discovery
Configuration Management
Privilege Analysis

24. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.24
Oracle Database Security
Customers Worldwide Rely on Oracle Database Security

25. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.25
Oracle Database Security Solutions
Summary
Simple and
Flexible
Enterprise
Ready
Security and
Compliance
Speed and Scale

26. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.26
 Data Sheets
 Whitepapers
 Webcasts
 Case Studies
 Events
 News
 and more…
www.oracle.com/database/security
Resources

27. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.27
Q&A

28. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.28

29. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.29
The following is intended to outline our general product direction. It is intended
for information purposes only, and may not be incorporated into any contract.
It is not a commitment to deliver any material, code, or functionality, and should
not be relied upon in making purchasing decisions. The development, release,
and timing of any features or functionality described for Oracle’s products
remains at the sole discretion of Oracle. Release timing for Oracle Database 12c
is planned for Calendar Year 2013.

30. Copyright © 2013, Oracle and/or its affiliates. All rights reserved.30