Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anybody have experience with Oracle ExaData Security? Client wants to move all of his Oracle DB to central Oracle ExaData server. So on same machine will be hosted DBs of different vendors and even competitors. What should we be aware of? (We = one of the vendors)

I found following Oracle document: Oracle ExData Database Machine Security Overview

Are there any other relevant resources on this?

share|improve this question
    
Generally questions that are likely to result in discussion or polling like answers are frowned upon. –  Scott Pack Dec 3 '12 at 14:38
    
@AaronS - this slide presentation discusses Exadata security to some extent. As you'll see, the main 'problem' with Exadata is that its default mode is Open-Security, and from there on you'd be assigning more restricted modes (Open-Security->ASM-Scoped Security->Database-Scoped Security) depending on your needs. Infiniband's Leaf Switch Log-ins also appear in need of looking into before deployment, with shadow files exposed in /conf/shadow by default. –  TildalWave Feb 24 '13 at 16:52

1 Answer 1

Don't expect database encryption to magically solve these security concerns. When yet another oracle db exploit hits metasploit a competitor could use this to compromise all data and all encryption keys stored on the database. In short, an adversary doesn't need SQL Injection to deliver a metasploit payload, they already have access to the database which is a much easier attack to carry out.

Personally, I wouldn't trust my data stored on a database where competitors have access. I also wouldn't depend on Oracle for security. They are very slow to roll out patches in mission critical software and do not handle 0-days very well. (TWO botched patches for the most recent java 0-day, really? This does not inspire consumer confidence.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.