The oracle tag has no wiki summary.
-1
votes
0answers
31 views
SYS access to the ORACLE database. Table with Sensitive/Production data
Having SYS access to the back end Oracle database in SAP can be deemed critical. However, due to the vast number of 25000+ tables
in the database it might be impossible to find exactly where the ...
4
votes
2answers
118 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
3
votes
2answers
172 views
Is it reasonable to prevent timing attacks by using fixed processing time
I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing.
Part 1
Is it a good idea to ...
2
votes
4answers
322 views
Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID
Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"
I know that not good to have clear text password in scripts (there is no alternative at the moment). But question
is the ...
4
votes
1answer
111 views
Security announcement mailing list for Java
I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products.
For example Apple provides such a ...
1
vote
1answer
153 views
Is Oracle gathering information from my machine when I download Virtualbox or Netbeans?
When we try to download Netbeans or Virtualbox from the Oracle/Sun site, our firewall warns us that some suite called EdgeSuite tries to obtain information from our machines. I don't know what ...
5
votes
1answer
538 views
Oracle ExaData Security best practice
Does anybody have experience with Oracle ExaData Security?
Client wants to move all of his Oracle DB to central Oracle ExaData server.
So on same machine will be hosted DBs of different vendors and ...
5
votes
1answer
237 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
7
votes
1answer
369 views
What evaluation criteria would you use for an Oracle scanning tool?
What evaluation criteria would you use to select the right Oracle scanning tool?
Context:
To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
1
vote
1answer
364 views
OpenSSO and Basic Auth together
Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
8
votes
1answer
95 views
Is there a list of default, standard or third-party “users” for Oracle
When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle.
Additionally, third-party software often has its own set of ...
7
votes
2answers
574 views
Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code
Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.
Apart from the generic arguments about 'security through obscurity' are there ...
