Oracle Database Security and the Payment Card Industry Data Security Standard

Oracle Database Security and the Payment Card Industry Data Security Standard

Oracle Database security provides powerful data protection and access control solutions to address PCI-DSS 1.1 requirements.

Oracle Database Vault prevents highly privileged users from accessing the credit card information and helps reduce the risk of insider threats with separation of duty, multi-factor authorization and command rules.

Oracle Advanced Security Transparent Data Encryption (TDE) provides the industry's most advanced database encryption solution, enabling encryption of credit card numbers with complete transparency to the existing application.

Oracle Audit Vault consolidates and protects database audit data from across the enterprise. Oracle Audit Vault reports and alerts provide pro-active notification of access to credit card information.

Oracle Enterprise Manager provides secure configuration scanning to insure your databases stay configured securely.

Oracle Label Security extends user security authorizations to help enforce the need-to-know principle.

See following link for more details

http://www.oracle.com/technology/deploy/security/database-security/oracle-pci.html


If you would like further information regarding the above services or any of the Quantix range, please feel free to visit the Quantix or contact us on 0115 983 6200

Orakill

The orakill utility is provided only with Oracle databases on Windows platforms. The executable (orakill.exe) is available to DBAs to kill Oracle sessions directly from the DOS command line without requiring any connection to the database.

In the UNIX world, a DBA can kill a shadow process by issuing the kill –9 command from the UNIX prompt. UNIX is able to provide this capability given that the UNIX operating system is based on processes that fork other processes. All processes can be listed by using the ps UNIX command. The Oracle background processes will be listed separately from all of the Oracle sessions since they have their own process.

Unlike the UNIX operating system, Windows systems are thread-based. For each instance, the background processes and sessions are all contained within the oracle.exe executable. These processes are not listed in the “Processes” tab of Windows Task Manager. Each session creates its own thread within oracle.exe and therefore, is not exposed to the Windows user. Killing the oracle.exe process in Windows would crash the entire database.

The orakill utility serves the same purpose as kill –9 in UNIX . The command requires the instance and the SPID of the thread to kill. The utility will display exactly how to obtain the SPID in the event the command was entered without parameters:

C:\oracle9i\bin>orakill

Usage: orakill sid thread

where sid = the Oracle instance to target
thread = the thread id of the thread to kill

The thread id should be retrieved from the spid column of a query such as:

select spid, osuser, s.program from
v$process p, v$session s where p.addr=s.paddr

If the statement suggested by Oracle (above) to retrieve the Thread ID is executed, the results below are displayed:

select a.username, a.osuser, b.spid
from v$session a, v$process b
where a.paddr = b.addr
and a.username is not null;


USERNAME OSUSER SPID
------------------------------ ------------------------------ -----
SCOTT Scott 3116
AMOORE Alex 4760
DMOORE Dave 768

With the SPID for each user listed above, the session for any user can be killed.

C:\oracle9i\bin>orakill ORCL92 4760

Kill of thread id 4760 in instance ORCL92 successfully signalled.


SQL> select a.username, a.osuser, b.spid
2 from v$session a, v$process b
3 where a.paddr = b.addr
4 and a.username is not null;


USERNAME OSUSER SPID
------------------------------ ------------------------------ -----
SCOTT Scott 3116
DMOORE Dave 768

2 rows selected.

Notice that SPID 4760, user AMOORE is gone.

Why does Oracle provide a utility to kill sessions from the DOS prompt, when a DBA could kill a user session from within Oracle? The following command will also kill the user session:

alter system kill session(sid, serial#);

The sid (session ID) and serial# above can be obtained from the v$session view. There are a couple of reasons a DBA might use orakill instead of the alter system kill session command.

1. The alter system statement will not clear any locks that exist. Instead, the session will remain connected until it times out, then the session is killed and the locks are released. The orakill command will kill the thread and the locks instantly.
2. A DBA may be unable to gain access to a SQL prompt due to a runaway query consuming all database resources. In this case, the session can be killed without ever logging in to the database.

If you would like more information on any of Quantix's Oracle product range then please visit the Quantix website or contact us on 0115 983 6200

Oracle VM Templates

Oracle VM Templates

Easier...Faster...Lower Cost...Fully Supported for Production Deployments Oracle VM Templates provide an innovative approach to deploying a fully configured software stack by offering pre-installed and pre-configured software images. Use of Oracle VM Templates eliminates the installation and configuration costs, and reduces the ongoing maintenance costs helping organizations achieve faster time to market and lower cost of operations.

Oracle VM Templates of many key Oracle products are available for download:• Oracle Database 11g• Oracle Database 10g Release 2 (10.2.0.3)• Oracle Enterprise Manager 10g (10.2.0.4)• Oracle Siebel CRM 8• Oracle Enterprise Linux

The use of Oracle VM offers full benefits of server virtualization including optimizing resource utilization with server consolidation, energy and power savings, and space savings, all of which lead to further lowering the cost of operations and enabling Green IT for users.

Just copy the software images provided on your server that has Oracle VM installed on it, and within minutes you will have a fully installed and configured Oracle environment without having to install products from scratch.

Set up a full Oracle environment within minutes.

Oracle Enterprise Linux Templates

Available for both Oracle Enterprise Linux 4 and Oracle Enterprise Linux 5
Download Linux Templates

Oracle Database Templates

Oracle Database Template comprises of Oracle Enterprise Linux template and Oracle Database disk images

Available for both Oracle Database 11g and Oracle Database 10g Release 2 (10.2.0.3)
Download Oracle Database Template

Oracle Siebel CRM Templates

Oracle Siebel CRM Templates include two Oracle VM templates;• Oracle Database 11g configured with the Siebel 8 schema;• Oracle Mid-Tier VM Template
Download Siebel CRM Template Notes:Fill out your registration information (Name, Company Name, Email Address and Country) and click on the download agreement.Pick "Oracle VM

Templates" in the drop down menu for "Select a Product Pack"Pick "x86 32 bit" in the drop down menu for "Platform"Click on "Go"This will take you to the page where the Oracle VM Templates are listed.Download and unzip the files.Spend about 30 minutes setting up the Oracle VM templates to work on your network/domain. Then start Siebel - as it ships out of the box!

Oracle Enterprise Manager Templates

Oracle Enterprise Manager Template can be deployed in minutes, thereby providing an ability to deploy a full-fledged Enterprise Manager on a pre-configured Oracle Enterprise Linux operating system.

The template contains two VMs—one for Oracle Enterprise Manager 10g (10.2.0.4) and one for the database repository (10.2.0.4)
Download Oracle Enterprise Manager Template

If you would like further information on any of Oracle's products or services then please visit the Quantix website or contact us on 0115 983 6200

Oracle Acquires ClearApp

On September 2, 2008, Oracle announced it has entered into an agreement to acquire ClearApp, a leading provider of application management solutions for composite applications. The transaction is subject to customary closing conditions and is expected to close in the second half of 2008. Until the deal closes, each company will continue to operate independently.

Today, businesses rely heavily on agile SOA applications to automate key business processes. These environments are often developed and managed by different teams, and the high level of abstraction that makes these architectures attractive also hides key application component relationships creating an "IT visibility gap".

ClearApp addresses the IT visibility gap by discovering and modeling the functional dependencies inherent in SOA environments. With the ClearApp solution, customers are able to discover and model end-to-end business services and component dependencies in runtime, monitor business service performance, and diagnose performance issues quickly. ClearApp’s capabilities are expected to extend Oracle’s application management solutions to provide visibility of transactions across all application components.

Oracle Enterprise Manager and ClearApp products, combined with recently acquired products from Moniforce and Auptyma, are expected to provide customers with a top-down application management solution that provides comprehensive management of their standards-based applications and integrations, delivering greater value to the business. Customers are expected to see enhanced service levels, reduced down time, and improved return on their SOA investments.

After the close of the transaction, we anticipate that Oracle partners will benefit from working with a single vendor to address customer needs for complete SOA governance and application management solutions. ISV partners are expected to gain broader opportunities for development integrations. System Integrators should be able to expand implementation and service offerings related to Oracle Enterprise Manager. Value-added resellers are expected to gain expanded opportunities to provide solutions. All partners can take advantage of Oracle’s worldwide resources and enablement through the Oracle PartnerNetwork program

Quantix, a Oracle Certified Advantage partner, offer a wide range of Oracle products and services to suit the needs of any business in any vertical market. If you would like information on any of our oracle products or services, please feel free to visit the Quantix website or call us on 0115 983 6200