Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Database Security >> Database Security >> Re: Let them eat cake
        
(Message started by: Pete Finnigan on Jul 12^th, 2008, 7:35pm)

Title: Re: Let them eat cake
Post by Pete Finnigan on Jul 12^th, 2008, 7:35pm

Nice anecdote Marcel-Jan, unfortunately I see the same situation many times.

The problem is that we have to have a "little", ok very very small sympathy with the management, there is risk to changing passwords in that the business stops if the application breaks.

This is largely a legacy and lazy issue, in that the people who set the app password to the username cannot remember where they hard coded it, at least they usually remember one place but not all of them, hence the risk.

Unfortunately the same reasons often result in the application schema having excessive privileges.

There are some techniques that can be used to trap it and find out what uses it. For instance one technique is to use audit or logon triggers that can capture who/when/where logs in as the application schema say over a couple of months. This will help track down the places its hard coded. Also you mustn;t just change the password, the hard coding must also be iliminated as well, often very hard to do.

cheers

Pete

Title: Re: Let them eat cake
Post by Pete Finnigan on Jul 14^th, 2008, 9:46am

Agreed. We need a lot of cake to solve all these issues. ;D

Having an application that connects with a users of which nobody knows what privileges are needed is not only a security problem, but typically also a disaster recovery problem. You are probably not able to rebuild your system after a disaster, because you haven't a clue what connects with what and how.

Also having an identical test-system (application + database) is crucial before you want to improve security. This way you can test "what might happen" if privileges are revoked.

By the way, setting an event on 942 is a great way to see what object privileges are necessary. This way you get to see what ORA-942 doesn't show you.

Title: Re: Let them eat cake
Post by Pete Finnigan on Jul 14^th, 2008, 11:02am

Thanks for your reply Marcel-Jan, and also the tip. I remember you mentioned this before, thanks for reminding me.

cheers

Pete

Title: Re: Let them eat cake
Post by Pete Finnigan on Jun 29^th, 2009, 2:58pm

thanks.......wow nice..

sales tracking software (http://salestrackingsoftware.org)