Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> The use of free tools in a secure environment
        
(Message started by: Pete Finnigan on Jan 6^th, 2006, 12:13pm)

Title: The use of free tools in a secure environment
Post by Pete Finnigan on Jan 6^th, 2006, 12:13pm

Hi,

In these forums from time to time I see people advising freely available open source tools to
aid them in getting some tasks done. I've seen tools like : expect, opr, swatch, etc, etc.
Now I have few questions :

1)Do you trust those tools blindly? you accept the advise and go and download, install and use such a tool ?
2)do you experiment first on a development environment?
3)do you do a code review (if possible) to detect possible security problems?
4)how does your IT-auditor (if any) react when confronted with those tools?
5)if you have a system administrator, in most large Oracle sites system administration is done by another person, how does he/she react when you ask him/her to install yet another tool? He/she has to cope with new versions, security updates, compatibility with OS version, etc.
6)After the installation of the tools who is responsibly for the correct function of the tool: you or your system administrator?

Maybe you will find those questions silly but in a real secure environment those questions a are real issues.

Ivan

Title: Re: The use of free tools in a secure environment
Post by Pete Finnigan on Jan 17^th, 2006, 7:52am

do not you use perl or java or gzip?

difficult to set a limit between what is secure and what is not secure.

there are (were?) some secure os, I remember "trusted solaris". In those os, you should certainly not download anything, or your security will be broken.

Nowadays, a lot of "freeware" is used on production servers.

I remember having downloaded md5sum binary from the internet to check the md5sum, because md5sum is not present on my aix system. Is this secure? Not really... But not checking the md5sum of my downloaded oracle software is also not secure.

What risk can you afford?

Title: Re: The use of free tools in a secure environment
Post by Pete Finnigan on Jan 17^th, 2006, 9:32am

Laurent,

I'm not advocating against open source/public domain tools. I'm just asking if you have procedures to check for possible security risks coming from the use of those tools (think of Troyan Horses).
To give an example of such a procedure :
if a DBA asks me if he/she should use opr in a 10G environment. I would tell him/her to use the external password store of Oracle.
In a 8i environment under OpenVMS I would advise him/her to use a OPS$ account and a OpenVMS batch account for scripts that need to run periodically.

I know that open source/PD tools are increasingly being used. Solaris 10 if full of Op/PD tools.
(I know organisations that use Solaris 10 and they throw away all tools/packages that they don't use!)
At the end you ask: "What risk can you afford?"
Well, that depends directly from what kind of bussines you have. Management high in the organisation should make a security policy and this policy must be implemented by dba, os-/network administrator.
And from time to time the correct implementation and working of the implemented procedures should be checked by (external) auditors.
In such an environment the questions I asked are very relevant. It's a pity that you misinterpreted my posting and thought I'm advocating against OS/PD.

Ivan