Pete Finnigan's Oracle Security Weblog

Jared Still, the author with Andy Duncan of the book "Perl for Oracle DBAs" has just written a paper called http://www.orafaq.com/articles/archives/000064.htm - (broken link) Protect Your Passwords that is hosted on OraFaq.

The intro for the paper says

"Jared explains how Oracle manages passwords and how "thinking like a hacker" can help you to better protect your databases from potential password theft."

This is good advice for anyone interested in security of their Oracle databases and also something I like to write about and emphasise to people. In this paper Jared talks about password verification functions and their use in enforcing stronger passwords. He also looks at how a password function can be used to steal passwords as users change them. We both came up with this same idea independently quite a while ago. I talked about it in the SANS 6 day hands on Securing Oracle track and some time ago Jared emailed me with the same good idea so when he asked me to review his finished paper I was keen to review it.

This is a http://www.orafaq.com/articles/archives/000064.htm - (broken link) very good paper and worth reading.