Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Interesting analysis of CPU 12 April - "To patch or not to patch""] [Next entry: "Making Oracle Forms more secure"]

Jared Still has a new paper on protecting passwords

Jared Still, the author with Andy Duncan of the book "Perl for Oracle DBAs" has just written a paper called - (broken link) Protect Your Passwords that is hosted on OraFaq.

The intro for the paper says

"Jared explains how Oracle manages passwords and how "thinking like a hacker" can help you to better protect your databases from potential password theft."

This is good advice for anyone interested in security of their Oracle databases and also something I like to write about and emphasise to people. In this paper Jared talks about password verification functions and their use in enforcing stronger passwords. He also looks at how a password function can be used to steal passwords as users change them. We both came up with this same idea independently quite a while ago. I talked about it in the SANS 6 day hands on Securing Oracle track and some time ago Jared emailed me with the same good idea so when he asked me to review his finished paper I was keen to review it.

This is a - (broken link) very good paper and worth reading.