Call: +44 (0)7759 277220 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

AI and Oracle Security

Can we use AI in Oracle security? - yes as an answer? we can but how effective it would be means the answer is maybe? It depends on what we want to use AI for and how much data is available and whether the existing models for generative AI and augmented data via RAG (Retrieval Augmented Generation) can work.

What could we use AI for in an Oracle security sense? the obvious choices that stand out are using AI to detect wrong doing in firewalls or audit trails or using AI to detect setup anomalies in configuration. Assuming the standard generative AI model does not have enough knowledge of these topics we could create our own model and in addition teach it these things or we could use RAG to input the right knowledge (usually specialist papers, manual etc) for these things BUT these things don't using exist in any quantity. We would need a manual that describes every type of attack and then also feed the audit trails or firewall logs to this augmented AI model.

So, yes its possible

The current AI that has burst onto the scene in the last few years from OpenAI or DeepSeek has happened because of two major factors

  • The rise in availability of hardware to implement the models - graphics cards and large amounts of RAM

  • The rise in the large amounts of data freely available



  • The hardware was helped along with games using graphics cards to do matrix calculations and vector calculations and from use on things like bitcoin mining and password cracking. The rise in data is because of the colossal growth of the internet; books being digital and many more sources of knowledge that ois now digital and freely available.
    Neural Networks



    Many years ago back in 1991, I bought the above book about neural networks and also another C/C++ book that also implemented neural networks and TurboVision ( text based UI for DOS back in the Borland 3.1 development days ). The book above includes a chapter on WIZARD that was an early attempt to implement neural nets in RAM. Around the same time from 1992-1994 I also go into Fuzzy Logic and Genetic Algorithms.

    For one assignment in one class of my degree i designed a system to control car wipers based on rain fall. Not the simple setting 1, 2, 3 and 4 of early mixed speed wipers. I designed it to have a water / rain detector use used fuzzy logic to decide how fast to tell the wipers to go, or not at all. It was implemented in MatLab only and not physically but worked in the testing of the software.

    How did we get to the sudden growth of AI now with the generative models and reasoning models available today. The golden circle of the right hardware and data being available. If you look at the net then it states that chatgpt was trained on very large data sets including online, conversations and more and it was also paired with supervised learning - re-enforced - where the examples are provided the right answers.

    The fact that these models most likely use very large data sets implies that the internet was spidered and web pages parsed and knowledge extracted. Makes sense.

    Generative AI in the sense of directions, recipes, general knowledge as viewed by the general person is fine but if you play with these interfaces and ask very specific questions not supplemented by RAG data then the answers are less accurate or wrong.

    There is also a second problem that we have all seen. The rise of AI generated things. Just as examples 1) today I saw a picture that looked like ancient South American carvings except the person imaged looked like a spaceman - I have seen genuine cases that could be interpreted loosely in this way BUT this example today was sitting there firing a machine gun, fake! 2) a picture today showed ancient architecture and more modern buildings BUT the people were the wrong scale for the doors, 3) yesterday I saw a picture of a prototype diesel locomotive in Doncaster works BUT the text stated that the name plate was missing and careful viewing showed a ghost steam engine partly drawn behind.

    All these are fakes generated by AI.

    Then we have the get rich quick market, web content and social media generation and more. I have seen lots of people touting how to create images, text, posts and more using chatgpt.

    We do not know the accuracy of this fake data. The internet and the corpus of data is growing and being filled with AI and generated AI data. If the models learn or train from the internet and the internet gets corrupted with generated and fake data from AI then the training and learning is also compromised.

    This is a big problem going forwards. Yes, generative AI is great but if its polluted can we trust it.

    I think that AI will only get bigger and I can see it used in cases in Oracle security with the right data and inputs to learn. How will it perform against audit trails or firewall logs being generated in large quantities and very fast. Can AI read the data fast enough and act on it?

    #oracleace #sym_42 #oracle #database #security #ai #generative #rag


Free Licenses for Oracle Security Software

PFCLScan - Oracle Security Training in York 2025


We are holding a 3 day live, in person training event here in York, UK on March 11th to March 13th 2025 (Tuesday to Thursday). The class is taught by Pete Finnigan. The class is a unique event and will cover what you need to know to secure data in your Oracle databases.

We cover every aspect from how databases are breached, how you may have made configuration and design mistakes that could leak or lose your valuable data. We show the problems and then cover how to review your database for issues and how to secure. We focus on the things that come free with the database BUT we also cover the cost options and context based security. The class covers planning and solutions and how to secure all of your databases and make sure that they remain secure over time.

There are full class details including the agenda here.

There is a lot of material in this complete coverage of cradle to grave of securing your data.

The class is over three days and is suitable for anyone who wants to secure data or is involved in securing data. We include the course notes/slides and also hundreds of free scripts and tools. We allow plenty of time for discussions and your questions.

Also included with the class are two free engagement software licenses for our products PFCLScan and PFCLForensics that you can use to help secure your own databases.

The price is just £1095 GBP + VAT so please hurry to register your place as we have only 4 seats left. First come first served.

#oracle #security #training #hacking #datasecurity #databreach

3 Day Oracle Security Training in York in March

Our recent 3 day Oracle Security training class in York scheduled in January was popular and a lot of people who enquired for the January class asked if we could do the class again in March. I decided to do this even though I had intended to do the class as a one off in January.

The class is fast paced and detailed but is suitable for anyone who wants to secure data in their Oracle databases whether this is in the cloud or on premise. We cover the process cradle to grave of identifying, planning and securing the data and database. The class has a lot of materials, demos and free tools and scripts (around 150 scripts and tools, a lot of which we use in our own work and are not on our website).

Details of the class are on the Oracle security training in 2025 training page. There are details on that page of the agenda, materials, location and more.

This is a live class with myself teaching here in York, UK

The class is held on 3 days from the 11th March to the 13th March 2025 here at our offices in York. The price is £1,095 per person plus VAT

Please contact training@petefinnigan.com to reserve your place.