Pete Finnigan's Oracle Security Weblog

Can we use AI in Oracle security? - yes as an answer? we can but how effective it would be means the answer is maybe? It depends on what we want to use AI for and how much data is available and whether the existing models for generative AI and augmented data via RAG (Retrieval Augmented Generation) can work.

What could we use AI for in an Oracle security sense? the obvious choices that stand out are using AI to detect wrong doing in firewalls or audit trails or using AI to detect setup anomalies in configuration. Assuming the standard generative AI model does not have enough knowledge of these topics we could create our own model and in addition teach it these things or we could use RAG to input the right knowledge (usually specialist papers, manual etc) for these things BUT these things don't using exist in any quantity. We would need a manual that describes every type of attack and then also feed the audit trails or firewall logs to this augmented AI model.

So, yes its possible

The current AI that has burst onto the scene in the last few years from OpenAI or DeepSeek has happened because of two major factors

• The rise in availability of hardware to implement the models - graphics cards and large amounts of RAM


• The rise in the large amounts of data freely available



The hardware was helped along with games using graphics cards to do matrix calculations and vector calculations and from use on things like bitcoin mining and password cracking. The rise in data is because of the colossal growth of the internet; books being digital and many more sources of knowledge that ois now digital and freely available.





Many years ago back in 1991, I bought the above book about neural networks and also another C/C++ book that also implemented neural networks and TurboVision ( text based UI for DOS back in the Borland 3.1 development days ). The book above includes a chapter on WIZARD that was an early attempt to implement neural nets in RAM. Around the same time from 1992-1994 I also go into Fuzzy Logic and Genetic Algorithms.

For one assignment in one class of my degree i designed a system to control car wipers based on rain fall. Not the simple setting 1, 2, 3 and 4 of early mixed speed wipers. I designed it to have a water / rain detector use used fuzzy logic to decide how fast to tell the wipers to go, or not at all. It was implemented in MatLab only and not physically but worked in the testing of the software.

How did we get to the sudden growth of AI now with the generative models and reasoning models available today. The golden circle of the right hardware and data being available. If you look at the net then it states that chatgpt was trained on very large data sets including online, conversations and more and it was also paired with supervised learning - re-enforced - where the examples are provided the right answers.

The fact that these models most likely use very large data sets implies that the internet was spidered and web pages parsed and knowledge extracted. Makes sense.

Generative AI in the sense of directions, recipes, general knowledge as viewed by the general person is fine but if you play with these interfaces and ask very specific questions not supplemented by RAG data then the answers are less accurate or wrong.

There is also a second problem that we have all seen. The rise of AI generated things. Just as examples 1) today I saw a picture that looked like ancient South American carvings except the person imaged looked like a spaceman - I have seen genuine cases that could be interpreted loosely in this way BUT this example today was sitting there firing a machine gun, fake! 2) a picture today showed ancient architecture and more modern buildings BUT the people were the wrong scale for the doors, 3) yesterday I saw a picture of a prototype diesel locomotive in Doncaster works BUT the text stated that the name plate was missing and careful viewing showed a ghost steam engine partly drawn behind.

All these are fakes generated by AI.

Then we have the get rich quick market, web content and social media generation and more. I have seen lots of people touting how to create images, text, posts and more using chatgpt.

We do not know the accuracy of this fake data. The internet and the corpus of data is growing and being filled with AI and generated AI data. If the models learn or train from the internet and the internet gets corrupted with generated and fake data from AI then the training and learning is also compromised.

This is a big problem going forwards. Yes, generative AI is great but if its polluted can we trust it.

I think that AI will only get bigger and I can see it used in cases in Oracle security with the right data and inputs to learn. How will it perform against audit trails or firewall logs being generated in large quantities and very fast. Can AI read the data fast enough and act on it?

#oracleace #sym_42 #oracle #database #security #ai #generative #rag

We are holding a 3 day live, in person training event here in York, UK on March 11th to March 13th 2025 (Tuesday to Thursday). The class is taught by Pete Finnigan. The class is a unique event and will cover what you need to know to secure data in your Oracle databases.

We cover every aspect from how databases are breached, how you may have made configuration and design mistakes that could leak or lose your valuable data. We show the problems and then cover how to review your database for issues and how to secure. We focus on the things that come free with the database BUT we also cover the cost options and context based security. The class covers planning and solutions and how to secure all of your databases and make sure that they remain secure over time.

There are full class details including the agenda here.

There is a lot of material in this complete coverage of cradle to grave of securing your data.

The class is over three days and is suitable for anyone who wants to secure data or is involved in securing data. We include the course notes/slides and also hundreds of free scripts and tools. We allow plenty of time for discussions and your questions.

Also included with the class are two free engagement software licenses for our products PFCLScan and PFCLForensics that you can use to help secure your own databases.

The price is just £1095 GBP + VAT so please hurry to register your place as we have only 4 seats left. First come first served.

#oracle #security #training #hacking #datasecurity #databreach

Our recent 3 day Oracle Security training class in York scheduled in January was popular and a lot of people who enquired for the January class asked if we could do the class again in March. I decided to do this even though I had intended to do the class as a one off in January.

The class is fast paced and detailed but is suitable for anyone who wants to secure data in their Oracle databases whether this is in the cloud or on premise. We cover the process cradle to grave of identifying, planning and securing the data and database. The class has a lot of materials, demos and free tools and scripts (around 150 scripts and tools, a lot of which we use in our own work and are not on our website).

Details of the class are on the Oracle security training in 2025 training page. There are details on that page of the agenda, materials, location and more.

This is a live class with myself teaching here in York, UK

The class is held on 3 days from the 11th March to the 13th March 2025 here at our offices in York. The price is £1,095 per person plus VAT

Please contact training@petefinnigan.com to reserve your place.

I talked last week about an issue where I wanted to pre-create a unified audit policy with no rules so that I could create a number of policies for a customer in advance and then we could add the actions/rules later.

I got an error ORA-46373 that if there were no rules on the unified policy then this is not allowed. Fine, we have a simple solution to create a dummy role and make sure its not granted to anyone and then create the policy with a ROLES rule for that dummy role. We can do this again now before we discuss the new point.

Create a dummy role and create the policy and also revoke the role from SYS so its not granted to anyone.

SQL> sho user
USER is "SYS"
SQL> create role pfclatk;

Role created.

SQL> revoke pfclatk from sys;

Revoke succeeded.

SQL> create audit policy pete1 roles pfclatk;

Audit policy created.

SQL>

Now, this solved my issue BUT the customer wanted to name his policies POL1.1.1 or similar. So he created a policy and said my fix was wrong:

SQL> create audit policy pete1.1 roles pfclatk;
create audit policy pete1.1 roles pfclatk
*
ERROR at line 1:
ORA-46373: Audit policy 'PETE1' must have at least one audit option.


SQL>

Hmmm, that does not add up. We have a valid ROLES clause so the error should not be ORA-46373. The issue is obvious as the name of the unified policy cannot contain a "." (DOT) unless the whole thing is encased in quotes. We can try that now:

SQL> create audit policy "pete1.1" roles pfclatk;

Audit policy created.

SQL>

That obviously works BUT I don't like to create objects encased in quotes. What if we try and create a unified audit policy in another schema? the syntax diagram for 19c does not state that this is allowed. Lets try anyway:

SQL> create audit policy atk.pete1 roles pfclatk;
create audit policy atk.pete1 roles pfclatk
*
ERROR at line 1:
ORA-46373: Audit policy 'ATK' must have at least one audit option.


SQL>

No, the same error BUT i expected that as the syntax does not state its possible and the dictionary does not include OWNER:

SQL> desc audit_unified_policies
 Name                                      Null?    Type
 ----------------------------------------- -------- ----------------------------
 POLICY_NAME                                        VARCHAR2(128)
 AUDIT_CONDITION                                    VARCHAR2(4000)
 CONDITION_EVAL_OPT                                 VARCHAR2(9)
 AUDIT_OPTION                                       VARCHAR2(128)
 AUDIT_OPTION_TYPE                                  VARCHAR2(18)
 OBJECT_SCHEMA                                      VARCHAR2(128)
 OBJECT_NAME                                        VARCHAR2(128)
 OBJECT_TYPE                                        VARCHAR2(23)
 COMMON                                             VARCHAR2(3)
 INHERITED                                          VARCHAR2(3)
 AUDIT_ONLY_TOPLEVEL                                VARCHAR2(3)

SQL>

If we do the same with a procedure for instance; call the procedure pete1.1 then we get:

SQL> create or replace procedure pete1.1
  2  is
  3  begin
  4  null;
  5  end;
  6  /

Warning: Procedure created with compilation errors.

SQL> sho err
No errors.
SQL>
SQL> desc pete1.1
ERROR:
ORA-24372: invalid object for describe


SQL> select procedure_name from dba_procedures where procedure_name like 'PETE%';

no rows selected

SQL>

So, a similar issue; the database said we created the procedure pete1.1 with errors BUT there were no errors and the procedure does not exist. We can create the procedure encased in double quotes:

SQL> create or replace procedure "pete1.1"
  2  is
  3  begin
  4  null;
  5  end;
  6  /

Procedure created.

SQL>

What if we create a table:

SQL> create table pete1.1 (col1 number);
create table pete1.1 (col1 number)
                  *
ERROR at line 1:
ORA-00922: missing or invalid option


SQL>

This is slightly more descriptive as the ORA-0922 points at the "." (DOT) and we can create the table with double quotes:

SQL> create table "pete1.1" (col1 number);

Table created.

SQL>

The issue we see in the unified audit policy shows the wrong error in my opinion as the error ORA-46373 shows that we don't have an ACTION, ROLES or PRIVILEGES and generated ORA-46373 but in fact the issue is we used an invalid character in the policy name. Similar occurs with the wrong character in a procedure name but no error number directly shown to the user/dba/developer and no warnings. Similarly with a table, we get closer to the actual place of error with ORA-0922 but still it doesn't state the real error, i.e. it doesn't say "you cant use '.' (DOT) in the name".

Be careful with Oracle errors, sometimes they don't tell you the real problem

#oracleace #sym_42 #oracle #security #audit #trail #unified #unifiedaudit

I have a requirement to pre-create unified audit policies and then add the ACTIONS, PRIVILEGES, ROLES etc after they have been created based on some stored audit rules for a customer. We tried to create a policy with no actions, roles, privileges and we get:

SQL> create audit policy pete1;
create audit policy pete1
*
ERROR at line 1:
ORA-46373: Audit policy 'PETE1' must have at least one audit option.


SQL>

Hmm, it would be nice to be able to be able to pre-create each policy before we start adding the rules but Oracle does not allow this. What if we create a policy with a rule and then remove that rule?

SQL> create audit policy pete1 privileges create session;

Audit policy created.

SQL> alter audit policy pete1 drop privileges create session;
alter audit policy pete1 drop privileges create session
*
ERROR at line 1:
ORA-46373: Audit policy 'PETE1' must have at least one audit option.


SQL>

Nope, we cannot just add a dummy rule and then remove it. We could add a dummy rule and before enabling the policy after we add all the real rules remove the dummy. What I mean by dummy here is a rule that I do not actually need. Lets drop our policy:

SQL> drop audit policy pete1;

Audit Policy dropped.

SQL>

Can we add a rule for an object that does not exist?

SQL> create audit policy pete1 actions select on orablog.dummy;
create audit policy pete1 actions select on orablog.dummy
                                                    *
ERROR at line 1:
ORA-00942: table or view does not exist


SQL>

Nope, cannot do that either. The database obviously checks that the object that we wish to audit exists or is visible to the policy.

So, it seems that we have two options:

• Add an audit action, privilege or role to out unified audit policy that we do not actually need and then add the real audit options later and remove the dummy before the policy is finally enabled


• Pre-Add some dummy object and make sure it is not used and then add that as an audit option so that if there were no other audit options added the enabling of the policy would not fail.

We will use the second option BUT a third option would ne to delay the creation of the policy until we need to add the first rule to it so creating the policy with a real rule. Whilst I would probably prefer that option that management is more complex so we will go with option 2 by creating a role and then revoke it from everyone and then add that to the policy so that the policy would work with no real rules and should not generate audit as the role is not granted to anyone.

SQL> sho user
USER is "SYS"
SQL> create role pfclatk;

Role created.

SQL> revoke pfclatk from sys;

Revoke succeeded.

SQL> create audit policy pete1 roles pfclatk;

Audit policy created.

SQL> audit policy pete1;

Audit succeeded.

SQL>

So, we can remove the dummy audit before we issue the "audit policy" command or leave it there and make sure our dummy role PFCLATK is not granted to anyone. We can clean up:

SQL> noaudit policy pete1;

Noaudit succeeded.

SQL> drop audit policy pete1;

Audit Policy dropped.

SQL>

So, this is an option to allow me to pre-create unified audit policies and to allow me to create those policies without any "real" audit options and to not generate or cause ORA-46373.

#oracle_ace #sym_42 #oracle #unified #audit #auditing #forensics #audittrail

This is the second talk that I did at the recent UKOUG conference at the East Side rooms in Birmingham. This talk discusses how you should respond if you think that your database has been breached or if you unfortunately know that you really have been breached.

The main purpose of this short blog post is to introduce the talk and to present a link to the MS Powerpoint slides.

We started by discussing the fact that data is now the new gold rush like the Yukon and Klondike in the 1890s onwards. Data is growing faster than anything and we manage data in Oracle databases and that data is now valuable so becomes a target for theft or damage.

Data hacking and breaches are now an every day occurrence and almost every person now knows what a data breach is. We cover laws like GDPR and the hefty fines that can happen if personal data is stolen. These elements confirm why we must protect Oracle databases and why the data is an easy target now for thieves.

The next part I covered is what do hackers do; steal data (read it), change data (update it) and destroy data (delete it). Also we cover how attackers do this, what do they exploit in your systems and processes to gain access to your data. We also discuss who is the attacker, internal, external, third parties, public? Finally we looked at the methods used to attack the data. These are essentially the open doors that you have left open to allow them in; this could be through bugs in your applications, bad configuration, bad processes and more.

Next we laid out the complete breach handling process and all the steps before focusing in on the breach response team, the leader and how to handle an incoming breach. We finished with a brief discussion on writing a report and how to fix the security and the breached system. Finally we looked at what you should be doing now to prevent a breach and also to add things to make breach response and analysis easier.

Here is the MS PPT slides:
What should you do if your Oracle database is hacked? - link here. Please have a read and be prepared for a breahc before it happens or take action to prevent a breach.

#oracleace #sym_42 #oracle #forensics #databreach #liveresponse #datasecurity

I presented recently at the UKOUG tech conference 2024 in Birmingham, UK at the Eastside rooms. This was a good conference and I had two talks there. This blog is about the first of those and includes a link to the MS Power Point slides as well.

This talk focused on what can go wrong with the data you hold and process in your Oracle database and how it can be vulnerable to attack or rather how the data held and processed can be vulnerable to attack. We also covered some background on data breaches and attack types and we position the task of securing data; we are securing data and not securing Oracle. We briefly covered cloud and of course Oracles security options.

The rest of the talk was to cover the top 10 security things to look at in the Oracle database to secure your data. The spoiler is that there is not a simple list of ten things that you can do in ten minutes that makes your data and database more secure. Its easy to see why this is the case. Oracle is a generic engine that allows you to process any data model and create any applications. So its not possible to have a generic security that just works. The security is part of the development of your data model, tables and code; its your job.

The power point slides for my talk Top 10 Things to Security Review in an Oracle Database are linked here. Please have a look.

#oracleace #sym_42 #oracle #security #databreach #hacking #datasecurity #data #database #ukoug #ukoug2024