IT Security is popular topic nowadays! We constantly hear news about data breaches, ransomware, malware, unauthorized access to IT systems, etc. IT organizations are constantly looking to keep their systems, networks and data safe and secure.
Today’s blog is about how Oracle Enterprise Manager (EM) can help Database Administrators to secure and harden the Oracle Databases they manage along with the hosts those databases are running on.
First things first. I strongly recommend to review the Oracle Database 19c Security Guide. This guide provides guidelines on how to secure the Oracle Database, harden the DB access, secure and encrypt the DB data and so.
Now let’s discuss some areas that database administrators should also look at in order to improve their security posture:
- Timely apply security patches
- Monitor database configuration and detect misconfigurations
- Use industry and regulatory standards like STIG and CIS for the Oracle Database
All the features that we will be discussing today are part of the Oracle Database Lifecycle Management pack. This pack requires an additional license.
Timely apply security patches
Fleet Maintenance (FM) enables administrators to automate lifecycle activities such as database patching and upgrades. FM is a gold image subscription based model that allows to patch databases with minimum downtime by using out-of-place patching mechanisms. In-place patching is also available if you need to apply an emergency on-off patch.
Administrators have the ability to customize the patching process by adding custom pre/post scripts to patching operations. FM supports single instance, RAC databases, Grid Infrastructure, Multitenant and Data Guard configurations.
One thing to mention is the ability to get security patch recommendations as soon as they are published. EM connects to My Oracle Support (MOS) and checks for the availability of new security patches. As soon as a new security patch is released EM will let you know if your DB estate is compliant or not in terms of these patches.
Monitor database configuration and detect misconfigurations
Configuration and Drift Management helps you monitor the configuration of your DB estate, the hosts on where those DB’s are running as well as the Oracle Homes (OH) for those installations. EM allows you to create your own configuration templates based on the configuration settings you need to enforce. Any misconfiguration or drift away of your template will be automatically reported via the Drift Management dashboard and you can also receive alerts if you choose to.
Corrective Actions (CA) can also be created to automatically fix this misconfigurations in order to comply with the templates and reduce security risks.
How many times administrators issued an ALTER SYSTEM command with SPFILE scope and forgot about it? Well, you will know next time you bring your DB up after maintenance. EM helps you detect these changes before they become a production issue. It also help you track the history of configuration changes, save configuration information at a given time and also allows you to use this configuration information to be compared between targets.
Have you wonder, how many OH’s we have with this specific one-off patch?
How many DB’s we have running on this specific OS version?
Well, EM can help you answer all these questions using this configuration data.
One thing worth mentioning is that EM comes with hundreds on configuration collections. If you need to gather a very specific configuration that is not available out-of-the-box, you can create your own configuration extension and collect this automatically.
Use industry and regulatory standards like STIG and CIS for the Oracle Database
EM provides compliance standards to help customers meet regulatory standards like STIG and CIS. Oracle’s best practices are also included within the compliance framework. There are two available options for analysis.
- Rule based analysis
- Real-time change
Each option allow administrators understand where attentions needs to be put in order to harden the DB estate.
Using the compliance framework, EM will provide a score to each associated target along with all the violations that need to be remediated after each evaluation.
I also want to provide links to Oracle LiveLabs workshops available that cover the features discussed above.
Thanks,
Alfredo
