Applied Oracle Security: Developing Secure Database and Middleware Environments- P35:Computer security is a field of study that continues to undergo significant changes at an extremely fast pace. As a result of research combined with increases in computing capacity, computer security has reached what many consider to be “early adulthood.” From advances in encryption and encryption devices to identity management and enterprise auditing, the computer security field is as vast and complex as it is sophisticated and powerful | 314 Part II Oracle Database Vault ORGANIZATION EXTERNAL TYPE ORACLE_LOADER DEFAULT DIRECTORY dbv_dir_log ACCESS PARAMETERS RECORDS DELIMITED BY NEWLINE BADFILE DISCARDFILE LOGFILE FIELDS TERMINATED BY OPTIONALLY ENCLOSED BY username CHAR 30 event CHAR 30 owner CHAR 30 object CHAR 130 status INTEGER EXTERNAL 6 LOCATION DBV_DIR REJECT LIMIT UNLIMITED Table created. The decision concept around the OET is that we can model the Subject-Verb-Object portion of a security profile directly in the OET using the USERNAME EVENT OWNER and OBJECT columns and use the STATUS column as an indicator of TRUE 1 or FALSE 0 to allow the command. The conditional aspect of our profile is satisfied by the file owner root in this example controlling when the commands are authorized on any given object. The table is empty at this point but if we populate the underlying comma-separated-values CSV file as the root OS account we will see the data in the table. root@node1 echo MARY DELETE SH 1 etc dbv In this example we model the concept that the USERNAME MARY is allowed STATUS 1 to execute a DELETE EVENT on any OBJECT whose OWNER is SH. If we attempt to update this file with the Oracle OS account the OS file s permissions prevent the attempt oracle@node1 echo ANTHONY DELETE SH 1 etc dbv -bash etc dbv Permission denied This is a simple example that makes use of the root and Oracle OS accounts. Note that technologies such as fine-grained OS access control lists based on IEEE s POSIX 1003 standards would offer a solution that uses a non-root account as the file owner but for brevity we simply used the root account. With this file populated we can now query the external table as the DBVEXT object-owner account and create a PL SQL package that can be used in DBV rule sets dvf@aos -- query the populated OET dvf@aos SELECT FROM Chapter 7 .
