Applied Oracle Security: Developing Secure Database and Middleware Environments- P48:Computer security is a field of study that continues to undergo significant changes at an extremely fast pace. As a result of research combined with increases in computing capacity, computer security has reached what many consider to be “early adulthood.” From advances in encryption and encryption devices to identity management and enterprise auditing, the computer security field is as vast and complex as it is sophisticated and powerful | 444 Part IV Applied Security for Oracle APEX and Oracle Business Intelligence to this is application 4155 which allows end users to reset their passwords. It also includes a documented procedure to convert to and from a Runtime Only installation so you don t have to make this decision at install time. Technically you could delete these applications in previous versions and achieve the same goal but then you would be left with no ability to manage any settings within the APEX environment. Since there is no user interface in a Runtime Only installation all instance configuration changes must occur using the APEX_INSTANCE_ADMIN API discussed earlier. Oracle SQL Developer shown in Figure 11-5 introduced tighter integration with APEX. A developer can now import export applications and pages and modify application and page-level attributes simply by connecting to a schema associated with an APEX application using SQL Developer and then right-clicking the application in the APEX tree. These features not only enhance productivity but they also compliment a Runtime Only installation as there is no APEX user interface in a Runtime Only installation. Calls to APEX_INSTANCE_ADMIN as well as SQL Developer features can also be tested with full installations of APEX to determine whether or not these interfaces will be acceptable before making the jump to a Runtime Only configuration. Additional security measures such as removing the APEX administration interface tend to introduce a level of inconvenience. This solution is a good example of adding security without sacrificing significant functionality or productivity. FIGURE 11-5 Oracle SQL Developer interface Chapter 11 Web-centric Security in APEX 445 Obfuscate the APEX_PUBLIC_USER Password in OHS uses a Database Access Descriptor DAD defined in ORACLE_HOME ohs mod_plsql conf to connect to the database. Each DAD includes connection information for the database including the database username and .
