Database Reference
In-Depth Information
C H A P T E R 7
Data Encryption in Transit
In Chapter 6, we laid the foundation for data encryption between Oracle database and a Java client. We
proved that we can exchange keys securely and then send encrypted data back and forth, successfully
decrypting the data at the recipient, and at the Oracle database.
In this chapter, we will complete the foundation for encryption, which we will continue to build in
the application security,
appsec
Oracle schema. Then we will take on the role of an application
developer, using the
appsec
structures to secure access to our data. Specifically, we will secure access to
data in the
HR
example schema.
Consider the last chapter and observe that we have been both building and testing our application
security structures and code as the
appsec
user. It is not the intent to have every application run as
appsec
. Rather, we will allow each application that needs our security to execute our security functions,
and we will be demonstrating that in this chapter.
Also, we need to provide developers access to our Java structures to include with their desktop
applications. We will discuss that at the end of this chapter.
Security Administrator Activities
Our security administrator,
secadm
, needs to provide a few more permissions. Some of the permissions
are system privileges, and some are grants to packages in the
appsec
and
HR
schemas.
Note
You can find a script of the following commands in the file named
Chapter7/SecAdm.sql
.
Connect to Oracle database as SECADM user, and acquire the secure application role,
secadm_role
.
EXECUTE sys.p_check_secadm_access;
We are going to be creating a table in the
appsec
schema for logging errors. We are also going to
create a trigger associated with that table. Our trigger is like a procedure that runs when certain events
occur—in our case, our trigger will run when a record is inserted into our table.
We want to have a central table for application errors, because the error messages will be returned
to, potentially, dozens or hundreds of applications. How will we, as the application security
administrator, get reports from all these sources? If our application developers are conscientious, they
will let us know what problems they are seeing, but we are not going to count on that happening. We will
watch for errors from our remote listening post—the error table.
