Oracle Database Vulnerability Assessment Service

The Current State of Database Security Measures

Despite knowing the importance of database security, many companies still do not have any security measures in place.

Some of the obstacles getting in the way of database security measures are:

1. • Higher priority given to network perimeter defense
2. • Uneven application support
3. • The cost and difficulty of using security products
4. • Lack of clarity on which department should pay for security products

The general sentiment in the workplace is that even though database security is clearly important, no one can move forward with plans to address it.

We believe that both top-down (management-driven) and bottom-up (IT-driven) approaches to the problem are important.

In recent years, most security incidents have been caused by either external attackers who exploit web application vulnerabilities or internal attackers who access a company's databases directly. In fact, domestic Japanese companies need stronger database security to address the large number of incidents that have been caused by insiders acting illegally.

We recommend database assessments to our clients so that we can better understand their situations and create milestones for database security measures.

Characteristics of an Oracle Database Vulnerability Assessment

1. Examine and propose security requirements
   We examine and propose security requirements for each client given their particular circumstances, the problems they face, and the properties of their IT systems.
2. Conduct a detailed database assessment
   We check dozens of database properties informed by our experience building and running database systems.
3. Present concrete proposals for enacting security measures
   We consider and present concrete steps to address the issues we identified in our assessment report.
4. Integrate with database (performance) assessments and tuning services
   We provide a smooth transition to our tuning services after security measures have been enacted.

System Components Covered by a Vulnerability Assessment

Vulnerability Assessment Flowchart

Interview topics: - Current issues - Current setup and settings - Client security policies - Operational methods - Future system updates • Methods for gathering data to analyze • Assessment schedule • Target and scope of the assessment • Available configuration data	• Configure information-gathering tools • Information to collect: - Network structure and settings - Operating system settings - Log configuration management - Database information • Permissions • Accounts • Settings and applied patches	• Current conditions to report: - Basic database assessment metrics - Issues • Discuss proposed improvements to address the results of the assessment and current issues experienced by the client • Security requirements to consider: - Data attributes - System attributes - Basic assessment metrics - Current issues	Proposals to present and discuss: - Database modifications - Structural system modifications

Vulnerability Assessment Options