ORACLE官方安全检测手册_Database_Checklist.pdfVIP

Oracle Database Checklist Prepared by Pete Finnigan References: Oracle security step-by-step – A survival guide for Oracle security – Pete Finnigan - SANS Press – April 2004 (version 1.0 and version 2.0) Links to many useful papers and presentations about Oracle security – /orasec.htm Oracle security website /deploy/security Oracle Corporation main page Customer support site Security alerts /deploy/security/alerts.htm Introduction: This checklist is to be used to audit an Oracle database installation. This checklist is just that “a checklist” and does not contain any specific SQL or shell commands because it is intended to be just a list rather than a “how to” document otherwise. It is also important that the Oracle database is not checked in isolation and the surrounding elements such as the operating system used, the network configuration, web access, application servers and clients are considered. Whilst every effort has been made to ensure that this checklist is as complete and comprehensive as possible new issues and vulnerabilities are found every day therefore don’t rely on it to be all encompassing. Regularly check for updates of this list. Elements to be considered prior to applying this checklist: Host Operating System – Although this checklist includes items that specifically relate to the operating system hosting the Oracle installation they are included because they have a direct effect on Oracle. It is imperative that the host operating system is secured before any applications (in this case Oracle). The same applies to network components and other applications hosted on the same servers. Please consult other S.C.O.R.E documents ( /score ), center for internet security (CIS) benchmarks and tools ( ) and SANS step-by-step guides ( ) for more information. Procedural – It is important to also consider physical security of the servers hosting the Oracl