oracle数据库安全讲义-by paul wright新.pdf

NGS Consulting NextNext GenerationGeneration SecuritySecurity SoftwareSoftware Ltd.Ltd. SecuringSecuring OracleOracle ForensicallyForensically Paul Wright Securityy Software Developper and Consultant NGS Consulting Oracle Forensics at ISACAOracle Forensics at ISACA Next Generation Security Software Ltd . About myself ~ Paul M. WrightAbout myself ~ Paul M. Wright • University of Manchester Computer Scientist specialised in Oracle and security. • 6 years Oracle experience and 7 years security experience. • 11 SANS conferences and most GIAC qualified person in the UK. • Pentest Ltd. Published the first paper on Oracle Forensics in January • NGS Software for the last year writing security checks for Oracle SSoftftware workiking withith DDavidid LitLitchfihfieldld. • First GSOC with the highest marks so far ~ Peter Finnigans course. • This latest work is an extension of the Oracle Forensics Paper for the GSOC qualification and I think it may be of interest to ISACA. Copyright © 2006. NGS Software Ltd. NGS Consulting Oracle Forensics at ISACAOracle Forensics at ISACA Next Generation Security Software Ltd . Plan of presentationPlan of presentation • General database security • Oracle database security • PLSQL packages and SQL Injection • Identifying easy vulnerabilities • Patching problems • Tryyingg to Identifyy vulnerable pprocedures • Identify vul