RE: ODBC and database security

=20
One other thing - you don't want the users to actually modify data outside of the application. In our homegrown databases and applications, our database roles are separated into roles with only SELECT rights and roles with UPDATE/INSERT/DELETE rights on tables. Users have the select roles as their default roles. The other roles may be granted to the users, but not as default roles. When the users log in through the application, the app issues a SET ROLE ALL command, which will allow the users to modify data as needed, based on their roles. If they access the database through another tool (SQL*Plus, MS Access, Excel, etc.) the can only SELECT data (unless they found this post and figure out how to issue the correct command to enable the other roles).

Jay

-----Original Message-----
From: oracle-l-bounce_at_freelists.org
[mailto:oracle-l-bounce_at_freelists.org] On Behalf Of Kip.Bryant_at_Vishay.com
Sent: Friday, December 03, 2004 12:54 PM To: Meenakshi.Aggarwal_at_fishersci.com
Cc: oracle-l_at_freelists.org
Subject: Re: ODBC and database security

IMHO the real security issue is with the oracle client install. Sorry if the following is too obvious... You need to be certain that the DBA utilities are never installed and that the sqlnet config can't be changed so as to avoid system probing. And everyone has changed all default passwords, right? ;-) Then the remaining issue would be account administration...what your password controls are...(length, content, expiration, sharing of accounts...).

Kip

|Hi All,

|Can anybody share what are database security issues when using ODBC=20
|(set up on client PCs).

|Thanks

|--
|http://www.freelists.org/webpage/oracle-l

--
http://www.freelists.org/webpage/oracle-l





**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the =
use of the individual or entity to which they are addressed and may contain=
 information that is privileged, proprietary and confidential. If you are n=
ot the intended recipient, you may not use, copy or disclose to anyone the =
message or any information contained in the message. If you have received t=
his communication in error, please notify the sender and delete this e-mail=
 message. The contents do not represent the opinion of D&E except to the ex=
tent that it relates to their official business.
--
http://www.freelists.org/webpage/oracle-l