DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references;
        b=nC+YMw4pVYeoVp0WO2BsOlhiCjwrIJNJFR6J6INdMYkPeB0I8jnqRjNC7yH3uG3Rh4b1lIlFCM3dsmKplJeQH2x2dKRJUyOxLJkGpoQh5XN1KGTI2ptcYows1CVL4YSHpCB9pyL+dfjchnpFLvJ3pESmdw2xW+FLlJQm2qtsr94=
Message-ID: <486b2b610709080139n6ed18411s1767935e806722ef@mail.gmail.com>
Date: Sat, 8 Sep 2007 10:39:51 +0200
From: "Stefan Knecht" <knecht.stefan@gmail.com>
To: Jay.Miller@tdameritrade.com
Subject: Re: Oracle Vault?
Cc: oracle-l <oracle-l@freelists.org>
In-Reply-To: <304CF4722010DD4FA19829D09DDB956BAC3103@prdhswsemlmb01.prod-am.ameritrade.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_4596_30613614.1189240791757"
References: <BAY103-W28F6E0EC0AAC3C8425BE5FD2EA0@phx.gbl>
	 <6e9345580708051243h363c75a0qa0bdc01ff5861a93@mail.gmail.com>
	 <ffb96860708080536q1bc39889p5f8d31e67031ba89@mail.gmail.com>
	 <01bd01c7d9d5$9d5c45c0$46fc4e89@jpl.nasa.gov>
	 <304CF4722010DD4FA19829D09DDB956BAC2ED4@prdhswsemlmb01.prod-am.ameritrade.com>
	 <bf46380708091333o1c6f975w7f84bcd68e83d293@mail.gmail.com>
	 <304CF4722010DD4FA19829D09DDB956BAC3103@prdhswsemlmb01.prod-am.ameritrade.com>
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-to: knecht.stefan@gmail.com
------=_Part_4596_30613614.1189240791757
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Jay

I've recently set up an environment for just that purpose.

What you're looking at is several important factors, to get as close as
possible to prevent a dba from accessing the important data:

- Separation of duties (once a DBA has got a shell as oracle software owner,
your data can be viewed)
- Use database vault to protect the sensitive data with a realm from direct
access
- Use TDE (transparent data encryption) to prevent a dba from restoring a
backup, doing block dumps etc.

The biggest "performance impact" you'll probably hit by the separation of
duties ;-) TDE might also cost you some extra CPU, but you'd have to
benchmark it in your environment. The Vault shouldn't do all that much to
performance, but again, benchmark it to see if it works for you.

Also, the vault isn't perfect. A lot of things don't work out of the box --
it's a very new product after all. I'll have a presentation on just this
topic at SIOUG at the end of september. Once I'm done with it I can mail it
your way if you're interested.

Stefan


On 9/7/07, Jay.Miller@tdameritrade.com <Jay.Miller@tdameritrade.com> wrote:
>
>  Has anyone used this product and be able to comment on any performance
> overhead involved?  We're looking at means of encrypting senstive
> information so sys/system accounts can't see it.
>
>
>
>


-- 
=========================

Stefan P Knecht
Consultant
Infrastructure Managed Services

Trivadis AG
Europa-Strasse 5
CH-8152 Glattbrugg

Phone +41-44-808 70 20
Fax +41-808 70 12
Mobile +41-79-571 36 27
stefan.knecht@trivadis.com
http://www.trivadis.com

OCP SCSA SCNA
=========================

------=_Part_4596_30613614.1189240791757
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Jay<br><br>I&#39;ve recently set up an environment for just that purpose.<br><br>What you&#39;re looking at is several important factors, to get as close as possible to prevent a dba from accessing the important data:<br><br>
- Separation of duties (once a DBA has got a shell as oracle software owner, your data can be viewed)<br>- Use database vault to protect the sensitive data with a realm from direct access<br>- Use TDE (transparent data encryption) to prevent a dba from restoring a backup, doing block dumps etc.
<br><br>The biggest &quot;performance impact&quot; you&#39;ll probably hit by the separation of duties ;-) TDE might also cost you some extra CPU, but you&#39;d have to benchmark it in your environment. The Vault shouldn&#39;t do all that much to performance, but again, benchmark it to see if it works for you.
<br><br>Also, the vault isn&#39;t perfect. A lot of things don&#39;t work out of the box -- it&#39;s a very new product after all. I&#39;ll have a presentation on just this topic at SIOUG at the end of september. Once I&#39;m done with it I can mail it your way if you&#39;re interested.
<br><br>Stefan<br><br><br><br><br><div><span class="gmail_quote">On 9/7/07, <b class="gmail_sendername"><a href="mailto:Jay.Miller@tdameritrade.com">Jay.Miller@tdameritrade.com</a></b> &lt;<a href="mailto:Jay.Miller@tdameritrade.com">
Jay.Miller@tdameritrade.com</a>&gt; wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">


<div>
<div><span></span><font face="Arial"><font color="#0000ff"><font size="2">H<span>as 
anyone&nbsp;used&nbsp;this product and be able to comment on any performance 
overhead involved?&nbsp; We&#39;re looking at means of encrypting senstive 
information so sys/system accounts can&#39;t see 
it.</span></font></font></font></div>
<div><font face="Arial"><font color="#0000ff"><font size="2"><span></span></font></font></font>&nbsp;</div>
<div><font face="Arial"><font color="#0000ff"><font size="2"><span></span></font></font></font>&nbsp;</div>
<div><font face="Arial"><font color="#0000ff"><font size="2"><span></span><span>&nbsp;</span></font></font></font><br></div></div>
</blockquote></div><br><br clear="all"><br>-- <br>=========================<br><br>Stefan P Knecht<br>Consultant<br>Infrastructure Managed Services<br><br>Trivadis AG<br>Europa-Strasse 5<br>CH-8152 Glattbrugg<br><br>Phone +41-44-808 70 20
<br>Fax +41-808 70 12<br>Mobile +41-79-571 36 27<br><a href="mailto:stefan.knecht@trivadis.com">stefan.knecht@trivadis.com</a><br><a href="http://www.trivadis.com">http://www.trivadis.com</a><br><br>OCP SCSA SCNA<br>=========================

------=_Part_4596_30613614.1189240791757--
--
http://www.freelists.org/webpage/oracle-l