RE: oracle data selection

From: Mark W. Farnham <mwf_at_rsiz.com>
Date: Wed, 23 May 2018 18:36:50 -0400
Message-ID: <03e101d3f2e6$8aac64b0$a0052e10$_at_rsiz.com>

Do the cloud vendors provide “super user” services as needed so you cannot see sensitive information in your own database?

That might also be an answer to the license cost of VAULT.

Good luck.

It is ever the conundrum to both fulfill maintenance and emergency capabilities and maintain separation of duties.

My usual suggestion was to make all DBAs dotted line reports to the CFO and the head of HR so they could see everything. (And in some cases also the head of research, but I can’t write about that.)

Of course the price of DBAs has to rise with the additional secrecy, HIPPA, etc., etc. training and responsibility, but they are probably worth it.

mwf

From: oracle-l-bounce_at_freelists.org [mailto:oracle-l-bounce_at_freelists.org] On Behalf Of Vishnu Sent: Wednesday, May 23, 2018 3:34 PM
To: knecht.stefan_at_gmail.com
Cc: Steve Harville; Nagaraj S; oracle-l
Subject: Re: oracle data selection

Naga - If you are in 12c, you can try using invisible columns. It wont show the column even if you are a super user or owner of the object, you can still do explain plan on those tables. you need to explicitly specify the column name to read it. But i'm not sure whether this will satisfy all of your requirements.

Thanks,

Vishnu

On Wed, May 23, 2018 at 3:11 PM, Stefan Knecht <knecht.stefan_at_gmail.com> wrote:

If by superuser you mean SYS - VPD won't work. SYS bypasses VPD policies.

I believe that your only option is Oracle Database Vault (which is an extra cost option).

Stefan

On Thu, May 24, 2018 at 1:50 AM, Steve Harville <steve.harville_at_gmail.com> wrote:

You can use VPD (virtual private database)

On Wed, May 23, 2018 at 1:38 PM Nagaraj chk <nagaraj.chk_at_gmail.com> wrote:

Hi Gurus,

I have a requirement to hide particular columns during select even as an super user, However i should able to do explain plan on those tables. Please guide me if this is possible using data masking or any other options available ?