DomainKey-Signature: a=rsa-sha1; c=nofws;        d=gmail.com; s=gamma;        h=mime-version:in-reply-to:references:from:date:message-id:subject:to         :cc:content-type;        b=ZzK1EmAStET25vxAqKIrenUPPwErWk+zqQy3N4dxvsejgRQfEMyS8IdbVuBFX4U6rv         0igLgFmS0m2D8jJJn9osS5MuhgSPQvGS6UCk9LGF2TB7iICNTgT0or+8DCmfsDymK+yG         JmPyen8bM5P8qWppNJuqCufrWlDLkKrLEe8sQ=
MIME-Version: 1.0
In-Reply-To: <BANLkTinW3168XiydhYiMiZDbu7WEhYm97g@mail.gmail.com>
References: <BANLkTimwPiD0t21Fn_Fgquo6dwKYT6d5SQ@mail.gmail.com> <BANLkTinYzNGwcHGW_7Nn3j+q8OBfJcHnvQ@mail.gmail.com> <BANLkTinTQqORQVma6REXKTc=TbXV3TVkRA@mail.gmail.com> <BANLkTi=Aax+kMaFityf98w_dAiQB_Fr6fQ@mail.gmail.com> <BANLkTinW3168XiydhYiMiZDbu7WEhYm97g@mail.gmail.com>
From: Jared Still <jkstill@gmail.com>
Date: Thu, 5 May 2011 08:06:28 -0700
Message-ID: <BANLkTiktZo32VBeTg+G8yJU+gpjDeiFB7w@mail.gmail.com>
Subject: Re: Security Question - how do you deal with sensitive information hardcoded in SQL statements
To: Michael Wehrle <michaelw436@gmail.com>
Cc: Oracle-L Freelists <oracle-l@freelists.org>
Content-Type: multipart/alternative; boundary=000e0cd243d2e82f7104a288b805
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: jkstill@gmail.com
--000e0cd243d2e82f7104a288b805
Content-Type: text/plain; charset=ISO-8859-1

On Wed, May 4, 2011 at 6:28 PM, Michael Wehrle <michaelw436@gmail.com>wrote:

> Jared, sorry about the link. It looks like they have since moved the Oracle
> By Example series into an Apex site that uses Single Sign On. Go to
> www.oracle.com/technetwork/tutorials/index.html, then click on the link at
> the bottom to access the "learning library". Once you have logged in, you
> can search for "Using Transparent Data Encryption for Database 10g Release
> 2".
>
>
Thanks, I will look for that.


> As far as the patch, it was a one-off for my previous employer. And it took
> lots of support calls, involving VP level and above, finally involving some
> backline engineers to fix the problem. I am not sure what they would do if
> you asked for the same patch, since its not publicly searchable. It never
> hurts to ask about it though, since its truly a security issue for everyone,
> that is not easily worked around.
>
>
Have you tried this in 11g?

It seems to me that failure to encrypt the data in AWR is a bug.


Jared Still
Certifiable Oracle DBA and Part Time Perl Evangelist
Oracle Blog: http://jkstill.blogspot.com
Home Page: http://jaredstill.com

--000e0cd243d2e82f7104a288b805
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, May 4, 2011 at 6:28 PM, Michael Wehrle <=
span dir=3D"ltr">&lt;<a href=3D"mailto:michaelw436@gmail.com">michaelw436@g=
mail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Jared, sorry about the link. It looks like they have since moved the Oracle=
 By Example series into an Apex site that uses Single Sign On. Go to <a hre=
f=3D"http://www.oracle.com/technetwork/tutorials/index.html" target=3D"_bla=
nk">www.oracle.com/technetwork/tutorials/index.html</a>, then click on the =
link at the bottom to access the &quot;learning library&quot;. Once you hav=
e logged in, you can search for &quot;<span style=3D"font-family:Arial, san=
s-serif;font-size:14px;font-weight:bold;line-height:20px">Using Transparent=
 Data Encryption for Database 10g Release 2</span>&quot;.<div>


<br></div></blockquote><div><br></div><div>Thanks, I will look for that.</d=
iv><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;"><div></div><div>As far as =
the patch, it was a one-off for my previous employer. And it took lots of s=
upport calls, involving VP level and above, finally involving some backline=
 engineers to fix the problem. I am not sure what they would do if you aske=
d for the same patch, since its not=A0publicly searchable. It never hurts t=
o ask about it though, since its truly a security issue for everyone, that =
is not easily worked around.</div>

<div><div></div><div class=3D"h5">
<div><br></div></div></div></blockquote><div><br></div><div>Have you tried =
this in 11g?</div><div><br></div><div>It seems to me that failure to encryp=
t the data in AWR is a bug.</div><div>=A0</div><div><br clear=3D"all">Jared=
 Still<br>

Certifiable Oracle DBA and Part Time Perl Evangelist<br>Oracle Blog: <a hre=
f=3D"http://jkstill.blogspot.com">http://jkstill.blogspot.com</a><br>Home P=
age: <a href=3D"http://jaredstill.com">http://jaredstill.com</a><br></div>
</div>

--000e0cd243d2e82f7104a288b805--
--
http://www.freelists.org/webpage/oracle-l