Re: Oracle Security Issue

miloann2002 wrote: 
I have the following questions in the Oracle 8 and 9 platforms:

1.     Does the roles need to set password?  If no password, any negative
impact?


No. Just don't grant the roles to the wrong users... ;-)

2. Can user data / objects be put in the system tablespace?

No, if database administrator is wise enough not to give/leave quotas on SYSTEM. Of course, the database administrator can, but it's not advisable, even SYSTEM's objects should not be put on SYSTEM (TOOLS is set up by standard installation).

Can this cause denial of services?

Yes, if SYSTEM tablespace fills up it can have weird consequences...

3.     Is it critical to set password life, password reuse, and other
password settings?  If we have robust operating system and application
security, do we still need to configure the password settings in Oracle?

In many countries, laws require passwords to be changed periodically, so, depending on environment, it may be required.
Moreover, it automatically locks out unneeded/unused accounts.

Remember that overall security is the one of the weakest link, so if SYSTEM's or a critical user's password is weak, someone could log in and sabotage the database without involving OS or application security.


Thanks.



Umberto
.

Relevant Pages

  • Re: setting a password on a button on the switchboard
    ... Could you send me the sample database for the fourth option (4. ... > Security in an Access database can probably be broken down into two big ... > points about being easier than User Level Security, ... > What type of data are you trying to protect? ...
    (microsoft.public.access.forms)
  • Re: access 2003
    ... security in access 2003. ... The data will go on the server and the program database ... than the alternative of creating an mde file. ... MDW file from the written record. ...
    (microsoft.public.access.conversion)
  • Re: access 2003
    ... security in access 2003. ... The data will go on the server and the program database ... than the alternative of creating an mde file. ... MDW file from the written record. ...
    (microsoft.public.access.conversion)
  • Re: Is this possible??
    ... I understand Windows security but since I've not seen A2007 live, ... The backend is on the server in it's own file. ... database, but everyone does not need to have access to tblwage which is ...
    (microsoft.public.access.tablesdbdesign)
  • Re: Is it safe to use social securty number as intranet username? (long)
    ... > they expect us to use our social security number as a username. ... by some database application ... ... The gateway router runs radius for authenticating ... ISPs perform internet connection authentication) ...
    (comp.security.misc)
Loading