Oracle Database Security Risk Assessment

Highly Confidential

Assessment Date & Time

Date of Data Collection	Date of Report	Reporter Version
Tue May 23 2017 11:00:00	Tue May 23 2017 11:05:19	1.0.2 (October 2016) - 7409

Database Identity

Name	Platform	Database Role	Log Mode	Created	Container Database	Container ID	Container Name
CDB3	Linux x86 64-bit	PRIMARY	NOARCHIVELOG	Mon Mar 13 2017 11:01:00	True	3	PDB1

Summary

Section	Pass	Evaluate	Opportunity	Some Risk	Significant Risk	Severe Risk	Total Findings
Basic Information	0	0	0	0	0	1	1
User Accounts	8	0	0	2	1	0	11
Privileges and Roles	6	10	0	1	0	0	17
Authorization Control	0	1	1	0	0	0	2
Data Encryption	0	1	1	0	0	0	2
Fine-Grained Access Control	0	2	3	0	0	0	5
Auditing	5	5	1	0	1	0	12
Database Configuration	6	4	0	1	0	1	12
Network Configuration	1	0	0	1	3	0	5
Operating System	1	1	0	2	0	0	4
Total	27	24	6	7	5	2	71

Basic Information

Database Version

Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production

Security options used: Advanced Security, Database Vault, Label Security

Security Features

Feature	Currently Used
AUTHORIZATION CONTROL
Database Vault	Yes
Privilege Analysis	No

DATA ENCRYPTION
Column Encryption	No
Tablespace Encryption	Yes
Network Encryption	Yes

FINE-GRAINED ACCESS CONTROL
Data Redaction	Yes
Virtual Private Database	Yes
Real Application Security	No
Label Security	Yes
Transparent Sensitive Data Protection	No

AUDITING
Traditional Audit	No
Fine Grained Audit	No
Unified Audit	Yes

USER AUTHENTICATION
External Authentication	No
Global Authentication	Yes

Patch Check

INFO.PATCH

Status

Severe Risk

Summary

Latest Oracle Database PSU not found.

Details

Patch Inventory:
(none)

Patch History:
(none)

Remarks

It is vital to keep the database software up-to-date with security fixes as they are released. Oracle issues Patch Set Updates (PSU) on a regular quarterly schedule. These updates should be applied as soon as they are available. For releases prior to Oracle Database 12c, quarterly updates may be delivered by patches not marked as PSUs.

User Accounts

Note: Predefined Oracle accounts which are locked are not included in this report. To include all user accounts, run the report with the -a option.

User Accounts

User Name	Status	Profile	Tablespace	Predefined	Type
C##AVAGENT	OPEN	DEFAULT	USERS	No	PASSWORD
C##DVAM	OPEN	DEFAULT	USERS	No	PASSWORD
C##DVO	OPEN	DEFAULT	USERS	No	PASSWORD
C##HR_ADMIN	OPEN	DEFAULT	USERS	No	PASSWORD
DBSFWUSER	OPEN	DEFAULT	SYSAUX	Yes	PASSWORD
DBSNMP	OPEN	DEFAULT	SYSAUX	Yes	PASSWORD
DEMOAPPS	OPEN	DEFAULT	USERDATA	No	PASSWORD
DVF	OPEN	DEFAULT	SYSAUX	Yes	PASSWORD
EUS_GLOBAL	OPEN	DEFAULT	USERS	No	GLOBAL
LBACSYS	OPEN	DEFAULT	SYSTEM	Yes	PASSWORD
PDBADMIN	OPEN	DEFAULT	USERS	No	PASSWORD
SECADMIN	OPEN	DEFAULT	USERS	No	PASSWORD
SYS	OPEN	DEFAULT	SYSTEM	Yes	PASSWORD
SYSKM	OPEN	DEFAULT	USERS	Yes	PASSWORD
SYSTEM	OPEN	DEFAULT	SYSTEM	Yes	PASSWORD

User Accounts in SYSTEM or SYSAUX Tablespace

USER.TBLSPACE

Status

Pass

Summary

No user uses SYSTEM or SYSAUX tablespace.

Remarks

The SYSTEM and SYSAUX tablespaces are reserved for Oracle-supplied user accounts. To avoid a possible denial of service caused by exhausting these resources, regular user accounts should not use these tablespaces. Prior to Oracle Database 12.2, the SYSTEM tablespace cannot be encrypted, and this is another reason to avoid user schemas in this tablespace.

Sample Schemas

USER.SAMPLE

Status

Pass

Summary

No sample schemas found.

Remarks

Sample schemas are well-known accounts provided by Oracle to serve as simple examples for developers. They generally serve no purpose in a production database and should be removed because they unnecessarily increase the attack surface of the database.

Inactive Users

USER.INACTIVE

Status

Some Risk

Summary

Found 6 unlocked users inactive for more than 30 days.

Details

Inactive users: DBSFWUSER, DVF, LBACSYS, PDBADMIN, SYS, SYSKM

Remarks

If a user account is no longer in use, it increases the attack surface of the system unnecessarily while providing no corresponding benefit. Furthermore, unauthorized use is less likely to be noticed when no one is regularly using the account. Accounts that have been unused for more than 30 days should be investigated to determine whether they should remain active.

Case-Sensitive Passwords

USER.CASE

Status

Pass

Summary

Case-sensitive passwords are used.

Details

Initialization parameter SEC_CASE_SENSITIVE_LOGON is set to TRUE.

Remarks

Case-sensitive passwords are recommended because including both upper and lower-case letters greatly increases the set of possible passwords that must be searched by an attacker who is attempting to guess a password by exhaustive search. Setting SEC_CASE_SENSITIVE_LOGON to TRUE ensures that the database distinguishes between upper and lower-case letters in passwords.

Users with Expired Passwords

USER.EXPIRED

Status

Pass

Summary

No unlocked users with password expired for more than 30 days found.

Remarks

Password expiration is used to ensure that users change their passwords on a regular basis. If a user's password has been expired for more than 30 days, it indicates that the user has not logged in for at least that long. Accounts that have been unused for an extended period of time should be investigated to determine whether they should remain active.

Users with Default Passwords

USER.DEFPWD

Status

Pass

Summary

No unlocked user accounts are using default password.

Remarks

Default account passwords for predefined Oracle accounts are well known. Open accounts with default passwords provide a trivial means of entry for attackers, but well-known passwords should be changed for locked accounts as well.

Minimum Client Authentication Version

USER.AUTHVERS

Status

Some Risk

Summary

Minimum client version is not configured correctly.

Details

SQLNET.ALLOWED_LOGON_VERSION_SERVER is not set (default value = 12).
    Recommended value is 12a.

Remarks

Over time, Oracle releases have added support for increasingly secure versions of the algorithm used for password authentication of user accounts. In order to remain compatible with older client software, the database continues to support previous password versions as well. The sqlnet.ora parameter ALLOWED_LOGON_VERSION_SERVER determines the minimum password version that the database will accept. For maximum security, this parameter should be set to the highest value supported by the database once all client systems have been upgraded.

Password Verifiers

USER.VERIFIER

Status

Significant Risk

Summary

Found 1 user account requiring updated password verifiers. No user accounts have HTTP verifiers.

Details

Database supports password versions up to 12C.
Users requiring updated password verifiers: DVF(11G )

Users with HTTP verifiers: (none)

Remarks

For each user account, the database may store multiple verifiers, which are hashes of the user password. Each verifier supports a different version of the password authentication algorithm. Every user account should include a verifier for the latest password version supported by the database so that the user can be authenticated using the latest algorithm supported by the client. When all clients have been updated, the security of user accounts can be improved by removing the obsolete verifiers. HTTP password verifiers are used for XML Database authentication. Use the ALTER USER command to remove these verifiers from user accounts that do not require this access.

User Profiles

Profile Name	Resource	Value
DEFAULT	(Number of Users)	15
DEFAULT	CONNECT_TIME	UNLIMITED
DEFAULT	FAILED_LOGIN_ATTEMPTS	10
DEFAULT	IDLE_TIME	UNLIMITED
DEFAULT	PASSWORD_GRACE_TIME	7
DEFAULT	PASSWORD_LIFE_TIME	180
DEFAULT	PASSWORD_LOCK_TIME	1
DEFAULT	PASSWORD_REUSE_MAX	UNLIMITED
DEFAULT	PASSWORD_REUSE_TIME	UNLIMITED
DEFAULT	PASSWORD_VERIFY_FUNCTION	ORA12C_STRONG_VERIFY_FUNCTION
ORA_STIG_PROFILE	(Number of Users)	0
ORA_STIG_PROFILE	CONNECT_TIME	UNLIMITED (DEFAULT)
ORA_STIG_PROFILE	FAILED_LOGIN_ATTEMPTS	3
ORA_STIG_PROFILE	IDLE_TIME	15
ORA_STIG_PROFILE	PASSWORD_GRACE_TIME	5
ORA_STIG_PROFILE	PASSWORD_LIFE_TIME	60
ORA_STIG_PROFILE	PASSWORD_LOCK_TIME	UNLIMITED
ORA_STIG_PROFILE	PASSWORD_REUSE_MAX	10
ORA_STIG_PROFILE	PASSWORD_REUSE_TIME	365
ORA_STIG_PROFILE	PASSWORD_VERIFY_FUNCTION	ORA12C_STIG_VERIFY_FUNCTION

Users with Unlimited Password Lifetime

USER.NOEXPIRE

Status

Pass

Summary

Password expiration is configured for all users.

Remarks

Password expiration is used to ensure that users change their passwords on a regular basis. Passwords that never expire may remain unchanged for an extended period of time. When passwords do not have to be changed regularly, users are also more likely to use the same passwords for multiple accounts.

Users with Unlimited Failed Login Attempts

USER.NOLOCK

Status

Pass

Summary

No users have unlimited failed login attempts.

Remarks

Attackers sometimes attempt to guess a user's password by simply trying all possibilities from a set of common passwords. To defend against this attack, it is advisable to lock a user account when there are multiple failed login attempts without a successful login.

Password Verification Functions

USER.PASSWD

Status

Pass

Summary

All user accounts are using password verification function.

Remarks

Password verification functions are used to ensure that user passwords meet minimum requirements for complexity, which may include factors such as length, use of numbers or punctuation characters, difference from previous passwords, etc. Oracle supplies several predefined functions, or a custom PL/SQL function can be used. Every user profile should include a password verification function.

Privileges and Roles

All System Privileges

PRIV.SYSTEM

Status

Evaluate

Summary

294 grants of system privileges

Details

Users directly or indirectly granted each system privilege:

ADMINISTER ANY SQL TUNING SET: SYSTEM
ADMINISTER DATABASE TRIGGER: LBACSYS, SYSTEM
ADMINISTER KEY MANAGEMENT: SYSKM
ADMINISTER RESOURCE MANAGER: SYSTEM
ADMINISTER SQL MANAGEMENT OBJECT: SYSTEM
ADMINISTER SQL TUNING SET: SYSTEM
ADVISOR: DBSNMP, SYSTEM
ALTER ANY ANALYTIC VIEW: SYSTEM
ALTER ANY ASSEMBLY: SYSTEM
ALTER ANY ATTRIBUTE DIMENSION: SYSTEM
ALTER ANY CLUSTER: SYSTEM
ALTER ANY CUBE: SYSTEM
ALTER ANY CUBE BUILD PROCESS: SYSTEM
ALTER ANY CUBE DIMENSION: SYSTEM
ALTER ANY DIMENSION: SYSTEM
ALTER ANY EDITION: SYSTEM
ALTER ANY EVALUATION CONTEXT: SYSTEM
ALTER ANY HIERARCHY: SYSTEM
ALTER ANY INDEX: SYSTEM
ALTER ANY INDEXTYPE: SYSTEM
ALTER ANY LIBRARY: SYSTEM
ALTER ANY MATERIALIZED VIEW: SYSTEM
ALTER ANY MEASURE FOLDER: SYSTEM
ALTER ANY MINING MODEL: SYSTEM
ALTER ANY OPERATOR: SYSTEM
ALTER ANY OUTLINE: SYSTEM
ALTER ANY PROCEDURE: SYSTEM
ALTER ANY ROLE: SYSTEM
ALTER ANY RULE: SYSTEM
ALTER ANY RULE SET: SYSTEM
ALTER ANY SEQUENCE: SYSTEM
ALTER ANY SQL PROFILE: SYSTEM
ALTER ANY SQL TRANSLATION PROFILE: SYSTEM
ALTER ANY TABLE: SYSTEM
ALTER ANY TRIGGER: SYSTEM
ALTER ANY TYPE: SYSTEM
ALTER DATABASE: SYSTEM
ALTER LOCKDOWN PROFILE: SYSTEM
ALTER PROFILE: C##DVAM, SECADMIN, SYSTEM
ALTER RESOURCE COST: SYSTEM
ALTER ROLLBACK SEGMENT: SYSTEM
ALTER SESSION: SYSTEM
ALTER SYSTEM: SYSTEM
ALTER TABLESPACE: SYSTEM
ALTER USER: C##DVAM, SECADMIN, SYSTEM
ANALYZE ANY: DBSNMP, SYSTEM
ANALYZE ANY DICTIONARY: DBSNMP, SYSTEM
AUDIT ANY: SECADMIN, SYSTEM
AUDIT SYSTEM: SECADMIN, SYSTEM
BACKUP ANY TABLE: SYSTEM
CHANGE NOTIFICATION: SYSTEM
COMMENT ANY MINING MODEL: SYSTEM
COMMENT ANY TABLE: SYSTEM
CREATE ANALYTIC VIEW: SYSTEM
CREATE ANY ANALYTIC VIEW: SYSTEM
CREATE ANY ASSEMBLY: SYSTEM
CREATE ANY ATTRIBUTE DIMENSION: SYSTEM
CREATE ANY CLUSTER: SYSTEM
CREATE ANY CONTEXT: SYSTEM
CREATE ANY CREDENTIAL: SYSTEM
CREATE ANY CUBE: SYSTEM
CREATE ANY CUBE BUILD PROCESS: SYSTEM
CREATE ANY CUBE DIMENSION: SYSTEM
CREATE ANY DIMENSION: SYSTEM
CREATE ANY DIRECTORY: SYSTEM
CREATE ANY EDITION: SYSTEM
CREATE ANY EVALUATION CONTEXT: SYSTEM
CREATE ANY HIERARCHY: SYSTEM
CREATE ANY INDEX: SYSTEM
CREATE ANY INDEXTYPE: SYSTEM
CREATE ANY JOB: (none)
CREATE ANY LIBRARY: SYSTEM
CREATE ANY MATERIALIZED VIEW: SYSTEM
CREATE ANY MEASURE FOLDER: SYSTEM
CREATE ANY MINING MODEL: SYSTEM
CREATE ANY OPERATOR: SYSTEM
CREATE ANY OUTLINE: SYSTEM
CREATE ANY PROCEDURE: SYSTEM
CREATE ANY RULE: SYSTEM
CREATE ANY RULE SET: SYSTEM
CREATE ANY SEQUENCE: SYSTEM
CREATE ANY SQL PROFILE: SYSTEM
CREATE ANY SQL TRANSLATION PROFILE: SYSTEM
CREATE ANY SYNONYM: SYSTEM
CREATE ANY TABLE: SYSTEM
CREATE ANY TRIGGER: SYSTEM
CREATE ANY TYPE: SYSTEM
CREATE ANY VIEW: SYSTEM
CREATE ASSEMBLY: SYSTEM
CREATE ATTRIBUTE DIMENSION: SYSTEM
CREATE CLUSTER: DEMOAPPS, LBACSYS, SYSTEM
CREATE CREDENTIAL: SYSTEM
CREATE CUBE: SYSTEM
CREATE CUBE BUILD PROCESS: SYSTEM
CREATE CUBE DIMENSION: SYSTEM
CREATE DATABASE LINK: SYSTEM
CREATE DIMENSION: SYSTEM
CREATE EVALUATION CONTEXT: SYSTEM
CREATE EXTERNAL JOB: (none)
CREATE HIERARCHY: SYSTEM
CREATE INDEXTYPE: DEMOAPPS, LBACSYS, SYSTEM
CREATE JOB: DBSNMP, SYSTEM
CREATE LIBRARY: SYSTEM
CREATE LOCKDOWN PROFILE: SYSTEM
CREATE MATERIALIZED VIEW: SYSTEM
CREATE MEASURE FOLDER: SYSTEM
CREATE MINING MODEL: SYSTEM
CREATE OPERATOR: DEMOAPPS, LBACSYS, SYSTEM
CREATE PLUGGABLE DATABASE: PDBADMIN, SYSTEM
CREATE PROCEDURE: DBSNMP, DEMOAPPS, DVF, LBACSYS, SYSTEM
CREATE PROFILE: C##DVAM, SECADMIN, SYSTEM
CREATE PUBLIC DATABASE LINK: SYSTEM
CREATE PUBLIC SYNONYM: SYSTEM
CREATE ROLE: SYSTEM
CREATE ROLLBACK SEGMENT: SYSTEM
CREATE RULE: SYSTEM
CREATE RULE SET: SYSTEM
CREATE SEQUENCE: DEMOAPPS, LBACSYS, SYSTEM
CREATE SESSION: C##AVAGENT, C##DVAM, C##DVO, C##HR_ADMIN, DBSFWUSER,
    DBSNMP, DEMOAPPS, LBACSYS, PDBADMIN, SECADMIN, SYSTEM
CREATE SQL TRANSLATION PROFILE: SYSTEM
CREATE SYNONYM: SYSTEM
CREATE TABLE: DBSNMP, DEMOAPPS, LBACSYS, SYSTEM
CREATE TABLESPACE: SYSTEM
CREATE TRIGGER: DEMOAPPS, LBACSYS, SYSTEM
CREATE TYPE: DEMOAPPS, LBACSYS, SYSTEM
CREATE USER: C##DVAM, SECADMIN, SYSTEM
CREATE VIEW: SYSTEM
DEBUG ANY PROCEDURE: SYSTEM
DEBUG CONNECT ANY: SYSTEM
DEBUG CONNECT SESSION: SYSTEM
DELETE ANY CUBE DIMENSION: SYSTEM
DELETE ANY MEASURE FOLDER: SYSTEM
DELETE ANY TABLE: SYSTEM
DEQUEUE ANY QUEUE: SYSTEM
DROP ANY ANALYTIC VIEW: SYSTEM
DROP ANY ASSEMBLY: SYSTEM
DROP ANY ATTRIBUTE DIMENSION: SYSTEM
DROP ANY CLUSTER: SYSTEM
DROP ANY CONTEXT: SYSTEM
DROP ANY CUBE: SYSTEM
DROP ANY CUBE BUILD PROCESS: SYSTEM
DROP ANY CUBE DIMENSION: SYSTEM
DROP ANY DIMENSION: SYSTEM
DROP ANY DIRECTORY: SYSTEM
DROP ANY EDITION: SYSTEM
DROP ANY EVALUATION CONTEXT: SYSTEM
DROP ANY HIERARCHY: SYSTEM
DROP ANY INDEX: SYSTEM
DROP ANY INDEXTYPE: SYSTEM
DROP ANY LIBRARY: SYSTEM
DROP ANY MATERIALIZED VIEW: SYSTEM
DROP ANY MEASURE FOLDER: SYSTEM
DROP ANY MINING MODEL: SYSTEM
DROP ANY OPERATOR: SYSTEM
DROP ANY OUTLINE: SYSTEM
DROP ANY PROCEDURE: SYSTEM
DROP ANY ROLE: SYSTEM
DROP ANY RULE: SYSTEM
DROP ANY RULE SET: SYSTEM
DROP ANY SEQUENCE: SYSTEM
DROP ANY SQL PROFILE: SYSTEM
DROP ANY SQL TRANSLATION PROFILE: SYSTEM
DROP ANY SYNONYM: SYSTEM
DROP ANY TABLE: SYSTEM
DROP ANY TRIGGER: SYSTEM
DROP ANY TYPE: SYSTEM
DROP ANY VIEW: SYSTEM
DROP LOCKDOWN PROFILE: SYSTEM
DROP PROFILE: C##DVAM, SECADMIN, SYSTEM
DROP PUBLIC DATABASE LINK: SYSTEM
DROP PUBLIC SYNONYM: SYSTEM
DROP ROLLBACK SEGMENT: SYSTEM
DROP TABLESPACE: SYSTEM
DROP USER: C##DVAM, SECADMIN, SYSTEM
EM EXPRESS CONNECT: SYSTEM
ENQUEUE ANY QUEUE: SYSTEM
EXECUTE ANY ASSEMBLY: SYSTEM
EXECUTE ANY EVALUATION CONTEXT: SYSTEM
EXECUTE ANY INDEXTYPE: SYSTEM
EXECUTE ANY LIBRARY: SYSTEM
EXECUTE ANY OPERATOR: SYSTEM
EXECUTE ANY PROCEDURE: SYSTEM
EXECUTE ANY RULE: SYSTEM
EXECUTE ANY RULE SET: SYSTEM
EXECUTE ANY TYPE: SYSTEM
EXECUTE ASSEMBLY: SYSTEM
EXEMPT DDL REDACTION POLICY: SYSTEM
EXEMPT DML REDACTION POLICY: SYSTEM
EXEMPT REDACTION POLICY: SYSTEM
EXPORT FULL DATABASE: SYSTEM
FLASHBACK ANY TABLE: SYSTEM
FLASHBACK ARCHIVE ADMINISTER: SYSTEM
FORCE ANY TRANSACTION: SYSTEM
FORCE TRANSACTION: SYSTEM
GLOBAL QUERY REWRITE: SYSTEM
GRANT ANY OBJECT PRIVILEGE: SYSTEM
GRANT ANY PRIVILEGE: SYSTEM
GRANT ANY ROLE: SYSTEM
IMPORT FULL DATABASE: SYSTEM
INHERIT ANY PRIVILEGES: DBSNMP
INSERT ANY CUBE DIMENSION: SYSTEM
INSERT ANY MEASURE FOLDER: SYSTEM
INSERT ANY TABLE: SYSTEM
LOCK ANY TABLE: SYSTEM
LOGMINING: SYSTEM
MANAGE ANY FILE GROUP: SYSTEM
MANAGE ANY QUEUE: DBSNMP, SYSTEM
MANAGE FILE GROUP: SYSTEM
MANAGE SCHEDULER: (none)
MANAGE TABLESPACE: SYSTEM
MERGE ANY VIEW: SYSTEM
ON COMMIT REFRESH: SYSTEM
QUERY REWRITE: SYSTEM
READ ANY FILE GROUP: SYSTEM
READ ANY TABLE: SYSTEM
REDEFINE ANY TABLE: SYSTEM
RESTRICTED SESSION: SYSTEM
RESUMABLE: SYSTEM
SELECT ANY CUBE: SYSTEM
SELECT ANY CUBE BUILD PROCESS: SYSTEM
SELECT ANY CUBE DIMENSION: SYSTEM
SELECT ANY DICTIONARY: DBSNMP, SYSTEM
SELECT ANY MEASURE FOLDER: SYSTEM
SELECT ANY MINING MODEL: SYSTEM
SELECT ANY SEQUENCE: SYSTEM
SELECT ANY TABLE: SYSTEM
SELECT ANY TRANSACTION: (none)
SET CONTAINER: C##DVAM, C##HR_ADMIN, DBSNMP, DEMOAPPS, PDBADMIN, SECADMIN,
    SYSTEM
UNDER ANY TABLE: SYSTEM
UNDER ANY TYPE: SYSTEM
UNDER ANY VIEW: SYSTEM
UNLIMITED TABLESPACE: DBSFWUSER, DBSNMP, LBACSYS, SYSTEM
UPDATE ANY CUBE: SYSTEM
UPDATE ANY CUBE BUILD PROCESS: SYSTEM
UPDATE ANY CUBE DIMENSION: SYSTEM
UPDATE ANY TABLE: SYSTEM
USE ANY JOB RESOURCE: SYSTEM
USE ANY SQL TRANSLATION PROFILE: SYSTEM

Remarks

System privileges provide the ability to access data or perform administrative operations for the entire database. Consistent with the principle of least privilege, these privileges should be granted sparingly. The Privilege Analysis feature of Database Vault may be helpful to determine the minimum set of privileges required by a user or role. In some cases, it may be possible to substitute a more limited object privilege grant in place of a system privilege grant that applies to all objects. System privileges should be granted with admin option only when the recipient needs the ability to grant the privilege to others.

All Roles

PRIV.ROLES

Status

Evaluate

Summary

62 grants of roles

Details

Users directly or indirectly granted each role:

AQ_ADMINISTRATOR_ROLE: SYSTEM
AUDIT_ADMIN: SECADMIN
AUDIT_VIEWER: SECADMIN
CAPTURE_ADMIN: SYSTEM
CDB_DBA: DBSNMP
CONNECT: C##DVAM, C##HR_ADMIN, DEMOAPPS, PDBADMIN, SECADMIN
DATAPUMP_EXP_FULL_DATABASE: SYSTEM
DATAPUMP_IMP_FULL_DATABASE: SYSTEM
DBA: SYSTEM
DBFS_ROLE: (none)
DV_ACCTMGR: C##DVAM, SECADMIN
DV_ADMIN: C##DVO, SYSTEM
DV_AUDIT_CLEANUP: C##DVO
DV_DATAPUMP_NETWORK_LINK: C##DVO
DV_GOLDENGATE_ADMIN: C##DVO
DV_GOLDENGATE_REDO_ACCESS: C##DVO
DV_MONITOR: C##DVO, DBSNMP
DV_OWNER: C##DVO
DV_PATCH_ADMIN: C##DVO
DV_POLICY_OWNER: C##DVO, SECADMIN
DV_PUBLIC: C##DVO
DV_SECANALYST: C##DVO, SYSTEM
DV_STREAMS_ADMIN: C##DVO
DV_XSTREAM_ADMIN: C##DVO
EM_EXPRESS_ALL: SYSTEM
EM_EXPRESS_BASIC: SYSTEM
EXECUTE_CATALOG_ROLE: SYSTEM
EXP_FULL_DATABASE: SYSTEM
GATHER_SYSTEM_STATISTICS: SYSTEM
GSMADMIN_ROLE: (none)
GSMUSER_ROLE: (none)
GSM_POOLADMIN_ROLE: (none)
HS_ADMIN_EXECUTE_ROLE: SYSTEM
HS_ADMIN_SELECT_ROLE: C##DVAM, C##DVO, DBSNMP, SECADMIN, SYSTEM
IMP_FULL_DATABASE: SYSTEM
LBAC_DBA: LBACSYS
OEM_MONITOR: DBSNMP
OPTIMIZER_PROCESSING_RATE: SYSTEM
PDB_DBA: PDBADMIN
RECOVERY_CATALOG_OWNER: (none)
RECOVERY_CATALOG_USER: (none)
RESOURCE: DEMOAPPS, LBACSYS
SCHEDULER_ADMIN: SYSTEM
SELECT_CATALOG_ROLE: C##DVAM, C##DVO, DBSNMP, SECADMIN, SYSTEM
SODA_APP: DEMOAPPS, LBACSYS
SYSUMF_ROLE: (none)
WATCH_HIM: DEMOAPPS
WM_ADMIN_ROLE: SYSTEM
XDBADMIN: SYSTEM
XDB_SET_INVOKER: SYSTEM

Remarks

Roles are a convenient way to manage groups of related privileges, especially when the privileges are required for a particular task or job function. Beware of broadly defined roles, which may confer more privileges than an individual recipient requires. Roles should be granted with admin option only when the recipient needs the ability to modify the role or grant it to others.

Account Management Privileges

PRIV.ACCT

Status

Evaluate

Summary

22 grants of account management privileges

Details

Grants of ALTER USER, CREATE USER, DROP USER:

C##DVAM <- DV_ACCTMGR: ALTER USER, CREATE USER, DROP USER
C##DVAM <- DV_ACCTMGR: ALTER USER, CREATE USER, DROP USER

SECADMIN <- DV_ACCTMGR: ALTER USER, CREATE USER, DROP USER

SYSTEM <- DBA: ALTER USER, CREATE USER, DROP USER
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: ALTER USER
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
    ALTER USER, CREATE USER, DROP USER
SYSTEM <- DBA <- EM_EXPRESS_ALL: ALTER USER, CREATE USER, DROP USER
SYSTEM <- DBA <- IMP_FULL_DATABASE: ALTER USER, CREATE USER, DROP
    USER

Remarks

User management privileges (ALTER USER, CREATE USER, DROP USER) can be used to create and modify other user accounts, including changing passwords. This power can be abused to gain access to another user's account, which may have greater privileges.

Privilege Management Privileges

PRIV.MGMT

Status

Evaluate

Summary

31 grants of privilege management privileges

Details

Grants of ALTER ANY ROLE, CREATE ROLE, DROP ANY ROLE, GRANT ANY OBJECT
    PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE:

SYSTEM <- DBA: ALTER ANY ROLE, CREATE ROLE, DROP ANY ROLE, GRANT ANY
    OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: GRANT ANY OBJECT
    PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
    CREATE ROLE, DROP ANY ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY
    PRIVILEGE, GRANT ANY ROLE
SYSTEM <- DBA <- EM_EXPRESS_ALL: ALTER ANY ROLE, CREATE ROLE, DROP
    ANY ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY
    ROLE
SYSTEM <- DBA <- IMP_FULL_DATABASE: CREATE ROLE, DROP ANY ROLE, GRANT
    ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE

(no users) <- DV_REALM_OWNER: ALTER ANY ROLE, CREATE ROLE, DROP ANY
    ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE

Remarks

Users with privilege management privileges (ALTER ANY ROLE, CREATE ROLE, DROP ANY ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE) can change the set of privileges granted to themselves and other users. This ability should be granted sparingly, since it can be used to circumvent many security controls in the database.

Audit Management Privileges

PRIV.AUDIT

Status

Evaluate

Summary

10 grants of audit privilege

Details

Grants of AUDIT ANY, AUDIT SYSTEM:

SECADMIN <- AUDIT_ADMIN: AUDIT ANY, AUDIT SYSTEM

SYSTEM <- DBA: AUDIT ANY, AUDIT SYSTEM
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: AUDIT ANY, AUDIT SYSTEM
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
    AUDIT ANY, AUDIT SYSTEM
SYSTEM <- DBA <- IMP_FULL_DATABASE: AUDIT ANY, AUDIT SYSTEM

Remarks

Audit management privileges (AUDIT ANY, AUDIT SYSTEM) can be used to change the audit policies for the database. This ability should be granted sparingly, since it may be used to hide malicious activity.

Data Access Privileges

PRIV.DATA

Status

Evaluate

Summary

46 grants of data access privileges

Details

Grants of ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX, CREATE ANY
    PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY TABLE, READ
    ANY TABLE, SELECT ANY DICTIONARY, SELECT ANY TABLE, UPDATE ANY TABLE:

DBSNMP: SELECT ANY DICTIONARY
DBSNMP <- OEM_MONITOR: SELECT ANY DICTIONARY

SYSTEM: SELECT ANY TABLE
SYSTEM <- DBA: ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX,
    CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY
    TABLE, READ ANY TABLE, SELECT ANY DICTIONARY, SELECT ANY TABLE, UPDATE
    ANY TABLE
SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
    SELECT ANY TABLE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: DELETE ANY TABLE, SELECT
    ANY TABLE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
    SELECT ANY TABLE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
    ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX, CREATE ANY
    PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY TABLE,
    SELECT ANY TABLE, UPDATE ANY TABLE
SYSTEM <- DBA <- EXP_FULL_DATABASE: SELECT ANY TABLE
SYSTEM <- DBA <- IMP_FULL_DATABASE: ALTER ANY TABLE, ALTER ANY
    TRIGGER, CREATE ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER,
    DELETE ANY TABLE, INSERT ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE

(no users) <- DV_REALM_OWNER: ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE
    ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE,
    INSERT ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE

Remarks

Users with data access privileges (ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY TABLE, READ ANY TABLE, SELECT ANY DICTIONARY, SELECT ANY TABLE, UPDATE ANY TABLE) can override various access controls on data. Most administrative tasks do not require access to the data itself, so these privileges should be granted rarely even to administrators. In addition to minimizing grants of these privileges, consider the use of Database Vault realms to limit the use of these privileges to access sensitive data.

Access Control Exemption Privileges

PRIV.EXEMPT

Status

Evaluate

Summary

3 grants of access control exemption privileges

Details

Grants of EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY:

SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
    EXEMPT REDACTION POLICY
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
    EXEMPT REDACTION POLICY
SYSTEM <- DBA <- EXP_FULL_DATABASE: EXEMPT REDACTION POLICY

Remarks

Users with exemption privileges (EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY) can bypass the access control policies created using Virtual Private Database and Data Redaction. Most administrative tasks do not require access to the data itself, so these privileges should be granted rarely even to administrators.

Access to Password Verifier Tables

PRIV.PASSWD

Status

Pass

Summary

No grants of object privileges on restricted objects

Remarks

Users with these privileges can access objects that contain user password verifiers. The verifiers can be used in offline attacks to discover user passwords.

Access to Restricted Objects

PRIV.OBJ

Status

Evaluate

Summary

663 grants of object privileges on restricted objects

Details

Grants of DELETE, INSERT, UPDATE on SYS, DVSYS, or LBACSYS objects:

C##DVO <- DV_OWNER <- DV_ADMIN: DELETE on DVSYS.SIMULATION_LOG$
C##DVO <- DV_OWNER <- DV_AUDIT_CLEANUP: DELETE on DVSYS.AUDIT_TRAIL$,
    DELETE on DVSYS.DV$CONFIGURATION_AUDIT, DELETE on
    DVSYS.DV$ENFORCEMENT_AUDIT
C##DVO <- DV_OWNER <- DV_ADMIN: DELETE on DVSYS.SIMULATION_LOG$
C##DVO <- DV_OWNER <- DV_AUDIT_CLEANUP: DELETE on DVSYS.AUDIT_TRAIL$,
    DELETE on DVSYS.DV$CONFIGURATION_AUDIT, DELETE on
    DVSYS.DV$ENFORCEMENT_AUDIT

SYSTEM <- DBA: DELETE on SYS.MAP_OBJECT, INSERT on SYS.MAP_OBJECT,
    INSERT on SYS.XSDB$SCHEMA_ACL, UPDATE on SYS.MAP_OBJECT, UPDATE on
    SYS.XSDB$SCHEMA_ACL
SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
    DELETE on SYS.INCEXP, DELETE on SYS.INCFIL, DELETE on SYS.INCVID,
    INSERT on SYS.INCEXP, INSERT on SYS.INCFIL, INSERT on SYS.INCVID,
    UPDATE on SYS.INCEXP, UPDATE on SYS.INCFIL, UPDATE on SYS.INCVID
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
    DELETE on SYS.INCEXP, DELETE on SYS.INCFIL, DELETE on SYS.INCVID,
    INSERT on SYS.INCEXP, INSERT on SYS.INCFIL, INSERT on SYS.INCVID,
    UPDATE on SYS.INCEXP, UPDATE on SYS.INCFIL, UPDATE on SYS.INCVID
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
    DELETE on SYS.EXPIMP_TTS_CT$, DELETE on SYS.RADM_FPTM$, INSERT on
    SYS.EXPIMP_TTS_CT$, INSERT on SYS.RADM_FPTM$, UPDATE on
    SYS.EXPIMP_TTS_CT$
SYSTEM <- DBA <- EXP_FULL_DATABASE: DELETE on SYS.INCEXP, DELETE on
    SYS.INCFIL, DELETE on SYS.INCVID, INSERT on SYS.INCEXP, INSERT on
    SYS.INCFIL, INSERT on SYS.INCVID, UPDATE on SYS.INCEXP, UPDATE on
    SYS.INCFIL, UPDATE on SYS.INCVID
SYSTEM <- DBA <- GATHER_SYSTEM_STATISTICS: DELETE on SYS.AUX_STATS$,
    DELETE on SYS.WRI$_OPTSTAT_AUX_HISTORY, INSERT on SYS.AUX_STATS$,
    INSERT on SYS.WRI$_OPTSTAT_AUX_HISTORY, UPDATE on SYS.AUX_STATS$,
    UPDATE on SYS.WRI$_OPTSTAT_AUX_HISTORY
SYSTEM <- DBA <- IMP_FULL_DATABASE: DELETE on SYS.EXPIMP_TTS_CT$,
    DELETE on SYS.RADM_FPTM$, INSERT on SYS.EXPIMP_TTS_CT$, INSERT on
    SYS.RADM_FPTM$, UPDATE on SYS.EXPIMP_TTS_CT$
SYSTEM <- DBA <- OPTIMIZER_PROCESSING_RATE: DELETE on
    SYS.OPT_CALIBRATION_STATS$, INSERT on SYS.OPT_CALIBRATION_STATS$,
    UPDATE on SYS.OPT_CALIBRATION_STATS$
SYSTEM <- DV_ADMIN: DELETE on DVSYS.SIMULATION_LOG$

(no users) <- SYSUMF_ROLE: DELETE on SYS.UMF$_LINK, DELETE on
    SYS.UMF$_REGISTRATION, DELETE on SYS.UMF$_SERVICE, DELETE on
    SYS.UMF$_TOPOLOGY, DELETE on SYS.WRH$_ACTIVE_SESSION_HISTORY, DELETE on
    SYS.WRH$_ASM_BAD_DISK, DELETE on SYS.WRH$_ASM_DISKGROUP, DELETE on
    SYS.WRH$_ASM_DISKGROUP_STAT, DELETE on SYS.WRH$_BG_EVENT_SUMMARY,
    DELETE on SYS.WRH$_BUFFERED_QUEUES, DELETE on
    SYS.WRH$_BUFFERED_SUBSCRIBERS, DELETE on
    SYS.WRH$_BUFFER_POOL_STATISTICS, DELETE on SYS.WRH$_CELL_CONFIG, DELETE
    on SYS.WRH$_CELL_CONFIG_DETAIL, DELETE on SYS.WRH$_CELL_DB, DELETE on
    SYS.WRH$_CELL_DISK_SUMMARY, DELETE on SYS.WRH$_CELL_GLOBAL, DELETE on
    SYS.WRH$_CELL_GLOBAL_SUMMARY, DELETE on SYS.WRH$_CELL_IOREASON, DELETE
    on SYS.WRH$_CELL_IOREASON_NAME, DELETE on SYS.WRH$_CELL_METRIC_DESC,
    DELETE on SYS.WRH$_CELL_OPEN_ALERTS, DELETE on SYS.WRH$_CHANNEL_WAITS,
    DELETE on SYS.WRH$_CLUSTER_INTERCON, DELETE on SYS.WRH$_COMP_IOSTAT,
    DELETE on SYS.WRH$_CON_SYSMETRIC_HISTORY, DELETE on
    SYS.WRH$_CON_SYSMETRIC_SUMMARY, DELETE on SYS.WRH$_CON_SYSSTAT, DELETE
    on SYS.WRH$_CON_SYSTEM_EVENT, DELETE on SYS.WRH$_CON_SYS_TIME_MODEL,
    DELETE on SYS.WRH$_CR_BLOCK_SERVER, DELETE on
    SYS.WRH$_CURRENT_BLOCK_SERVER, DELETE on SYS.WRH$_DATAFILE, DELETE on
    SYS.WRH$_DB_CACHE_ADVICE, DELETE on SYS.WRH$_DISPATCHER, DELETE on
    SYS.WRH$_DLM_MISC, DELETE on SYS.WRH$_DYN_REMASTER_STATS, DELETE on
    SYS.WRH$_ENQUEUE_STAT, DELETE on SYS.WRH$_EVENT_HISTOGRAM, DELETE on
    SYS.WRH$_EVENT_NAME, DELETE on SYS.WRH$_FILEMETRIC_HISTORY, DELETE on
    SYS.WRH$_FILESTATXS, DELETE on SYS.WRH$_IC_CLIENT_STATS, DELETE on
    SYS.WRH$_IC_DEVICE_STATS, DELETE on SYS.WRH$_IM_SEG_STAT, DELETE on
    SYS.WRH$_IM_SEG_STAT_OBJ, DELETE on SYS.WRH$_INSTANCE_RECOVERY, DELETE
    on SYS.WRH$_INST_CACHE_TRANSFER, DELETE on SYS.WRH$_INTERCONNECT_PINGS,
    DELETE on SYS.WRH$_IOSTAT_DETAIL, DELETE on SYS.WRH$_IOSTAT_FILETYPE,
    DELETE on SYS.WRH$_IOSTAT_FILETYPE_NAME, DELETE on
    SYS.WRH$_IOSTAT_FUNCTION, DELETE on SYS.WRH$_IOSTAT_FUNCTION_NAME,
    DELETE on SYS.WRH$_JAVA_POOL_ADVICE, DELETE on SYS.WRH$_LATCH, DELETE
    on SYS.WRH$_LATCH_CHILDREN, DELETE on SYS.WRH$_LATCH_MISSES_SUMMARY,
    DELETE on SYS.WRH$_LATCH_NAME, DELETE on SYS.WRH$_LATCH_PARENT, DELETE
    on SYS.WRH$_LIBRARYCACHE, DELETE on SYS.WRH$_LMS_STATS, DELETE on
    SYS.WRH$_LOG, DELETE on SYS.WRH$_MEMORY_RESIZE_OPS, DELETE on
    SYS.WRH$_MEMORY_TARGET_ADVICE, DELETE on SYS.WRH$_MEM_DYNAMIC_COMP,
    DELETE on SYS.WRH$_METRIC_NAME, DELETE on SYS.WRH$_MTTR_TARGET_ADVICE,
    DELETE on SYS.WRH$_MUTEX_SLEEP, DELETE on SYS.WRH$_MVPARAMETER, DELETE
    on SYS.WRH$_OPTIMIZER_ENV, DELETE on SYS.WRH$_OSSTAT, DELETE on
    SYS.WRH$_OSSTAT_NAME, DELETE on SYS.WRH$_PARAMETER, DELETE on
    SYS.WRH$_PARAMETER_NAME, DELETE on SYS.WRH$_PERSISTENT_QMN_CACHE,
    DELETE on SYS.WRH$_PERSISTENT_QUEUES, DELETE on
    SYS.WRH$_PERSISTENT_SUBSCRIBERS, DELETE on SYS.WRH$_PGASTAT, DELETE on
    SYS.WRH$_PGA_TARGET_ADVICE, DELETE on SYS.WRH$_PLAN_OPERATION_NAME,
    DELETE on SYS.WRH$_PLAN_OPTION_NAME, DELETE on
    SYS.WRH$_PROCESS_MEMORY_SUMMARY, DELETE on SYS.WRH$_RECOVERY_PROGRESS,
    DELETE on SYS.WRH$_REPLICATION_TBL_STATS, DELETE on
    SYS.WRH$_REPLICATION_TXN_STATS, DELETE on SYS.WRH$_RESOURCE_LIMIT,
    DELETE on SYS.WRH$_ROWCACHE_SUMMARY, DELETE on
    SYS.WRH$_RSRC_CONSUMER_GROUP, DELETE on SYS.WRH$_RSRC_METRIC, DELETE on
    SYS.WRH$_RSRC_PDB_METRIC, DELETE on SYS.WRH$_RSRC_PLAN, DELETE on
    SYS.WRH$_RULE_SET, DELETE on SYS.WRH$_SEG_STAT, DELETE on
    SYS.WRH$_SEG_STAT_OBJ, DELETE on SYS.WRH$_SERVICE_NAME, DELETE on
    SYS.WRH$_SERVICE_STAT, DELETE on SYS.WRH$_SERVICE_WAIT_CLASS, DELETE on
    SYS.WRH$_SESSMETRIC_HISTORY, DELETE on SYS.WRH$_SESS_SGA_STATS, DELETE
    on SYS.WRH$_SESS_TIME_STATS, DELETE on SYS.WRH$_SGA, DELETE on
    SYS.WRH$_SGASTAT, DELETE on SYS.WRH$_SGA_TARGET_ADVICE, DELETE on
    SYS.WRH$_SHARED_POOL_ADVICE, DELETE on SYS.WRH$_SHARED_SERVER_SUMMARY,
    DELETE on SYS.WRH$_SQLCOMMAND_NAME, DELETE on SYS.WRH$_SQLSTAT, DELETE
    on SYS.WRH$_SQLTEXT, DELETE on SYS.WRH$_SQL_BIND_METADATA, DELETE on
    SYS.WRH$_SQL_PLAN, DELETE on SYS.WRH$_SQL_SUMMARY, DELETE on
    SYS.WRH$_SQL_WORKAREA_HISTOGRAM, DELETE on SYS.WRH$_STAT_NAME, DELETE
    on SYS.WRH$_STREAMS_APPLY_SUM, DELETE on SYS.WRH$_STREAMS_CAPTURE,
    DELETE on SYS.WRH$_STREAMS_POOL_ADVICE, DELETE on
    SYS.WRH$_SYSMETRIC_HISTORY, DELETE on SYS.WRH$_SYSMETRIC_SUMMARY,
    DELETE on SYS.WRH$_SYSSTAT, DELETE on SYS.WRH$_SYSTEM_EVENT, DELETE on
    SYS.WRH$_SYS_TIME_MODEL, DELETE on SYS.WRH$_TABLESPACE, DELETE on
    SYS.WRH$_TABLESPACE_SPACE_USAGE, DELETE on SYS.WRH$_TABLESPACE_STAT,
    DELETE on SYS.WRH$_TEMPFILE, DELETE on SYS.WRH$_TEMPSTATXS, DELETE on
    SYS.WRH$_THREAD, DELETE on SYS.WRH$_TOPLEVELCALL_NAME, DELETE on
    SYS.WRH$_UNDOSTAT, DELETE on SYS.WRH$_WAITCLASSMETRIC_HISTORY, DELETE
    on SYS.WRH$_WAITSTAT, DELETE on SYS.WRHS$_CELL_IOREASON_NAME, DELETE on
    SYS.WRHS$_CELL_METRIC_DESC, DELETE on SYS.WRHS$_DATAFILE, DELETE on
    SYS.WRHS$_EVENT_NAME, DELETE on SYS.WRHS$_IM_SEG_STAT_OBJ, DELETE on
    SYS.WRHS$_IOSTAT_FILETYPE_NAME, DELETE on
    SYS.WRHS$_IOSTAT_FUNCTION_NAME, DELETE on SYS.WRHS$_LATCH_NAME, DELETE
    on SYS.WRHS$_METRIC_NAME, DELETE on SYS.WRHS$_OPTIMIZER_ENV, DELETE on
    SYS.WRHS$_OSSTAT_NAME, DELETE on SYS.WRHS$_PARAMETER_NAME, DELETE on
    SYS.WRHS$_PLAN_OPERATION_NAME, DELETE on SYS.WRHS$_PLAN_OPTION_NAME,
    DELETE on SYS.WRHS$_SEG_STAT_OBJ, DELETE on SYS.WRHS$_SERVICE_NAME,
    DELETE on SYS.WRHS$_SQLCOMMAND_NAME, DELETE on SYS.WRHS$_SQLTEXT,
    DELETE on SYS.WRHS$_SQL_BIND_METADATA, DELETE on SYS.WRHS$_SQL_PLAN,
    DELETE on SYS.WRHS$_STAT_NAME, DELETE on SYS.WRHS$_TABLESPACE, DELETE
    on SYS.WRHS$_TEMPFILE, DELETE on SYS.WRHS$_TOPLEVELCALL_NAME, DELETE on
    SYS.WRI$_ADV_ACTIONS, DELETE on SYS.WRI$_ADV_DEF_PARAMETERS, DELETE on
    SYS.WRI$_ADV_DIRECTIVE_DEFS, DELETE on
    SYS.WRI$_ADV_DIRECTIVE_INSTANCES, DELETE on SYS.WRI$_ADV_EXECUTIONS,
    DELETE on SYS.WRI$_ADV_EXEC_PARAMETERS, DELETE on
    SYS.WRI$_ADV_FINDINGS, DELETE on SYS.WRI$_ADV_INST_FDG, DELETE on
    SYS.WRI$_ADV_JOURNAL, DELETE on SYS.WRI$_ADV_MESSAGE_GROUPS, DELETE on
    SYS.WRI$_ADV_OBJECTS, DELETE on SYS.WRI$_ADV_PARAMETERS, DELETE on
    SYS.WRI$_ADV_RATIONALE, DELETE on SYS.WRI$_ADV_RECOMMENDATIONS, DELETE
    on SYS.WRI$_ADV_REC_ACTIONS, DELETE on SYS.WRI$_ADV_SQLT_BINDS, DELETE
    on SYS.WRI$_ADV_SQLT_PLANS, DELETE on SYS.WRI$_ADV_SQLT_PLAN_HASH,
    DELETE on SYS.WRI$_ADV_SQLT_PLAN_STATS, DELETE on
    SYS.WRI$_ADV_SQLT_RTN_PLAN, DELETE on SYS.WRI$_ADV_SQLT_STATISTICS,
    DELETE on SYS.WRI$_ADV_TASKS, DELETE on SYS.WRI$_ADV_USAGE, DELETE on
    SYS.WRI$_ALERT_HISTORY, DELETE on SYS.WRI$_OPTSTAT_OPR, DELETE on
    SYS.WRI$_SEGADV_CNTRLTAB, DELETE on SYS.WRI$_SEGADV_OBJLIST, DELETE on
    SYS.WRI$_SQLSET_DEFINITIONS, DELETE on SYS.WRI$_SQLSET_REFERENCES,
    DELETE on SYS.WRI$_SQLTEXT_REFCOUNT, DELETE on SYS.WRM$_ACTIVE_PDBS,
    DELETE on SYS.WRM$_BASELINE, DELETE on SYS.WRM$_BASELINE_DETAILS,
    DELETE on SYS.WRM$_BASELINE_TEMPLATE, DELETE on SYS.WRM$_COLORED_SQL,
    DELETE on SYS.WRM$_DATABASE_INSTANCE, DELETE on SYS.WRM$_PDB_INSTANCE,
    DELETE on SYS.WRM$_PDB_IN_SNAP, DELETE on SYS.WRM$_SNAPSHOT, DELETE on
    SYS.WRM$_SNAPSHOT_DETAILS, DELETE on SYS.WRM$_SNAP_ERROR, DELETE on
    SYS.WRM$_WR_CONTROL, DELETE on SYS.WRM$_WR_SETTINGS, DELETE on
    SYS.WRM$_WR_USAGE, DELETE on SYS.WRMS$_SNAPSHOT, INSERT on
    SYS.UMF$_LINK, INSERT on SYS.UMF$_REGISTRATION, INSERT on
    SYS.UMF$_SERVICE, INSERT on SYS.UMF$_TOPOLOGY, INSERT on
    SYS.WRH$_ACTIVE_SESSION_HISTORY, INSERT on SYS.WRH$_ASM_BAD_DISK,
    INSERT on SYS.WRH$_ASM_DISKGROUP, INSERT on
    SYS.WRH$_ASM_DISKGROUP_STAT, INSERT on SYS.WRH$_BG_EVENT_SUMMARY,
    INSERT on SYS.WRH$_BUFFERED_QUEUES, INSERT on
    SYS.WRH$_BUFFERED_SUBSCRIBERS, INSERT on
    SYS.WRH$_BUFFER_POOL_STATISTICS, INSERT on SYS.WRH$_CELL_CONFIG, INSERT
    on SYS.WRH$_CELL_CONFIG_DETAIL, INSERT on SYS.WRH$_CELL_DB, INSERT on
    SYS.WRH$_CELL_DISK_SUMMARY, INSERT on SYS.WRH$_CELL_GLOBAL, INSERT on
    SYS.WRH$_CELL_GLOBAL_SUMMARY, INSERT on SYS.WRH$_CELL_IOREASON, INSERT
    on SYS.WRH$_CELL_IOREASON_NAME, INSERT on SYS.WRH$_CELL_METRIC_DESC,
    INSERT on SYS.WRH$_CELL_OPEN_ALERTS, INSERT on SYS.WRH$_CHANNEL_WAITS,
    INSERT on SYS.WRH$_CLUSTER_INTERCON, INSERT on SYS.WRH$_COMP_IOSTAT,
    INSERT on SYS.WRH$_CON_SYSMETRIC_HISTORY, INSERT on
    SYS.WRH$_CON_SYSMETRIC_SUMMARY, INSERT on SYS.WRH$_CON_SYSSTAT, INSERT
    on SYS.WRH$_CON_SYSTEM_EVENT, INSERT on SYS.WRH$_CON_SYS_TIME_MODEL,
    INSERT on SYS.WRH$_CR_BLOCK_SERVER, INSERT on
    SYS.WRH$_CURRENT_BLOCK_SERVER, INSERT on SYS.WRH$_DATAFILE, INSERT on
    SYS.WRH$_DB_CACHE_ADVICE, INSERT on SYS.WRH$_DISPATCHER, INSERT on
    SYS.WRH$_DLM_MISC, INSERT on SYS.WRH$_DYN_REMASTER_STATS, INSERT on
    SYS.WRH$_ENQUEUE_STAT, INSERT on SYS.WRH$_EVENT_HISTOGRAM, INSERT on
    SYS.WRH$_EVENT_NAME, INSERT on SYS.WRH$_FILEMETRIC_HISTORY, INSERT on
    SYS.WRH$_FILESTATXS, INSERT on SYS.WRH$_IC_CLIENT_STATS, INSERT on
    SYS.WRH$_IC_DEVICE_STATS, INSERT on SYS.WRH$_IM_SEG_STAT, INSERT on
    SYS.WRH$_IM_SEG_STAT_OBJ, INSERT on SYS.WRH$_INSTANCE_RECOVERY, INSERT
    on SYS.WRH$_INST_CACHE_TRANSFER, INSERT on SYS.WRH$_INTERCONNECT_PINGS,
    INSERT on SYS.WRH$_IOSTAT_DETAIL, INSERT on SYS.WRH$_IOSTAT_FILETYPE,
    INSERT on SYS.WRH$_IOSTAT_FILETYPE_NAME, INSERT on
    SYS.WRH$_IOSTAT_FUNCTION, INSERT on SYS.WRH$_IOSTAT_FUNCTION_NAME,
    INSERT on SYS.WRH$_JAVA_POOL_ADVICE, INSERT on SYS.WRH$_LATCH, INSERT
    on SYS.WRH$_LATCH_CHILDREN, INSERT on SYS.WRH$_LATCH_MISSES_SUMMARY,
    INSERT on SYS.WRH$_LATCH_NAME, INSERT on SYS.WRH$_LATCH_PARENT, INSERT
    on SYS.WRH$_LIBRARYCACHE, INSERT on SYS.WRH$_LMS_STATS, INSERT on
    SYS.WRH$_LOG, INSERT on SYS.WRH$_MEMORY_RESIZE_OPS, INSERT on
    SYS.WRH$_MEMORY_TARGET_ADVICE, INSERT on SYS.WRH$_MEM_DYNAMIC_COMP,
    INSERT on SYS.WRH$_METRIC_NAME, INSERT on SYS.WRH$_MTTR_TARGET_ADVICE,
    INSERT on SYS.WRH$_MUTEX_SLEEP, INSERT on SYS.WRH$_MVPARAMETER, INSERT
    on SYS.WRH$_OPTIMIZER_ENV, INSERT on SYS.WRH$_OSSTAT, INSERT on
    SYS.WRH$_OSSTAT_NAME, INSERT on SYS.WRH$_PARAMETER, INSERT on
    SYS.WRH$_PARAMETER_NAME, INSERT on SYS.WRH$_PERSISTENT_QMN_CACHE,
    INSERT on SYS.WRH$_PERSISTENT_QUEUES, INSERT on
    SYS.WRH$_PERSISTENT_SUBSCRIBERS, INSERT on SYS.WRH$_PGASTAT, INSERT on
    SYS.WRH$_PGA_TARGET_ADVICE, INSERT on SYS.WRH$_PLAN_OPERATION_NAME,
    INSERT on SYS.WRH$_PLAN_OPTION_NAME, INSERT on
    SYS.WRH$_PROCESS_MEMORY_SUMMARY, INSERT on SYS.WRH$_RECOVERY_PROGRESS,
    INSERT on SYS.WRH$_REPLICATION_TBL_STATS, INSERT on
    SYS.WRH$_REPLICATION_TXN_STATS, INSERT on SYS.WRH$_RESOURCE_LIMIT,
    INSERT on SYS.WRH$_ROWCACHE_SUMMARY, INSERT on
    SYS.WRH$_RSRC_CONSUMER_GROUP, INSERT on SYS.WRH$_RSRC_METRIC, INSERT on
    SYS.WRH$_RSRC_PDB_METRIC, INSERT on SYS.WRH$_RSRC_PLAN, INSERT on
    SYS.WRH$_RULE_SET, INSERT on SYS.WRH$_SEG_STAT, INSERT on
    SYS.WRH$_SEG_STAT_OBJ, INSERT on SYS.WRH$_SERVICE_NAME, INSERT on
    SYS.WRH$_SERVICE_STAT, INSERT on SYS.WRH$_SERVICE_WAIT_CLASS, INSERT on
    SYS.WRH$_SESSMETRIC_HISTORY, INSERT on SYS.WRH$_SESS_SGA_STATS, INSERT
    on SYS.WRH$_SESS_TIME_STATS, INSERT on SYS.WRH$_SGA, INSERT on
    SYS.WRH$_SGASTAT, INSERT on SYS.WRH$_SGA_TARGET_ADVICE, INSERT on
    SYS.WRH$_SHARED_POOL_ADVICE, INSERT on SYS.WRH$_SHARED_SERVER_SUMMARY,
    INSERT on SYS.WRH$_SQLCOMMAND_NAME, INSERT on SYS.WRH$_SQLSTAT, INSERT
    on SYS.WRH$_SQLTEXT, INSERT on SYS.WRH$_SQL_BIND_METADATA, INSERT on
    SYS.WRH$_SQL_PLAN, INSERT on SYS.WRH$_SQL_SUMMARY, INSERT on
    SYS.WRH$_SQL_WORKAREA_HISTOGRAM, INSERT on SYS.WRH$_STAT_NAME, INSERT
    on SYS.WRH$_STREAMS_APPLY_SUM, INSERT on SYS.WRH$_STREAMS_CAPTURE,
    INSERT on SYS.WRH$_STREAMS_POOL_ADVICE, INSERT on
    SYS.WRH$_SYSMETRIC_HISTORY, INSERT on SYS.WRH$_SYSMETRIC_SUMMARY,
    INSERT on SYS.WRH$_SYSSTAT, INSERT on SYS.WRH$_SYSTEM_EVENT, INSERT on
    SYS.WRH$_SYS_TIME_MODEL, INSERT on SYS.WRH$_TABLESPACE, INSERT on
    SYS.WRH$_TABLESPACE_SPACE_USAGE, INSERT on SYS.WRH$_TABLESPACE_STAT,
    INSERT on SYS.WRH$_TEMPFILE, INSERT on SYS.WRH$_TEMPSTATXS, INSERT on
    SYS.WRH$_THREAD, INSERT on SYS.WRH$_TOPLEVELCALL_NAME, INSERT on
    SYS.WRH$_UNDOSTAT, INSERT on SYS.WRH$_WAITCLASSMETRIC_HISTORY, INSERT
    on SYS.WRH$_WAITSTAT, INSERT on SYS.WRHS$_CELL_IOREASON_NAME, INSERT on
    SYS.WRHS$_CELL_METRIC_DESC, INSERT on SYS.WRHS$_DATAFILE, INSERT on
    SYS.WRHS$_EVENT_NAME, INSERT on SYS.WRHS$_IM_SEG_STAT_OBJ, INSERT on
    SYS.WRHS$_IOSTAT_FILETYPE_NAME, INSERT on
    SYS.WRHS$_IOSTAT_FUNCTION_NAME, INSERT on SYS.WRHS$_LATCH_NAME, INSERT
    on SYS.WRHS$_METRIC_NAME, INSERT on SYS.WRHS$_OPTIMIZER_ENV, INSERT on
    SYS.WRHS$_OSSTAT_NAME, INSERT on SYS.WRHS$_PARAMETER_NAME, INSERT on
    SYS.WRHS$_PLAN_OPERATION_NAME, INSERT on SYS.WRHS$_PLAN_OPTION_NAME,
    INSERT on SYS.WRHS$_SEG_STAT_OBJ, INSERT on SYS.WRHS$_SERVICE_NAME,
    INSERT on SYS.WRHS$_SQLCOMMAND_NAME, INSERT on SYS.WRHS$_SQLTEXT,
    INSERT on SYS.WRHS$_SQL_BIND_METADATA, INSERT on SYS.WRHS$_SQL_PLAN,
    INSERT on SYS.WRHS$_STAT_NAME, INSERT on SYS.WRHS$_TABLESPACE, INSERT
    on SYS.WRHS$_TEMPFILE, INSERT on SYS.WRHS$_TOPLEVELCALL_NAME, INSERT on
    SYS.WRI$_ADV_ACTIONS, INSERT on SYS.WRI$_ADV_DEF_PARAMETERS, INSERT on
    SYS.WRI$_ADV_DIRECTIVE_DEFS, INSERT on
    SYS.WRI$_ADV_DIRECTIVE_INSTANCES, INSERT on SYS.WRI$_ADV_EXECUTIONS,
    INSERT on SYS.WRI$_ADV_EXEC_PARAMETERS, INSERT on
    SYS.WRI$_ADV_FINDINGS, INSERT on SYS.WRI$_ADV_INST_FDG, INSERT on
    SYS.WRI$_ADV_JOURNAL, INSERT on SYS.WRI$_ADV_MESSAGE_GROUPS, INSERT on
    SYS.WRI$_ADV_OBJECTS, INSERT on SYS.WRI$_ADV_PARAMETERS, INSERT on
    SYS.WRI$_ADV_RATIONALE, INSERT on SYS.WRI$_ADV_RECOMMENDATIONS, INSERT
    on SYS.WRI$_ADV_REC_ACTIONS, INSERT on SYS.WRI$_ADV_SQLT_BINDS, INSERT
    on SYS.WRI$_ADV_SQLT_PLANS, INSERT on SYS.WRI$_ADV_SQLT_PLAN_HASH,
    INSERT on SYS.WRI$_ADV_SQLT_PLAN_STATS, INSERT on
    SYS.WRI$_ADV_SQLT_RTN_PLAN, INSERT on SYS.WRI$_ADV_SQLT_STATISTICS,
    INSERT on SYS.WRI$_ADV_TASKS, INSERT on SYS.WRI$_ADV_USAGE, INSERT on
    SYS.WRI$_ALERT_HISTORY, INSERT on SYS.WRI$_OPTSTAT_OPR, INSERT on
    SYS.WRI$_SEGADV_CNTRLTAB, INSERT on SYS.WRI$_SEGADV_OBJLIST, INSERT on
    SYS.WRI$_SQLSET_DEFINITIONS, INSERT on SYS.WRI$_SQLSET_REFERENCES,
    INSERT on SYS.WRI$_SQLTEXT_REFCOUNT, INSERT on SYS.WRM$_ACTIVE_PDBS,
    INSERT on SYS.WRM$_BASELINE, INSERT on SYS.WRM$_BASELINE_DETAILS,
    INSERT on SYS.WRM$_BASELINE_TEMPLATE, INSERT on SYS.WRM$_COLORED_SQL,
    INSERT on SYS.WRM$_DATABASE_INSTANCE, INSERT on SYS.WRM$_PDB_INSTANCE,
    INSERT on SYS.WRM$_PDB_IN_SNAP, INSERT on SYS.WRM$_SNAPSHOT, INSERT on
    SYS.WRM$_SNAPSHOT_DETAILS, INSERT on SYS.WRM$_SNAP_ERROR, INSERT on
    SYS.WRM$_WR_CONTROL, INSERT on SYS.WRM$_WR_SETTINGS, INSERT on
    SYS.WRM$_WR_USAGE, INSERT on SYS.WRMS$_SNAPSHOT, UPDATE on
    SYS.UMF$_LINK, UPDATE on SYS.UMF$_REGISTRATION, UPDATE on
    SYS.UMF$_SERVICE, UPDATE on SYS.UMF$_TOPOLOGY, UPDATE on
    SYS.WRH$_ACTIVE_SESSION_HISTORY, UPDATE on SYS.WRH$_ASM_BAD_DISK,
    UPDATE on SYS.WRH$_ASM_DISKGROUP, UPDATE on
    SYS.WRH$_ASM_DISKGROUP_STAT, UPDATE on SYS.WRH$_BG_EVENT_SUMMARY,
    UPDATE on SYS.WRH$_BUFFERED_QUEUES, UPDATE on
    SYS.WRH$_BUFFERED_SUBSCRIBERS, UPDATE on
    SYS.WRH$_BUFFER_POOL_STATISTICS, UPDATE on SYS.WRH$_CELL_CONFIG, UPDATE
    on SYS.WRH$_CELL_CONFIG_DETAIL, UPDATE on SYS.WRH$_CELL_DB, UPDATE on
    SYS.WRH$_CELL_DISK_SUMMARY, UPDATE on SYS.WRH$_CELL_GLOBAL, UPDATE on
    SYS.WRH$_CELL_GLOBAL_SUMMARY, UPDATE on SYS.WRH$_CELL_IOREASON, UPDATE
    on SYS.WRH$_CELL_IOREASON_NAME, UPDATE on SYS.WRH$_CELL_METRIC_DESC,
    UPDATE on SYS.WRH$_CELL_OPEN_ALERTS, UPDATE on SYS.WRH$_CHANNEL_WAITS,
    UPDATE on SYS.WRH$_CLUSTER_INTERCON, UPDATE on SYS.WRH$_COMP_IOSTAT,
    UPDATE on SYS.WRH$_CON_SYSMETRIC_HISTORY, UPDATE on
    SYS.WRH$_CON_SYSMETRIC_SUMMARY, UPDATE on SYS.WRH$_CON_SYSSTAT, UPDATE
    on SYS.WRH$_CON_SYSTEM_EVENT, UPDATE on SYS.WRH$_CON_SYS_TIME_MODEL,
    UPDATE on SYS.WRH$_CR_BLOCK_SERVER, UPDATE on
    SYS.WRH$_CURRENT_BLOCK_SERVER, UPDATE on SYS.WRH$_DATAFILE, UPDATE on
    SYS.WRH$_DB_CACHE_ADVICE, UPDATE on SYS.WRH$_DISPATCHER, UPDATE on
    SYS.WRH$_DLM_MISC, UPDATE on SYS.WRH$_DYN_REMASTER_STATS, UPDATE on
    SYS.WRH$_ENQUEUE_STAT, UPDATE on SYS.WRH$_EVENT_HISTOGRAM, UPDATE on
    SYS.WRH$_EVENT_NAME, UPDATE on SYS.WRH$_FILEMETRIC_HISTORY, UPDATE on
    SYS.WRH$_FILESTATXS, UPDATE on SYS.WRH$_IC_CLIENT_STATS, UPDATE on
    SYS.WRH$_IC_DEVICE_STATS, UPDATE on SYS.WRH$_IM_SEG_STAT, UPDATE on
    SYS.WRH$_IM_SEG_STAT_OBJ, UPDATE on SYS.WRH$_INSTANCE_RECOVERY, UPDATE
    on SYS.WRH$_INST_CACHE_TRANSFER, UPDATE on SYS.WRH$_INTERCONNECT_PINGS,
    UPDATE on SYS.WRH$_IOSTAT_DETAIL, UPDATE on SYS.WRH$_IOSTAT_FILETYPE,
    UPDATE on SYS.WRH$_IOSTAT_FILETYPE_NAME, UPDATE on
    SYS.WRH$_IOSTAT_FUNCTION, UPDATE on SYS.WRH$_IOSTAT_FUNCTION_NAME,
    UPDATE on SYS.WRH$_JAVA_POOL_ADVICE, UPDATE on SYS.WRH$_LATCH, UPDATE
    on SYS.WRH$_LATCH_CHILDREN, UPDATE on SYS.WRH$_LATCH_MISSES_SUMMARY,
    UPDATE on SYS.WRH$_LATCH_NAME, UPDATE on SYS.WRH$_LATCH_PARENT, UPDATE
    on SYS.WRH$_LIBRARYCACHE, UPDATE on SYS.WRH$_LMS_STATS, UPDATE on
    SYS.WRH$_LOG, UPDATE on SYS.WRH$_MEMORY_RESIZE_OPS, UPDATE on
    SYS.WRH$_MEMORY_TARGET_ADVICE, UPDATE on SYS.WRH$_MEM_DYNAMIC_COMP,
    UPDATE on SYS.WRH$_METRIC_NAME, UPDATE on SYS.WRH$_MTTR_TARGET_ADVICE,
    UPDATE on SYS.WRH$_MUTEX_SLEEP, UPDATE on SYS.WRH$_MVPARAMETER, UPDATE
    on SYS.WRH$_OPTIMIZER_ENV, UPDATE on SYS.WRH$_OSSTAT, UPDATE on
    SYS.WRH$_OSSTAT_NAME, UPDATE on SYS.WRH$_PARAMETER, UPDATE on
    SYS.WRH$_PARAMETER_NAME, UPDATE on SYS.WRH$_PERSISTENT_QMN_CACHE,
    UPDATE on SYS.WRH$_PERSISTENT_QUEUES, UPDATE on
    SYS.WRH$_PERSISTENT_SUBSCRIBERS, UPDATE on SYS.WRH$_PGASTAT, UPDATE on
    SYS.WRH$_PGA_TARGET_ADVICE, UPDATE on SYS.WRH$_PLAN_OPERATION_NAME,
    UPDATE on SYS.WRH$_PLAN_OPTION_NAME, UPDATE on
    SYS.WRH$_PROCESS_MEMORY_SUMMARY, UPDATE on SYS.WRH$_RECOVERY_PROGRESS,
    UPDATE on SYS.WRH$_REPLICATION_TBL_STATS, UPDATE on
    SYS.WRH$_REPLICATION_TXN_STATS, UPDATE on SYS.WRH$_RESOURCE_LIMIT,
    UPDATE on SYS.WRH$_ROWCACHE_SUMMARY, UPDATE on
    SYS.WRH$_RSRC_CONSUMER_GROUP, UPDATE on SYS.WRH$_RSRC_METRIC, UPDATE on
    SYS.WRH$_RSRC_PDB_METRIC, UPDATE on SYS.WRH$_RSRC_PLAN, UPDATE on
    SYS.WRH$_RULE_SET, UPDATE on SYS.WRH$_SEG_STAT, UPDATE on
    SYS.WRH$_SEG_STAT_OBJ, UPDATE on SYS.WRH$_SERVICE_NAME, UPDATE on
    SYS.WRH$_SERVICE_STAT, UPDATE on SYS.WRH$_SERVICE_WAIT_CLASS, UPDATE on
    SYS.WRH$_SESSMETRIC_HISTORY, UPDATE on SYS.WRH$_SESS_SGA_STATS, UPDATE
    on SYS.WRH$_SESS_TIME_STATS, UPDATE on SYS.WRH$_SGA, UPDATE on
    SYS.WRH$_SGASTAT, UPDATE on SYS.WRH$_SGA_TARGET_ADVICE, UPDATE on
    SYS.WRH$_SHARED_POOL_ADVICE, UPDATE on SYS.WRH$_SHARED_SERVER_SUMMARY,
    UPDATE on SYS.WRH$_SQLCOMMAND_NAME, UPDATE on SYS.WRH$_SQLSTAT, UPDATE
    on SYS.WRH$_SQLTEXT, UPDATE on SYS.WRH$_SQL_BIND_METADATA, UPDATE on
    SYS.WRH$_SQL_PLAN, UPDATE on SYS.WRH$_SQL_SUMMARY, UPDATE on
    SYS.WRH$_SQL_WORKAREA_HISTOGRAM, UPDATE on SYS.WRH$_STAT_NAME, UPDATE
    on SYS.WRH$_STREAMS_APPLY_SUM, UPDATE on SYS.WRH$_STREAMS_CAPTURE,
    UPDATE on SYS.WRH$_STREAMS_POOL_ADVICE, UPDATE on
    SYS.WRH$_SYSMETRIC_HISTORY, UPDATE on SYS.WRH$_SYSMETRIC_SUMMARY,
    UPDATE on SYS.WRH$_SYSSTAT, UPDATE on SYS.WRH$_SYSTEM_EVENT, UPDATE on
    SYS.WRH$_SYS_TIME_MODEL, UPDATE on SYS.WRH$_TABLESPACE, UPDATE on
    SYS.WRH$_TABLESPACE_SPACE_USAGE, UPDATE on SYS.WRH$_TABLESPACE_STAT,
    UPDATE on SYS.WRH$_TEMPFILE, UPDATE on SYS.WRH$_TEMPSTATXS, UPDATE on
    SYS.WRH$_THREAD, UPDATE on SYS.WRH$_TOPLEVELCALL_NAME, UPDATE on
    SYS.WRH$_UNDOSTAT, UPDATE on SYS.WRH$_WAITCLASSMETRIC_HISTORY, UPDATE
    on SYS.WRH$_WAITSTAT, UPDATE on SYS.WRHS$_CELL_IOREASON_NAME, UPDATE on
    SYS.WRHS$_CELL_METRIC_DESC, UPDATE on SYS.WRHS$_DATAFILE, UPDATE on
    SYS.WRHS$_EVENT_NAME, UPDATE on SYS.WRHS$_IM_SEG_STAT_OBJ, UPDATE on
    SYS.WRHS$_IOSTAT_FILETYPE_NAME, UPDATE on
    SYS.WRHS$_IOSTAT_FUNCTION_NAME, UPDATE on SYS.WRHS$_LATCH_NAME, UPDATE
    on SYS.WRHS$_METRIC_NAME, UPDATE on SYS.WRHS$_OPTIMIZER_ENV, UPDATE on
    SYS.WRHS$_OSSTAT_NAME, UPDATE on SYS.WRHS$_PARAMETER_NAME, UPDATE on
    SYS.WRHS$_PLAN_OPERATION_NAME, UPDATE on SYS.WRHS$_PLAN_OPTION_NAME,
    UPDATE on SYS.WRHS$_SEG_STAT_OBJ, UPDATE on SYS.WRHS$_SERVICE_NAME,
    UPDATE on SYS.WRHS$_SQLCOMMAND_NAME, UPDATE on SYS.WRHS$_SQLTEXT,
    UPDATE on SYS.WRHS$_SQL_BIND_METADATA, UPDATE on SYS.WRHS$_SQL_PLAN,
    UPDATE on SYS.WRHS$_STAT_NAME, UPDATE on SYS.WRHS$_TABLESPACE, UPDATE
    on SYS.WRHS$_TEMPFILE, UPDATE on SYS.WRHS$_TOPLEVELCALL_NAME, UPDATE on
    SYS.WRI$_ADV_ACTIONS, UPDATE on SYS.WRI$_ADV_DEF_PARAMETERS, UPDATE on
    SYS.WRI$_ADV_DIRECTIVE_DEFS, UPDATE on
    SYS.WRI$_ADV_DIRECTIVE_INSTANCES, UPDATE on SYS.WRI$_ADV_EXECUTIONS,
    UPDATE on SYS.WRI$_ADV_EXEC_PARAMETERS, UPDATE on
    SYS.WRI$_ADV_FINDINGS, UPDATE on SYS.WRI$_ADV_INST_FDG, UPDATE on
    SYS.WRI$_ADV_JOURNAL, UPDATE on SYS.WRI$_ADV_MESSAGE_GROUPS, UPDATE on
    SYS.WRI$_ADV_OBJECTS, UPDATE on SYS.WRI$_ADV_PARAMETERS, UPDATE on
    SYS.WRI$_ADV_RATIONALE, UPDATE on SYS.WRI$_ADV_RECOMMENDATIONS, UPDATE
    on SYS.WRI$_ADV_REC_ACTIONS, UPDATE on SYS.WRI$_ADV_SQLT_BINDS, UPDATE
    on SYS.WRI$_ADV_SQLT_PLANS, UPDATE on SYS.WRI$_ADV_SQLT_PLAN_HASH,
    UPDATE on SYS.WRI$_ADV_SQLT_PLAN_STATS, UPDATE on
    SYS.WRI$_ADV_SQLT_RTN_PLAN, UPDATE on SYS.WRI$_ADV_SQLT_STATISTICS,
    UPDATE on SYS.WRI$_ADV_TASKS, UPDATE on SYS.WRI$_ADV_USAGE, UPDATE on
    SYS.WRI$_ALERT_HISTORY, UPDATE on SYS.WRI$_OPTSTAT_OPR, UPDATE on
    SYS.WRI$_SEGADV_CNTRLTAB, UPDATE on SYS.WRI$_SEGADV_OBJLIST, UPDATE on
    SYS.WRI$_SQLSET_DEFINITIONS, UPDATE on SYS.WRI$_SQLSET_REFERENCES,
    UPDATE on SYS.WRI$_SQLTEXT_REFCOUNT, UPDATE on SYS.WRM$_ACTIVE_PDBS,
    UPDATE on SYS.WRM$_BASELINE, UPDATE on SYS.WRM$_BASELINE_DETAILS,
    UPDATE on SYS.WRM$_BASELINE_TEMPLATE, UPDATE on SYS.WRM$_COLORED_SQL,
    UPDATE on SYS.WRM$_DATABASE_INSTANCE, UPDATE on SYS.WRM$_PDB_INSTANCE,
    UPDATE on SYS.WRM$_PDB_IN_SNAP, UPDATE on SYS.WRM$_SNAPSHOT, UPDATE on
    SYS.WRM$_SNAPSHOT_DETAILS, UPDATE on SYS.WRM$_SNAP_ERROR, UPDATE on
    SYS.WRM$_WR_CONTROL, UPDATE on SYS.WRM$_WR_SETTINGS, UPDATE on
    SYS.WRM$_WR_USAGE, UPDATE on SYS.WRMS$_SNAPSHOT

Remarks

Users with these privileges can directly modify objects in the SYS, DVSYS, or LBACSYS schemas. Manipulating these system objects may allow security protections to be circumvented or otherwise interfere with normal operation of the database.

User Impersonation

PRIV.USER

Status

Pass

Summary

No grants of EXECUTE on restricted packages

Remarks

These PL/SQL packages (DBMS_SCHEDULER, DBMS_SYS_SQL) allow for execution of SQL code or external jobs using the identity of a different user. Access should be strictly limited and granted only to users with a legitimate need for this functionality.

Data Exfiltration

PRIV.EXFIL

Status

Pass

Summary

No grants of EXECUTE on restricted packages

Remarks

These PL/SQL packages (DBMS_BACKUP_RESTORE) can send data from the database using the network or file system. Access should be granted only to users with a legitimate need for this functionality.

System Privileges Granted to PUBLIC

PRIV.SYSPUB

Status

Pass

Summary

No grants of system privileges to PUBLIC

Remarks

Privileges granted to PUBLIC are available to all users. This generally should include few, if any, system privileges since these will not be needed by ordinary users who are not administrators.

Roles Granted to PUBLIC

PRIV.ROLEPUB

Status

Pass

Summary

No grants of roles to PUBLIC

Remarks

Roles granted to PUBLIC are available to all users. Most roles contain privileges that are not appropriate for all users.

Column Privileges Granted to PUBLIC

PRIV.COLPUB

Status

Pass

Summary

No grants of column privileges to PUBLIC

Remarks

Privileges granted to PUBLIC are available to all users. This should include column privileges only for data that is intended to be accessible to everyone.

DBA Role

PRIV.DBA

Status

Evaluate

Summary

1 grant of DBA role

Details

Grants of DBA role:

SYSTEM: DBA

Remarks

The DBA role is very powerful and can be used to bypass many security protections. It should be granted to only a small number of trusted administrators. Furthermore, each trusted user should have an individual account for accountability reasons. As with any powerful role, avoid granting the DBA role with admin option unless absolutely necessary.

Other Powerful Roles

PRIV.BIGROLES

Status

Evaluate

Summary

9 grants of powerful roles (1 with admin option)

Details

Grants of AQ_ADMINISTRATOR_ROLE, EM_EXPRESS_ALL, EXP_FULL_DATABASE,
    IMP_FULL_DATABASE, OEM_MONITOR roles:

DBSNMP: OEM_MONITOR

SYSTEM: AQ_ADMINISTRATOR_ROLE(*)
SYSTEM <- DBA: EM_EXPRESS_ALL, EXP_FULL_DATABASE, IMP_FULL_DATABASE
SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE: EXP_FULL_DATABASE
SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: EXP_FULL_DATABASE,
    IMP_FULL_DATABASE

(no users) <- GSMADMIN_ROLE: AQ_ADMINISTRATOR_ROLE

(*) = granted with admin option

Remarks

Like the DBA role, these roles (AQ_ADMINISTRATOR_ROLE, EM_EXPRESS_ALL, EXP_FULL_DATABASE, IMP_FULL_DATABASE, OEM_MONITOR) contain powerful privileges that can be used to bypass security protections. They should be granted only to a small number of trusted administrators.

Users with Administrative Privileges

PRIV.ADMIN

Status

Some Risk

Summary

Found 2 users granted administrative privileges. Found 2 administrative privileges not granted to any user.

Details

SYSDBA    (1): SYS
SYSOPER   (1): SYS
SYSBACKUP (0): (none)
SYSDG     (0): (none)
SYSKM     (1): SYSKM

Remarks

Administrative privileges allow a user to perform maintenance operations, including some that may occur while the database is not open. The SYSDBA privilege allows the user to run as SYS and perform virtually all privileged operations. Starting with Oracle Database 12.1, less powerful administrative privileges were introduced to allow users to perform common administrative tasks with less than full SYSDBA privileges. To achieve the benefit of this separation of duty, each of these administrative privileges should be granted to at least one user account.

Authorization Control

Database Vault

AUTH.DV

Status

Evaluate

Summary

Found 7 Database Vault realms and 24 command rules.

Details

Realms:
Database Vault Account Management (Enabled) (Default)
Protects roles: CONNECT, DV_ACCTMGR
Protects objects: (none)

HR_DATA (Disabled)
Protects roles: (none)
Protects objects: DEMOAPPS.<Any Object> (Any Type)

Oracle Database Vault (Enabled) (Default)
Protects roles: DV_ADMIN, DV_AUDIT_CLEANUP, DV_DATAPUMP_NETWORK_LINK,
    DV_GOLDENGATE_ADMIN, DV_GOLDENGATE_REDO_ACCESS, DV_MONITOR, DV_OWNER,
    DV_PATCH_ADMIN, DV_POLICY_OWNER, DV_PUBLIC, DV_SECANALYST,
    DV_STREAMS_ADMIN, DV_XSTREAM_ADMIN, LBAC_DBA
Protects objects: DVF.<Any Object> (Any Type), DVSYS.<Any
    Object> (Any Type), LBACSYS.<Any Object> (Any Type),
    PUBLIC.CDB_DV_STATUS (SYNONYM), PUBLIC.CONFIGURE_DV (SYNONYM),
    PUBLIC.DBA_DV_AUTH (SYNONYM), PUBLIC.DBA_DV_CODE (SYNONYM),
    PUBLIC.DBA_DV_COMMAND_RULE (SYNONYM), PUBLIC.DBA_DV_COMMAND_RULE_ID
    (SYNONYM), PUBLIC.DBA_DV_DATAPUMP_AUTH (SYNONYM),
    PUBLIC.DBA_DV_DDL_AUTH (SYNONYM), PUBLIC.DBA_DV_DIAGNOSTIC_AUTH
    (SYNONYM), PUBLIC.DBA_DV_DICTIONARY_ACCTS (SYNONYM),
    PUBLIC.DBA_DV_FACTOR (SYNONYM), PUBLIC.DBA_DV_FACTOR_LINK (SYNONYM),
    PUBLIC.DBA_DV_FACTOR_TYPE (SYNONYM), PUBLIC.DBA_DV_IDENTITY (SYNONYM),
    PUBLIC.DBA_DV_IDENTITY_MAP (SYNONYM), PUBLIC.DBA_DV_JOB_AUTH (SYNONYM),
    PUBLIC.DBA_DV_MAC_POLICY (SYNONYM), PUBLIC.DBA_DV_MAC_POLICY_FACTOR
    (SYNONYM), PUBLIC.DBA_DV_MAINTENANCE_AUTH (SYNONYM),
    PUBLIC.DBA_DV_ORADEBUG (SYNONYM), PUBLIC.DBA_DV_PATCH_ADMIN_AUDIT
    (SYNONYM), PUBLIC.DBA_DV_POLICY (SYNONYM), PUBLIC.DBA_DV_POLICY_LABEL
    (SYNONYM), PUBLIC.DBA_DV_POLICY_OBJECT (SYNONYM),
    PUBLIC.DBA_DV_POLICY_OWNER (SYNONYM), PUBLIC.DBA_DV_PREPROCESSOR_AUTH
    (SYNONYM), PUBLIC.DBA_DV_PROXY_AUTH (SYNONYM), PUBLIC.DBA_DV_PUB_PRIVS
    (SYNONYM), PUBLIC.DBA_DV_REALM (SYNONYM), PUBLIC.DBA_DV_REALM_AUTH
    (SYNONYM), PUBLIC.DBA_DV_REALM_OBJECT (SYNONYM), PUBLIC.DBA_DV_ROLE
    (SYNONYM), PUBLIC.DBA_DV_RULE (SYNONYM), PUBLIC.DBA_DV_RULE_SET
    (SYNONYM), PUBLIC.DBA_DV_RULE_SET_RULE (SYNONYM),
    PUBLIC.DBA_DV_SIMULATION_LOG (SYNONYM), PUBLIC.DBA_DV_STATUS (SYNONYM),
    PUBLIC.DBA_DV_TTS_AUTH (SYNONYM), PUBLIC.DBA_DV_USER_PRIVS (SYNONYM),
    PUBLIC.DBA_DV_USER_PRIVS_ALL (SYNONYM), PUBLIC.DBMS_MACADM (SYNONYM),
    PUBLIC.DBMS_MACOLS_SESSION (SYNONYM), PUBLIC.DBMS_MACSEC_ROLES
    (SYNONYM), PUBLIC.DBMS_MACUTL (SYNONYM), PUBLIC.DUAL (SYNONYM),
    PUBLIC.DV_ADMIN_GRANTEES (SYNONYM), PUBLIC.DV_AUDIT_CLEANUP_GRANTEES
    (SYNONYM), PUBLIC.DV_DATABASE_NAME (SYNONYM), PUBLIC.DV_DICT_OBJ_NAME
    (SYNONYM), PUBLIC.DV_DICT_OBJ_OWNER (SYNONYM), PUBLIC.DV_DICT_OBJ_TYPE
    (SYNONYM), PUBLIC.DV_INSTANCE_NUM (SYNONYM), PUBLIC.DV_JOB_INVOKER
    (SYNONYM), PUBLIC.DV_JOB_OWNER (SYNONYM), PUBLIC.DV_LOGIN_USER
    (SYNONYM), PUBLIC.DV_MONITOR_GRANTEES (SYNONYM),
    PUBLIC.DV_OWNER_GRANTEES (SYNONYM), PUBLIC.DV_SECANALYST_GRANTEES
    (SYNONYM), PUBLIC.DV_SQL_TEXT (SYNONYM), PUBLIC.DV_SYSEVENT (SYNONYM),
    PUBLIC.GET_FACTOR (SYNONYM), PUBLIC.GET_FACTOR_LABEL (SYNONYM),
    PUBLIC.GET_TRUST_LEVEL (SYNONYM), PUBLIC.GET_TRUST_LEVEL_FOR_IDENTITY
    (SYNONYM), PUBLIC.IS_SECURE_APPLICATION_ROLE (SYNONYM),
    PUBLIC.ROLE_IS_ENABLED (SYNONYM), PUBLIC.SET_FACTOR (SYNONYM),
    SYS.DBMS_RLS (Any Type)

Oracle Default Component Protection Realm (Enabled) (Default)
Protects roles: (none)
Protects objects: OUTLN.<Any Object> (Any Type), SYSTEM.<Any
    Object> (Any Type)

Oracle Default Schema Protection Realm (Enabled) (Default)
Protects roles: AUTHENTICATEDUSER, GDS_CATALOG_SELECT, GGSYS_ROLE,
    GSMADMIN_ROLE, GSMUSER_ROLE, GSM_POOLADMIN_ROLE, SODA_APP, SYSUMF_ROLE,
    WM_ADMIN_ROLE, XDBADMIN, XDB_SET_INVOKER, XDB_WEBSERVICES,
    XDB_WEBSERVICES_OVER_HTTP, XDB_WEBSERVICES_WITH_PUBLIC
Protects objects: (none)

Oracle Enterprise Manager (Enabled) (Default)
Protects roles: EM_EXPRESS_ALL, EM_EXPRESS_BASIC, OEM_ADVISOR, OEM_MONITOR
Protects objects: DBSNMP.<Any Object> (Any Type)

Oracle System Privilege and Role Management Realm (Enabled) (Default)
Protects roles: ADM_PARALLEL_EXECUTE_TASK, APPLICATION_TRACE_VIEWER,
    AQ_ADMINISTRATOR_ROLE, AQ_USER_ROLE, AUDIT_ADMIN, AUDIT_VIEWER,
    CAPTURE_ADMIN, CDB_DBA, CONNECT, DATAPATCH_ROLE,
    DATAPUMP_EXP_FULL_DATABASE, DATAPUMP_IMP_FULL_DATABASE, DBA, DBFS_ROLE,
    DBMS_AUTH, DBMS_MDX_INTERNAL, DBMS_PASSWD, DV_REALM_OWNER,
    DV_REALM_RESOURCE, EXECUTE_CATALOG_ROLE, EXP_FULL_DATABASE,
    EXTERNAL_DBMS_AUTH, GATHER_SYSTEM_STATISTICS, GLOBAL_AQ_USER_ROLE,
    HS_ADMIN_EXECUTE_ROLE, HS_ADMIN_ROLE, HS_ADMIN_SELECT_ROLE,
    IMP_FULL_DATABASE, LOGSTDBY_ADMINISTRATOR, MIDTIER_AUTH,
    OPTIMIZER_PROCESSING_RATE, PDB_DBA, PROVISIONER,
    RECOVERY_CATALOG_OWNER, RECOVERY_CATALOG_OWNER_VPD,
    RECOVERY_CATALOG_USER, RESOURCE, SCHEDULER_ADMIN, SELECT_CATALOG_ROLE,
    XSAUTHENTICATED, XSBYPASS, XSCACHEADMIN, XSDISPATCHER,
    XSNAMESPACEADMIN, XSPROVISIONER, XSSESSIONADMIN, XSSWITCH,
    XS_CACHE_ADMIN, XS_CONNECT, XS_NAMESPACE_ADMIN, XS_SESSION_ADMIN
Protects objects: LBACSYS.DBA_OLS_STATUS (VIEW), XS$NULL.<Any Object>
    (Any Type)


Command rules:
ALTER PROFILE (Enabled) (Default)
ALTER SYSTEM DUMP (Enabled) (Default)
ALTER SYSTEM SET (Enabled) (Default)
ALTER SYSTEM SET AUDIT_SYSLOG_LEVEL (Enabled) (Default)
ALTER SYSTEM SET AUDIT_SYS_OPERATIONS (Enabled) (Default)
ALTER SYSTEM SET AUDIT_TRAIL (Enabled) (Default)
ALTER SYSTEM SET CONTROL_FILES (Enabled) (Default)
ALTER SYSTEM SET LOG_ARCHIVE_MIN_SUCCEED_DEST (Enabled) (Default)
ALTER SYSTEM SET LOG_ARCHIVE_TRACE (Enabled) (Default)
ALTER SYSTEM SET OPTIMIZER_SECURE_VIEW_MERGING (Enabled) (Default)
ALTER SYSTEM SET OS_ROLES (Enabled) (Default)
ALTER SYSTEM SET PLSQL_DEBUG (Enabled) (Default)
ALTER SYSTEM SET REMOTE_OS_ROLES (Enabled) (Default)
ALTER SYSTEM SET SQL92_SECURITY (Enabled) (Default)
ALTER SYSTEM SET UTL_FILE_DIR (Enabled) (Default)
ALTER SYSTEM SET _DYNAMIC_RLS_POLICIES (Enabled) (Default)
ALTER SYSTEM SET _SYSTEM_TRIG_ENABLED (Enabled) (Default)
ALTER USER (Enabled) (Default)
CHANGE PASSWORD (Enabled) (Default)
CONNECT on DEMOAPPS.<Any Object> (Disabled)
CREATE PROFILE (Enabled) (Default)
CREATE USER (Enabled) (Default)
DROP PROFILE (Enabled) (Default)
DROP USER (Enabled) (Default)

Users with DV_OWNER role: C##DVO
Users with DV_ADMIN role: C##DVO, SYSTEM
Users with DV_PATCH_ADMIN role: SYS
Users with DV_AUDIT_CLEANUP role: C##DVO
Users with DV_ACCTMGR role: C##DVAM, SECADMIN, SYS

Remarks

Database Vault provides for configurable policies to control the actions of privileged administrative users, in order to protect against insider threats, stolen credentials, and human error. Data realms prevent unauthorized access to sensitive data objects, even by users with system privileges. Command rules limit the SQL commands and options that administrators can execute.

Privilege Analysis

AUTH.PRIV

Status

Opportunity

Summary

No privilege analysis policies found.

Details


Users with EXECUTE on SYS.DBMS_PRIVILEGE_CAPTURE: SYSTEM

Remarks

Privilege Analysis records the privileges used during a real or simulated workload. After collecting data about the privileges that are actually used, this information can be used to revoke privilege grants that are no longer needed.

Data Encryption

Transparent Data Encryption

CRYPT.TDE

Status

Opportunity

Summary

Found 1 encrypted tablespace. No encrypted columns found. Examined 1 initialization parameter.

Details

Encrypted tablespaces: USERDATA (AES256)
Unencrypted tablespaces: SYSAUX, SYSTEM, TEMP, UNDOTBS1, USERS

ENCRYPT_NEW_TABLESPACES=DDL. Recommended value is ALWAYS.

Remarks

Encryption of some sensitive data is a requirement in certain regulated environments. Transparent Data Encryption automatically encrypts data as it is stored and decrypts it upon retrieval. This protects sensitive data from attacks that bypass the database to read data files directly. Encryption keys may be stored in wallets on the database server itself, or stored remotely in Oracle Key Vault for improved security. The ENCRYPT_NEW_TABLESPACES parameter ensures that TDE tablespace encryption is applied to all newly created tablespaces. Setting this parameter to ALWAYS is recommended in order to protect all data regardless of the options specified when the tablespace is created.

Encryption Key Wallet

CRYPT.WALLET

Status

Evaluate

Summary

Found 2 wallets. No wallets are stored in the data file directory.

Details

Wallet location:
Wallet type: FILE
Status: OPEN_NO_MASTER_KEY
Keystore type: UNKNOWN
Wallet order: SINGLE

Wallet location:
Wallet type: OKV
Status: OPEN
Keystore type: OKV
Wallet order: SINGLE

Data file directory: /u01/oracle/db/product/12.2.0/dbhome_1/dbs

Remarks

Wallets are encrypted files used to store encryption keys, passwords, and other sensitive data. Wallet files should not be stored in the same directory with database data files, to avoid accidentally creating backups that include both encrypted data files and the wallet containing the master key protecting those files. For maximum separation of keys and data, consider storing encryption keys in Oracle Key Vault instead of wallet files.

Fine-Grained Access Control

Data Redaction

ACCESS.REDACT

Status

Evaluate

Summary

Found 1 data redaction policy protecting 2 objects.

Details

Policy REDACT_PI_DATA: Protects DEMOAPPS.DEMO_HR_EMPLOYEES (col SALARY),
    DEMOAPPS.DEMO_HR_EMPLOYEES (col EMAIL)

Users with EXEMPT REDACTION POLICY privilege: SYSTEM
Users with EXECUTE on SYS.DBMS_REDACT: SYSTEM

Remarks

Data Redaction automatically masks sensitive data found in the results of a database query. The data is masked immediately before it is returned as part of the result set, so it does not interfere with any conditions specified as part of the query. Access by users with the EXEMPT REDACTION POLICY privilege will not be affected by the redaction policy. Users who can execute the DBMS_REDACT package are able to create and modify redaction policies. Also consider the use of Oracle Data Masking and Subsetting to permanently mask sensitive data when making copies for test or development use.

Virtual Private Database

ACCESS.VPD

Status

Evaluate

Summary

Found 1 VPD policy protecting 1 object.

Details

Policy RESTRICTED_IP: Protects DEMOAPPS.DEMO_HR_EMPLOYEES

Users with EXEMPT ACCESS POLICY privilege: (none)
Users with EXECUTE on SYS.DBMS_RLS: C##DVO, SYSTEM

Remarks

Virtual Private Database (VPD) allows for fine-grained control over which rows and columns of a table are visible to a SQL statement. Access control using VPD limits each database session to only the specific data it should be able to access. Access by users with the EXEMPT ACCESS POLICY privilege will not be affected by VPD policies. Users who can execute the DBMS_RLS package are able to create and modify these policies.

Real Application Security

ACCESS.RAS

Status

Opportunity

Summary

No RAS policies found.

Details


Users with EXEMPT ACCESS POLICY privilege: (none)
Users with ADMIN_ANY_SEC_POLICY privilege: SYSTEM
Users with ADMIN_SEC_POLICY privilege: DBSFWUSER
Users with APPLY_SEC_POLICY privilege: (none)

Remarks

Like Virtual Private Database, Real Application Security (RAS) provides fine-grained control over the rows and columns of a table that are visible to a SQL statement. Specification of RAS data access policies uses a declarative syntax based on access control lists. Access by users with the EXEMPT ACCESS POLICY privilege will not be affected by RAS access policies. Users with ADMIN_SEC_POLICY and APPLY_SEC_POLICY privileges are able to create and modify these policies.

Label Security

ACCESS.OLS

Status

Opportunity

Summary

No Label Security policies found.

Details


Users with LBAC_DBA role: LBACSYS
Users with EXEMPT ACCESS POLICY privilege: (none)

Remarks

Oracle Label Security provides the ability to tag data with a data label or a data classification. Access to sensitive data is controlled by comparing the data label with the requesting user's label or security clearance. A user label or security clearance can be thought of as an extension to standard database privileges and roles. Access by users with the EXEMPT ACCESS POLICY privilege will not be affected by the Label Security policies. Each policy has a corresponding role; users who have this role are able to administer the policy.

Transparent Sensitive Data Protection

ACCESS.TSDP

Status

Opportunity

Summary

No sensitive types and columns found. Found 0 TSDP policies.

Details

Policies: (none)

Users with EXECUTE on SYS.DBMS_TSDP_MANAGE: (none)
Users with EXECUTE on SYS.DBMS_TSDP_PROTECT: (none)

Remarks

Transparent Sensitive Data Protection (TSDP), introduced in Oracle Database 12.1, allows a data type to be associated with each column that contains sensitive data. TSDP can then apply various data security features to all instances of a particular type so that protection is uniform and consistent. Data from columns marked as sensitive is also automatically redacted in the database audit trail and trace logs. Users who can execute the DBMS_TSDP_MANAGE and DBMS_TSDP_PROTECT packages are able to manage sensitive data types and the protection actions that are applied to them.

Auditing

Audit Records

AUDIT.RECORDS

Status

Evaluate

Summary

Examined 3 audit trails. Found records in 1 audit trail. No errors found in audit initialization parameters.

Details

Traditional Audit Trail: No records found
FGA Audit Trail: No records found
Unified Audit Trail: In use, 163 records found (May 19 2017 - May 23 2017)

AUDIT_FILE_DEST=/u01/oracle/db/admin/cdb3/adump
AUDIT_SYSLOG_LEVEL is not set.
AUDIT_TRAIL=DB

Remarks

Auditing is an essential component for securing any system. The audit trail allows for monitoring the activities of highly privileged users. For any attack that exploits gaps in other security policies, auditing cannot prevent the attack but it forms the critical last line of defense by detecting the malicious activity. Sending audit data to a remote system is recommended in order to prevent any possible tampering with the audit records. The AUDIT_SYSLOG_LEVEL parameter can be set to send an abbreviated version of some audit records to a remote syslog collector. A better solution is to use Oracle Audit Vault and Database Firewall to centrally collect full audit records from multiple databases.

Statement Audit

AUDIT.STMT

Status

Evaluate

Summary

Auditing enabled for 18 statements.

Details

Unified Audit (18): ALL, ALTER DATABASE LINK, ALTER PLUGGABLE DATABASE,
    ALTER PROFILE, ALTER ROLE, ALTER USER, CREATE DATABASE LINK, CREATE
    DIRECTORY, CREATE PLUGGABLE DATABASE, CREATE PROFILE, CREATE ROLE, DROP
    DATABASE LINK, DROP DIRECTORY, DROP PLUGGABLE DATABASE, DROP PROFILE,
    DROP ROLE, LOGON, SET ROLE

Remarks

This finding shows the SQL statements that are audited by enabled audit policies.

Object Audit

AUDIT.OBJ

Status

Evaluate

Summary

Auditing enabled for 18 objects.

Details

Traditional Audit:
Schema DVSYS (18): AUDIT_TRAIL$, CODE$, COMMAND_RULE$, FACTOR$,
    FACTOR_LINK$, FACTOR_TYPE$, IDENTITY$, IDENTITY_MAP$, MAC_POLICY$,
    MAC_POLICY_FACTOR$, POLICY_LABEL$, REALM$, REALM_AUTH$, REALM_OBJECT$,
    ROLE$, RULE$, RULE_SET$, RULE_SET_RULE$

Remarks

This finding shows the object accesses that are audited by enabled audit policies.

Privilege Audit

AUDIT.PRIV

Status

Evaluate

Summary

Auditing enabled for 30 privileges.

Details

Unified Audit (30): ADMINISTER KEY MANAGEMENT, ALTER ANY PROCEDURE, ALTER
    ANY SQL TRANSLATION PROFILE, ALTER ANY TABLE, ALTER DATABASE, ALTER
    SYSTEM, AUDIT SYSTEM, BECOME USER, CREATE ANY JOB, CREATE ANY LIBRARY,
    CREATE ANY PROCEDURE, CREATE ANY SQL TRANSLATION PROFILE, CREATE ANY
    TABLE, CREATE EXTERNAL JOB, CREATE PUBLIC SYNONYM, CREATE SQL
    TRANSLATION PROFILE, CREATE USER, DROP ANY PROCEDURE, DROP ANY SQL
    TRANSLATION PROFILE, DROP ANY TABLE, DROP PUBLIC SYNONYM, DROP USER,
    EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY, GRANT ANY OBJECT
    PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE, LOGMINING, PURGE
    DBA_RECYCLEBIN, TRANSLATE ANY SQL

Remarks

This finding shows the privileges that are audited by enabled audit policies.

Administrative User Audit

AUDIT.ADMIN

Status

Pass

Summary

Actions of the SYS user are audited.

Details

Traditional Audit: AUDIT_SYS_OPERATIONS is set to TRUE.

Unified Audit policies enabled for administrators: (none)

Remarks

It is important to audit administrative actions performed by the SYS user. Traditional audit policies do not apply to SYS, so the AUDIT_SYS_OPERATIONS parameter must be set to record SYS actions to a separate audit trail. Beginning with Oracle 12c, the same Unified Audit policies can be applied to SYS that are used to monitor other users.

Privilege Management Audit

AUDIT.PRIVMGMT

Status

Pass

Summary

Actions related to privilege management are sufficiently audited.

Details

Traditional audit - auditing enabled: (none)
Unified audit - auditing enabled: ALL, GRANT ANY OBJECT PRIVILEGE, GRANT
    ANY PRIVILEGE, GRANT ANY ROLE

Remarks

Granting additional privileges to users or roles potentially affects most security protections and should be audited. Each action or privilege listed here should be included in at least one enabled audit policy.

Account Management Audit

AUDIT.ACCTMGMT

Status

Pass

Summary

Actions related to account management are sufficiently audited.

Details

Traditional audit - auditing enabled: (none)
Unified audit - auditing enabled: ALL, ALTER PROFILE, ALTER USER, CREATE
    PROFILE, CREATE USER, DROP PROFILE, DROP USER

Remarks

Creation of new user accounts or modification of existing accounts can be used to gain access to the privileges of those accounts and should be audited. Each action or privilege listed here should be included in at least one enabled audit policy.

Database Management Audit

AUDIT.DBMGMT

Status

Pass

Summary

Actions related to database management are sufficiently audited.

Details

Traditional audit - auditing enabled: (none)
Unified audit - auditing enabled: ADMINISTER KEY MANAGEMENT, ALL, ALTER
    DATABASE, ALTER DATABASE LINK, ALTER PLUGGABLE DATABASE, ALTER SYSTEM,
    CREATE ANY LIBRARY, CREATE DATABASE LINK, CREATE EXTERNAL JOB, CREATE
    PLUGGABLE DATABASE, CREATE PUBLIC SYNONYM, DROP DATABASE LINK, DROP
    PLUGGABLE DATABASE, DROP PUBLIC SYNONYM, EXECUTE ON SYS.DBMS_RLS

Remarks

Actions that affect the management of database features should always be audited. Each action or privilege listed here should be included in at least one enabled audit policy.

Privilege Usage Audit

AUDIT.PRIVUSE

Status

Significant Risk

Summary

Usages of powerful system privileges are not sufficiently audited.

Details

Auditing not enabled: CREATE ANY TRIGGER

Traditional audit - auditing enabled: (none)
Unified audit - auditing enabled: ALTER ANY SQL TRANSLATION PROFILE, BECOME
    USER, CREATE ANY JOB, CREATE ANY PROCEDURE, CREATE ANY SQL TRANSLATION
    PROFILE, EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY, LOGMINING,
    TRANSLATE ANY SQL

Remarks

Usage of powerful system privileges should always be audited. Each privilege listed here should be included in at least one enabled audit policy.

Database Connection Audit

AUDIT.CONN

Status

Pass

Summary

Database connections are sufficiently audited.

Details

Traditional audit - auditing enabled: (none)
Unified audit - auditing enabled: ALL, LOGON

Remarks

Successful user connections to the database should be audited to assist with future forensic analysis. Unsuccessful connection attempts can provide early warning of an attacker's attempt to gain access to the database.

Fine Grained Audit

AUDIT.FGA

Status

Opportunity

Summary

No fine grained audit policies found.

Details


Users with EXECUTE on SYS.DBMS_FGA: SECADMIN, SYSTEM

Remarks

Fine Grained Audit policies can record highly specific activity, such as access to particular table columns or access that occurs under specified conditions. This is a useful way to monitor unexpected data access while avoiding unnecessary audit records that correspond to normal activity.

Unified Audit

AUDIT.UNIFIED

Status

Evaluate

Summary

Found 11 unified audit policies. Found 51 objects or statements being audited.

Details

Policy AUDITDBA (Disabled): Audits 1 objects/statements
Policy AUDIT_USER_WITH_ROLE (Enabled): Audits 2 objects/statements
Policy ORA_ACCOUNT_MGMT (Disabled): Audits 9 objects/statements
Policy ORA_CIS_RECOMMENDATIONS (Disabled): Audits 26 objects/statements
Policy ORA_DATABASE_PARAMETER (Disabled): Audits 3 objects/statements
Policy ORA_DV_AUDPOL (Disabled): Audits 2096 objects/statements
Policy ORA_DV_AUDPOL2 (Disabled): Audits 19 objects/statements
Policy ORA_LOGON_FAILURES (Enabled): Audits 1 objects/statements
Policy ORA_RAS_POLICY_MGMT (Disabled): Audits 35 objects/statements
Policy ORA_RAS_SESSION_MGMT (Disabled): Audits 14 objects/statements
Policy ORA_SECURECONFIG (Enabled): Audits 48 objects/statements

Remarks

Unified Audit, available in Oracle Database 12.1 and later releases, combines multiple audit trails into a single unified view. It also introduces new syntax for specifying effective audit policies.

Database Configuration

Initialization Parameters for Security

Name	Value
AUDIT_FILE_DEST	/u01/oracle/db/admin/cdb3/adump
AUDIT_SYSLOG_LEVEL
AUDIT_SYS_OPERATIONS	TRUE
AUDIT_TRAIL	DB
COMPATIBLE	12.2.0
DBFIPS_140	FALSE
DISPATCHERS	(PROTOCOL=TCP) (SERVICE=cdb3XDB)
ENCRYPT_NEW_TABLESPACES	DDL
GLOBAL_NAMES	FALSE
LDAP_DIRECTORY_ACCESS	PASSWORD
LDAP_DIRECTORY_SYSAUTH	NO
O7_DICTIONARY_ACCESSIBILITY	FALSE
OS_AUTHENT_PREFIX	ops$
OS_ROLES	FALSE
PDB_LOCKDOWN
PDB_OS_CREDENTIAL
REMOTE_LISTENER
REMOTE_LOGIN_PASSWORDFILE	EXCLUSIVE
REMOTE_OS_AUTHENT	FALSE
REMOTE_OS_ROLES	FALSE
RESOURCE_LIMIT	TRUE
SEC_CASE_SENSITIVE_LOGON	TRUE
SEC_MAX_FAILED_LOGIN_ATTEMPTS	3
SEC_PROTOCOL_ERROR_FURTHER_ACTION	(DROP,3)
SEC_PROTOCOL_ERROR_TRACE_ACTION	TRACE
SEC_RETURN_SERVER_RELEASE_BANNER	FALSE
SQL92_SECURITY	TRUE
UNIFIED_AUDIT_SGA_QUEUE_SIZE	1048576
UTL_FILE_DIR

Access to Dictionary Objects

CONF.SYSOBJ

Status

Pass

Summary

Access to dictionary objects is properly limited.

Details

O7_DICTIONARY_ACCESSIBILITY=FALSE

Remarks

When O7_DICTIONARY_ACCESSIBILITY is set to FALSE, tables owned by SYS are not affected by the ANY TABLE system privileges. This parameter should always be set to FALSE because tables owned by SYS control the overall state of the database and should not be subject to manipulation by users with ANY TABLE privileges.

Inference of Table Data

CONF.INFER

Status

Pass

Summary

Data inference attacks are properly blocked.

Details

SQL92_SECURITY=TRUE

Remarks

When SQL92_SECURITY is set to TRUE, UPDATE and DELETE statements that refer to a column in their WHERE clauses will succeed only when the user has the privilege to SELECT from the same column. This parameter should be set to TRUE so that this requirement is enforced in order to prevent users from inferring the value of a column which they do not have the privilege to view.

Network Communications

CONF.NETCOM

Status

Pass

Summary

Examined 3 initialization parameters. No issues found.

Details

SEC_PROTOCOL_ERROR_FURTHER_ACTION=(DROP,3)
SEC_PROTOCOL_ERROR_TRACE_ACTION=TRACE
SEC_RETURN_SERVER_RELEASE_BANNER=FALSE

Remarks

The SEC_PROTOCOL_ERROR parameters control the database server's response when it receives malformed network packets from a client. Because these malformed packets may indicate an attempted attack by a malicious client, the parameters should be set to log the incident and terminate the connection. SEC_RETURN_SERVER_RELEASE_BANNER should be set to FALSE to limit the information that is returned to an unauthenticated client, which could be used to help determine the server's vulnerability to a remote attack.

External Authorization

CONF.EXTAUTH

Status

Pass

Summary

Examined 2 initialization parameters. No issues found.

Details

REMOTE_OS_ROLES=FALSE
OS_ROLES=FALSE

Remarks

The OS_ROLES and REMOTE_OS_ROLES parameters determine whether roles granted to users are controlled by GRANT statements in the database or by the operating system environment. Both parameters should be set to FALSE so that the authorizations of database users are managed by the database itself.

File System Access

CONF.FILESYS

Status

Pass

Summary

Examined 1 initialization parameter. No issues found.

Details

UTL_FILE_DIR=''

Remarks

The UTL_FILE_DIR parameter controls which part of the server's file system can be accessed by PL/SQL code. Note that as the directories specified in the UTL_FILE_DIR parameter may be accessed by any database user, it should be set to specify one or more safe directories that do not contain restricted files such as the configuration or data files for the database. For maximum security, use directory objects which allow finer grained control of access, rather than relying on this parameter.

Triggers

CONF.TRIG

Status

Pass

Summary

No logon triggers found. No disabled triggers found.

Remarks

A trigger is code that executes whenever a specific event occurs, such as inserting data in a table or connecting to the database. Disabled triggers are a potential cause for concern because whatever protection or monitoring they may be expected to provide is not active.

Disabled Constraints

CONF.CONST

Status

Some Risk

Summary

Found 1 disabled constraint.

Details

Disabled constraints: STS_CHUNKS on GSMADMIN_INTERNAL.SHARD_TS

Remarks

Constraints are used to enforce and guarantee specific relationships between data items stored in the database. Disabled constraints are a potential cause for concern because the conditions they ensure are not enforced.

External Procedures

CONF.EXTPROC

Status

Evaluate

Summary

Found 5 external procedures. Found 1 external service.

Details

External procedures: SYS.DBMSHADOOPLIB, SYS.DBMS_SUMADV_LIB,
    SYS.DM$RQEXTLIB, SYS.KUBSAGT_LIB, SYSTEM.SHELL_LIB

Listener services for external procedures:
PLSExtProc: EXTPROC_DLLS=ONLY:/u01/oracle/extproc/shell.so

Remarks

External procedures allow code written in other languages to be executed from PL/SQL. Note that modifications to external code cannot be controlled by the database. Be careful to ensure that only trusted code libraries are available to be executed. Although the database can spawn its own process to execute the external procedure, it is advisable to configure a listener service for this purpose so that the external code can run as a less-privileged OS user. The listener configuration should set EXTPROC_DLLS to identify the specific shared library code that can be executed rather than using the default value ANY.

Directory Objects

CONF.DIR

Status

Severe Risk

Summary

Found 13 directory objects. Found 1 directory object allowing access to restricted Oracle directory paths. Found 1 directory object with both write and execute access.

Details

Directory Name: DATA_PUMP_DIR
Path = /u01/oracle/db/admin/cdb3/dpdump/4A9B64089E5B4DCAE053CD6EC80A9459/
Users or roles with access: EXP_FULL_DATABASE(READ),
    EXP_FULL_DATABASE(WRITE), IMP_FULL_DATABASE(READ),
    IMP_FULL_DATABASE(WRITE)

Directory Name: DLL_LOC
Path = /u01/oracle/extproc/
Users or roles with access: SYSTEM(EXECUTE), SYSTEM(READ), SYSTEM(WRITE)

Directory Name: OPATCH_INST_DIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/OPatch/

Directory Name: OPATCH_LOG_DIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/QOpatch/

Directory Name: OPATCH_SCRIPT_DIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/QOpatch/

Directory Name: ORACLE_BASE
Path = /u01/oracle/db/

Directory Name: ORACLE_HOME
Path = /u01/oracle/db/product/12.2.0/dbhome_1/

Directory Name: ORACLE_OCM_CONFIG_DIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/ccr/state/

Directory Name: ORACLE_OCM_CONFIG_DIR2
Path = /u01/oracle/db/product/12.2.0/dbhome_1/ccr/state/

Directory Name: ORA_DBMS_FCP_ADMINDIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/rdbms/admin/

Directory Name: ORA_DBMS_FCP_LOGDIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/cfgtoollogs/

Directory Name: XMLDIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/rdbms/xml/

Directory Name: XSDDIR
Path = /u01/oracle/db/product/12.2.0/dbhome_1/rdbms/xml/schema/


$ORACLE_HOME: ORACLE_HOME

Directories with both write and execute access: DLL_LOC

Remarks

Directory objects allow access to the server's file system from PL/SQL code within the database. Access to files that are used by the database kernel itself should not be permitted, as this may alter the operation of the database and bypass its access controls.

Database Links

CONF.LINKS

Status

Evaluate

Summary

Found 1 database link.

Details

Users with CREATE DATABASE LINK privilege: SYSTEM
Users with CREATE PUBLIC DATABASE LINK privilege: SYSTEM

Private links:
SYS: SYS_HUB.VBOX.LOCAL

Remarks

Database links allow users to execute SQL statements that access tables in other databases. This allows for both querying and storing data on the remote database.

Network Access Control

CONF.NETACL

Status

Evaluate

Summary

Found 1 network ACL.

Details

NETWORK_ACL_4A9AD814835C206BE053CD6EC80A78AA (Host: *, Ports: Min - Max)
Principal: GGSYS, Action: deny, Privilege: resolve
Principal: GSMADMIN_INTERNAL, Action: deny, Privilege: resolve

Remarks

Network ACLs control the external servers that database users can access using network packages such as UTL_TCP and UTL_HTTP. Specifically, a database user needs the connect privilege to an external network host computer if he or she is connecting using the UTL_TCP, UTL_HTTP, UTL_SMTP, and UTL_MAIL utility packages. To convert between a host name and its IP address using the UTL_INADDR package, the resolve privilege is required. Make sure that these permissions are limited to the minimum required by each user.

XML Database Access Control

CONF.XMLACL

Status

Evaluate

Summary

Found 4 XML Database ACLs.

Details

Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
Description: Protected:Readable by PUBLIC and all privileges to OWNER
Principal: dav:owner, Action: grant, Privileges: all
Principal: XDBADMIN, Action: grant, Privileges: all
Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
    contents, read-acl, resolve

Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
Description: Public:All privileges to PUBLIC
Principal: PUBLIC, Action: grant, Privileges: all

Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
Description: Private:All privileges to OWNER only and not accessible to
    others
Principal: dav:owner, Action: grant, Privileges: all

Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
Description: Read-Only:Readable by all and writeable by none
Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
    contents, read-acl, resolve

Remarks

XML ACLs control access to database resources using the XML DB feature. Every resource in the Oracle XML DB Repository hierarchy has an associated ACL. The ACL mechanism specifies a privilege-based access control for resources to principals, which are database users or roles. Whenever a resource is accessed, a security check is performed, and the ACL determines if the requesting user has sufficient privileges to access the resource. Make sure that these privileges are limited to the minimum required by each user.

Network Configuration

Network Encryption

NET.CRYPT

Status

Significant Risk

Summary

Native encryption is partially enabled. Integrity check using checksums is partially enabled.

Details

SQLNET.ENCRYPTION_SERVER is not set (default value = ACCEPTED).
SQLNET.CRYPTO_CHECKSUM_SERVER is not set (default value = ACCEPTED).

Examined 2 listeners.

LISTENER_ADMIN: IPC (0), TCP (1), TCPS (0)
LISTENER: IPC (1), TCP (1), TCPS (1)

SSL_CERT_REVOCATION is not set (default value = NONE).

Remarks

Network encryption protects the confidentiality and integrity of communication between the database server and its clients. Either Native Encryption or TLS should be enabled. For Native Encryption, both ENCRYPTION_SERVER and CRYPTO_CHECKSUM_SERVER should be set to REQUIRED. If TLS is used, TCPS should be specified for all network ports and SSL_CERT_REVOCATION should be set to REQUIRED.

Client Nodes

NET.CLIENTS

Status

Significant Risk

Summary

Valid node check is not enabled. Neither TCP.INVITED_NODES nor TCP.EXCLUDED_NODES is set.

Details

TCP.VALIDNODE_CHECKING is not set (default value = NO). Recommended value
    is YES.
TCP.INVITED_NODES is not set.
TCP.EXCLUDED_NODES is not set.

Remarks

TCP.VALIDNODE_CHECKING should be enabled to control which client nodes can connect to the database server. Either a whitelist of client nodes allowed to connect (TCP.INVITED_NODES) or a blacklist of nodes that are not allowed (TCP.EXCLUDED_NODES) may be specified. Configuring both lists is an error; only the invited node list will be used in this case.

SQLNET Banners

NET.BANNER

Status

Some Risk

Summary

Connect banners are not fully configured.

Details

SEC_USER_AUDIT_ACTION_BANNER is not set. Should be set to a proper value.
SEC_USER_UNAUTHORIZED_ACCESS_BANNER is not set. Should be set to a proper
    value.

Remarks

These banner messages are used to warn connecting users that unauthorized access is not permitted and that their activities may be audited.

Network Listener Configuration

NET.COST

Status

Significant Risk

Summary

Examined 1 listener. Found 1 listener not configured properly.

Details

Listeners not configured properly: LISTENER_ADMIN

Parameter setting for LISTENER_ADMIN:
DYNAMIC_REGISTRATION_LISTENER_ADMIN is not set (default value = ON).
    Recommended value is OFF.
VALID_NODE_CHECKING_REGISTRATION_LISTENER_ADMIN is not set (default value =
    OFF). Should not be set to OFF.
SECURE_PROTOCOL_LISTENER_ADMIN is not set.
SECURE_CONTROL_LISTENER_ADMIN is not set.
SECURE_REGISTER_LISTENER_ADMIN is not set.

Remarks

These parameters are used to limit changes to the network listener configuration. One of the following restrictions should be implemented: (a) prevent changes by disabling DYNAMIC_REGISTRATION, (b) limit the nodes that can make changes by enabling VALID_NODE_CHECKING_REGISTRATION, or (c) limit the network sources for changes using the COST parameters SECURE_PROTOCOL, SECURE_CONTROL, and SECURE_REGISTER.

Listener Logging Control

NET.LISTENLOG

Status

Pass

Summary

Examined 1 listener. Found 0 listeners not configured properly.

Details

Listeners configured properly: LISTENER_ADMIN

Parameter setting for LISTENER_ADMIN:
LOGGING_LISTENER_ADMIN is not set (default value = ON).

Remarks

This parameter enables logging of listener activity. Log information can be useful for troubleshooting and to provide early warning of attempted attacks.

Operating System

OS Authentication

OS.AUTH

Status

Evaluate

Summary

1 OS user can connect to the database via OS authentication.

Details

SYSDBA [dba group]: oracle
SYSOPER [dba group]: oracle
SYSBACKUP [dba group]: oracle
SYSKM [dba group]: oracle
SYSDG [dba group]: oracle
SYSRAC [dba group]: oracle

Remarks

OS authentication allows operating system users within the specified user group to connect to the database with administrative privileges. This shows the OS group names and users that can exercise each administrative privilege.

Process Monitor Process

OS.PMON

Status

Pass

Summary

Found 2 PMON processes. The owner of the PMON process matches the ORACLE_HOME owner.

Details

PMON process: ora_pmon_cdb3, Owner: oracle
ORACLE_HOME owner: oracle

Other PMON processes found:
        Owner: oracle, Command: ora_pmon_emrep

Remarks

The PMON process monitors user processes and frees resources when they terminate. This process should run with the user ID of the ORACLE_HOME owner.

Agent Processes

OS.AGENT

Status

Some Risk

Summary

Some Agent process owners overlap with Listener or PMON process owners.

Details

Owner: oracle
Command: /u01/oracle/emagent/agent_13.2.0.0.0/perl/bin/perl
    /u01/oracle/emagent/agent_13.2.0.0.0/bin/emwd.pl agent
    /u01/oracle/emagent/agent_inst/sysman/log/emagent.nohup

Owner: oracle
Command: /u01/oracle/emagent/agent_13.2.0.0.0/oracle_common/jdk/bin/java
    -Xmx245M -XX:MaxPermSize=96M -server
    -Djava.security.egd=file:///dev/./urandom
    -Dsun.lang.ClassLoader.allowArraySyntax=true -XX:-UseLargePages
    -XX:+UseLinuxPosixThreadCPUClocks -XX:+UseConcMarkSweepGC
    -XX:+CMSClassUnloadingEnabled -XX:+UseCompressedOops
    -Dwatchdog.pid=6703 -cp /u01/oracle/emagent/agent_13.2.0.0.0/jdbc/lib/o
    jdbc7.jar:/u01/oracle/emagent/agent_13.2.0.0.0/ucp/lib/ucp.jar:/u01/ora
    cle/emagent/agent_13.2.0.0.0/oracle_common/modules/jsch-0.1.53.jar:/u01
    /oracle/emagent/agent_13.2.0.0.0/oracle_common/modules/com.oracle.http_
    client.http_client_12.1.3.jar:/u01/oracle/emagent/agent_13.2.0.0.0/orac
    le_common/modules/oracle.xdk_12.1.3/xmlparserv2.jar:/u01/oracle/emagent
    /agent_13.2.0.0.0/oracle_common/modules/oracle.dms_12.1.3/dms.jar:/u01/
    oracle/emagent/agent_13.2.0.0.0/oracle_common/modules/oracle.odl_12.1.3
    /ojdl.jar:/u01/oracle/emagent/agent_13.2.0.0.0/oracle_common/modules/or
    acle.odl_12.1.3/ojdl2.jar:/u01/oracle/emagent/agent_13.2.0.0.0/lib/opti
    c.jar:/u01/oracle/emagent/agent_13.2.0.0.0/sysman/jlib/log4j-core.jar:/
    u01/oracle/emagent/agent_13.2.0.0.0/jlib/gcagent_core.jar:/u01/oracle/e
    magent/agent_13.2.0.0.0/sysman/jlib/emagentSDK-intg.jar:/u01/oracle/ema
    gent/agent_13.2.0.0.0/sysman/jlib/emagentSDK.jar
    oracle.sysman.gcagent.tmmain.TMMain

Owner: oracle
Command: /u01/oracle/emagent/agent_13.2.0.0.0/perl/bin/perl /u01/oracle/ema
    gent/agent_13.2.0.0.0/plugins/oracle.sysman.oh.agent.plugin_13.2.0.0.0/
    scripts/OHConfigCollector.pl --home /u01/oracle/db/product/12.1.0/emrep
    --metric COMP_DEPS --type O --inventory /u01/oracle/oraInventory
    --mw_home

Owner: oracle
Command: /u01/oracle/emagent/agent_13.2.0.0.0/perl/bin/perl /u01/oracle/ema
    gent/agent_13.2.0.0.0/plugins/oracle.sysman.oh.agent.plugin_13.2.0.0.0/
    scripts/OHConfigCollector.pl --home
    /u01/oracle/db/product/12.1.0/dbhome_1 --metric COMP_DEPS --type O
    --inventory /u01/oracle/oraInventory --mw_home

Owner: oracle
Command: /u01/oracle/emagent/agent_13.2.0.0.0/perl/bin/perl /u01/oracle/ema
    gent/agent_13.2.0.0.0/plugins/oracle.sysman.emas.agent.plugin_13.2.1.0.
    0/scripts/weblogic/nmresponse.pl
    /u01/oracle/oms/oracle_common/common/bin/ /u01/oracle/emagent/agent_13.
    2.0.0.0/plugins/oracle.sysman.emas.agent.plugin_13.2.1.0.0/scripts/webl
    ogic/nmresponse.py dbserver.vbox.local 7403 GCDomain ssl 60

Owner: oracle
Command: /bin/sh /u01/oracle/oms/oracle_common/common/bin/wlst.sh /u01/orac
    le/emagent/agent_13.2.0.0.0/plugins/oracle.sysman.emas.agent.plugin_13.
    2.1.0.0/scripts/weblogic/nmresponse.py dbserver.vbox.local 7403
    GCDomain ssl

Owner: oracle
Command: /u01/oracle/oms/oracle_common/jdk/bin/java
    -Dprod.props.file=/u01/oracle/oms/wlserver/.product.properties
    -Dweblogic.wlstHome=/u01/oracle/oms/oracle_common/common/wlst:
    -Dwlst.offline.log=disable -DORACLE_HOME=/u01/oracle/oms/oracle_common
    -DCOMMON_COMPONENTS_HOME=/u01/oracle/oms/oracle_common
    -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -Xms32m -Xmx1024m
    -XX:MaxPermSize=256m -Dweblogic.alternateTypesDirectory=/u01/oracle/oms
    /oracle_common/modules/oracle.ossoiap_12.1.3,/u01/oracle/oms/oracle_com
    mon/modules/oracle.oamprovider_12.1.3,/u01/oracle/oms/oracle_common/mod
    ules/oracle.jps_12.1.3 weblogic.WLST /u01/oracle/emagent/agent_13.2.0.0
    .0/plugins/oracle.sysman.emas.agent.plugin_13.2.1.0.0/scripts/weblogic/
    nmresponse.py dbserver.vbox.local 7403 GCDomain ssl

Remarks

Agent processes are used by Oracle Enterprise Manager to monitor and manage the database. These processes should run with a user ID separate from the database and listener processes.

Listener Processes

OS.LISTEN

Status

Some Risk

Summary

Found 1 Listener process. Some Listener process owners overlap with Agent or PMON process owners.

Details

Owner: oracle
Command: /u01/oracle/db/product/12.2.0/dbhome_1/bin/tnslsnr LISTENER
    -inherit

Remarks

Listener processes accept incoming network connections and connect them to the appropriate database server process. These processes should run with a user ID separate from the database and agent processes.

Diagnostics

Skipped Java Permissions

This report is focused on detecting areas of potential security vulnerabilities or misconfigurations and providing recommendations on how to mitigate those potential vulnerabilities.

The report provides a view on the current status. These recommendations are provided for informational purposes only and should not be used as a substitute for a thorough analysis or interpreted to contain any legal or regulatory advice or guidance.

You are solely responsible for your system, and the data and information gathered during the production of this report. You are also solely responsible for the execution of software to produce this report, and for the effect and results of the execution of any mitigating actions identified herein.

Oracle provides this analysis on an "as is" basis without warranty of any kind and Oracle hereby disclaims all warranties and conditions whether express, implied or statutory.