Join us to hear about a new Oracle product that monitors Oracle and non-Oracle database traffic, detects unauthorized activity including SQL injection attacks, and blocks internal and external threats from reaching the database. In addition this new product collects and consolidates audit data from databases, operating systems, directories, and any custom template-defined source into a centralized, secure warehouse. This new enterprise security monitoring and auditing platform allows organizations to quickly detect and respond to threats with powerful real-time policy analysis, alerting and reporting capabilities. Based on proven SQL grammar analysis that ensures accuracy, performance, and scalability, organizations can deploy with confidence in any mode. You will also hear how organizations such as TransUnion Interactive and SquareTwo Financial rely on Oracle today to monitor and secure their Oracle and non-Oracle database environments.

1. 1 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

2. Introducing
Oracle Audit Vault and
Database Firewall

3. Billions of Database Records Breached Globally
97% of Breaches Were Avoidable with Basic Controls
98% records stolen
from databases
84% records breached
using stolen credentials
71% fell within minutes
92% discovered
by third party
3 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

4. Why are Databases so Vulnerable?
80% of IT Security Programs Don’t Address Database Security
Forrester Research Network
Security
“Enterprises are taking on risks Authentication
SIEM
& User Security
that they may not even be aware
of. Especially as more and more
Email Security Endpoint
attacks against databases exploit Database Security
Security
legitimate access.” Web
Application
Firewall
5 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

5. Oracle Database Security Solutions
Defense-in-Depth for Maximum Security
PREVENTIVE DETECTIVE ADMINISTRATIVE
Encryption Activity Monitoring Privilege Analysis
Redaction and Masking Database Firewall Sensitive Data Discovery
Privileged User Controls Auditing and Reporting Configuration Management
6 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

6. Oracle Database Security Solutions
Detect and Block Threats, Alert, Audit and Report
PREVENTIVE DETECTIVE ADMINISTRATIVE
Encryption Activity Monitoring Privilege Analysis
Redaction and Masking Database Firewall Sensitive Data Discovery
Privileged User Controls Auditing and Reporting Configuration Management
7 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

7. Oracle Audit Vault and Database Firewall
New Solution for Oracle and Non-Oracle Databases
Database Firewall
Users
Allow
Log
Alert
Applications Substitute
Block
Firewall Events
Auditor
Reports
Audit Data
Alerts !
Security
Manager Policies
OS, Directory, File System &
Custom Audit Logs
Audit Vault
8 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

8. Oracle Audit Vault and Database Firewall
SQL Injection Protection with Positive Security Model
SELECT * from stock White List
where catalog-no='PHE8131' Allow
Block
Applications SELECT * from stock
where catalog-no=‘ Databases
' union select cardNo,0,0
from Orders --’
• “Allowed” behavior can be defined for any user or application
• Automated white list generation for any application
• Out-of-policy database transaction detected and blocked/alerted
9 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

9. Oracle Audit Vault and Database Firewall
Enforcing Database Activity with Negative Security Model
SELECT * FROM
v$session Black List
Block
DBA activity
from Application?
SELECT * FROM Allow
+ Log
DBA activity from v$session
Approved Workstation
• Stop specific unwanted SQL interactions, user or schema access
• Blacklisting can be done on factors such as time of day, day of
week, network, application, user name, OS user name etc
• Provide flexibility to authorized users while still monitoring activity
10 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

10. Oracle Audit Vault and Database Firewall
Comprehensive Enterprise Audit and Log Consolidation
 Databases: Oracle, SQL Server, DB2 LUW, Sybase ASE
 New Audit Sources
– Operating Systems: Microsoft Windows, Solaris
– Directory Services: Active Directory
– File Systems: Oracle ACFS
 Audit Collection Plugins for Custom Audit Sources
– XML file maps custom audit elements to canonical audit elements
– Collect and map data from XML audit file and database tables
11 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

11. Oracle Audit Vault and Database Firewall
Audit and Event Repository
 Based on proven Oracle Database technology
– Includes compression, partitioning, scalability, high availability, etc.
– Open schema for flexible reporting
 Information lifecycle management for target specific data retention
 Centralized web console for easy administration
 Command line utility for automation and scripting
12 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

12. Oracle Audit Vault and Database Firewall
Audit and Event Data Security
 Software appliance based on hardened OS and pre-
configured database
 Fine-grained administrative groups
– Sources can be grouped for access authorization
– Individual auditor reports limited to data from the „grouped‟ sources
 Separation of duties
 Powerful multi-event alerting with thresholds and group-by
13 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

13. Oracle Audit Vault and Database Firewall
Single Administrator Console
14 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

14. Oracle Audit Vault and Database Firewall
Default Reports
15 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

15. Oracle Audit Vault and Database Firewall
Out-of-the Box Compliance Reporting
16 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

16. Oracle Audit Vault and Database Firewall
Report with Data from Multiple Source Types
17 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

17. Oracle Audit Vault and Database Firewall
Auditing Stored Procedure Calls – Not Visible on the Network
18 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

18. Oracle Audit Vault and Database Firewall
Extensive Audit Details
19 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

19. Oracle Audit Vault and Database Firewall
Blocking SQL Injection Attacks
20 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

20. Oracle Audit Vault and Database Firewall
Powerful Alerting Filter Conditions
21 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

21. Oracle Audit Vault and Database Firewall
Flexible Deployment Architectures
In-Line Blocking
and Monitoring
Remote Monitoring
Out-of-Band
Monitoring
Applications
and Users
HA Mode
Inbound
SQL Traffic
Audit Agents
Audit Vault Audit Data
Audit Vault Primary
Standby
Software Appliances
22 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

22. Oracle Audit Vault and Database Firewall
Performance and Scalability
 Audit Vault
– Supports monitoring and auditing multiple hundreds of heterogeneous
database and non-database targets
– Supports wide range of hardware to meet load requirements
 Database Firewall
– Decision time is independent of the number of rules in the policy
– Multi-device / multi-process / multi-core scalability
– 8 core can handle between 30K – 60K transactions/second
23 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

23. T-Mobile
Protecting Customer Data in Oracle and non-Oracle Databases
Challenge
 Protect sensitive data – PCI, CPNI, SPII – in both Oracle and non-
Oracle Databases
 Monitor database threats, including SQL injection attacks and data
Provider of wireless voice, harvesting, without having to change application code
messaging, and data
 Full visibility into database activity
services throughout the U.S.
Fourth largest wireless
 Understand what types of changes are being made to sensitive data
company in the U.S. with Solution
more than 35 million
subscribers  Addresses data security with Database Firewall, TDE, Data Masking
Industry: Telecom as comprehensive database security defense-in-depth strategy
 Database activity monitoring prevents insider and external threats
 Deployed and setup within a few hours; already protected against a
few compromised accounts that were harvesting data
24 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

24. SquareTwo Financial
Addresses Regulatory Compliance, Enables Separation of Duties
Challenge
 Comply with a number of regulations: GLBA, HIPAA, SOX, and PCI
 Prove separation of duties for Sarbanes-Oxley compliance
 Quickly scale IT Security to address fast 37% company growth
Leader in $100 billion asset
recovery and management
 Minimal disruption to 5.9 million accounts while maintaining growth
industry  Secure Exadata Database Machine with no application changes
Partner Network used by
Fortune 500 companies in
Solution
banking, credit card, and  Addresses compliance with Database Firewall, TDE, Data Masking
health care as comprehensive database security defense-in-depth strategy
Industry: Financial Services  Database activity monitoring to protect against insider and external
threats, including SQL injection attacks
 Securing Exadata and SQL Server database activity
25 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

25. TransUnion Interactive
Addresses Regulatory Compliance, Secures Sensitive Data
Challenge
 Maintain PCI DSS, SOX, and GLBA compliance
 Increase database traffic visibility; detect and monitor activity
 Increase database security and monitor for application SQL
Consumer subsidiary of injection attacks
TransUnion, a global leader
in credit information  Detect and prevent application by-pass and data harvesting
Maintains credit histories on Solution
over 500 million consumers
globally  Deployed Database Firewall in one month; monitor database traffic
Industry: Financial Services  Achieved 10k transactions/sec while maintaining performance
 Using reports to monitor traffic and manage workloads and capacity
 Use Oracle Advanced Security to encrypt tablespaces
26 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

26. For More Information
Oracle Audit Vault and Database Firewall
27 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

27. Q&A
28 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

28. 29 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.