🗊Презентация Oracle Data Encryption

Категория: Устройства и комплектующие
Нажмите для полного просмотра!
Oracle Data Encryption, слайд №1Oracle Data Encryption, слайд №2Oracle Data Encryption, слайд №3Oracle Data Encryption, слайд №4Oracle Data Encryption, слайд №5Oracle Data Encryption, слайд №6Oracle Data Encryption, слайд №7Oracle Data Encryption, слайд №8Oracle Data Encryption, слайд №9Oracle Data Encryption, слайд №10Oracle Data Encryption, слайд №11Oracle Data Encryption, слайд №12Oracle Data Encryption, слайд №13Oracle Data Encryption, слайд №14Oracle Data Encryption, слайд №15Oracle Data Encryption, слайд №16Oracle Data Encryption, слайд №17Oracle Data Encryption, слайд №18Oracle Data Encryption, слайд №19Oracle Data Encryption, слайд №20Oracle Data Encryption, слайд №21Oracle Data Encryption, слайд №22Oracle Data Encryption, слайд №23Oracle Data Encryption, слайд №24Oracle Data Encryption, слайд №25Oracle Data Encryption, слайд №26Oracle Data Encryption, слайд №27Oracle Data Encryption, слайд №28Oracle Data Encryption, слайд №29Oracle Data Encryption, слайд №30Oracle Data Encryption, слайд №31Oracle Data Encryption, слайд №32Oracle Data Encryption, слайд №33Oracle Data Encryption, слайд №34Oracle Data Encryption, слайд №35Oracle Data Encryption, слайд №36Oracle Data Encryption, слайд №37Oracle Data Encryption, слайд №38Oracle Data Encryption, слайд №39Oracle Data Encryption, слайд №40
Скачать

Содержание ▲

Вы можете ознакомиться и скачать презентацию на тему Oracle Data Encryption. Доклад-сообщение содержит 40 слайдов. Презентации для любого класса можно скачать бесплатно. Если материал и наш сайт презентаций Mypresentation Вам понравились – поделитесь им с друзьями с помощью социальных кнопок и добавьте в закладки в своем браузере.

Слайды и текст этой презентации

Слайд 1


Oracle Data Encryption, слайд №1
Описание слайда:

Слайд 2


Introduction This presentation describes introduction of data encryption into Oracle databases and how “Transparent Data Encryption” in Oracle 11g can benefit DBAs in achieving compliancy with Payment Card Industry Data Security Standard.
Описание слайда:
Introduction This presentation describes introduction of data encryption into Oracle databases and how “Transparent Data Encryption” in Oracle 11g can benefit DBAs in achieving compliancy with Payment Card Industry Data Security Standard.

Слайд 3


Content Identification of threats Basic framework of Oracle security PCI requirements What is Encryption ? Encryption in Oracle: DBMS_OBFUSCATION_TOOLKIT, DBMS_CRYPTO, TDE Demo of Transparent Data Encryption
Описание слайда:
Content Identification of threats Basic framework of Oracle security PCI requirements What is Encryption ? Encryption in Oracle: DBMS_OBFUSCATION_TOOLKIT, DBMS_CRYPTO, TDE Demo of Transparent Data Encryption

Слайд 4


Identification of Threats What are the Common Security Threats ? Eavesdropping and Data Theft Data Tampering Falsifying User Identities Password Related Threats
Описание слайда:
Identification of Threats What are the Common Security Threats ? Eavesdropping and Data Theft Data Tampering Falsifying User Identities Password Related Threats

Слайд 5


Basic Framework of Oracle Security Securing database during installation Securing user accounts Managing user privileges Auditing database activity Securing network Securing data (encryption, VPD, Database Vault)
Описание слайда:
Basic Framework of Oracle Security Securing database during installation Securing user accounts Managing user privileges Auditing database activity Securing network Securing data (encryption, VPD, Database Vault)

Слайд 6


PCI Requirements What is Payment Card Industry Data Security Standard (PCI DSS) ? Founded by American Express, Visa, MasterCard, Discover Financial Services, and JCB The standards apply to all organizations that store, process or transmit cardholder data Any company processing, storing, or transmitting cardholder data must be PCI DSS compliant https://www.pcisecuritystandards.org/
Описание слайда:
PCI Requirements What is Payment Card Industry Data Security Standard (PCI DSS) ? Founded by American Express, Visa, MasterCard, Discover Financial Services, and JCB The standards apply to all organizations that store, process or transmit cardholder data Any company processing, storing, or transmitting cardholder data must be PCI DSS compliant https://www.pcisecuritystandards.org/

Слайд 7


The Core Elements of DSS Build and Maintain a Secure Network Protect Cardholder Data (encryption) Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Maintain an Information Security Policy
Описание слайда:
The Core Elements of DSS Build and Maintain a Secure Network Protect Cardholder Data (encryption) Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Maintain an Information Security Policy

Слайд 8


What is encryption ? Transformation of information using “encryption algorithm” into a form that can not be deciphered without a decryption key
Описание слайда:
What is encryption ? Transformation of information using “encryption algorithm” into a form that can not be deciphered without a decryption key

Слайд 9


Two types of encryption: Symmetric key encryption Public-key (asymmetric key) encryption
Описание слайда:
Two types of encryption: Symmetric key encryption Public-key (asymmetric key) encryption

Слайд 10


Symmetric Key Encryption Method in which both the sender and receiver share the same key
Описание слайда:
Symmetric Key Encryption Method in which both the sender and receiver share the same key

Слайд 11


Oracle Data Encryption, слайд №11
Описание слайда:

Слайд 12


Public Key Encryption The public key is freely distributed, while its paired private key remains secret The public key is typically used for encryption, while the private or secret key is used for decryption
Описание слайда:
Public Key Encryption The public key is freely distributed, while its paired private key remains secret The public key is typically used for encryption, while the private or secret key is used for decryption

Слайд 13


Oracle Data Encryption, слайд №13
Описание слайда:

Слайд 14


Oracle Data Encryption, слайд №14
Описание слайда:

Слайд 15


Encryption Algorithms Supported by Oracle RC4 DES (Oracle 8 and 9) 3DES (Oracle 10) AES (Oracle 11)
Описание слайда:
Encryption Algorithms Supported by Oracle RC4 DES (Oracle 8 and 9) 3DES (Oracle 10) AES (Oracle 11)

Слайд 16


DBMS_OBFUSCATION_TOOLKIT Introduced in Oracle 8i Uses DES algorithm
Описание слайда:
DBMS_OBFUSCATION_TOOLKIT Introduced in Oracle 8i Uses DES algorithm

Слайд 17


Syntax DBMS_OBFUSCATION_TOOLKIT.DES3Encrypt( input_string IN VARCHAR2, key_string IN VARCHAR2, which IN PLS_INTEGER DEFAULT TwoKeyMode iv_string IN VARCHAR2 DEFAULT NULL) RETURN VARCHAR2; DBMS_OBFUSCATION_TOOLKIT.DES3DECRYPT( input_string IN VARCHAR2, key_string IN VARCHAR2, which IN PLS_INTEGER DEFAULT TwoKeyMode iv_string IN VARCHAR2 DEFAULT NULL) RETURN VARCHAR2;
Описание слайда:
Syntax DBMS_OBFUSCATION_TOOLKIT.DES3Encrypt( input_string IN VARCHAR2, key_string IN VARCHAR2, which IN PLS_INTEGER DEFAULT TwoKeyMode iv_string IN VARCHAR2 DEFAULT NULL) RETURN VARCHAR2; DBMS_OBFUSCATION_TOOLKIT.DES3DECRYPT( input_string IN VARCHAR2, key_string IN VARCHAR2, which IN PLS_INTEGER DEFAULT TwoKeyMode iv_string IN VARCHAR2 DEFAULT NULL) RETURN VARCHAR2;

Слайд 18


Key Management Store the key in the database Store the key in the operating system Have the user manage the key
Описание слайда:
Key Management Store the key in the database Store the key in the operating system Have the user manage the key

Слайд 19


DBMS_CRYPTO Released in Oracle 10.1 Supports AES Provides automatic padding Different options for block chaining Support for CLOB and BLOB Will deprecate dbms_obfuscation_toolkit
Описание слайда:
DBMS_CRYPTO Released in Oracle 10.1 Supports AES Provides automatic padding Different options for block chaining Support for CLOB and BLOB Will deprecate dbms_obfuscation_toolkit

Слайд 20


Real Life Both packages are complicated to use Key management represents a problem Encryption / decryption must be done through the application Not used as often as it should be Solution ?
Описание слайда:
Real Life Both packages are complicated to use Key management represents a problem Encryption / decryption must be done through the application Not used as often as it should be Solution ?

Слайд 21


Transparent Data Encryption (TDE) Introduced in Oracle 10.2 – column encryption Enhanced in Oracle 11.1 - tablespace encryption
Описание слайда:
Transparent Data Encryption (TDE) Introduced in Oracle 10.2 – column encryption Enhanced in Oracle 11.1 - tablespace encryption

Слайд 22


How is TDE Implemented? 1 Setup Wallet and Master Key 2 Identify columns with sensitive data 3 Review constraints 4 Encrypt existing and new data
Описание слайда:
How is TDE Implemented? 1 Setup Wallet and Master Key 2 Identify columns with sensitive data 3 Review constraints 4 Encrypt existing and new data

Слайд 23


Wallet Default wallet location $ORACLE_BASE/admin/$ORACLE_SID/wallet Alternative location specified in sqlnet.ora wallet_location encryption_wallet_location ewallet.p12 Created by creating a new Master key: alter system set encryption key identified by “password “; Load the Master key into the database: alter system set encryption wallet open identified by “password”;
Описание слайда:
Wallet Default wallet location $ORACLE_BASE/admin/$ORACLE_SID/wallet Alternative location specified in sqlnet.ora wallet_location encryption_wallet_location ewallet.p12 Created by creating a new Master key: alter system set encryption key identified by “password “; Load the Master key into the database: alter system set encryption wallet open identified by “password”;

Слайд 24


Oracle Data Encryption, слайд №24
Описание слайда:

Слайд 25


Wallet Maintenance To disable all encryption columns in database: alter system set encryption wallet close; Wallet must be done after database restart: alter system set encryption wallet open authenticated by “password"; Enable auto logging using Wallet Manager or mkwallet utility cwallet.sso
Описание слайда:
Wallet Maintenance To disable all encryption columns in database: alter system set encryption wallet close; Wallet must be done after database restart: alter system set encryption wallet open authenticated by “password"; Enable auto logging using Wallet Manager or mkwallet utility cwallet.sso

Слайд 26


Wallet Backups Back up the wallet to a secure location (HSM), separately from the tape backups. Use RMAN backups which automatically excludes the wallet.Sand*.sso During the OS backups exclude files *.p12 and *.sso
Описание слайда:
Wallet Backups Back up the wallet to a secure location (HSM), separately from the tape backups. Use RMAN backups which automatically excludes the wallet.Sand*.sso During the OS backups exclude files *.p12 and *.sso

Слайд 27


Column Encryption CREATE TABLE employee (name VARCHAR2(128), salary NUMBER(6) ENCRYPT); ALTER TABLE employee ADD (ssn VARCHAR2(11) ENCRYPT); ALTER TABLE employee MODIFY (first_name ENCRYPT); ALTER TABLE employee MODIFY (first_name DECRYPT);
Описание слайда:
Column Encryption CREATE TABLE employee (name VARCHAR2(128), salary NUMBER(6) ENCRYPT); ALTER TABLE employee ADD (ssn VARCHAR2(11) ENCRYPT); ALTER TABLE employee MODIFY (first_name ENCRYPT); ALTER TABLE employee MODIFY (first_name DECRYPT);

Слайд 28


Salt CREATE TABLE employee (name VARCHAR2(128), empID NUMBER ENCRYPT NO SALT, salary NUMBER(6) ENCRYPT USING '3DES168'); CREATE INDEX employee_idx on employee (empID); You cannot create an index on a column that has been encrypted with salt. ORA-28338: cannot encrypt indexed column(s) with salt
Описание слайда:
Salt CREATE TABLE employee (name VARCHAR2(128), empID NUMBER ENCRYPT NO SALT, salary NUMBER(6) ENCRYPT USING '3DES168'); CREATE INDEX employee_idx on employee (empID); You cannot create an index on a column that has been encrypted with salt. ORA-28338: cannot encrypt indexed column(s) with salt

Слайд 29


Export / Import Must use Datapump expdp hr TABLES=emp DIRECTORY=dpump_dir  DUMPFILE=dumpemp.dmp ENCRYPTION=ENCRYPTED_COLUMNS_ONLY ENCRYPTION_PASSWORD=pw2encrypt impdp hr TABLES=employee_data DIRECTORY=dpump_dir DUMPFILE= dumpemp.dmp ENCRYPTION_PASSWORD=pw2encrypt ENCRYPTION_MODE=DUAL ENCRYPTION_MODE=TRANSPARENT
Описание слайда:
Export / Import Must use Datapump expdp hr TABLES=emp DIRECTORY=dpump_dir  DUMPFILE=dumpemp.dmp ENCRYPTION=ENCRYPTED_COLUMNS_ONLY ENCRYPTION_PASSWORD=pw2encrypt impdp hr TABLES=employee_data DIRECTORY=dpump_dir DUMPFILE= dumpemp.dmp ENCRYPTION_PASSWORD=pw2encrypt ENCRYPTION_MODE=DUAL ENCRYPTION_MODE=TRANSPARENT

Слайд 30


Overheads 5 % – 35 % performance overhead Indexes are using encrypted values Each encrypted value needs 20 bytes for integrity check Encrypted value padded to 16 bytes If using salt, additional 16 bytes needed NOMAC parameter skips integrity check ALTER TABLE employee MODIFY (salary ENCRYPT 'NOMAC');
Описание слайда:
Overheads 5 % – 35 % performance overhead Indexes are using encrypted values Each encrypted value needs 20 bytes for integrity check Encrypted value padded to 16 bytes If using salt, additional 16 bytes needed NOMAC parameter skips integrity check ALTER TABLE employee MODIFY (salary ENCRYPT 'NOMAC');

Слайд 31


Incompatible Features Index types other than B-tree Range scan search through an index External large objects (BFILE) Materialized View Logs Transportable Tablespaces Original import/export utilities
Описание слайда:
Incompatible Features Index types other than B-tree Range scan search through an index External large objects (BFILE) Materialized View Logs Transportable Tablespaces Original import/export utilities

Слайд 32


TDE - Advantages Simple - can be done in four easy steps! Automatically encrypts database column data before it's written to disk Encryption and decryption is performed through the SQL interface No need for triggers to call encryption API's Views to decrypt data are completely eliminated Encryption is completely transparent to the application
Описание слайда:
TDE - Advantages Simple - can be done in four easy steps! Automatically encrypts database column data before it's written to disk Encryption and decryption is performed through the SQL interface No need for triggers to call encryption API's Views to decrypt data are completely eliminated Encryption is completely transparent to the application

Слайд 33


TDE - Disadvantages Will not use indexes where the search criteria requires a range scan “where account number > 10000 or < 20000” will not work with TDE Indexes not possible if using ‘salt’ Performance hit Requires more space
Описание слайда:
TDE - Disadvantages Will not use indexes where the search criteria requires a range scan “where account number > 10000 or < 20000” will not work with TDE Indexes not possible if using ‘salt’ Performance hit Requires more space

Слайд 34


Data Dictionary Views
Описание слайда:
Data Dictionary Views

Слайд 35


Tablespace Encryption Compatibility = 11.0.0 or higher CREATE TABLESPACE encryptblspc DATAFILE '/u01/oradata/encryptblspc01.dbf‘ SIZE 200M ENCRYPTION USING '3DES168‘ DEFAULT STORAGE(ENCRYPT); DBA_TABLESPACES
Описание слайда:
Tablespace Encryption Compatibility = 11.0.0 or higher CREATE TABLESPACE encryptblspc DATAFILE '/u01/oradata/encryptblspc01.dbf‘ SIZE 200M ENCRYPTION USING '3DES168‘ DEFAULT STORAGE(ENCRYPT); DBA_TABLESPACES

Слайд 36


Considerations Great for encrypting whole tables Objects automatically created encrypted All data encrypted including data in TEMP, UNDO, REDO (except BFILEs) Data protected during JOIN and SORT Allows index range scan Can not encrypt existing tablespace Use datapump, “create table as select”, “alter table move” Tablespace can not be enctypted with NO SALT option
Описание слайда:
Considerations Great for encrypting whole tables Objects automatically created encrypted All data encrypted including data in TEMP, UNDO, REDO (except BFILEs) Data protected during JOIN and SORT Allows index range scan Can not encrypt existing tablespace Use datapump, “create table as select”, “alter table move” Tablespace can not be enctypted with NO SALT option

Слайд 37


Transparent Data Encryption cont. Example
Описание слайда:
Transparent Data Encryption cont. Example

Слайд 38


Encryption in Practice Not a solution to all security problems Represents only one layer of Oracle security model Should be implemented in combination with Data Pump, RMAN, VPD and Data Masking PCI’s requirement to change regularly the encryption key is difficult to achieve Only as safe as your wallet With TDE there is no reason why your datafiles should stay unsecured
Описание слайда:
Encryption in Practice Not a solution to all security problems Represents only one layer of Oracle security model Should be implemented in combination with Data Pump, RMAN, VPD and Data Masking PCI’s requirement to change regularly the encryption key is difficult to achieve Only as safe as your wallet With TDE there is no reason why your datafiles should stay unsecured

Слайд 39


This presentation explained: What is data encryption Why sensitive data should be secured using encryption Demonstrated how TDE in Oracle 11 can help DBAs to encrypt data in an elegant and easy way With Oracle 11g there is no reason to fail PCI audit !
Описание слайда:
This presentation explained: What is data encryption Why sensitive data should be secured using encryption Demonstrated how TDE in Oracle 11 can help DBAs to encrypt data in an elegant and easy way With Oracle 11g there is no reason to fail PCI audit !

Слайд 40


Oracle Data Encryption, слайд №40
Описание слайда:

Скачать

Похожие презентации
Mypresentation.ru
Загрузить презентацию