Oracle Database Advanced Security 10g Release 1, Administrator'S Manual

Page: 48 / 518

Solving Security Challenges with Oracle Advanced Security
1-4 Oracle Database Advanced Security Administrator's Guide
Password-Related Threats
In large systems, users typically must remember multiple passwords for the
different applications and services that they use. For example, a developer can have
access to a development application on a workstation, a PC for sending e-mail, and
several computers or intranet sites for testing, reporting bugs, and managing
configurations.
Users typically respond to the problem of managing multiple passwords in several
ways:
■
They may select easy-to-guess passwords—such as a name, fictional character,
or a word found in a dictionary. All of these passwords are vulnerable to
dictionary attack s.
■
They may also choose to standardize passwords so that they are the same on all
machines or web sites. This results in a potentially large exposure in the event
of a compromised password. They can also use passwords with slight
variations that can be easily derived from known passwords.
■
Users with complex passwords may write them down where an attacker can
easily find them, or they may just forget them—requiring costly administration
and support efforts.
All of these strategies compromise password secrecy and service availability.
Moreover, administration of multiple user accounts and passwords is complex,
time-consuming, and expensive.
Solving Security Challenges with Oracle Advanced Security
To solve enterprise computing security problems, Oracle Advanced Security
provides industry standards-based data privacy, integrity, authentication, single
sign-on, and access authorization in a variety of ways. For example, you can
configure either Oracle Net native encryption or Secure Sockets Layer (SSL) for data
privacy. Oracle Advanced Security also provides the choice of several strong
authentication methods, including Kerberos, smart cards, and digital certificates.
Oracle Advanced Security provides the following security features:
■
Data Encryption
■
Strong Authentication
■
Enterprise User Management