Product Report: Oracle Database Vault/Oracle Audit Vault - 70112

The market for Database Security involves a number of different technical solution approaches which are not covered by a single product, but instead require a set of different products and features in order to secure content in databases. As a result, there are many different solutions on offer in the market today. In this report we will focus on Oracle Database Vault and Oracle Audit Vault which are two products covering two distinct areas of database security, the first one focusing on preventive controls and the other on detective controls.

Oracle Database Vault deals with privileged access to data by implementing policies which restrict and control access of privileged users and thus mitigate the associated security risks. Oracle tightly integrated Database Vault with the Oracle Database kernel to ensure policies cannot be by-passed and performance overhead is neglible. Privileged users are now considered to be one of the biggest threats to database security for companies, organizations and government agencies. Database administrators (DBAs) are the most prevalent type of privileged users with potential access to all information in databases, besides application/technical users which have frequently somewhat limited access. Having their accounts being abused thus imposes the biggest risk.

Oracle Audit Vault is a second key product in Oracle’s database security portfolio. It also supports da-tabases from different vendors, including Microsoft SQL Server, IBM DB2 UDB, and SAP Sybase. Audit Vault consolidates audit data from different database servers. These can be analyzed in reports through a large number of out-of-the-box reports. The product also supports alerts on security threats.

As a detective control for different databases, Oracle Audit Vault can be used in a pretty straightfor-ward way. Oracle Database Vault, however, requires a good deal of planning. The pre-configured integration with several core business applications can help reduce the effort involved. Nevertheless, adequate organizational policies must be in place for deployment to be successful.

KuppingerCole strongly recommends defining a holistic security strategy in order to identify the necessary database security technologies beforehand. Within their separate technical categories, we consider Oracle Database Vault and Oracle Audit Vault to be products well worthy of further evaluation.