Author Archives: rlockard
Update to my earlier #quicktip on setting #plsql scope and warnings.
I noticed a error in my code for setting PLSCOPE_SETTINGS and PLSQL_WARNINGS. QuicTip Logon.sql What I did was get the instance name out of v$instance to figure out if I was connecting to a production environment or one of the lower environments. The … Continue reading
Posted in Database Stuff, Life of a Oracle DBA, PL/SQL
Tagged logon.sql, oracle, pl/sql, PLSCOPE, PLSCOPE_SETTINGS, PLSQL_WARNINGS, quick tip, quicktip, sys_context
Leave a comment
My upcoming Spring events @OracleACE #InfoSec
March 5 – 8: I will be speaking at the Hotsos Symposium in Dallas Texas. https://www.hotsos.com/apex/f?p=200:61801:6152298924404 I will be showing how to secure your high performance code. We will be looking at some coding standards, what common errors we are … Continue reading
Posted in Database Stuff
Tagged bgoug, database security, devgym, harmony, infosec, oracle, oracle devgym, secure coding, speaking engagements, Travel, utoug
Leave a comment
2017 was a crazy year, 2018 is going to be challenging
It’s been a crazy year. In 2017 I’ve done talks in Paris France, Helsinki and Rovaniemi Finland, Sofia Bulgaria, Moscow Russia, Denver Colorado, Las Vegas Nevada, San Antonio Texas, Krakow Poland, Dushanbe Tajikistan, and Raleigh North Carolina. A few of … Continue reading
Posted in Database Stuff
Leave a comment
The Impossible Password and default accounts. Oracle #LockDown #QuickTip #Infosec
Let’s revisit a customer who was about to go through an IG Audit. There is one finding that always seems to come up. Default accounts with default passwords. I don’t care if the accounts are expired and locked, if the … Continue reading
Posted in infosec, PL/SQL, Security
Tagged Audit, Default Accounts, Default Password, impossible, infosec, oracle, password
Leave a comment
Five things that make me just want to scream. #Infosec
When evaluating the security of a database, and/or the security of an application, there are a few things that will make me start pounding my head against my desk. What prompted this? A customer asked me help evaluate a system … Continue reading
Posted in Audit, Security
Leave a comment
Yet another breach through #SQLInjection
The following quote bothered me a lot. “No amount of best practices or prohibitive steps is going to stop a determined hacker.” While this is a true statement, what it leaves out is if you make it difficult by securing the … Continue reading
Upcoming #POUG17 and #tajoug #techconftj* #Oracle #plsql #infosec #fun
99% of my presentations are technical, addressing our information security needs. Then every now and again, I get to do something fun. There was “Hacking The Human Brain” last June at BGOUG. My next trip in September is taking me … Continue reading
Posted in Database Stuff
Leave a comment
Code Based Access Control, #securecoding #oracle #plsql #MultipleSchemas
You can download the full code from gethub.com CBAC Simple This example depends on the HR Demo schema being loaded. We will be building on this example over the next several months to present a full blown application that includes … Continue reading
What is it like on the Oracle User Group Speaking circuit?
This is how most of my trips start, a ride to the airport with my headset on. Listen to some easy listening music such as AC/DC or Iron Maiden to get me in the mood for travel. Once at the … Continue reading
Posted in Database Stuff
Tagged education, oracle, Oracle Users Group, speaker "Oracle Users Group" travel, Travel, users group
Leave a comment
#Oracle #sqldev 17.2.0.188 MAJOR improvement
This is going to be quick, I don’t get a lot of time to read new features documentation. I normally reserve that for once a month, print em’ out and read over a nice glass of Scotch. Hey it works … Continue reading
Posted in Database Stuff
Leave a comment
Kinda disturbed by an article I just read. #infosec #rant
As most of you know I live on the defense side of infosec. As attack vectors are exposed, I study them to learn how to design systems that can defend against them. There are some biggies, sql injection, cross site … Continue reading
Posted in Database Stuff
Leave a comment
Exciting times. #poug #tajoug #techconftj*
I will making my first trip to Krakow Poland and Dushanbe Tajikistan. This trip will cover over 24,000 miles in air travel and five different airlines. POUG High Five. The Polish Oracle Users Group will be having their annual tech … Continue reading
Posted in Database Stuff
Leave a comment
Getting to know you, getting to know all about you. #infosec #windows10
Windows 10 has the capability to record everything you say, everything you type and everything you write. Okay, I have a fundamental problem with this. Microsoft implemented this feature in the Beta release of Windows 10 to help the product … Continue reading
Posted in Database Stuff
Leave a comment
#quicktip #oracle #sqlcl logon.sql #PLSCOPE_SETTINGS and #PLSQL_WARNINGS
Quick Tip. My logon.sql file. I don’t want plscope_settings and plsql_warnings set when I’m in production; but if I’m in my test / dev / sandbox environments, then I do turn them on. This helps. Enjoy; this should be self … Continue reading
Posted in Database Stuff
Leave a comment
#GDPR – RIGHT TO ACCESS. Security is a feature #3 Right to Access Part 1 of 2
The GDPR Right to access can get a bit complicated as it covers a few things that provide some challenges for us. What is the purpose of the processing? Lets face it, we process data on people for a number … Continue reading
#SQLDeveloper Unit Testing
I’ll get back to the GDPR series tomorrow. Can I get a show of hands, How many people do unit testing? I’ve been in a lot of shops where unit testing and code reviews have been passed up in the … Continue reading
Posted in Database Stuff
Leave a comment
#GDPR is coming Security is a feature #2 Data Masking
#GDPR is coming Security is a feature #2 Data Masking In the context of GDPR, data masking should be done so that the all the data attributes on a person should not be able to define that person. Most of … Continue reading
Posted in Database Stuff
Leave a comment
#GDPR is coming Security is a feature #1
Security is feature. Over the next few weeks, I’ll be looking how some of the issues on how GDPR will be impacting us as technical professionals. There are a lot of things that I find technically interesting in GDPR such … Continue reading
Posted in Database Stuff
Leave a comment
Yet another Phishing Attack #DontClickThatLink #Infosec
So I get up this morning, check email and what is waiting for me. A phishing email. Okay lets do a little analysis to see how to detect this really quick. 1) My paypal account is not linked to this … Continue reading
Posted in Database Stuff
Leave a comment
Next month is going to be a busy – Atlanta, Helsinki, Saint Petersburg, Moscow, Sofia Bulgaria, and London
May 10th I will be speaking In Atlanta Georgia on Holistic Database Security at Georgia Oracle Users Group Tech Days 2017. I have not decided if I’m flying 81K down or flying commercial yet. I may just go ahead and … Continue reading
Posted in Database Stuff
Leave a comment
@Oracle 12.2.0.1 Cool new features to improve security. Part 2 TDE support to encrypt SYSTEM, SYSAUX, TEMP and UNDO tablespaces. #infosec
Are you gathering statistics on your data? Are you running Transparent Data Encryption, then it’s time to upgrade to Oracle 12.2.0.1. Pretty cool, eh? So what’s happening here? Statistics that were gathered on the hr.employees table are stored in the … Continue reading
Posted in Database Stuff
Leave a comment
Every now and then “It happens.”
I have lost count of the number of times I’ve given the Holistic Database Security talk. The talk has evolved over the years, it continues to evolve, and is a mature presentation. Yesterday at Collaborate 2017, It Happened! I was asked … Continue reading
Posted in Database Stuff
Leave a comment
@Oracle 12.2.0.1 Cool new features to improve security. Part 1 Enhanced Whitelists PL/SQL
In Oracle 12.1 the ACCESSIBLE BY clause was introduced to the PL/SQL language. This gives the developer the ability mark a package, procedure, function, or type with what was allowed to call it. 12.2 gives us fine grained control over … Continue reading
Posted in Database Stuff, infosec, PL/SQL, Security, Trusted Path
Tagged infosec, oracle, pl/sql, SecureCoding
Comments Off on @Oracle 12.2.0.1 Cool new features to improve security. Part 1 Enhanced Whitelists PL/SQL
PL/SQL Security Coding Practices. Introduction to a better architecture part 2
For this post, we are going to focus on definers rights and invokers rights. Most developers already know about these privilege modifiers, but sadly I rarely see these being used at customer sites. Key to understanding how to secure your … Continue reading
Posted in Security, Trusted Path
Tagged pl/sql authid invokers definer "trusted path"
Leave a comment
#Infosec Virus Delivery via Email
I’ve been getting a lot of these emails lately. If you receive an email with an attachment and you did not expect it, or in this case if you did expect it. Take a closer look. This Christmas season, a … Continue reading
Posted in Database Stuff
Leave a comment