A database firewall has some similarities with a traditional network-based firewall, in that it’s about protecting and controlling items that flow across the network. But unlike a network-based firewall that’s predominately focused on ensuring only the right destinations can connect to the right sources, a database firewall is entirely focused on the conversations that are flowing in and out of your databases. Oracle Database Firewall has a complete understanding of the database language— SQL—and it’s this database language that powers the firewall and ensures that only the conversations you want to have going into your database are permitted. All others can be blocked.
The database firewall is there to monitor database activity and to help prevent unauthorized access to and particular attacks on databases, including SQL injections, privilege or role escalations, and illegal access to sensitive data. Oracle Database Firewall has a highly accurate approach to controlling interactions with the database, based on a SQL grammar analysis. This ensures that there are no costly false £ alarms triggered by the firewall. The product also provides a very flexible level of enforcement options based on two different security paradigms: a positive security model known as white lists, and a negative security model known as black lists. Customers deploy the firewall using a combination of these two paradigms. Going beyond this, the firewall has a very scalable architecture that provides enterprise-level performance in many different deployment modes. The great news for database administrators and application authors is that it requires no configuration changes at either the application level or the database level to provide a very powerful level of protection in the environment.
SQL injection is a development-side error. It’s an application-layer error, but it’s not just one single mistake—it can manifest in many different ways. It’s also entirely application specific; each application that has a particular SQLinjection vulnerability will appear different to its database than its operator. Since there’s no one-size-fits-all way of looking for SQL injections, the technology for protecting against them needs to understand whatis normal for each database and application in the operating environment. However, with this level of understanding comes protection against all manner of risks. So although a SQLinjection is often caused by a malicious attacker on the outside, the same sorts of controls work for protecting against a malicious user on the inside or perhaps someone who has connected a piece of software to the network that is outside policy. All of these unauthorized access mechanisms can be protected against very powerfully by Oracle Database Firewall.
Oracle Database Firewall reduces the risk profile of a database at the network level by ensuring that only permitted locations can connect through to the database—only permitted applications at permitted times of day with permitted users. For example, high-privilege users may only connect to the database from their workstations at particular times of day, which are their normal hours of business. Should the credentials for a high-privilege user become compromised, it would not be possible to use them from another location within the organization’s network.