Can Oracle TDE protect data from the database administrator?

Question

oracle experts. A.

My client wants to deploy an application that should contain credit card numbers in the database. Obviously, the customer is interested in security.

We particularly agree with one painful problem. How can we make sure that only authorized users with "business information" are allowed access to the data? How can we protect data from the database administrator?

One obvious solution is application level encryption. We do not want to do this.

The oracle product that has emerged as a possible solution is Orace TDE (transparent data encryption). It seems like this is good for disk encryption. However, there are controversial claims if they can be used to hide data from someone with database administrator privileges.

I want to be very specific in the case of the use with which we are dealing. We have a running application, 24/7/365, which constantly works with access to data. This means that the Oracle wallet is open and the data is decrypted in the database. At the same time, the database administrator still cannot access the data.

I know that Oracle is selling Oracle Database Vault for this very problem. Given that all I want to do is block access to the DBA database from one specific table, do I really need storage or can I use TDE?

Help would be greatly appreciated

or

Answer 1

I assume you need Oracle Vault. TDE makes it impossible to read data files, but a simple choice will still extract data that is not encrypted.

But ask the guys or dudetles who said TDE is enough to explain how to do this without Oracle Vault.

Edit: two threads on this issue:

http://forums.oracle.com/forums/thread.jspa?messageID=3249532镼

http://forums.oracle.com/forums/thread.jspa?messageID=3261345쎡

Answer 2

" , - ". , , DBA. DBA, SYSDBA -, oracle ( ) , DBA, .

VPD , , , , IP- (, ), . DBA VPD , .

Answer 3

. . , , DBA . -. , .

Answer 4

There are certain alternative companies with database encryption and access control solutions that strictly divide responsibilities between the database administrator and the security administrator.

You can take a look at D'Amo from Korean company Penta Security Systems.

Disclaimer: I worked as a database consultant and deployed a solution for many of my clients.