Is it safe to let application administrators look at v$session, v$process, and v$sql?

Question

In an Oracle database shared among multiple application, is it 'safe' (from a security and system integrity perspective) to allow application administrators access to v$session, v$process, and v$sql? Or perhaps an overlying view limited to the application schema?

Thanks.

Answer 1

"Safe" is relative and involves a tradeoff between access and privileges and application and data security.

The factors that you would night want to consider are:

• have the app admins had this access before?
• Are the app admins employees or contractors?
• what do they say they need it for and are there other ways to accomplish this?
• do you have a development stack where they could have access?
• who "owns" the database or applications?
• Does each admin take care of one app and there is a higher corporate owner? If this is the case a brief to the corporate owner should be your starting point.

My opinion is that unless there are performance or other application defects that are only seen on the production stack then access should not be granted on production. A view of the v$ views you mention on development should be fine.

Security procedures vary wildly from company to company and factors that are external to Oracle security are more often than not the deciding factors.

In short, only give access when you are satisfied that there is a real documented need that is supported by management.

In answer to the OP's question of what can you do with v$session I didn't know this till I looked for it but here is an example of what you can do with v$session. That's the thing about security, it's not what you can imagine people can do with information that is dangerous. It's what you don't know about. To a point, less access to interesting system information is more security.