Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

In an Oracle database shared among multiple application, is it 'safe' (from a security and system integrity perspective) to allow application administrators access to v$session, v$process, and v$sql? Or perhaps an overlying view limited to the application schema?

Thanks.

share|improve this question
add comment

1 Answer

"Safe" is relative and involves a tradeoff between access and privileges and application and data security.

The factors that you would night want to consider are:

  • have the app admins had this access before?
  • Are the app admins employees or contractors?
  • what do they say they need it for and are there other ways to accomplish this?
  • do you have a development stack where they could have access?
  • who "owns" the database or applications?
  • Does each admin take care of one app and there is a higher corporate owner? If this is the case a brief to the corporate owner should be your starting point.

My opinion is that unless there are performance or other application defects that are only seen on the production stack then access should not be granted on production. A view of the v$ views you mention on development should be fine.

Security procedures vary wildly from company to company and factors that are external to Oracle security are more often than not the deciding factors.

In short, only give access when you are satisfied that there is a real documented need that is supported by management.

In answer to the OP's question of what can you do with v$session I didn't know this till I looked for it but here is an example of what you can do with v$session. That's the thing about security, it's not what you can imagine people can do with information that is dangerous. It's what you don't know about. To a point, less access to interesting system information is more security.

share|improve this answer
    
Thanks or the reply. What are the security issues with granting access to these views? I'd have through a view that restricted access to a specific schema would be relatively harmless. –  Nick Pierpoint Sep 11 '11 at 15:43
4  
I like where Kevinsky is going with it, great points. I would like to play devil's advocate and say "how could someone in your organization misuse these v$ views"? I'm not so worried about v$process or even v$session but v$sql contains a biggie - SQL Text. If your application throws around sensitive data in plain text, you can see it here. If sensitive info is in bind variables and developers come back and ask for access to v$sql_bind_capture on prod then they better have a good reason. –  David Mann Sep 16 '11 at 14:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.