0

Is it possible for Oracle database administrator to make direct changes in data contained in a row, for example, changing an amount of 50 to 500 either by typing into the database cell or by executing an update query? If so, how could it be restricted so that data changes could only input through ERP application?

1 Answer 1

0

If you have Enterprise Edition you can purchase the Database Vault option, which can be used to lock the DBA and SYSDBA accounts out of specific schemas. Otherwise there is no way to prevent a DBA or SYSDBA user (or anyone with the [INSERT|UPDATE|DELETE] ANY TABLE privileges or the ability to login to the application schema) from bypassing the application and modifying data directly. Generally speaking, your DBAs must be trusted individuals.

5
  • Thanks for clearing things up. On a side note, if database vault is not setup, is there any logging option to track such changes?
    – itsec80
    Aug 23, 2023 at 10:35
  • Auditing can be configured - but also disabled - by the DBA. It is important to audit changes to auditing and the audit trail itself, in addition to the data. There are several excellent checklists out there for hardening your database (CIS, DISA STIG, etc.) that include basic auditing setups.
    – pmdba
    Aug 23, 2023 at 11:07
  • Is it possible to create a trigger to fire if a direct input to a database value is detected, so that it only allows such data changes to be affected through application input?
    – itsec80
    Aug 24, 2023 at 5:28
  • Yes, this could be done, but a DBA could easily disable any trigger. A robust auditing solution is also critical here: DDL changes (like altering triggers, for example) should be captured, and possibly (depending on overall activity and your specific data) possibly actual DML operations that change specific data. You may not be able to stop a DBA from changing data, but you should be able to capture a record of what was done and prevent the DBA from erasing that audit record. In the end, it still comes down to the DBA needing to be a trusted individual.
    – pmdba
    Aug 24, 2023 at 10:00
  • Thanks a lot. This was really helpful.
    – itsec80
    Aug 24, 2023 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.