Database Vault

Database vault  is a licensed feature in oracle which will help us to impose security at the database to the next level by eliminating oracle super user to access sensitive application data.

For example I have an employee table having sensitive columns of SSN and salary . We can restrict sys user to access employee table and also its sensitive columns and also can authorize uses to access the table to perform DML operations and to  restrict sensitive columns to read only access and also can set time bound restrictions to the authorized uses to perform any actions on the table 

database vault has been introduced from 10g onwards but the features have been enhanced for each release.

In 19C DB vault feature has been extended to standby database as previously DB vault feature is not auto applicable to standby server upon enabling at the primary site.

DB vault is integrated with database security assessment tool (DBSAT)

From 21c onwards there is no need to disable the DB vault feature during the dB upgrade operation

The important components of DB vault is 

• Realms 
• Factors
• Identity 
• rule set 
• command rules 
• secure application roles 

Realms is a functional grouping of schemas, objects, roles
Factors discuss about the method of authorizing the users with password, MFA, security keys ,Kerberos

Identity is defined for a factor components which tells about what kind of security the application is having .

for example I have an application with a sensitive data and it has some specific roles and these roles will be represented as Identity and can be associated to a factor authentication.

Ruleset - it is termed to be collection of rules 

command rule : this tells as the rules to be executed with a command rule for example an authorized user can update/delete/add a data to a table  only during office hours 

Secure application rules will  tells us which rule are allowed or denied based on the application identity 

How to enable DB vault?

alter system set enable_dv=true;

what is the package used to create rules/factors/identity ?

DBMS_MACADM