Database Security Assessment Tool.

Database Security Assessment Tool.

The Oracle Database Security Assessment Tool (DBSAT) analyzes database configurations, users, their entitlements, security policies and identifies where sensitive data resides to uncover security risks and improve the security posture of Oracle Databases.

The Database Security Assessment Tool (DBSAT) consists of the following components:

1. Collector

2. Reporter

3. Discoverer

1. Collector.

l The collector should be run on the database server.

l Collector gathers information from the database and generates a JSON file containing all the information.

2. Reporter

l DBSAT Reporter will take as input the file generated by the collector (json or zip file).

l The Reporter and will produce one zip file containing three reports in different formats: HTML, spreadsheet, and text.

3. Discoverer

l The discoverer is essentially a separate Java-based tool that checks for sensitive data in the database.

l First you need to create a dbsat.config file. You can call it anything you want as you will be referencing it explicitly later.

1. DBSAT INSTALLATION:

Requirements:

1. DBSAT Tool zip.

2. Python 2.5 and above.

3. Java 1.8 and above.

A) Create specific DBSAT Directory.

mkdir DBSAT

cd /home/oracle/DBSAT

B) Move DBSAT Tool into the location and unzip.

pwd

/home/oracle/DBSAT

[oracle@ssssss DBSAT]$ unzip dbsat.zip

Archive: dbsat.zip

inflating: dbsat

inflating: dbsat.bat

inflating: sat_reporter.py

inflating: sat_analysis.py

inflating: sat_collector.sql

inflating: xlsxwriter/app.py

inflating: xlsxwriter/chart_area.py

inflating: xlsxwriter/chart_bar.py

inflating: xlsxwriter/chart_column.py

inflating: xlsxwriter/chart_doughnut.py

inflating: xlsxwriter/chart_line.py

inflating: xlsxwriter/chart_pie.py

inflating: xlsxwriter/chart.py

inflating: xlsxwriter/chart_radar.py

inflating: xlsxwriter/chart_scatter.py

inflating: xlsxwriter/chartsheet.py

inflating: xlsxwriter/chart_stock.py

inflating: xlsxwriter/comments.py

inflating: xlsxwriter/compat_collections.py

inflating: xlsxwriter/compatibility.py

inflating: xlsxwriter/contenttypes.py

inflating: xlsxwriter/core.py

inflating: xlsxwriter/custom.py

inflating: xlsxwriter/drawing.py

inflating: xlsxwriter/format.py

inflating: xlsxwriter/__init__.py

inflating: xlsxwriter/packager.py

inflating: xlsxwriter/relationships.py

inflating: xlsxwriter/shape.py

inflating: xlsxwriter/sharedstrings.py

inflating: xlsxwriter/styles.py

inflating: xlsxwriter/table.py

inflating: xlsxwriter/theme.py

inflating: xlsxwriter/utility.py

inflating: xlsxwriter/vml.py

inflating: xlsxwriter/workbook.py

inflating: xlsxwriter/worksheet.py

inflating: xlsxwriter/xmlwriter.py

inflating: xlsxwriter/LICENSE.txt

inflating: Discover/bin/discoverer.jar

inflating: Discover/lib/ojdbc8.jar

inflating: Discover/lib/oraclepki.jar

inflating: Discover/lib/osdt_cert.jar

inflating: Discover/lib/osdt_core.jar

inflating: Discover/conf/sample_dbsat.config

inflating: Discover/conf/sensitive_en.ini

Unzip was Completed , The following files are showing in the unzipped directory.

[oracle@ssssss DBSAT]$ ls -lrt

total 4880

-r-xr-xr-x. 1 oracle oracle 28216 Dec 21 2017 sat_analysis.py

-r-xr-xr-x. 1 oracle oracle 248371 Apr 13 2018 sat_reporter.py

-r-xr-xr-x. 1 oracle oracle 12839 May 1 2018 dbsat

-r-xr-xr-x. 1 oracle oracle 12771 May 18 2018 dbsat.bat

-r-xr-xr-x. 1 oracle oracle 43796 May 31 2018 sat_collector.sql

-rwxrw-r--. 1 oracle oracle 4630125 Jan 22 17:05 dbsat.zip

drwxrwxr-x. 2 oracle oracle 4096 Jan 22 17:05 xlsxwriter

drwxrwxr-x. 5 oracle oracle 4096 Jan 22 17:05 Discover

1. Running DBSAT Collector.

1.Specify the parameters.

$ dbsat collect <connect_string> <destination>

Example: $ dbsat collect system@PRDCLN /DBSAT

Database Security Assessment Tool version 2.0.2 (May 2018)

This tool is intended to assist in you in securing your Oracle database

system. You are solely responsible for your system and the effect and

results of the execution of this tool (including, without limitation,

any damage or data loss). Further, the output generated by this tool may

include potentially sensitive system configuration data and information

that could be used by a skilled attacker to penetrate your system. You

are solely responsible for ensuring that the output of this tool,

including any generated reports, is handled in accordance with your

company's policies.

Connecting to the target Oracle database...

SQL*Plus: Release 12.1.0.2.0 Production on Thu Jul 5 00:05:08 2018

Enter password:

Last Successful login time: Wed Jun 20 2018 23:51:14 +05:30

Connected to:

Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production

With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options

Setup complete.

SQL queries complete.

OS commands complete.

Disconnected from Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production

With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options

DBSAT Collector completed successfully.

Calling /u01/app/oracle/product/12.1.0.2/db_1/bin/zip to encrypt report.json...

Enter password:

Verify password:

adding:report.json (deflated 86%)

zip completed successfully.

2. Running DBSAT Collector.

$ ./dbsat report /DBSAT

[oracle@ssssss DBSAT]$ ./dbsat report /DBSAT