Re: Securing 3rd party connections to Oracle DB's?

On the technical side (depending on the evironment of course), I would look at abstracting the access rather than direct access, suggesting web services for exposing and controlling access to the data: SSL for transport security and certificate based or usernane/password authentication for each client. On the database side, match the certificates or userId to a client specific DB user account that only has access to view the data for that client, thus ensuring that each client can only access the data they need to access. Remember to make sure that all web services methods are properly validating input parameters to prevent SQL Injection. Restricting by IP address can help too, but certainly do not rely on this to prevent cross-client access to data.

I would not consider exposing the database directly to untrusted clients as your post seems to suggest (apologies if i've misread).

For non-technical controls, always ensure an appropriate contract is in place with proper info security clauses such as nondisclosure, protection of data, acceptable use etc.

hth
Mike

Relevant Pages

  • Re: Bucking -- a person should take responsibility for this
    ... >my fodder was directed towards and in lieu of comments from Ms ... >Rockwell. ... Please accept my apologies for my having misread your statements. ...
    (rec.equestrian)
  • Re: Jesus Broke the Rules, was Moderation Delays
    ... You [Frederick Williams] believe homosexuals fantasise about children? ... Then please accept my apologies, I misread you. ...
    (uk.religion.christian)
  • Re: Singapore delivery price????
    ... Please accept my apologies. ... I went back and reread what you posted and realized that I misread or misinterpreted what you wrote. ... You did emphasize "a delivery" in your comment and it was meant as more of a financial judgement than a capability one. ...
    (rec.boats.cruising)
  • Re: Singapore delivery price????
    ... Please accept my apologies. ... I went back and reread what you posted and ... realized that I misread or misinterpreted what you wrote. ... to something when I'm rushing out the door. ...
    (rec.boats.cruising)
  • Re: Singapore delivery price????
    ... Please accept my apologies. ... I went back and reread what you posted and ... realized that I misread or misinterpreted what you wrote. ... emphasize "a delivery" in your comment and it was meant as more of a ...
    (rec.boats.cruising)