1
© Pete Finnigan 2018
P. Finnigan, Oracle Incident Response and Forensics,
https://doi.org/10.1007/978-1-4842-3264-4_1
CHAPTER 1
Data Breach
There are often multiple reasons why an Oracle database may be attacked.
An attacker may see an Oracle database simply as an easy target to gain
access to a company’s other IT infrastructure. Unfortunately, because
Oracle is a very complex product that requires an enormous amount of
configuration, often gaps are created in the security model used to protect
the data held within the database.
Because access to data is often at multiple levels—via an application
interface, a developer using TOAD, a DBA using SQL*Plus, and many
more—there is a risk that the security controls are different at each layer
and so allow access to more data at one layer than another. An attacker
may choose to attack an Oracle database to steal the data or he may
choose to attack an Oracle database simply to gain access to other IT
infrastructure.
It is important to understand at a high level the types of attacks that
can be performed on an Oracle database so that you are able to recognize
them from evidence gathered. It is also imperative to understand what
an incident is and what an incident response is. Following an incident,
forensic analysis must take place to understand how the attackers may
have breached and stolen data or done other damage to your database.
Finally, it’s important to know how Oracle itself works at a reasonably
detailed level because this will give you clues as to where evidence or
artifacts can be found and used.
剩余207页未读，继续阅读
