Oracle’s Database Security Assessment Tool (DBSAT) Version 2 (2.0.1)

Background

Advantages of Version 2 over Version 1

• Change in terminology from “Opportunity”, “Some Risk”, “Significant Risk”, and “Severe Risk” to the more conventional terms “Advisory”, “Low Risk”, “Medium Risk”, and “High Risk”.
• A more comprehensive analysis. Running both versions against the same database, version 2 found more “issues”. Even within the same check, the new version sometimes identified more results.
• A new “References” section at the bottom of each check. From the DBSAT documentation: “Provides information on whether the finding is related to a CIS Oracle Database Benchmark 12c v2.0.0 recommendation or related to a GDPR Article/Recital”.
• A whole new Discoverer component designed to search for data based on customizable criteria and then generate a “Database Sensitive Data Assessment Report”. This report can be generated offline on a secondary system (only the source data collection runs on the database server).
• A new output format: JSON for ingestion into other tools or utilities (i.e. via a custom loader). Previously output was provided in HTML for easy manual navigation, Excel where additional columns can be added (i.e. making it more like a check-list), and text for easy cut & paste.

New Feature: “Discoverer”

Comparison to ORAchk

• DBSAT is a two-step operation: fist your collect data, then report on it. The later can be performed on a secondary machine.
• DBSAT gives the option to encrypt the raw data it gathers during the collection phase (more on this later).
• DBSAT has fewer command line switches and is simpler to run and use. Though the basic usage of ORAchk is pretty simple also.
• The HTML reports generated are a little similar in look and feel but also differ in many ways.
• Unlike ORAchk, DBSAT is not extensible meaning you cannot add your own custom audit checks.
• Unlike ORAchk, DBSAT does not offer automated runs or repository storage for comparative analysis and overall estate dashboard (ORAchk offers the “Collection Manager” repository database and APEX application).
• There’s no catalog of checks like ORAchk provides in HTML format.

Integration

1. There’s no guarantee that the version of DBSAT bundled with the version of ORAchk being used is the most recent. Since DBSAT doesn’t seem to be updated nearly as frequently it’s likely not a problem except for a period of time shortly after a DBSAT release.
2. The included DBSAT output within an ORAchk report is only in text format and is encapsulated as a single audit check by ORAchk. In the ORAchk output, there’s no included DBSAT HTML, XLS, or JSON data for an easier review or integration into other tools.
3. Most significantly, the scope of visibility may be different between an ORAchk report and a DBSAT report. An ORAchk findings report may be treated as low risk from a security and confidentiality perspective and therefore may be shared with a wider audience or handled less securely within an organization. Conversely, DBSAT reports may show current exposures and sensitive information that could be easily exploited if it fell into the wrong hands. Consequently DBSAT findings are often handled and secured with additional scrutiny.

./orachk -excludecheck 39128FBB540C098AE0530D98EB0AFB1A

./orachk -excludeprofile security

Limitations and Concerns

Conclusion

References: