eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Regulations require that databases be audited, while data encryption too often means a drag on performance and multiple migraines induced by application changes.
Oracle Corp., for one, has been tackling these issues in the database server. Evidence of its work was on display at Oracle OpenWorld this week in San Francisco, as the company demoed the second release of its flagship database, Oracle 10g.
Specifically, in R2, Oracle is delivering Transparent Data Encryption, a data lock-down that requires no application modification. R2 also delivers Oracle Secure Backup, a backup-to-tape product that encrypts entire backups, thus foiling the bad guys who swipe tapes off of FedEx trucks.
These are just some of the big features in R2 that eWEEK.com News Editor Lisa Vaas got to go over with Oracle Senior Vice President of Server Technologies Andy Mendelsohn when the two sat down at OpenWorld.
Whats driving the need for encryption?
Compliance, and [regulations such as] SarbOx [Sarbanes-Oxley Act] are driving a lot of this as well.
Whats the coolest new security feature in R2?
Transparent Data Encryption. Security at this point, its very topical: Theres been a lot of news about people stealing identity, about tapes disappearing off FedEx trucks.
But weve got encryption. What new security techniques is Oracle bringing to the table?
In the past youve had strong security. You couldnt see the credit card data unless you were authorized to see that. But even within a credit card organization, a hacker, say a privileged DBA [database administrator], can go in and swipe his ID card and access credit card data.
In R2 weve added a few things to deal with the problem. Weve got Oracle Secure Backup, a backup-to-tape product.
Its key feature is when you back up and move data to a tape, it can encrypt the whole backup for you. So when the tape is stolen off the back of the truck, who cares? Nobody can read the data.
Entire tape backup is a heavy-handed solution. What else have you got for dealing with inside jobs?
You need a finer-grained instrument. You need to encrypt data before its on disk.
The barrier to doing that in the past has been if you do that and just encrypt credit card data, you have to change the application. If youre using a packaged application, you cant easily go in and encrypt information like that.
Even if you own the application, its expensive. Developers have to start [lengthy] projects and change the code.
So in R2 we have Transparent Data Encryption. With a single line, a DBA can say, Change this table so the credit card data is encrypted.
So the application still sees the credit card data. When we pull the data off the disk, we decrypt it and hand it back to the program.
Coupled with the secure backup product coming out, we have a complete solution to encrypt on tape and on disk.
What in R2 will help people deal with SarbOx requirements?
Data centers now have to be careful who has access to data. They have to document processes, etc.
Theyre very interested in separation of privilege. In a big Oracle system, there are often multiple applications running on a single system: HR, financials, payroll, all on the same system. Its a common setup with how people run [Oracles] E-Business Suite or PeopleSoft, for example.
They usually want an administrator to administrate one of those systems. The problem is that with security on Oracle, if you want to grant an administrator powerful privilege to manage lots of information on the system, the easiest way to do that is to give them the ability to access all the information on the system. But you dont want that.
Next Page: Rolling up databases for the auditor.
Rolling Up Databases for
the Auditor”>
So we created Project Data Vault: the ability to say, for a powerful administrator, I want to confine him to just a set of tables or schemas he should have access to. The HR administrator should only see HR schemas, not payroll or anything else.
With Data Vault you can split the system into realms and have powerful administrators, but only all-powerful in [given] realms. If they try to get out of those realms, they get blocked.
Is this an add-on product, or is it included in R2?
Add-on product, coming out some time by next May.
I can see how Data Vault can help with compliance, helping organizations to tell auditors who has access to what information, according to SarbOx rules. What else are customers going to get to help with compliance?
Another project, Project Audit Vault, will help with [showing auditors multiple databases]. The auditor wants to see the whole history. He may drill down randomly, to get just samples of information. He cant look at every transaction.
But customers will have hundreds of databases in the data center. If you want the auditor to check out hundreds of databases, its a daunting task.
Customers want to take audit trails and logs—which, on one database, record all changes to that database—and take off hundreds of database systems and consolidate them to a data vault. Which is essentially a data warehouse.
They want to take auditing information off all these systems, and consolidate it on one system so they can check out whats going on in all these systems. It helps to deal with SarbOx issues. Its interesting for North American customers or anybody who wants to do business in the United States.
What else is hot in R2?
Coming up real soon—by May—is the 10g R2 version of grid control, our new enterprise management capability. Instead of an administrator doing one system, he can manage all systems across the grid.
Also, CPUs [Critical Patch Updates]: A customer who has a big data center might want to very rapidly roll out these CPUs to all their production systems. That can be expensive, time-consuming. So with R2 we have nice automation for that. The grid control console has a link to the support site, to MetaLink.
Grid control automatically pulls down the alert to the site and notifies the customer. Grid control says, You have 500 systems in the data center. As far as I can tell, youve applied the CPU to just three. Can I roll out the patch to all the others?
The admin can click on systems to apply the patch, or he can say, Take these steps first; say, I want this system down on Saturday at 2 a.m., and send notification to users before taking it down.
And it will restart automatically for you, too. Thats something that in the past has been time consuming.
Whats the main goal behind R2?
For R2 to be very robust.
In [Chuck Rozwats] keynote well show high-performance implementation of a basic sorting algorithm. Customers sort millions of times a day. If you make that run faster, you can make a lot of stuff run faster in the data center.
In R2 we looked at the chips in the marketplace and built this new sorting algorithm that makes it run much faster on new chips.
Were talking huge performance increases: up to 5 times faster for sorting.
We think this is the kind of thing from which our customers will really benefit. They can take batch jobs that took 2 hours to run and cut them down to 30 minutes.
Check out eWEEK.coms for the latest database news, reviews and analysis.