Oracle Database encryption for SAP systems

[Former Member]

Hi All,

Wish you all a Happy New year ' 09..

I am working on oracle security (data in rest (file systems) and in motion (network encryption) ) for SAP systems with Oracle database.

Here is my initial analysis

1. Data stored in rest (File system) - Oracle 10g (10.2.0.4) provides Transparent Data Encrytion which is supported by SAP also - please correct me if i am wrong.

2. Data in motion (Network Encryption) - Oracle provides few parameters which needs to be added in sqlnet.ora file (encryption and checksum parameters).

Would appreciate if you can clarify following doubts and provide information based on your experience:

a. Oracle Transparent Data Encryption works at column level only. So we need to first identify the respective tables and columns - and this will be a time consuming activity. Is there fast way to do that - i mean some sort of automating scripts which identifies critical tables and columns based on initial inputs.

b. With TDE, inspite of modifying specific tables, columns - can we encrypt the complete database - how much would be the performance impact (approx figures).

c. Except TDE, is there any other solution for oracle database encryption (data stored at disks/backup media) which is being supported by SAP systems.

d. How can i verify that oracle database has been encrypted when stored in file systems or backup media.

e. How can i verify that data transferred from oracle database to end user machine has been encrypted.

f. Please provide some case stuides / documentation on this.

Appreciate your patience for going through this and looking forward to hear from your experience/knowledge.

Best Regards

Davinderpal Singh

[stefan_koehler · Accepted solution]

Hello Davinderpal,

i have tested the TDE with some non-SAP oracle databases and it works really well in my cases. I have never introduced it in production, but my tests were successful.

Please check sapnote #974876. This note is really large and tries to cover any aspects in a sap enviornment.

I think you will get answers to the most of your questions there.

On the other hand i will answer some points of you, because they are not covered in this note:

> d. How can i verify that oracle database has been encrypted when stored in file systems or backup media.

The easist way is a blockdump. Keep in mind that the encrypted data can still be stored as "cleartext", if you encrypt the columns later. An explanation is here: http://www.pythian.com/blogs/510/oracle-10g-transparent-encryption-not-so-encrypted

> e. How can i verify that data transferred from oracle database to end user machine has been encrypted.

You can make a network trace with tcpdump/iptrace or some other network sniffer tools or you can enable SQL*Net tracing. How you can encrypt the network data, please also check sapnote #973450.

Regards

Stefan

[Former Member · Accepted solution]

Hi ,

Thanks Stefan for sharing the information.

Would appreciate if someone can share their knowledge on following points:

a. Oracle Transparent Data Encryption works at column level only. So we need to first identify the respective tables and columns - and this will be a time consuming activity. Is there fast way to do that - i mean some sort of automating scripts which identifies critical tables and columns based on initial inputs.

b. With TDE, inspite of modifying specific tables, columns - can we encrypt the complete database - how much would be the performance impact (approx figures).

c. Except TDE, is there any other solution for oracle database encryption (data stored at disks/backup media) which is being supported by SAP systems.

Regards

Davinder