Chapter 12: Oracle Label Security

This chapter shows how to apply Oracle Label Security (OLS) to your tables to enforce row-level security. OLS has many capabilities that make it an attractive technique for implementing fine-grained access control. OLS is conceptually easy to understand and is based on a proven and well-understood security model. It makes it easy to create, deploy, and maintain your security; and, in contrast to views with functions and VPD, no coding is required to implement row-level security with OLS.

OLS was designed to meet some of the strongest security requirements ever put forth. This chapter offers a brief review of its history, which helps to explain the labeling concept and the behavior of the product. You’ll then see an example that illustrates the powerful security that OLS provides and the ease with which it can be provided. After a discussion of tips and tricks, OLS and VPD will be compared.

Classifying Data

OLS is based on the work done for U.S. intelligence agencies and the U.S. Department of Defense (DoD). You don’t have to work for an intelligence agency or the DoD to know that they interact with very sensitive information. Not only is the data sensitive, but some of it’s more sensitive than others. The data is separated and categorized based on its sensitivity. When the data’s sensitivity has been determined, it’s marked with a sensitivity designation, also known as a classification.

For a simple description, let’s assume three levels of classification: top secret, secret, and confidential. Top secret data is the most sensitive and requires the highest security. Secret is next in sensitivity, and confidential data is still sensitive but can be distributed to a wider audience. The security policy says that users with top secret access can see everything; users with secret access can see everything except the top secret data; and the users with confidential access only can see data that is confidential.

Let’s consider an example of how to classify information. Assume you’re part of the coaching staff for a sports team that will be participating in a big game. You classify the different strategies or game plan you’ll be using by the three classifications: confidential, secret, and top secret. The confidential data indicates who will be starting the game and in what position. The starting roster has a “CONFIDENTIAL” label on it. If your opponent knows the starting roster, they’ll have some insight into your starting strategy for the game. The secret data is the types of offense and defense patterns you’ll use during the game. The list of patterns you plan to execute might be kept in a manila folder labeled “SECRET.” This is more sensitive information because knowledge of this may allow your opponent to counter with a pattern that makes your strategy less effective. The top secret information is the details of the play you’re about to execute. If your opponent gains access to this, they’ll know all the plays you’ll make before you make them, which will likely defeat your plans. The play calls are labeled “TOP SECRET.”

The data sensitivity is determined based on how devastating the effects would be if the data was accessed by an opponent or someone with bad intentions. Access to data at a specific classification requires the user to have a clearance, or be approved for access.

The data classification process may or may not occur within your organization. Whether or not you have consciously categorized your data, it has different levels of sensitivity. For example, any trade secrets or intellectual property that you own may be considered the most sensitive information. You don’t have to categorize this as TOP SECRET; you can say this information is CORPORATE PROPRIETARY. It distinguishes the information from the other information within your organization, such as last year’s revenue earnings, which is less sensitive and may even be publicly available.

In a healthcare scenario, the patient’s information also has different sensitivities and classifications. The patient name isn’t as sensitive as their medical diagnosis. Similarly, a company’s HR records contain different levels of sensitivity—names and job titles are less sensitive than compensation information. My point is that the concept of data classification and data labeling is applicable to your environment even if you don’t work in the intelligence field or for the DoD.