Index A Access Control, 183 Administration console, 17 home page, 17 managing instances, 19 managing requests, 18 managing workspaces, 19 monitoring activity, 19 Advanced security option (ASO), 58, 262 network encryption, 263 TDE, 263 APEX applications, 3 APEX export reports, 185 column restrictions interactive reports, 187 standard reports, 187 drawbacks, 185 maximum row count, 185 restricting records with PL/SQL (see Restricting records) with ROWNUM, 188 APEX instance APEX_ADMINISTRATOR_ROLE, 43 APEX_INSTANCE_ADMIN APIs, 43 configuration and management, 44 runtime mode, 42 APEX listener, 39 APEX security plan, 7 Application context, views, 203 Application Express (APEX), 15 administration console, 16 17 home page, 18 managing instances, 19 managing requests, 18 managing workspaces, 19 monitoring activity, 19 application builder, 17 architecture jquery, 26 PL/SQL and JavaScript, 26 schemas, 27 database application, 16 definition, 15 developer tools, 15 export reports (see APEX export reports) foundation components, 16 infrastructure, 38 APEX listener, 39 embedded PL/SQL gateway (EPG), 38 Oracle HTTP server, 39 metadata-based architecture, 26 limitations, 26 views, 26 overview of, 15 schemas APEX_040200, 27, 29 APEX_PUBLIC_USER, 27 28 FLOW_FILES, 31 FLOWS_FILES, 27 transactions, 32 fprocedure, 32 session state, 36 WWV_FLOW.ACCEPT procedure, 33 WWV_FLOW.SHOW, 33 workspaces, 20 components, 22 schema mappings, 22 users and roles, 20 Application settings, 101 availability attribute, 104 to developers only, 104 with edit links, 104 restricted access, 104 SET_FLOW_STATUS procedure, 105 settings, 104 265
Application settings (cont.) via SQL developer, 105 unavailable status, 104 build status, 106 compatibility mode attribute, 103 debugging, 102 definition section, 101 e-mails address, 103 feedback, 102 global notification attribute, 107 logging, 101 security attribute, 108 authorization scheme, 109 cache, 113 cleanup PL/SQL code, 116 deep linking, 109 embed in frames, 113 HTML escaping mode, 114 initialization PL/SQL code, 115 parsing schema setting, 110 public user and authentication scheme, 108 run on public pages option, 109 session state protection option, 110 session timeout, 110 substitution strings, 107 user interface attributes, 117 Application threats, 129 Authentication scheme, 159 Application Express users, 160 components, 166 login processing settings, 167 post logout URL, 168 session cookie attributes, 168 session not valid settings, 167 source region, 166 custom, 163 database accounts, 160 HTTP header variable, 160 LDAP directory, 162 login page, 169 in APEX 4.0 and prior versions, 172 APEX 4.2, 172 companies, 174 developers, 171 get username cookie, 170 logout, 174 security attributes section, 169 session cookie, 173 set username cookie process, 172 user interfaces section, 169 no authentication scheme, 162 OASSSO, 163 open door credentials scheme, 163 Authorization inconsistency, 153 Authorization scheme, 177 access control, 183 attributes, 177 gatekeeper authorization scheme, 180 inconsistencies, 182 183 methods, 178 page-level authorization scheme, 180 role location, 179 subscriptions, 179 table-based roles, 179 utilization report, 182 B Blacklisting, 225 C Clickjacking, 113 Column-level encryption, 263 Column masking and obfuscation reports, 215 types, 215 Cross-site scripting (XSS) attack, 129, 139 anatomy of, 140 data sanitization, 144 APEX_ESCAPE, 145 column formatting, 146 cookies, 152 frames, 152 HTML regions and items, 151 restricted characters attribute, 145 persistent XSS attacks, 143 reflexive XSS attacks, 140 Custom authentication scheme, 163 APIs, 165 APEX_AUTHENTICATION, 165 APEX_CUSTOM_AUTH, 165 APEX_LDAP, 165 APEX_UTIL, 165 SET_AUTHENTICATION_RESULT, 166 attributes, 163 invalid session procedure, 164 legacy attributes section, 164 restriction, 164 sentry function, 164 D DATA and SHADOW schemas, 226 Database access descriptor (DAD), 162 DBMS_CRYPTO package, 255 266
E Embedded PL/SQL gateway (EPG), 38 Encryption, 247 APEX application computations, 260 collections, 256 data encryption, 255 DBMS_CRYPTO package, 255 encrypt_data and decrypt_data, 257 item-level attribute, 254 session state, 252 ASO (see Advanced security option (ASO)) HTTPS, 248 instance admin console/application development environment, 251 packet peeper, 248 secure cookie attributes section, 251 Enkitec esert, 107 F Fine-grained access control, 212 G Gatekeeper authorization scheme, 180 H Health Insurance Portability and Accountability Act (HIPAA), 6 HTTP Header Variable, 160 HTTPS, 248 I, J, K Instance administration console, 45 manage workspaces (see Manage Workspaces section) Monitor Activity (see Monitor Activity section) Manage Instance (see Manage Instance section) Instance settings, 41 APEX_ADMINISTRATOR_ROLE, 43 APEX_INSTANCE_ADMIN APIs, 43 configuration and management, 44 Manage instance section, 45 feature configuration, 47 main page, 46 runtime mode, 42 security, 41 workspace login, 44 L Lightweight directory access protocol (LDAP), 162 M Manage Instance section application activity log, 48 Database Monitoring, 48 demonstration objects, 47 enable application tracing, 48 enable service requests, 48 feature configuration packaged application, 47 PL/SQL program units, 47 SQL Workshop, 47 Websheet objects, 47 Instance Settings section, 56 delete uploaded files after (days) feature, 58 E-mail provisioning status, 57 E-mail section, 58 encrypted tablespaces, 57 message setting, 57 notification E-mail address, 57 provisioning status setting, 56 purge sessions region, 61 recent sessions report, 60 report printing options, 59 require new schema, 57 self service sign up, 64 session state, 59 session state statistics report, 62 verification code, 57 wallet password, 59 wallet path, 59 packaged application, 47 PL/SQL program units, 47 main page, 46 security attributes, 48 account password lifetime (days) setting, 53 allow public file upload setting, 49 allow RESTful Access, 50 disable administrator login, 49 disable workspace login, 49 domain names, 52 failed login, 52 53 File Browser APEX, 49 HTTPS setting, 50 inbound proxy servers, 52 instance proxy setting, 50 login controls section, 52 maximum session length and idle time in seconds, 51 267
Manage Instance section (cont.) method for computing the delay setting, 52 Outbound HTTPS setting, 50 password reset and locking policy, 52 restrict access, IP address, 50 set workspace cookie option, 49 workspace password policy setting, 53 Session State, 59 logs and files section, 62 message setting, 63 Purge Sessions region, 61 Recent Sessions report, 60 Self Service Sign Up, 64 session state statistics report, 62 SQL workshop, 47 websheet objects, 47 workspace purge settings, 59 workspaces, 64 Manage workspaces section, 65 application attributes, status report, 78 79 component availability, 75 create multiple workspaces, 68 create workspace option, 65 export and import, 76 lock workspace, 71 manage developers and users section, 73 APEX account types, 74 forgot passwords, 74 internal workspace, 74 users, 75 remove workspace, 70 reports, 76 existing workspace report, 76 workspace database privileges, 77 schema assignments, 72 Mobile applications, 127 HTML-based application, 127 native application development, 127 security, 127 shadow schema, 128 Monitor Activity section, 80, 99 archived activity reports, 87 dashboard reports, 87 realtime monitor reports, 80 calendar reports, 84 developer activity, 87 login attempts, 85 page views, 81 N Network encryption, 263 No authentication scheme, 162 O Open door credentials scheme, 163 Oracle Application Server Single Sign-On (OASSSO) authentication scheme, 163 Oracle Enterprise Manager (OEM), 222 registration, 223 security options, 222 Oracle HTTP Server, 39 P, Q Packet peeper, 248 Page-level authorization scheme, 180 Page settings, 118 authentication attribute, 119 authorization scheme, 119 browser cache, 122 deep linking attribute, 119 duplicate submission, 122 form auto complete attribute, 120 page access protection, 119 read only attribute, 118 server cache, 122 Persistent XSS attacks, 143 PL/SQL package, views, 203 Preventable threats, 4 cross-site scripting, 6 SQL injection, 5 URL tempering, 4 R Reflexive XSS attacks, 140 Region settings, 124 APEX conditions, 124 authorization schemes, 126 caching, 126 read only setting, 126 Report settings, 126 Restricting records with PL/SQL, 190 application item, 194 application process, 194 authorization checks, 197 custom_export procedure, 199 disable built-in export controls, 190 download link, 196 error handling, 197 error message, 198 fetching static ID, 197 p1_emp_classic procedure, 199 PL/SQL package, 195 shortcuts, 191 static ID, 193 with ROWNUM, 188 268
S Secure views, 201 in APEX, 201 benefits and drawbacks, 208 components, 202 application context, 203 attributes, 206 PL/SQL procedure, 203 SQL, 204 Security plan, 7 assessments access control, 8 application management, 9 auditing and monitoring, 9 data access, 9 risk analysis, 8 breach simulation, 12 categories, 7 contingency, 10 design phase, 9 development, 10 review process automated, 11 manual, 12 Shadow schema, 225 components APEX application, 226, 231 database, 226 data schema, 226, 228 DML APIs and processes, 232 237 grants and synonyms, 238 revoke system privileges, 229 system and user event triggers function, 230 table API processes, 238 concept of, 225 securing data, 242 application context, 242 PL/SQL initialization code, 245 synonym, 244 views, 244 SQL injection attack, 129 anatomy of, 130 in APEX, bind variables and dynamic SQL, 133, 136 ename, 133 EXECUTE IMMEDIATE, 133 PL/SQL procedure, 130, 132 value KING, 131 SYS_CONTEXT procedure, views, 204 T Tablespace-level encryption, 263 Threats, 1 assessment, 1 application security, 2 data and privileges, 3 home security, 1 categories, 1 preventable threats, 4 cross-site scripting, 5 SQL injection, 5 URL tempering, 4 unpreventable threats, 6 Transparent data encryption (TDE), 57, 263 column-level encryption, 263 tablespace-level encryption, 263 U Unpreventable threats, 6 URL tampering, 129, 153 authorization inconsistency, 153 page and item protection, 154 Virtual Private Database and secure views, 157 User authentication, 159 User authorization, 177 Users and groups management, 95, 98 account privileges section, 96 attribute developer/administrator password, 97 developers, 95 end users, 95 expire password, 97 password region, 97 user groups region, 98 user identification section, 96 workspace administrators, 95 V Views. See also Secure views Application context, 203 PL/SQL package, 203 SYS_CONTEXT procedure, 204 Virtual private database (VPDs), 158, 211, 225 APEX integration, 212 column masking and obfuscation, 215 VPD policy function, 213 column-level policies, 212 evolution of, 211 in OEM, 222 269
W, X, Y, Z Whitelisting, 225 Workspace(s), 20 components, 22 application builder, 23 SQL workshop, 23 team development, 24 websheets, 24 drawbacks, 25 schema mappings, 22 subscriptions, 25 technical benefits, 25 users and roles, 20 developers, 21 end user, 20 workspace administrator, 22 Workspace administrators best practices, 100 Manage Service, 89 manage users and groups (see Users and groups management) monitor activity, 99 Workspace settings, 89 manage meta data, 92 build status report, 94 session state section, 92 troubleshooting process, 94 service requests, accessible schemas, 90 91 workspace preferences account login control, 91 module access, 91 270