# Oracle Database 19c Security Hardening Checklist for ERP > Source: https://netray.co/tools/oracle-database-19c-security-hardening-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 37 item hardening checklist for Oracle Database 19c under an ERP: accounts, privileges, network, unified auditing, data protection and patching. ## Category oracle ## Erp Oracle Database ## Audience - Oracle DBA - Security engineer - ERP administrator - IT auditor ## Tool **Kind:** checklist **Groups:** #### Accounts and profiles **Items:** **Text:** Query DBA_USERS_WITH_DEFPWD and change or lock every account still using a default password **Critical:** true Lock and expire Oracle supplied accounts that are not in use (check ORACLE_MAINTAINED = 'Y' in DBA_USERS) Review the DEFAULT profile: FAILED_LOGIN_ATTEMPTS, PASSWORD_LIFE_TIME, PASSWORD_LOCK_TIME, PASSWORD_REUSE_MAX and PASSWORD_VERIFY_FUNCTION Set a password verify function such as ORA12C_STRONG_VERIFY_FUNCTION (created by utlpwdmg.sql) Consider ORA_STIG_PROFILE (with ORA12C_STIG_VERIFY_FUNCTION) for named DBA accounts where STIG compliance applies Set INACTIVE_ACCOUNT_TIME to lock accounts unused for a defined period **Text:** Make ERP schema owners schema-only accounts (NO AUTHENTICATION) or locked where the ERP allows **Critical:** true Use a separate application login with only the roles the ERP needs, not the schema owner Give each DBA a named account; restrict use of SYS and SYSTEM #### Privileges **Items:** **Text:** Review EXECUTE grants to PUBLIC on UTL_FILE, UTL_HTTP, UTL_TCP, UTL_SMTP and DBMS_SQL; revoke only after testing the ERP **Critical:** true Control outbound network packages with network ACLs (DBMS_NETWORK_ACL_ADMIN) **Text:** Remove ANY system privileges (SELECT ANY TABLE, EXECUTE ANY PROCEDURE and similar) from application users **Critical:** true Limit DBA role and SYSDBA grants; review V$PWFILE_USERS Use administrative privileges SYSBACKUP, SYSDG and SYSKM for backup, Data Guard and key tasks instead of SYSDBA Run privilege analysis (DBMS_PRIVILEGE_CAPTURE) to find unused privileges before removing them Restrict directory objects and their READ and WRITE grants #### Network **Items:** Enable valid node checking for registration (VALID_NODE_CHECKING_REGISTRATION_ and REGISTRATION_INVITED_NODES_ in listener.ora) Restrict client addresses with TCP.VALIDNODE_CHECKING and TCP.INVITED_NODES in sqlnet.ora **Text:** Encrypt client traffic with Native Network Encryption (SQLNET.ENCRYPTION_SERVER = REQUIRED, AES256) or TLS **Critical:** true Enable integrity checking (SQLNET.CRYPTO_CHECKSUM_SERVER) when using Native Network Encryption Restrict listener administration to the local OS owner and do not set a listener password on 12c and later Firewall the listener port so only application and admin hosts can reach it #### Auditing **Items:** **Text:** Confirm the predefined unified audit policies ORA_SECURECONFIG and ORA_LOGON_FAILURES are enabled (AUDIT_UNIFIED_ENABLED_POLICIES) **Critical:** true Add policies for account and role changes (ORA_ACCOUNT_MGMT) and parameter changes (ORA_DATABASE_PARAMETER) Create a custom policy for direct changes to sensitive ERP tables from non-application accounts Plan the move to pure unified auditing (relink uniaud_on) after testing Schedule audit trail purge with DBMS_AUDIT_MGMT after the trail is exported to a log platform Keep AUDIT_SYS_OPERATIONS = TRUE and forward the OS audit trail #### Data protection **Items:** **Text:** Use Transparent Data Encryption for tablespaces holding ERP data; TDE requires the Advanced Security option licence **Critical:** true Store the TDE keystore separately from database backups and back up the keystore Encrypt RMAN backups and protect backup media and cloud buckets Mask or subset production data before copying it to test and development Consider Data Redaction (part of Advanced Security) for sensitive columns shown in ERP reports #### Patching and monitoring **Items:** **Text:** Apply the quarterly Release Update within your patch policy window **Critical:** true Run the Database Security Assessment Tool (DBSAT) collector and report, and track findings Review the alert log and listener log for repeated login failures and errors Remove sample schemas and unused components from production **Scoring Note:** Critical items are the controls auditors and attackers check first: default passwords, broad privileges, unencrypted traffic, missing audit and missing patches. Test every revoke and lock against the ERP in a clone first. ## Content **Intro:** This checklist hardens an Oracle Database 19c instance that runs an ERP, covering default accounts and profiles, PUBLIC and ANY privileges, listener and network encryption, unified auditing, data protection and patching. Licence-dependent options are marked so you do not enable something you have not bought. **Sections:** #### How to use it **Body:** Run DBSAT first to get a baseline report, then work through each group on a clone of production with the ERP running against it. ERP products often rely on specific grants, so every revoke and account lock needs a regression test of logins, batch and integrations before production. Tick items as they are done, add the evidence (query output or DBSAT section) in your change record, and export the checklist for the auditor. Re-run DBSAT after each RU and after major ERP changes. **Bullets:** - Baseline with DBSAT before changing anything. - Test on a clone with the ERP connected. - Keep query output as audit evidence. #### Accounts, profiles and the DEFAULT profile **Body:** DBA_USERS_WITH_DEFPWD lists accounts that still have their default passwords. The DEFAULT profile ships with ten failed login attempts, a 180 day password life and no verify function, so set a verify function and values that match your policy. 19c also ships ORA_STIG_PROFILE, aimed at DISA STIG requirements, and utlpwdmg.sql creates the ORA12C verify functions. Schema-only accounts, available since 18c, cannot log in directly, which suits ERP schema owners where the application connects through a separate user. Check with your ERP vendor before changing how the application logs in. #### Network and auditing **Body:** Native Network Encryption and TLS are included with Enterprise Edition and Standard Edition 2 without the Advanced Security option. Set SQLNET.ENCRYPTION_SERVER to REQUIRED only after confirming every client, including batch servers and reporting tools, can negotiate it. For auditing, 19c runs mixed mode by default; ORA_SECURECONFIG and ORA_LOGON_FAILURES are predefined unified audit policies, enabled by default in a new 19c database; check AUDIT_UNIFIED_ENABLED_POLICIES and enable them with AUDIT POLICY if they are missing, which is common after an upgrade. Query UNIFIED_AUDIT_TRAIL for results and purge with DBMS_AUDIT_MGMT once records are shipped to your log platform, otherwise the AUDSYS audit tables, in SYSAUX by default, grow without limit. #### Licensing and ERP gotchas **Body:** Transparent Data Encryption and Data Redaction are part of the Advanced Security option, an extra cost licence on Enterprise Edition. Database Vault and Label Security are separate options. DBSAT is a free tool from Oracle, available through My Oracle Support. For ERP, the classic risks are shared admin accounts, reporting users with SELECT ANY TABLE, and production copies with live customer and payroll data in test. Fix those first; they matter more than any single parameter. **Cta:** If you want an AI assistant over your ERP that respects these database roles and runs on your own servers with no data leaving the site, we can set that up. **Faq:** #### What is the default profile in Oracle 19c? **Answer:** Every user without an assigned profile uses DEFAULT. Out of the box it allows ten failed logins, a 180 day password life, a one day lock time and a seven day grace time, with no password verify function. Query DBA_PROFILES WHERE profile = 'DEFAULT' to see the values on your database, then tighten them to your policy. #### How do I find accounts with default passwords in Oracle 19c? **Answer:** Query SELECT username FROM dba_users_with_defpwd. It lists accounts whose password matches a known Oracle default. Change the password or lock and expire each account, then rerun the query. DBSAT also reports these accounts in its user accounts section. #### Is there an official Oracle Database 19c security guide? **Answer:** Yes. The Oracle Database 19c Security Guide covers users, profiles, privileges, network encryption, unified auditing and TDE. Oracle also provides DBSAT for automated checks, and DISA publishes an Oracle Database 19c STIG. Use the guide for how, and the STIG or CIS benchmark for which values to set. #### Do I need a licence for TDE in Oracle 19c? **Answer:** Yes. Transparent Data Encryption is part of the Oracle Advanced Security option on Enterprise Edition, which also includes Data Redaction. Native Network Encryption and TLS for client connections do not need that option. Check your licence before enabling encryption features, because feature usage is recorded. ## Search terms oracle database hardening checklist 19c, oracle database 19c security guide, oracle database 19c vulnerability, 19c oracle database default profile, dba_users_with_defpwd, ora_stig_profile, oracle unified auditing policies, oracle dbsat --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json