Oracle 19c Security Hardening Checklist for ERP

0%

0 of 37 items complete

8 critical items still open - these are the highest-risk gaps.

Download checklist:

Accounts and profiles

Query DBA_USERS_WITH_DEFPWD and change or lock every account still using a default passwordCRITICALLock and expire Oracle supplied accounts that are not in use (check ORACLE_MAINTAINED = 'Y' in DBA_USERS)Review the DEFAULT profile: FAILED_LOGIN_ATTEMPTS, PASSWORD_LIFE_TIME, PASSWORD_LOCK_TIME, PASSWORD_REUSE_MAX and PASSWORD_VERIFY_FUNCTIONSet a password verify function such as ORA12C_STRONG_VERIFY_FUNCTION (created by utlpwdmg.sql)Consider ORA_STIG_PROFILE (with ORA12C_STIG_VERIFY_FUNCTION) for named DBA accounts where STIG compliance appliesSet INACTIVE_ACCOUNT_TIME to lock accounts unused for a defined periodMake ERP schema owners schema-only accounts (NO AUTHENTICATION) or locked where the ERP allowsCRITICALUse a separate application login with only the roles the ERP needs, not the schema ownerGive each DBA a named account; restrict use of SYS and SYSTEM

Privileges

Review EXECUTE grants to PUBLIC on UTL_FILE, UTL_HTTP, UTL_TCP, UTL_SMTP and DBMS_SQL; revoke only after testing the ERPCRITICALControl outbound network packages with network ACLs (DBMS_NETWORK_ACL_ADMIN)Remove ANY system privileges (SELECT ANY TABLE, EXECUTE ANY PROCEDURE and similar) from application usersCRITICALLimit DBA role and SYSDBA grants; review V$PWFILE_USERSUse administrative privileges SYSBACKUP, SYSDG and SYSKM for backup, Data Guard and key tasks instead of SYSDBARun privilege analysis (DBMS_PRIVILEGE_CAPTURE) to find unused privileges before removing themRestrict directory objects and their READ and WRITE grants

Network

Enable valid node checking for registration (VALID_NODE_CHECKING_REGISTRATION_<listener> and REGISTRATION_INVITED_NODES_<listener> in listener.ora)Restrict client addresses with TCP.VALIDNODE_CHECKING and TCP.INVITED_NODES in sqlnet.oraEncrypt client traffic with Native Network Encryption (SQLNET.ENCRYPTION_SERVER = REQUIRED, AES256) or TLSCRITICALEnable integrity checking (SQLNET.CRYPTO_CHECKSUM_SERVER) when using Native Network EncryptionRestrict listener administration to the local OS owner and do not set a listener password on 12c and laterFirewall the listener port so only application and admin hosts can reach it

Auditing

Confirm the predefined unified audit policies ORA_SECURECONFIG and ORA_LOGON_FAILURES are enabled (AUDIT_UNIFIED_ENABLED_POLICIES)CRITICALAdd policies for account and role changes (ORA_ACCOUNT_MGMT) and parameter changes (ORA_DATABASE_PARAMETER)Create a custom policy for direct changes to sensitive ERP tables from non-application accountsPlan the move to pure unified auditing (relink uniaud_on) after testingSchedule audit trail purge with DBMS_AUDIT_MGMT after the trail is exported to a log platformKeep AUDIT_SYS_OPERATIONS = TRUE and forward the OS audit trail

Data protection

Use Transparent Data Encryption for tablespaces holding ERP data; TDE requires the Advanced Security option licenceCRITICALStore the TDE keystore separately from database backups and back up the keystoreEncrypt RMAN backups and protect backup media and cloud bucketsMask or subset production data before copying it to test and developmentConsider Data Redaction (part of Advanced Security) for sensitive columns shown in ERP reports

Patching and monitoring

Apply the quarterly Release Update within your patch policy windowCRITICALRun the Database Security Assessment Tool (DBSAT) collector and report, and track findingsReview the alert log and listener log for repeated login failures and errorsRemove sample schemas and unused components from production

Critical items are the controls auditors and attackers check first: default passwords, broad privileges, unencrypted traffic, missing audit and missing patches. Test every revoke and lock against the ERP in a clone first.

Get your DBSAT report reviewed

Send us a DBSAT report from your ERP database and we will rank the findings by real risk for your ERP and note which fixes need application testing.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

How to use it

Run DBSAT first to get a baseline report, then work through each group on a clone of production with the ERP running against it. ERP products often rely on specific grants, so every revoke and account lock needs a regression test of logins, batch and integrations before production. Tick items as they are done, add the evidence (query output or DBSAT section) in your change record, and export the checklist for the auditor. Re-run DBSAT after each RU and after major ERP changes.

Baseline with DBSAT before changing anything.
Test on a clone with the ERP connected.
Keep query output as audit evidence.

Accounts, profiles and the DEFAULT profile

DBA_USERS_WITH_DEFPWD lists accounts that still have their default passwords. The DEFAULT profile ships with ten failed login attempts, a 180 day password life and no verify function, so set a verify function and values that match your policy. 19c also ships ORA_STIG_PROFILE, aimed at DISA STIG requirements, and utlpwdmg.sql creates the ORA12C verify functions. Schema-only accounts, available since 18c, cannot log in directly, which suits ERP schema owners where the application connects through a separate user. Check with your ERP vendor before changing how the application logs in.

Network and auditing

Native Network Encryption and TLS are included with Enterprise Edition and Standard Edition 2 without the Advanced Security option. Set SQLNET.ENCRYPTION_SERVER to REQUIRED only after confirming every client, including batch servers and reporting tools, can negotiate it. For auditing, 19c runs mixed mode by default; ORA_SECURECONFIG and ORA_LOGON_FAILURES are predefined unified audit policies, enabled by default in a new 19c database; check AUDIT_UNIFIED_ENABLED_POLICIES and enable them with AUDIT POLICY if they are missing, which is common after an upgrade. Query UNIFIED_AUDIT_TRAIL for results and purge with DBMS_AUDIT_MGMT once records are shipped to your log platform, otherwise the AUDSYS audit tables, in SYSAUX by default, grow without limit.

Licensing and ERP gotchas

Transparent Data Encryption and Data Redaction are part of the Advanced Security option, an extra cost licence on Enterprise Edition. Database Vault and Label Security are separate options. DBSAT is a free tool from Oracle, available through My Oracle Support. For ERP, the classic risks are shared admin accounts, reporting users with SELECT ANY TABLE, and production copies with live customer and payroll data in test. Fix those first; they matter more than any single parameter.

Frequently Asked Questions

What is the default profile in Oracle 19c?

Every user without an assigned profile uses DEFAULT. Out of the box it allows ten failed logins, a 180 day password life, a one day lock time and a seven day grace time, with no password verify function. Query DBA_PROFILES WHERE profile = 'DEFAULT' to see the values on your database, then tighten them to your policy.

How do I find accounts with default passwords in Oracle 19c?

Query SELECT username FROM dba_users_with_defpwd. It lists accounts whose password matches a known Oracle default. Change the password or lock and expire each account, then rerun the query. DBSAT also reports these accounts in its user accounts section.

Is there an official Oracle Database 19c security guide?

Yes. The Oracle Database 19c Security Guide covers users, profiles, privileges, network encryption, unified auditing and TDE. Oracle also provides DBSAT for automated checks, and DISA publishes an Oracle Database 19c STIG. Use the guide for how, and the STIG or CIS benchmark for which values to set.

Do I need a licence for TDE in Oracle 19c?

Yes. Transparent Data Encryption is part of the Oracle Advanced Security option on Enterprise Edition, which also includes Data Redaction. Native Network Encryption and TLS for client connections do not need that option. Check your licence before enabling encryption features, because feature usage is recorded.

If you want an AI assistant over your ERP that respects these database roles and runs on your own servers with no data leaving the site, we can set that up.

Talk to an Expert Explore More Free Tools

Related Tools

Oracle

More Oracle tools

See all

Oracle Database 19c Security Hardening Checklist for ERP