Oracle Security & Operations
Hardening, patching, auditing, automation
Security and operations is where Oracle databases quietly accumulate risk: patches deferred because they're scary, audit settings nobody owns, hardening checklists with 200 items and no priority. These guides cut that down to what actually matters — quarterly patching demystified (CPU vs RU vs RUR), a hardening checklist that isn't busywork, auditing that answers real questions, and the automation that makes all of it repeatable instead of heroic.
Guides in this pillar
- Oracle Privilege Analysis: You Granted DBA. Here's What They Actually Used.
Oracle Privilege Analysis with DBMS_PRIVILEGE_CAPTURE: how to record the privileges a user really exercises, compare used against granted, and generate the least-privilege revoke list from evidence — including why SELECT ANY TABLE almost always shows up unused, and a lab that proves it. - Oracle Virtual Private Database: Row-Level Security You Can't Route Around
Oracle VPD (DBMS_RLS) without the confusion: how a policy function appends a per-session WHERE clause to the base table, how EXEMPT ACCESS POLICY works, SELECT vs INSERT/UPDATE/DELETE and update_check, and a lab proving three users each see only the rows they should — on counts, sums, and by-id lookups. - Oracle Data Redaction: Mask at Read Time, Prove It Isn't Access Control
Oracle Data Redaction (DBMS_REDACT) without the myths: full, partial, regexp and random masking, who gets redacted via the policy expression and EXEMPT REDACTION POLICY, and a lab proving it is a read-time display control — not encryption at rest and not access control. - Oracle Transparent Data Encryption: Prove the Datafile Is Unreadable
Oracle TDE without the hand-waving: what encryption at rest actually protects, the keystore that is the whole game, tablespace vs column encryption, and proving a stolen datafile is unreadable ciphertext. - Oracle Unified Auditing Without the Noise
Oracle Unified Auditing done right: enable the few policies that matter, migrate off traditional AUD$, read the trail, and why 23ai desupports it entirely. - The Oracle Hardening Checklist That Actually Matters
Oracle hardening without the busywork: close default-password accounts, tame PUBLIC and ANY grants, lock the listener, encrypt at rest, and audit what matters. - Oracle Patching, Demystified: CPU, RU, RUR — and What Changed in 2026
Oracle patching in 2026: what a Release Update is, why RUR is dead, the new monthly CSPU and MRP, and how to apply it with OPatch and datapatch — no outage.