Home › Discussions › Questions & Answers › Column-Level Security: Implementing Oracle VPD to Hide Sensitive Data from Database Users and Developers

Column-Level Security: Implementing Oracle VPD to Hide Sensitive Data from Database Users and Developers

Avatar photoCustomer Questions & Answers 6 replies

Our developers and custom report writers require basic SELECT privileges on many tables, such as HR.PER_ALL_PEOPLE_F, for building complex Blitz Reports. However, due to compliance, they absolutely must not see sensitive columns like DATE_OF_BIRTH or NATIONAL_IDENTIFIER. We need to implement a solution that allows them to query the table but masks these specific columns. Is Column Level VPD the appropriate solution, and how does this affect Blitz Reports run by the privileged APPS user?

6 replies

  • Support Enginatics

    Yes, implementing Column Level VPD is ideal for this scenario, as it allows users to access the table while returning NULL values only for specified, sensitive columns. This is far more efficient than modifying countless view definitions.

  • Avatar photoCustomer

    How do we define the VPD Policy for column restriction? Specifically, how is the list of sensitive columns provided?

  • Support Enginatics

    You create a VPD policy using `DBMS_RLS.ADD_POLICY`. Within this policy definition, you utilize the parameter `sec_relevant_cols` and specify the column names that should be restricted, such as ‘DATE_OF_BIRTH,NATIONAL_IDENTIFIER’. This security cannot be bypassed by SQL statements.

  • Avatar photoCustomer

    Since Blitz Report runs as APPS, how do we prevent the security policy from inadvertently blocking APPS or standard Oracle functionality?

  • Support Enginatics

    If you want to secure data only from general database users (like your developers’ direct accounts) but allow the core APPS user (who executes Blitz Reports) to see data, the Policy Function is designed to check the current database user. If the user is NOT APPS, it applies a predicate like ‘1=2’ or enforces column masking.

  • Support Enginatics

    If the goal is to protect against any external access, including Blitz Reports, the VPD policy must use application context (`sys_context`) to restrict data based on the source module name, ensuring data is hidden when accessed via Blitz Reports.

  • You must be logged in to reply to this post.