Securing sensitive data with Oracle VPD

Customer June 12, 2019 at 12:47 am

Our data governance policy mandates strict row and column-level control over sensitive data, such as PII and HR details, even for technical users who write custom SQL reports via tools like Blitz Report. How exactly can we implement Oracle Virtual Private Database (VPD) security policies to restrict access within the Blitz Report environment?

Viewing 8 reply threads

Author
Replies
- Support June 12, 2019 at 3:03 pm
  Blitz Report is fully compatible with standard Oracle VPD security policies. This framework is the definitive way to control data visibility. You implement VPD policies at the database layer (row and column level) on the tables containing the sensitive data.
- Customer June 13, 2019 at 10:26 am
  If a consulting team uses Blitz Report’s ability to ‘drop their favorite SQL scripts’ directly into the tool , how does the system ensure that the VPD policies are applied immediately and transparently to their queries?
- Support June 14, 2019 at 4:36 pm
  The policy function is dynamically applied by Oracle whenever the underlying table is accessed. If you define a VPD policy on a table accessed by a Blitz Report query, the policy function modifies the SQL statement *before* execution, typically by adding a dynamic `WHERE` clause (predicate).
- Customer June 15, 2019 at 12:04 am
  Can you elaborate on how we secure data that is designated as sensitive, such as Human Resources data, from unauthorized report execution?
- Support June 16, 2019 at 12:43 pm
  For sensitive data, such as Human Resources information, access can be strictly secured by configuration within Blitz Report itself, beyond the VPD layer. However, the foundational security mechanism relies on VPD, ensuring that even if a developer with SQL access attempts to query a restricted table via Blitz Report, the database only returns data permitted by their security profile.
- Customer June 18, 2019 at 3:35 pm
  What is the primary audience for this security implementation strategy?
- Support June 20, 2019 at 7:06 am
  This is crucial for Oracle EBS implementation and project support consultants managing extensions or upgrades, as well as business users needing to validate reports. The VPD feature within the Blitz Report framework allows us to protect sensitive master data while still supporting flexible reporting needs.
- Customer June 20, 2019 at 2:26 pm
  We are specifically concerned that our technical staff, who inherently have high privileges, might bypass standard EBS controls. Does VPD mitigate this risk effectively?
- Support June 21, 2019 at 8:29 pm
  Yes, VPD is effective because it enforces security at the data layer itself, independent of the application that generates the SQL. It ensures that data governance rules are respected when securing developer SQL access, preventing the accidental or unauthorized exposure of data.
Author
Replies

Viewing 8 reply threads

You must be logged in to reply to this post.