Use IPSec or VPNs to protect data excahnge
Luigi D. Sandon, October 25, 2009 - 9:56 am UTC
Besides Oracle Advanced Security, you could set up IPsec or a VPN to protect the data. The difference is that OAS will protect data from one database to the other one, while IPSec or a VPN will protect data between the network adapters, or the VPN endpoints.
I agree exchanging data using files is more dangerous, and SFTP requires an SFTP server to be setup also, increasing, not reducing, the attack surface. It looks to me the "old sysamdin" approach, setting up a SFTP server is easy, while setting up IPSec and VPNs is more work. This way they leave the burden of exporting data, sending data, reimporting data to the db developer, instead of exploiting available technologies to protect the data path.
The CRYPTO-Keeper says...
Duke Ganote, October 26, 2009 - 11:35 am UTC
So is the gist? There are several means of transmitting encrypted data.
1) if dblnk points to a remote account that only accesses encrypted data, then the encrypted data can be securely pulled through TNS. Encryption could occur through DBMS_OBFUSCATION_TOOLKIT in 8i and 9i, or DBMS_CRYPTO in 10g and later. The data is then de-crypted by the receiving system.
2) 10gR2 offers an means of "transparently" encrypting the network data transmissions, which you referenced.
3) Luigi D. Sandon suggests a secure IP or VPN.
BTW, I also found this reference in Oracle Magazine:
https://asktom.oracle.com/Misc/oramag/on-injecting-and-comparing.html
October 26, 2009 - 2:50 pm UTC
change #1 to read
if dblnk points to a remote account that only accesses APPLICATION encrypted data
so as to not confuse that with transparent data encryption