Proposte ORACLE per la modernizzazione dello sviluppo applicativo

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |
Oracle e CRUI
Webinar ICT – Gennaio 2019
Gabriele Folchi
Cloud Platform Representative
gabriele.folchi@oracle.com

Safe Harbor Statement
The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.
3

Agenda
• Oracle, oggi
• La collaborazione con la CRUI e le soluzioni proposte
• Webinar 2: Soluzioni per lo Sviluppo “Digital”
4
 Esposizione sintetica, poi successivi webinar e sessioni di approfondimento
 Domande in chat e Survey,
 Acronimi…

Oracle, oggi
5

Oracle, oggi
• Cloud Provider globale…
• Open-
• Data Lake
• Machine Learning
• Sviluppo e Architetture Cloud Native
• …nel segmento “Enterprise”
• Performance e Resilienza Enterprise: IaaS “Gen2”
• Conformità (GDPR) e Governance Enterprise
• Costi e Semplicità di configurazione
• Opzioni per la migrazione Enterprise
• Espandibilità Enterprise: IaaS + PaaS + SaaS,
“Autonomous”
• Lift and Shift, Improve
6
Non più soltanto leader del Database

Gen 2 Cloud Built for High Performance, Security & Governance
NVMe storage Load Balancers, …Bare Metal VMs Exadata, RAC
PHYSICAL NETWORK
DATACENTERSREGION
VIRTUAL NETWORK
COMPUTE, STORAGE,
DATABASE, LBs, …
Availability
Domain 1
Availability
Domain 2
Availability
Domain 3
Compartments,Monitoring,CoreSecurity
Edge Security (DDoS, Traffic Steering, WebApp Firewall, Health Monitoring)
3 datacenter (AD) per Metro Area
1 msec di latenza tra AD
25/100 Gbs NIC
1,5 - 100 microsec intra AD
Non oversubscribed
Offbox virtualization
https://blogs.oracle.com/oraclemagazine/infrastructure-as-a-service-re-created
BareMetal as a Service, bring your own
hypervisor
Container, VM, Engineered Systems as a Service

Only Cloud with 3 Service Level Agreements
Preminent cloud
provider
Availability Covered Covered
Performance Covered No coverage
Manageability Covered No coverage

Oracle Cloud Offers the Most Aggressive Pricing
Oracle
Preminent
cloud provider
Oracle costs:
Compute
Standard compute core/hours
$0.03 $0.096 68% less
Block Storage
1 TB @ 25K IOPS /per month
$43 $1,750 97% less
Network
100 TB egress per month
$76 $7,800 99% less
https://cloud.oracle.com/en_US/cost-estimator

For on-premise customers Oracle Cloud Offers more capacity per
license than other authorized cloud providers
• Su Oracle Cloud
– 2 OCPU = 4 vCpu = 1 Licenza on-prem
• Amazon EC2 and RDS - count two vCPUs as equivalent to one Oracle Processor license if
hyper-threading is enabled, and one vCPU as equivalent to one Oracle Processor license
if hyper-threading is not enabled.
• Microsoft Azure – count two vCPUs as equivalent to one Oracle Processor license if
hyper- threading is enabled, and one vCPU as equivalent to one Oracle Processor license
if hyper- threading is not enabled.
https://www.oracle.com/assets/cloud-licensing-070579.pdf

Oracle Cloud Offers a Comprehensive Set of Cloud Services

…and worldwide Internet Intelligence
https://map.internetintel.oracle.com

Oracle Cloud: formule di pricing
• Pay as you Go
– Provision resources on demand with no upfront commitment, and pay only for what
you use
• Universal Credit
– Discounted, predictable spending, and complete resource flexibility with monthly
commitment
• Receive a discount by committing to a minimum one-year and $1000 USD monthly credit
• Usage is consumed from your monthly prepaid commitment
• Any overage is charged at the same discounted rate
– + “Bring your Own License” to PaaS
• Leverage existing on-premises licenses to reduce PaaS costs
https://cloud.oracle.com/en_US/pricing/options

“We were seeing 75%
utilization and 60X
performance improvements
over other cloud providers”
Navindra Yadav, founder,
Cisco Tetration

Oracle è Cloud Service Provider (CSP) certificato AgID
• Cloud Service Provider certificato AgID
– https://cloud.italia.it/marketplace/supplier/
market/index.html
– IaaS, PaaS, SaaS

Approfondimenti online
• https://cloud.oracle.com/home (home)
• https://cloud.oracle.com/en_US/cost-estimator (configuratore online)
• https://myservices.us.oraclecloud.com/mycloud/signup?language=en (trial)
• https://docs.oracle.com/en/cloud/ (documentazione online)
16

La collaborazione Oracle / CRUI
18

La transizione al “Digital”
• Servizi self-service online, multicanale
– Applicazioni attuali e nuove
– Per interni e esterni
• Conoscenza e gestione 360° del “Cliente”
• Creare valore distintivo sul Mercato globale

Transizione Digital per l’IT
– Attuali e nuovi
Infrastrutture
IT
Sviluppo
IT
Strategie
 Maggiore
efficientamento
dell’ on-prem
 Capacità On
Demand
 Maggiore
Continuità
 Maggiore
Protezione
 Archittture
modulari e
distribuite
 Prototipazione
Continua e
Sviluppo Rapido
 Integrazione e
Federazione
con sistemi
esterni
 Dematerializz.
processi e asset
 Collaborazione
team
 Comunicazione,
Self-Service
 Analitica
 Offerta e Ricerca su tecnologie di
frontiera

Le Soluzioni Oracle…
– Attuali e nuovi
Infrastrutture
IT
Sviluppo
IT
Strategie
Maggiore
efficientamento
dell’ on-prem
Capacità On
Demand
Maggiore
Continuità
Maggiore
Protezione
(Micro)Servizi
Prototipazione
Continua e
Sviluppo Rapido
Integrazione e
Federazione con
sistemi esterni
Dematerializzazione
processi e asset
Processi
Collaborativi
Comunicazione,
Self-Service
Analitica
Offerta e Ricerca su tecnologie di
frontiera
Soluzioni per
le
Infrastrutture
Digitali
Soluzioni per
lo Sviluppo
Digitale
Soluzioni per la
Comunicazione
Digitale
Soluzioni per la Ricerca

Soluzioni per le
Infrastrutture Digitali
…nel contesto della roadmap AgID del Piano Triennale ICT
Soluzioni per le Infrastrutture
Maggiore
efficientamento
dell’ on-prem
Capacità On
Demand
Maggiore
Continuità
Maggiore
Protezione
Appliance HWConsolidamento HW, Automazione
Consolidamento SW, Automazione
Offloading “on-demand”
Off-site DR
GDPR
Upgrade DBEE
Storage (& Backup) in Cloud
Linux
Dev, Test & MOOC in Cloud
Offsite DR dei Dati
GDPR in-db
DC in Cloud
DR “intra” Cloud
GDPR & Cybersecurity
in Cloud
Riduzione investimenti on-prem Migrazione a Cloud
Obiettivi ICT

Soluzioni per lo
Sviluppo
Soluzioni per lo Sviluppo
Piattaforme “Container-native”Container e Serverless
DataStore “multimodello”
Sviluppo “LowCode “
Identity Federation
GDPR
REST/JSON in database
APEX 18.1
Identity Cloud Service
GDPR in-db
Piattaforme Container
GDPR & Cybersecurity
in Cloud
 Archittture
modulari e
distribuite
 Prototipazione
Continua e
Sviluppo
Rapido
 Integrazione e
Federazione
con sistemi
esterni
Obiettivi ICT

Soluzioni per la
Comunicazione
Soluzioni per la Comunicazione
Customer Experience Cloud Service
Gestione Digiitale dei Contenuti e Processi
Integrazione con strumenti di collaboration
Sviluppo rapido di micrositi, multicanale e conversazionali
Integrazione rapida con API esterne
Analitica rapida e self-service
VisualBuilder Cloud Service, DigitalAssistant
Integration Cloud Service
DataVisualization
Dematerializzazione
processi e asset
Processi
Collaborativi
Comunicazione,
Self-Service
Analitica
Pilot su Cloud
Obiettivi ICT

Soluzioni per lo
Sviluppo
Soluzioni per la Ricerca
HPC CloudHPC in Cloud
DataScience
Internet of Things, Industry 4.0
Offerta e
Ricerca su
tecnologie di
frontiera
DataScience Platform
Internet of Things Cloud Service
Blockchain Blockchain CloudService
Obiettivi Ateneo
Pilot su Cloud

Ulteriori Approfondimenti
Survey
• Importante per
– Approfondimenti di dettaglio
– Identificare aree di maggiore interesse, migliori condizioni di convenzione

Sessioni webinars

Soluzioni per lo
Sviluppo
DataStore “multimodello”
Sviluppo “LowCode “
Identity Federation
GDPR
REST/JSON in database
APEX 18.1
GDPR in-db GDPR & Cybersecurity
in Cloud
(Micro)Servizi
Prototipazione
Continua e
Sviluppo Rapido
Integrazione e
Federazione con
sistemi esterni
Obiettivi ICT
Piattaforme “Container-native”Container e Serverless Piattaforme Container

REST / JSON in-db
30
REST / JSON in DB

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 31
On premise e in Cloud
Oracle Database “Multi Modello”:
Accesso REST e utilizzo come Document Store JSON
JSON
JSON
Via RESTful service
Via Native APIs
Data persisted
in database
In JSON
SQL
Data analyzed via SQL
Oracle
REST Data Service
REST / JSON in DB

Oracle REST Data Services
HTTP(s) API App-Dev with Relational Tables in Oracle Database
{ “custno”: 1001,
“name”: “Scott King”,
“address”: “500 Main street, Innovation CA”,
“orders”: [ { “orderno”: 404,
“orderdate”: “Feb 27, 2014”,
“status”: “in process”} } }
{ “orderno”: 303,
“orderdate”: “Feb 26, 2014”,
“status”: “in process”} ] }
JSON
HTTP(s)
https://myhost/myapp/hr/customerorders/1001
Oracle REST
Data Services
SQL
SQL result to
JSON
transformation
URI Request or HTTP(s) post
mapped to SQL request
JDBC
Connection
Pool
Oracle Database
URI
Module
Template
Context Root
https://www.oracle.com/database/technologies/appdev/rest.html
GETTING STARTED: https://docs.oracle.com/en/database/oracle/oracle-rest-data-services/18.4/qsord/get-
started-with-oracle-rest-data-services.html#GUID-14BE2F08-842E-4D2F-86B9-EA245B8487F9

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 33Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle REST Data Services 3.0
RESTful access to relational data returned in JSON format
• Oracle REST Data services is an enhanced version of a Java based mod_plsql clone we already ship
• Maps requests to SQL and transforms results to JSON, CSV, Binary and even Excel
• Data service request mappings can be defined using Oracle SQL Developer 4.1
http://myhost/hcm/employees/10
SELECT * FROM EMP
WHERE DEPTNO = :b1
Oracle DBBrowser
1. Browser RESTful get request
2. ORDS maps to “EMPLOYEES” SQL
ORDSRuns in WLS, Tomcat,
Glassfish container
Oracle
REST
Data
Services
REST / JSON in DB
https://www.oracle.com/database/technologies/appdev/rest.html
GETTING STARTED: https://docs.oracle.com/en/database/oracle/oracle-rest-data-services/18.4/qsord/get-
started-with-oracle-rest-data-services.html#GUID-14BE2F08-842E-4D2F-86B9-EA245B8487F9

Simple Oracle Document Access (SODA)
34
Oracle as JSON document store
• Transactions and consistency
• Advanced SQL engine
• Enterprise-Grade High Availability
• Enterprise-Grade Security
• Scalability and Performance: Exadata and Real Application Clusters
• Same administration, backup/restore procedures as Oracle DB
• Oracle Cloud Infrastructure: Oracle Database Cloud Service
REST / JSON in DB
https://docs.oracle.com/en/database/oracle/oracle-rest-data-services/18.2/adrst/using-soda-
rest.html#GUID-C67498D7-5783-4969-80EF-C180CEC1144A

Insert JSON documents via REST
Data persisted in database
In JSON
JSON
JSON
REST API
PUT /my_database/my_schema/customers
Content-Type: application/json
Body:
{
"firstName": "John",
“lastName”: "Smith",
"age": 25,
"address": {
"streetAddress": "21 2nd Street",
"city": "New York",
"state": "NY",
"postalCode": "10021“,
"isBusiness" : false },
"phoneNumbers": [
{"type": "home",
"number": "212 555-1234“ },
{"type": "fax",
"number": "646 555-4567“ } ]
}

Access JSON Documents via SQL
Data persisted in database
In JSON
JSON
JDBC/ODBC
SQL
SELECT c.json_document.firstName,
c.json_document.lastName,
c.json_document.age,
c.json_document.address.streetAddress,
c.json_document.address.city,
c.json_document.address.state,
c.json_document.address.postalCode
FROM "MyCollection" c;
firstName lastName address.city
----------- ----------- --------------
“John” “Smith” “New York”

Representing rows as objects
37
select JSON_OBJECT(
'Id' is EMPLOYEE_ID,
'FirstName' is FIRST_NAME,
'LastName' is LAST_NAME
) JSON
from HR.EMPLOYEES
JSON
------------------------------------------------------
{"Id":100,"FirstName":"Steven","LastName":"King"}
{"Id":101,"FirstName":"Neena","LastName":"Kochhar"}
{"Id":102,"FirstName":"Lex","LastName":"De Haan"}
{"Id":103,"FirstName":"Alexander","LastName":"Hunold"}
{"Id":104,"FirstName":"Bruce","LastName":"Ernst"}
{"Id":105,"FirstName":"David","LastName":"Austin"}
{"Id":106,"FirstName":"Valli","LastName":"Pataballa"}
{"Id":107,"FirstName":"Diana","LastName":"Lorentz"}
{"Id":108,"FirstName":"Nancy","LastName":"Greenberg"}
{"Id":109,"FirstName":"Daniel","LastName":"Faviet"}
{"Id":110,"FirstName":"John","LastName":"Chen"}
• Generates a JSON Object from each
row returned by the query
• The Object contains a key:value pair
for each pair of arguments specified
in the JSON_OBJECT operator

Learn More about Oracle, JSON and SODA
• Oracle JSON document store on the Oracle Technology Network
– http://otn.oracle.com/database/application-development/oracle-document-
store/index.html
• Downloadable Oracle JSON Code samples on Github
– https://github.com/oracle/json-in-db
• LiveSQL: https://livesql.oracle.com/apex/f?p=590:1000
38

LiveSQL
https://livesql.oracle.com/

“LowCode”:
sviluppare applicazioni moderne con APEX 18.1
40
LowCode: APEX 18.1

Sviluppare “Low Code” moderne UI responsive:
APEX 18.1
Database-centric web application development framework
Develop desktop and
mobile web apps
Visualize and
maintain
database data
Leverage SQL Skills
and database
capabilities
LowCode: APEX 18.1

Oracle APEX
Use Cases
Developing opportunistic
& self service web apps
Extending enterprise
application solutions
Migrating file based and
client server apps to the web

Oracle APEX
Distinguishing Characteristics
App Development IDE is
a web browser.
No client software
needed
App definitions are stored in
the database as meta data.
Declarative – No code
generation
Page generation is efficient
with only one request and
one response.
Data processing done in the
Database

Oracle APEX
• No-cost fully supported feature
• Any number of apps, developers & end-users
• Specialized Oracle Support Team
• 11gR2, 12c, 18c
• All DB editions: EE, SE, XE
• Included with Oracle Cloud Services
• Database Cloud Service
• No cost evaluation http://apex.oracle.com
• Easy to install
• Included by default with all editions of Oracle database
• Download latest release from https://apex.oracle.com/otn
No cost feature of the Oracle Database

Features: Multiple, etherogeneous Data Sources
Utilize the Oracle Database / ORDS / Web Services
Local Data Source
HTTPS
REST, SOAP
Oracle Database & APEX
JDBC
JDBC
Remote Data Sources & Services
(REST enabled SQL)
Enterprise Data Sources
and Services
Database Link
https://www.oracle.com/technetwork/developer-tools/apex/overview/apex-181-new-features-otn-4491380.pdf

• Oracle APEX 18.1 introduces a new data source type called "Web Source Modules",
a declarative method to define references to external REST APIs and generic JSON
data feeds.
• Web Source Modules store additional metadata about how to parse response data
and map it as a virtual table with rows and columns.
• A module can contain one or many Web Source
Operations which are the references to a concrete
external web service.
• Create and maintain Web Source Modules in
Shared Components.
46
Features: Web Source Modules
Integrare velocemente molteplici fonti dati: generiche API

• Create and manage REST Services in any schema assigned to a Workspace
• Generate Swagger documentation
47
Features: ORDS Repository
Esporre velocemente dati come API REST

• New Gantt Charts
• Based on JET ojGantt component
• Responsive, theme-able, WAI-ARIA compliant
• New Chart Types – Pyramid, Box Plot
• New Chart-Level Attributes:
• Fill Gaps in Chart Data – Yes / No
• Sort Order
• New Series-Level Attributes:
• Display As
• Value Aggregation
• Enhanced Sample Charts application
48
Features: Oracle JET & jQuery Upgrade
Integrare nuovi widget javascript

• New authentication scheme –
Social Sign-In
• Supports Oracle Identity Cloud Service,
Google, Facebook, OpenID Connect,
OAuth2
• New authentication scheme attribute
"Switch in Session" for schemes that
can be set in the current session.
49
Features: New Authentication Scheme

Features: Sample Datasets

Development / Deployment Options
Local
• Install on stand-alone laptops
using Oracle Express Edition (XE)
or full database version
• Simply upgrade APEX to the
required version
• Can work completely
disconnected
On-Premise
• Typically run by the IT
Department
• IT generally both production
operations service, and a service
provider
• Departments responsible for
application development
Cloud
• Deploy Internet applications
• Leveraged for fast application
development, user acceptance
and training.
• Prototyping & Proof-of-Concept
• Consulting companies develop
for deployment on customer
premise
Browser based application development framework enables efficient development & deployment

• Over 500,00 developers worldwide
• Estimated from support requests,
downloads, conferences, discussion forum
activity
• More than 100 active bloggers
http://odtug.com/apex
• http://apex.oracle.com/community
Consulting companies, books, success
stories, quotes, commercial apps
Community
Oracle APEX

http://apex.world
Community-authored site providing:
• Plug-ins
• Slack discussion channels
• Twitter feeds
• News
• Jobs
• Conferences
• Meetups
Community site built by the community for the community
Oracle APEX

Sviluppo “Cloud Native”
54
Cloud Native

Sviluppare su Docker / Kubernetes Cloud Native
https://developer.oracle.com/devo/containers

Oracle Linux Cloud Native Environment Cloud Native
• features to develop microservices-based applications that can be deployed in
environments that support open standards and specifications
– 2 Container Infrastructure runtimes
• Oracle Container Runtime for Docker package available for Oracle Linux 7 on both the x86_64 and Arm
architectures
• Kata Container software to deliver the framework for creating lightweight virtual machines that can easily plug
into a container ecosystem (Developer preview)
– Container Orchestration and Management
• Oracle Container Services for use with Kubernetes, based on the upstream Kubernetes project and released
under the CNCF Kubernetes Certified Conformance program
• CRI-O, an implementation of the Kubernetes CRI (Container Runtime Interface) to enable using Open Container
Initiative compatible runtimes, is available in preview

Oracle Linux Cloud Native Environment (cont.) Cloud Native
– Cloud Native Networking
• Flannel used in Oracle Container Services for use with Kubernetes today and simplifies container-to-container
networking
• Container Network Interface (CNI) project currently incubating under CNCF
• Coming soon Calico
– Cloud Native Storage
• included by default in Oracle Container Services for use with Kubernetes a plugin for Gluster Storage
• Container Storage Interface (CSI) which was released in alpha beginning with Kubernetes 1.9 (developer
preview)
– Continuous Integration / Continuous Delivery
• Jenkins X, available in preview
– Observability and Diagnostics
• Prometheus
• In addition, integration with 3rd party “exporters”: Fluentd provides an exporter for Prometheus

Immagini Oracle software per Docker / Kubernetes
• Immagini Docker del software Oracle sono
disponibili su Oracle Container Registry
• Script per build Docker sono disponibili su
GitHub
• Kubernetes Operator per WebLogic e MySQL

Sviluppo Serverless open: FNProject
• FNProject è una piattaforma Open, 100% ibrida
– Basata su Docker
– Configurabile anche su Kubernetes
• Poliglotta, estendibile e performante
– Java, Python, Node, Ruby, Go, Php, …
– 0 annotazioni nel codice sorgente
 brew install fn
 fn start
 fn init --runtime go hello
 $ fn run Building image hello:0.0.1 ........... {"message":"Hello World"}
Cloud Native
https://fnproject.io

Sviluppo Cloud-Native sul Cloud Oracle IaaS
An open approach to Cloud Native Applications
Build
DeployOperate
Containers and Functions
Events
Streaming
Monitoring
Notifications
Auto Scaling
Orchestration
• Embrace open
source and open
standards
• Works with on-prem
and on other clouds
• No vendor lock-in
Cloud Native

• Cloud Native
– Standard Docker and Kubernetes
– Registry Integration
– Integrated with virtual cloud
networking and storage
• Developer Friendly
– Streamlined workflow
– Full REST API
– Built in cluster add-ons
– Open standards
• Enterprise Ready
– Simplified Cluster Operations
– Full Bare Metal Performance and
Highly Available IaaS
– Team Based Access Controls
– Autonomous Clusters
Oracle Cloud:
Container Engine for Kubernetes and Registry
Customer ManagedOracle Managed
OCI Container Engine
for Kubernetes
Cluster Management
Container Engine
Dashboard
Oracle Cloud Infrastructure
OCI Registry
In-flight and at rest
data encryption
VM based Clusters and Nodes
Bare Metal Clusters and Nodes
Customer’s OCI
Account/Tenancy
HA - 3 Masters/etcd
across 3 ADs

Risorse online per sviluppo “Cloud Native”
• https://cloudnative.oracle.com/learn.html

Last but not least: Oracle VirtualBox
• https://blogs.oracle.com/scoter/virtualbox-3
Cloud Native

Federazione delle Identità
64

Core and Edge Create a Complete Cloud
Users
[Customers, Partners,
Employees, Things] IT
[DevOps, Administrators,
Architects]
Expectation
[High quality experience]
Identity
Compute Block Storage
Database Networking
Object Storage
Edge
Name
Resolution
Distributed
Content
Traffic
Steering
Internet
Monitoring
Availability
Performance
Security
Control
Edge
Networking
Edge
Security
Core+
End-to-End SLA
No Single Point of
Failure
Common Console
Across Functionality
Email
Delivery

Identity Cloud Service:
Manage Users across on-premises and cloud applications
66
• Synchronize user identities from on-premises AD or
OIM
• Federate to external SAML Identity Provider
• Provisioning & Deprovisioning to Cloud Apps
– Flexible Attribute Configuration using Expression Language
– Full provisioning as well as incremental provisioning
options
– Admin-configurable actions for user termination events
– Deactivate user account – block, disable or delete account
OIM SAML IDP
Oracle Identity
Cloud Service
3rd Party Apps

Open and Standards-based
• API first design
• 100% standards-based: SAML,
SCIM, OpenID Connect and OAuth
• Sustaining board member of
OpenID Foundation
• Leading OpenID FastFed Working
Group to simplify and accelerate
app integrations
Oracle PublicCopyright © 2016, Oracle and/or its affiliates. All rights reserved. |

• User, Group and Role-based Access
Control
• Multi-Factor Authentication for
strong security
• OAuth protection for Application
APIs
68
Manage Policies to secure Application Access

Data Protection e conformità con GDPR
69
GDPR

Most business data is in databases
– Manage large amounts of data
– Easy to retrieve, search and analyze
– High performance
Verizon Breach Report 2018
– Top asset breached: database (20%)
– Internal actors involved: 28% (up 12%)
– 57% of internal attacks on databases
70
Why Focus on Databases?
Databases may be
your most valuable
information asset
Databases may be
one of your
greatest liabilities
Conformità GDPR
https://www.oracle.com/technetwork/database/security/wp-security-dbsec-gdpr-3073228.pdf
GDPR

GDPR Articles and Mapping to Oracle Database Security
GDPR Article Protection Mechanism Oracle Mapping
Article 35 Data Protection Impact Assessment Database Security Assessment Tool
Database Vault
Article 32 Pseudonymization and encryption of personal data Advanced Security, Key Vault
Article 25, 29 Data protection by design and by default
Processing under the authority
Database Vault
Article 30, 33 Notification of a personal data breach Audit Vault and Database Firewall
Security Monitoring and Analytics Cloud Service
Article 18, 25,
32
Right to restriction of processing
Data protection by design and by default
Label Security
Articles 25, 32 Pseudonymisation and encryption of personal data
Data Minimization
Data Masking and Subsetting
Article 25 Data Protection by Design and Default All of the above

Database Security for GDPR
Config Assessment
User policies
Data Discovery
Privilege Analysis
Activity Auditing
Reporting/Alerting
Database Firewall
Monitor/Analytics Encryption
Key Management
Data Masking
Data Redaction
Admin Control
Row Security
Label Security
Real App Security
Crypto Toolkit

Oracle Database Maximum Security Architecture
options per un approccio incrementale
Apps
Transparent
Data
Encryption
Key Vault
###-##-5100
Data Redaction Database
Firewall
Privilege
Analysis
Data Masking
010-11-5100
022-22-5001
Audit
Vault
Audit Data
Test Dev Partners
Database
Vault
DB Security Assessment Tool

Discover Sensitive Data
Sensitive Data Discovery
• Locate sensitive data using an extensible
library of common descriptors
• Scans column name and comments
• Includes type and amount of sensitive data
• Integrated with Audit Vault Privacy Reports
• Simple to install and run – results in
minutes
• Available for use with your Database at no
additional cost

Assess Database to Identify Configuration Risk
Configuration Scan and Risk Analysis
• Scan database configuration and assess
against common best practices
– CIS Benchmark
– GDPR
• Provides risk finding and remediation
recommendations
minutes
additional cost
Config &
Parameters

Assess Database to Locate High-Risk Users
User Risk Assessment
• Identify membership in sensitive roles
• Identify grants of critical privileges
• Locate users who present excessive risk
– Passwords that never expire
– Unlimited failed login attempts
– Unencrypted Data
minutes
additional cost

Identify Excessive Privilege Grants
Oracle Database Enterprise Ed.
Privilege Analysis
• Implement least privilege and reduce risks
• Report on actual privileges and roles used
in the database, not just what privileges
have been granted
• Helps revoke unnecessary privileges
• Increase security without disruption
Create…
Drop…
Update…
DBA role
APPADMIN role
Unused
Update
APPADMIN
Privilege
Analysis
Application

Advanced Security
Protect Data at Rest
Encryption and Redaction
• Encrypt data at rest with Transparent Data
Encryption
– Column and Tablespace Encryption
• Encrypt database exports with Data Pump
Encryption
• Encrypt database backups with RMAN
Encryption
• Control the display of sensitive data with
Data Redaction

Control the Display of Sensitive Data
Advanced Security
Data Redaction
• Dynamic masking of application data based
upon user name, IP, application context,
and other session factors
• Full, partial, fixed, regexp redaction
• Library of redaction policies and point-and-
click policy definition
• Transparent to typical applications
• No impact on operational activities
 Use Case: Good candidates include display-oriented
screens, reports, and dashboards.
Credit Card Numbers
4451-2172-9841-4368
5106-8395-2095-5938
7830-0032-0294-1827
Redaction Policy
xxxx-xxxx-xxxx-4368 4451-2172-9841-4368
Billing DepartmentCall Center Application

Encrypt Data-in-Motion - Native
Oracle Database
Oracle Native Network Encryption
• Transparent to most clients, a single
parameter on the database server enables
or disables encryption
• No application changes
• Automatically selects the highest mutually
supported encryption algorithm between
the client and server
• Available in all supported Database
Versions and Editions at no additional cost
Clear Text Sensitive Data
1%^@8#^@91a^%
X

Reduce Risk and Control Storage Costs for Test DBs
Data Subsetting
• Provides a relationally intact and yet
fractional representation of production
data for test and development
• Subsetting may be based upon a
percentage of production data, or upon a
selection criteria. e.g.:
– Retain 15% of data
– Retain Departments 20 and 50
• May be combined with Data Masking to
produce smaller test databases without
sensitive data

Reduce Security Risk in Test and
Development Databases
Data Masking
• Anonymize sensitive or personal data to
remove security risk
– Key part of compliance with GDPR and other
data privacy regulations
• Minimize the amount of sensitive data you
are storing
• Format replacement data such that
applications continue to function normally
• Retain referential integrity, both within a
single database and across multiple
different databases
LAST_NAME SSN SALARY
AGUILAR 203-33-3234 40,000
BENSON 323-22-2943 60,000
Non-production
Production
LAST_NAME SSN SALARY
ANSKEKSL 323-23-1111 60,000
BKJHHEIEDK 252-34-1345 40,000

Manage Database Users in an LDAP Directory
Oracle Database
Enterprise User Security
• Available Oracle 8i and above
• Authenticate and Authorize Database Users
– Shared and Dedicated Schemas
– Kerberos, Certificate, and Password
authentication
• Database users and roles managed in an
LDAP Directory
– Oracle Internet Directory
– Oracle Unified Directory
– Optional virtualization or synchronization
with Microsoft Active Directory
Oracle Internet Directory
Oracle Unified Directory
Microsoft Active
Directory

Control Privileged User Access to Data
Oracle Database Vault
Security Realms
• Mitigate risks posed by attacks that misuse
privileged database accounts
• Protect app sensitive data even by
DBAs/Outsourcers/Partners
• Restrict Privileged Users access to realm-
protected data
• Attempts to bypass realms are audited
• Enforce enterprise data governance,
separation of duties, and least privilege
Procurement
HR
Finance
select * from finance.customers
Application
DBA
Applications
Infrastructure
DBA

Reduce the Risk of Stolen Application Credentials
Oracle Database Vault
Applications
Wrong IP, Program,
and/or time of day
Trusted-Path Command Rules and Realms
• Prevent the misuse of stolen application
service accounts
• Protect against human error
• Exercise control at the connect, schema,
object and/or command execution level
• Allow or deny access to application data
and command execution based on multiple
factors
– IP Address ̶ Operating System Username
– Program used ̶ Time of day

Enforce Access to Data at the Row Level
Oracle Label Security
Data and User Labels
• Controls access to classified data based on
the classification of the data and the
security clearance of the user
• Restrict exposure of sensitive data based
on the security clearance of the user
• Restrict access to data using ad hoc tools
based on the security clearance of the user
• Controls on database operations permitted
based on the security clearance of the user
Sensitive
Confidential
Public
Sensitive

Record and Enforce Consent for
Access and Processing
Oracle Label Security
Data and User Labels
• Record end-user consent in data labels
– Opt-in and Opt-Out models supported
– Consent choices are attached to the data
record
– Enforced for all application and reporting
access
• Control access to personal data records
using user labels for different applications
• Help meet EU GDPR and California
Consumer Protection Act requirements
Sales & Service
Third Party
Data Sales

Oracle Audit Vault and Database Firewall
Monitor Access to Data
Database Activity Monitoring
• Centralized management of audit data for
Oracle and non-Oracle Databases
• Database Anomaly Detection – if it’s new, it
should be investigated
• Support forensic investigation
• Detect and block SQL Injection

Oracle Database Security Resources
– Know more about Database Security
http://oracle.com/database/security
– Free Database Security Assessment Tool
– Database Security and GDPR Whitepaper
https://go.oracle.com/LP=54366
89

GDPR As a Service
an high level solution view
90
Record of Processing
Activities
GDPR Self Sevice
Consent
Management
GDPR Customer
Rights Management
GDPR Discovery
Engine
GDPR
Pseudonomization &
Indexing Engine
Customer App Customer App Customer App Customer App
Cusomer
Data
Cusomer
Data
Cusomer
Data
Cusomer
Data

GDPR As a Service - Discovery and Pseunominization
The Pilot, an high level solution view
91
GDPR D-Engine
Personal and Sensitive
Data Discovery
GDPR P-Engine
Execution of oblivion
and Subject Search
Customer App Customer App Customer App
Cusomer
Data
Cusomer
Data
Cusomer
Data
Search and Identify
Sensitive and Personal
Data. Where are Names,
Surnames?....
Search and Identify
Sensitive and Personal
Data. Where can I find This
Person?....
Provide Subject MAP,
oblivion Statements OR
Execute the
Pseudonimization on
targets (Provide Update
Statements or Execute
those)
PILOT SCOPE

GDPR intend to strengthen and unify data
protection for all individuals within the European
Union (EU)
When personal data are no longer necessary in
relation to the purposes for which they were
collected or otherwise processed, the controller
(Enterprise) must guarantee the erasure of
personal data
Enhance data breach Capability
Speed up Masking and Obfuscation processes
• Data Discovery :
• Identify personal data in Customer
information landscape
• Classify discovered data based on Categories
defined by Customer
• Create e personal data map relevant for
GDPR
• Data Management:
• Execute GDPR Oblivium on specific subject
• Execute Data Masking/Redaction
• Monitoring dato:
• Analyze application access on classified data
and discovered data
• Analyze data breach on discovered data
• Trace data processing within the
Company
GDPRaaSGDPR Requirements
for personal data
GDPR Business Requirement & GDPRaaS Capabilities
The Context and requirements

1. Map all DBs in
scope

2. Configure and
setup all meta
descriptions for all
Dba, Tables and
attributes

19
7
10
1
Personal Data Distribution - PARC
1. Nome
2. Cognome
3. Indirizzo
4. Email
21 5
1239
59
6
37
Number of Personal data Field
CDMM
CRMA
DBAZ
DOMA
MICK
PARC
3. Search COLUMNS
that likely contains
personal data

4. Search ROWS
(sampling) likely
contains personal
data
1. Name
2. Surname
3. Address
4. Phone Number
5. Social Security Number
6. E-mail
7. Document ID
Most Common

4. Search ROWS
(sampling) likely
contains personal
data
Sample Output with
likelihood of relevance for
GDPR Personal Data.
i.e. Col3 is an Email, Col2 is a
name with 75% of probability

Next steps
98

• “Oracle Desk”
– Sportello virtuale settimanale
• Ogni Venerdi h11-13
• Webcast
• Agenda aperta
– Approfondimenti sulle soluzioni
– Indirizzo su questioni architetturali e tecniche
– Pianificazione incontri 1:1
TBD da Febbraio 2019

Oracle “Digital Shift” Tour
• 5 workshops itineranti presso i principali Atenei
– Live Streaming
• Laboratori hands-on di aggiornamento sulle competenze più avanzate
dell’Information Technology “digitale”
– L’infrastruttura fondante per le architetture a Microservizi:
• Docker, Kubernetes e CI/CD
– Le piattaforme evolute per le architetture a Microservizi
• ServiceMesh e Serverless
– Java 11: “alive and kicking”
– Basi Dati Multimodello: REST/JSON
– Deep Learning demistified TBD su richiesta
Soluzioni per
lo Sviluppo

Trial Cloud dedicati
• Ambienti trial dedicati
– Per verifiche tecniche, architetturali
– 1 / 2 mesi
– Su richiesta, assistenza tecnica
Su richiesta

Proposte ORACLE per la modernizzazione dello sviluppo applicativo

Proposte ORACLE per la modernizzazione dello sviluppo applicativo

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Proposte ORACLE per la modernizzazione dello sviluppo applicativo

Similar to Proposte ORACLE per la modernizzazione dello sviluppo applicativo (20)

More from Jürgen Ambrosi

More from Jürgen Ambrosi (20)

Recently uploaded

Recently uploaded (20)

Proposte ORACLE per la modernizzazione dello sviluppo applicativo

Editor's Notes