Oracle Database Security Review
Oracle’s ANY privileges and PUBLIC role can reach every schema in the database at once. We test privileged accounts, PUBLIC grants, the listener, network encryption and database link credentials. CREST-certified testers, fixed price from £2,740 for a 2-day single-system scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Every database user automatically holds the PUBLIC role and it cannot be dropped, so a privilege granted to PUBLIC, whether an ANY system privilege or EXECUTE on a network package, becomes available to every account in the database.
Why Oracle Database security comes down to privileged accounts and what PUBLIC can reach
Oracle’s own documentation for administrative privileges is direct about SYS and the accounts that sit above the ordinary privilege model: by default, the underlying schemas for SYSDBA and SYSOPER are dictionary protected, which stops other users exercising system privileges, including ANY privileges, against them, and the use of administrative privileges is mandatorily audited. Everywhere else in the database, a system privilege that carries the ANY keyword, such as SELECT ANY TABLE or CREATE ANY PROCEDURE, reaches every schema at once, and Oracle’s documentation gives the example of a user with CREATE ANY PROCEDURE creating a procedure in another schema that then runs as that schema’s owner, not the creator, without the owner necessarily knowing. Separate administrative privileges such as SYSBACKUP, SYSDG and SYSKM let Oracle Database split backup, Data Guard and encryption key management away from full SYSDBA access, but each one still bypasses the ordinary object privilege model, so which accounts hold which of these privileges is where we start.
Every account also automatically holds the PUBLIC role, which cannot be dropped, so a privilege granted to PUBLIC becomes available to every user in the database. Oracle Database 12c and later applies fine-grained access control to the UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP and UTL_INADDR packages, so a database upgraded from an earlier release can still carry an EXECUTE grant to PUBLIC on one of these packages from before that control existed, and Oracle’s own documentation confirms the call fails with ORA-24247 rather than succeeding silently once network access control lists are in place without a matching entry. We test which accounts hold EXECUTE on these and other PUBLIC-granted packages, which hosts and ports the network access control lists actually authorise for each principal, and whether an application schema holds broader privileges than the objects it uses.
Where Oracle Database runs changes what we can test. On-premises, we test SYS, SYSTEM, listener configuration and network encryption directly against your infrastructure. On Oracle Autonomous Database, Oracle runs the infrastructure and provides an ADMIN account in place of SYS, connections use mutual TLS through a downloaded wallet by default, and access is controlled through a public-endpoint access control list of IP addresses, CIDR blocks or VCNs or, where configured, a private endpoint instead, so we confirm which model your instance uses before scoping. For estates running more than one database engine, see our wider database security review.
SCOPE
What we review in an Oracle database
Privileged System Accounts and ANY Privileges
SYS is automatically granted the SYSDBA privilege on installation and, like every ANY system privilege such as SELECT ANY TABLE or CREATE ANY PROCEDURE, sits outside the ordinary object privilege model: Oracle’s own documentation notes that a procedure created under CREATE ANY PROCEDURE runs with the privileges of the schema it was created in, not the creator’s, while the SYSDBA and SYSOPER schemas are dictionary protected specifically to stop other users exercising ANY privileges against them. We map every account holding SYSDBA, SYSTEM, the DBA role or an ANY privilege against who actually needs that reach, and confirm no ANY privilege has been granted to PUBLIC.
Default Accounts, Sample Schemas and Password Profiles
Oracle’s installation process locks and expires the sample schema accounts such as HR and SCOTT, while most other predefined accounts are created schema-only with no password at all, and the database’s own DEFAULT profile ships with FAILED_LOGIN_ATTEMPTS set to 10 but no PASSWORD_VERIFY_FUNCTION, so there is no complexity or history check on a password until one is configured. We test whether any sample or predefined account has been unlocked and left with a weak or unchanged password, and whether the profile applied to real accounts enforces complexity, reuse and lockout limits rather than the shipped defaults.
PUBLIC Grants and Network ACLs on UTL_* Packages
Oracle Database 12c and later applies fine-grained access control to UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP and UTL_INADDR, so a database upgraded from an earlier release can still carry an EXECUTE grant to PUBLIC on one of these packages from before that control existed, and Oracle’s own upgrade documentation states the call fails with ORA-24247 rather than succeeding once an access control list is required but no matching entry exists. We test which accounts and roles hold EXECUTE on these and other PUBLIC-granted packages, which hosts and ports the network ACLs actually authorise for each principal, and whether an application schema holds broader privileges than the tables and procedures it uses.
Listener Registration, Administration and Exposure
Oracle Net Listener restricts runtime administration to the operating system user who started it by default, and valid node checking registration also defaults to on, meaning only local IP addresses can register a service with the listener unless a remote host or subnet is added to REGISTRATION_INVITED_NODES, while the ADMIN_RESTRICTIONS parameter that blocks a remote SET command from altering listener.ora at all defaults to off. We test what the listener actually accepts registration and administration from, and whether ADMIN_RESTRICTIONS and valid node checking are configured to match the network it sits on rather than left at their installation defaults.
Network Encryption in Transit
SQLNET.ENCRYPTION_SERVER and SQLNET.ENCRYPTION_CLIENT both default to accepted, so Oracle Net negotiates encryption if the other side offers it but does not require it, meaning an unencrypted client can still connect unless the parameter is explicitly set to required, and Oracle Database 21c deprecated older algorithms including 3DES and RC4 for native network encryption. We test what a client can actually negotiate against every listener endpoint in scope, and whether encryption is enforced with a current algorithm rather than left to the accepted default.
Unified Auditing and Mandatory Audit Trails
Unified auditing is enabled by default and certain security-sensitive activity is always recorded through Oracle’s mandatory audits, but the ORA_SECURECONFIG and ORA_LOGIN_LOGOUT predefined policies that cover most compliance needs are only enabled by default on databases created from release 12.2 and 26ai onwards respectively, since Oracle’s own documentation states that a database upgrade does not enable them automatically. We test which unified audit policies are actually enabled against what a new installation would carry, and whether the audit trail captures privileged account use, schema changes and failed logins.
Database Links and Stored Credentials
A traditional database link’s password is stored obfuscated rather than encrypted in SYS.LINK$ by default, and Oracle’s own documentation for ALTER DATABASE DICTIONARY describes a dedicated command to de-obfuscate and re-encrypt those stored passwords using the TDE keystore, while a definer’s rights unit that uses a connected-user database link needs the caller to hold INHERIT REMOTE PRIVILEGES before it will run. We test whether database link credentials in scope are encrypted rather than merely obfuscated, what each link actually authenticates as on the remote database, and whether INHERIT REMOTE PRIVILEGES has been granted more widely than the procedures that need it.
Definer’s Rights PL/SQL and AUTHID
AUTHID DEFINER is the default for a PL/SQL function, procedure, package or type when no AUTHID clause is specified, and Oracle’s own documentation confirms that a definer’s rights unit runs with the privileges and schema of its owner rather than its caller, with only the PUBLIC role enabled for the duration of the call. We test installed definer’s rights units for logic that can be influenced by an untrusted caller, for name resolution that could be hijacked, and whether AUTHID CURRENT_USER would remove the need for the elevated privilege in the first place.
Backup and RMAN Access
RMAN backup encryption is off by default and has to be configured explicitly with CONFIGURE ENCRYPTION FOR DATABASE ON against an Oracle keystore, so a database protected by Transparent Data Encryption at rest can still produce unencrypted backup sets if that configuration was never set, and Oracle provides a dedicated SYSBACKUP administrative privilege, separate from SYSDBA, for RMAN and SQL*Plus backup and recovery operations. We test whether backups in scope are actually encrypted, who holds SYSBACKUP or equivalent access to the recovery catalog and backup destination, and whether that access is scoped to backup and recovery rather than full administrative reach.
Oracle Cloud: Autonomous Database vs On-Premises
On Autonomous Database, Oracle manages the infrastructure and provides an ADMIN account in place of SYS, connections use mutual TLS through a downloaded wallet by default, and access is controlled through a public-endpoint access control list of IP addresses, CIDR blocks or VCNs or, where configured, a private endpoint instead, whereas on-premises the equivalent controls, SYS and SYSTEM, listener configuration and network encryption, sit entirely with you. We confirm during scoping which model your instance uses, test the roles, ACL or private endpoint configuration and application code you control, and work to Oracle’s own Cloud Security Testing Policy where it affects what can be tested directly.
OUR PROCESS
Oracle Database Security Review: From Scope to Attestation
Scope and Access
We agree which Oracle Database instances, PDBs or Autonomous Database services are in scope, plus an account for every privilege tier you want tested and, where relevant, a SYSDBA or Oracle Cloud console credential to review configuration.
Privilege and Configuration Mapping
We map every account holding SYSDBA, SYSTEM, the DBA role or an ANY privilege, PUBLIC and network ACL grants, listener and network encryption settings, and database link credentials against what each is actually meant to have.
Manual Testing
A CREST-certified tester manually tests privileged account boundaries, PUBLIC and network ACL grants, listener administration, definer’s rights PL/SQL and database link authentication, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Oracle Database pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Oracle Database Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Oracle Database For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Oracle Database Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Oracle database?
We need at least one authenticated account for every privilege tier in scope, from an ordinary application account through to one that can query DBA_SYS_PRIVS, DBA_ROLE_PRIVS and DBA_USERS for configuration review. A SYSDBA or Oracle Cloud console credential speeds up configuration checks but is not required to run the manual test itself.
Will testing touch live data?
We test the instances, PDBs or Autonomous Database services you nominate, working against your actual accounts, privileges and schema structure rather than a copy, so we agree exclusions such as destructive statements, bulk data changes or production RMAN targets before testing starts. We do not run destructive tests or export real customer data without that agreement in writing.
Do you test on-premises and Oracle Cloud (Autonomous Database) the same way?
The underlying questions are the same: who holds SYS, SYSTEM or an ANY privilege, what PUBLIC can reach, and what the network exposes. What differs is the boundary, since Autonomous Database gives you an ADMIN account instead of SYS, moves the listener and host to Oracle, and controls access through a wallet, mutual TLS and an access control list or private endpoint, so we confirm during scoping exactly what you control on your deployment and test to that boundary.
What is out of scope for a single-system Oracle Database review?
We never test Oracle’s own database engine source code or the underlying infrastructure of Autonomous Database, and a separately hosted application that happens to connect to the database is scoped and quoted on its own. We test the privileged accounts, schema privileges, listener configuration, network encryption, auditing, database links and PL/SQL configured on the instance or service you nominate.
Does Oracle have a policy on testing Autonomous Database or other Oracle Cloud services?
Yes. Oracle’s Customer Security Testing Policy treats testing of the resources you have configured within your own OCI tenancy, including an Autonomous Database instance, as needing only prior notification to Oracle at least five business days beforehand using its published Testing Request Form, while testing the underlying OCI service infrastructure itself needs Oracle’s prior approval and a signed Cloud Security Testing Addendum. We confirm Oracle’s current policy and complete the appropriate notification or approval step with you during scoping.
How long does an Oracle Database security review take?
A single Oracle Database instance or Autonomous Database service, with a limited number of schemas and accounts in scope, sits in our 2-day single-system scope, with a report typically landing around 5 working days after kickoff. More PDBs, database links to other systems, or a mix of on-premises and cloud instances moves into a larger scope with more testing days.
Do you test database links to other systems?
We test the database links configured on the instance in scope, including how each one authenticates and whether its stored credential is encrypted rather than merely obfuscated, and whether a definer’s rights procedure using a connected-user link has been granted INHERIT REMOTE PRIVILEGES more widely than it needs. The remote database at the other end of a link to a separate system is scoped and quoted separately.
Are your testers CREST certified?
Yes. Every Oracle Database engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Oracle Database review
Oracle’s ANY privileges and PUBLIC role can reach every schema in the database at once. We test privileged accounts, PUBLIC grants, the listener, network encryption and database link credentials. CREST-certified testers, fixed price from £2,740 for a 2-day single-system scope, quoted within 24 hours.
