Skip to main content

New Book: Expert Oracle Application Express Security

I remember vividly meeting with Jonathan Gennick at RMOUG 2012 at the Apress booth.  As always, he asked if I was up for writing something APEX-related.  And as always, I politely declined, as I just had too much going on at the time.  However, before he let me leave the booth, he pledged that I didn't have to write something that was 800+ pages, and that a niche topic book that was "only" a couple hundred pages would work.  Time to reconsider.

Fast forward a year and change later, and finally, I'm happy to announce that Expert Oracle Application Express Security is now available for purchase (well, it has been for a while, and I'm just now getting around to posting this).  The book really did not take an entire year to write, but there were a couple of challenges that were thrown in along the way.  First of all, that night, we sat down with Enkitec and began discussion the acquisition plans.  So that was a bit of a distraction.  Also, I knew that at the time, APEX 4.2 was near release, and I wanted to ensure that I covered that release, so I had to actually write some of the later chapters first, and then circle back and complete the first ones last, since they contained more APEX 4.2-specific elements.  Throw in the daily trials and tribulations of two kids and their hectic schedules and eventually a new job with new responsibilities, and all that added up to why it took longer than many of us wanted.

But enough about the excuses, and more about the book!  The book contains 14 chapters, which range in topic from assessing a threat to preventing SQL injection to securing data at the database level.  I've summarized each chapter below:

Chapter 1 begins with a discussion of how to identify and assess threats to your applications.  It uses home security as an analogy when discussing this, since everyone already understands how to secure their home and has likely already taken steps to do so.  It then categorizes all threats into two categories: preventable and unpreventable, and briefly discusses examples of each 
Chapter 2 covers what a security plan is and how to implement one for your organization.  The main objective when creating such a plan is to first properly assess what the threats are, as specified in the previous chapter.  The security plan is an ever-changing document that has to adjust as threats do, and should be reviewed often. 
Chapter 3 provides an overview of the APEX architecture from a security perspective.  It starts by reviewing the Administration Console and how to configure Workspaces.  It then covers a bit of APEX architecture, as well as touches on the different options for the web listener tier. 
Chapter 4 outlines all of the Instance Settings that pertain to security, and what the implications of setting them improperly are. 
Chapter 5 does the same as the previous chapter, but does so at the Workspace level. 
Chapter 6 covers setting within an application that pertain to security.  It discusses them at the application, page and component level, as well as provides some advice when building mobile applications. 
Chapter 7 outlines the three main threats to an APEX application: SQL Injection, Cross Site Scripting and URL Tampering.  It illustrates example of each, as well as shows how to protect against them. 
Chapter 8 covers how User Authentication schemes work and how they can be better secured.  It also discusses the pros and cons of each type of scheme, as well as some commonly used APIs. 
Chapter 9 talks about Authorization Schemes and how they can be used throughout an application for access control purposes.  It also briefly covers the Access Control feature of APEX. 
Chapter 10 provides an alternate, more secure way to download CSV files from an APEX report.  It provides step-by-step instructions to implement this solution in your applications. 
Chapter 11 outlines a technique called Secure Views.  Secure Views can be used in conjunction with a database context to provide a more secure way to display your data at no additional cost, if you are not using the Enterprise Edition of the database. 
Chapter 12 is similar to the previous one, but it uses Virtual Private Database, which is a feature of the Enterprise Edition of the database. 
Chapter 13 illustrates a concept called Shadow Schema.  By using a limited privilege schema as your parse-as schema in an APEX application, you greatly increase the security of that application using this technique. 
Chapter 14 concludes with some examples of how using encryption in your application can increase the security of your data.
You can get the book online from Amazon here: http://www.amazon.com/Expert-Application-Express-Security-Experts/dp/1430247312/  Alternatively, if you'll be at OOW this year, we will be giving away copies at our booth in the exhibit hall.






Comments

Popular posts from this blog

Thanks, ODC (Oracle Developer Community)!

I owe a lot of thanks to the ODC - which stands for Oracle Developer Community.  What is ODC?  You may remember it as OTN, or the Oracle Technology Network.  Same people, different name.  Why they changed it I can't say.  People just liked it better that way... (love that song)

In any case, what am I thankful for?  A lot.  To start, the tools that I use day in and day out: SQL Developer, ORDS, Oracle Data Modeler, SQLcl and - of course - APEX.  Without these tools, I'm likely on a completely different career path, perhaps even one that aligns more closely with my degree in television management.

While the tools are great, it's really the people that make up the community that make ODC stand out. From the folks who run ODC and the Oracle ACE program to the developers and product managers who are behind the awesome tools, the ODC community is one of, if not the greatest asset of being involved with Oracle's products.

If you have yet to get more involved with this communi…

Spaced Out

A while back, I wrote about how to give the Universal Theme a face lift.  If you follow the steps in that post, the base font for an APEX application with the Universal Theme can easily be changed.

While that's all well and good, sometimes you only want to change the font for a report, not the entire page.  One of the applications that I'm building contains a number of IRs based mostly on log data.  Thus, having that data in a monospaced font would make it a whole lot easier to read.

You can search Google Fonts for monospaced fonts by selecting only that option on the right-side menubar.  You can also opt for the standard yet kinda boring Courier and achieve the same thing.

To implement this in your application, follow the steps in my other post, but stop shy of the final step.  Instead of pasting in the text that I specify, paste in the following to the Custom CSS field in Theme Roller, using the name of the font you selected for the font-family:

.a-IRR-table tr td { font-fam…

Logging APEX Report Downloads

A customer recently asked how APEX could track who clicked “download” from an Interactive Grid.  After some quick searching of the logs, I realized that APEX simply does not record this type of activity, aside from a simple page view type of “AJAX” entry.  This was not specific enough, and of course, led to the next question - can we prevent users from downloading data from a grid entirely?

I knew that any Javascript-based solution would fall short of their security requirements, since it is trivial to reconstruct the URL pattern required to initiate a download, even if the Javascript had removed the option from the menu.  Thus, I had to consider a PL/SQL-based approach - one that could not be bypassed by a malicious end user.

To solve this problem, I turned to APEX’s Initialization PL/SQL Code parameter.  Any PL/SQL code entered in this region will be executed before any other APEX-related process.  Thus, it is literally the first place that a developer can interact with an APEX page…