I remember vividly meeting with Jonathan Gennick at RMOUG 2012 at the Apress booth. As always, he asked if I was up for writing something APEX-related. And as always, I politely declined, as I just had too much going on at the time. However, before he let me leave the booth, he pledged that I didn't have to write something that was 800+ pages, and that a niche topic book that was "only" a couple hundred pages would work. Time to reconsider.
Fast forward a year and change later, and finally, I'm happy to announce that Expert Oracle Application Express Security is now available for purchase (well, it has been for a while, and I'm just now getting around to posting this). The book really did not take an entire year to write, but there were a couple of challenges that were thrown in along the way. First of all, that night, we sat down with Enkitec and began discussion the acquisition plans. So that was a bit of a distraction. Also, I knew that at the time, APEX 4.2 was near release, and I wanted to ensure that I covered that release, so I had to actually write some of the later chapters first, and then circle back and complete the first ones last, since they contained more APEX 4.2-specific elements. Throw in the daily trials and tribulations of two kids and their hectic schedules and eventually a new job with new responsibilities, and all that added up to why it took longer than many of us wanted.
But enough about the excuses, and more about the book! The book contains 14 chapters, which range in topic from assessing a threat to preventing SQL injection to securing data at the database level. I've summarized each chapter below:
Chapter 1 begins with a discussion of how to identify and assess threats to your applications. It uses home security as an analogy when discussing this, since everyone already understands how to secure their home and has likely already taken steps to do so. It then categorizes all threats into two categories: preventable and unpreventable, and briefly discusses examples of each
Chapter 2 covers what a security plan is and how to implement one for your organization. The main objective when creating such a plan is to first properly assess what the threats are, as specified in the previous chapter. The security plan is an ever-changing document that has to adjust as threats do, and should be reviewed often.
Chapter 3 provides an overview of the APEX architecture from a security perspective. It starts by reviewing the Administration Console and how to configure Workspaces. It then covers a bit of APEX architecture, as well as touches on the different options for the web listener tier.
Chapter 4 outlines all of the Instance Settings that pertain to security, and what the implications of setting them improperly are.
Chapter 5 does the same as the previous chapter, but does so at the Workspace level.
Chapter 6 covers setting within an application that pertain to security. It discusses them at the application, page and component level, as well as provides some advice when building mobile applications.
Chapter 7 outlines the three main threats to an APEX application: SQL Injection, Cross Site Scripting and URL Tampering. It illustrates example of each, as well as shows how to protect against them.
Chapter 8 covers how User Authentication schemes work and how they can be better secured. It also discusses the pros and cons of each type of scheme, as well as some commonly used APIs.
Chapter 9 talks about Authorization Schemes and how they can be used throughout an application for access control purposes. It also briefly covers the Access Control feature of APEX.
Chapter 10 provides an alternate, more secure way to download CSV files from an APEX report. It provides step-by-step instructions to implement this solution in your applications.
Chapter 11 outlines a technique called Secure Views. Secure Views can be used in conjunction with a database context to provide a more secure way to display your data at no additional cost, if you are not using the Enterprise Edition of the database.
Chapter 12 is similar to the previous one, but it uses Virtual Private Database, which is a feature of the Enterprise Edition of the database.
Chapter 13 illustrates a concept called Shadow Schema. By using a limited privilege schema as your parse-as schema in an APEX application, you greatly increase the security of that application using this technique.
Chapter 14 concludes with some examples of how using encryption in your application can increase the security of your data.You can get the book online from Amazon here: http://www.amazon.com/Expert-Application-Express-Security-Experts/dp/1430247312/ Alternatively, if you'll be at OOW this year, we will be giving away copies at our booth in the exhibit hall.
Comments