Skip to main content

New Book: Expert Oracle Application Express Security

I remember vividly meeting with Jonathan Gennick at RMOUG 2012 at the Apress booth.  As always, he asked if I was up for writing something APEX-related.  And as always, I politely declined, as I just had too much going on at the time.  However, before he let me leave the booth, he pledged that I didn't have to write something that was 800+ pages, and that a niche topic book that was "only" a couple hundred pages would work.  Time to reconsider.

Fast forward a year and change later, and finally, I'm happy to announce that Expert Oracle Application Express Security is now available for purchase (well, it has been for a while, and I'm just now getting around to posting this).  The book really did not take an entire year to write, but there were a couple of challenges that were thrown in along the way.  First of all, that night, we sat down with Enkitec and began discussion the acquisition plans.  So that was a bit of a distraction.  Also, I knew that at the time, APEX 4.2 was near release, and I wanted to ensure that I covered that release, so I had to actually write some of the later chapters first, and then circle back and complete the first ones last, since they contained more APEX 4.2-specific elements.  Throw in the daily trials and tribulations of two kids and their hectic schedules and eventually a new job with new responsibilities, and all that added up to why it took longer than many of us wanted.

But enough about the excuses, and more about the book!  The book contains 14 chapters, which range in topic from assessing a threat to preventing SQL injection to securing data at the database level.  I've summarized each chapter below:

Chapter 1 begins with a discussion of how to identify and assess threats to your applications.  It uses home security as an analogy when discussing this, since everyone already understands how to secure their home and has likely already taken steps to do so.  It then categorizes all threats into two categories: preventable and unpreventable, and briefly discusses examples of each 
Chapter 2 covers what a security plan is and how to implement one for your organization.  The main objective when creating such a plan is to first properly assess what the threats are, as specified in the previous chapter.  The security plan is an ever-changing document that has to adjust as threats do, and should be reviewed often. 
Chapter 3 provides an overview of the APEX architecture from a security perspective.  It starts by reviewing the Administration Console and how to configure Workspaces.  It then covers a bit of APEX architecture, as well as touches on the different options for the web listener tier. 
Chapter 4 outlines all of the Instance Settings that pertain to security, and what the implications of setting them improperly are. 
Chapter 5 does the same as the previous chapter, but does so at the Workspace level. 
Chapter 6 covers setting within an application that pertain to security.  It discusses them at the application, page and component level, as well as provides some advice when building mobile applications. 
Chapter 7 outlines the three main threats to an APEX application: SQL Injection, Cross Site Scripting and URL Tampering.  It illustrates example of each, as well as shows how to protect against them. 
Chapter 8 covers how User Authentication schemes work and how they can be better secured.  It also discusses the pros and cons of each type of scheme, as well as some commonly used APIs. 
Chapter 9 talks about Authorization Schemes and how they can be used throughout an application for access control purposes.  It also briefly covers the Access Control feature of APEX. 
Chapter 10 provides an alternate, more secure way to download CSV files from an APEX report.  It provides step-by-step instructions to implement this solution in your applications. 
Chapter 11 outlines a technique called Secure Views.  Secure Views can be used in conjunction with a database context to provide a more secure way to display your data at no additional cost, if you are not using the Enterprise Edition of the database. 
Chapter 12 is similar to the previous one, but it uses Virtual Private Database, which is a feature of the Enterprise Edition of the database. 
Chapter 13 illustrates a concept called Shadow Schema.  By using a limited privilege schema as your parse-as schema in an APEX application, you greatly increase the security of that application using this technique. 
Chapter 14 concludes with some examples of how using encryption in your application can increase the security of your data.
You can get the book online from Amazon here: http://www.amazon.com/Expert-Application-Express-Security-Experts/dp/1430247312/  Alternatively, if you'll be at OOW this year, we will be giving away copies at our booth in the exhibit hall.






Comments

Popular posts from this blog

Custom Export to CSV

It's been a while since I've updated my blog. I've been quite busy lately, and just have not had the time that I used to. We're expecting our 1st child in just a few short weeks now, so most of my free time has been spent learning Lamaze breathing, making the weekly run to Babies R Us, and relocating my office from the larger room upstairs to the smaller one downstairs - which I do happen to like MUCH more than I had anticipated. I have everything I need within a short walk - a bathroom, beer fridge, and 52" HD TV. I only need to go upstairs to eat and sleep now, but alas, this will all change soon... Recently, I was asked if you could change the way Export to CSV in ApEx works. The short answer is, of course, no. But it's not too difficult to "roll your own" CSV export procedure. Why would you want to do this? Well, the customer's requirement was to manipulate some data when the Export link was clicked, and then export it to CSV in a forma

Refreshing PL/SQL Regions in APEX

If you've been using APEX long enough, you've probably used a PL/SQL Region to render some sort of HTML that the APEX built-in components simply can't handle. Perhaps a complex chart or region that has a lot of custom content and/or layout. While best practices may be to use an APEX component, or if not, build a plugin, we all know that sometimes reality doesn't give us that kind of time or flexibility. While the PL/SQL Region is quite powerful, it still lacks a key feature: the ability to be refreshed by a Dynamic Action. This is true even in APEX 5. Fortunately, there's a simple workaround that only requires a small change to your code: change your procedure to a function and call it from a Classic Report region. In changing your procedure to a function, you'll likely only need to make one type of change: converting and htp.prn calls to instead populate and return a variable at the end of the function. Most, if not all of the rest of the code can rem

Logging APEX Report Downloads

A customer recently asked how APEX could track who clicked “download” from an Interactive Grid.  After some quick searching of the logs, I realized that APEX simply does not record this type of activity, aside from a simple page view type of “AJAX” entry.  This was not specific enough, and of course, led to the next question - can we prevent users from downloading data from a grid entirely? I knew that any Javascript-based solution would fall short of their security requirements, since it is trivial to reconstruct the URL pattern required to initiate a download, even if the Javascript had removed the option from the menu.  Thus, I had to consider a PL/SQL-based approach - one that could not be bypassed by a malicious end user. To solve this problem, I turned to APEX’s Initialization PL/SQL Code parameter.  Any PL/SQL code entered in this region will be executed before any other APEX-related process.  Thus, it is literally the first place that a developer can interact with an APEX p