Choosing Between Oracle Virtual Private Database and Oracle Label Security

Both Oracle Virtual Private Database (VPD) and Oracle Label Security (OLS) enable you to restrict the data that different users can see in database tables. But when should you use Virtual Private Database and when should you use Oracle Label Security? Virtual Private Database is effective when there is existing data you can use to determine the access requirements. For example, you can configure a sales representative to see only the rows and columns in a customer order entry table for orders he or she handles. Oracle Label Security is useful if you have no natural data (such as user accounts or employee IDs) that can be used to indicate a table's access requirements. To determine this type of user access, you assign different levels of sensitivity to the table rows.

In some cases, Oracle Virtual Private Database and Oracle Label Security can complement each other. The following Oracle Technology Network hands-on tutorial demonstrates how a Virtual Private Database policy can compare an Oracle Label Security user clearance with a minimum clearance. When the user clearance dominates the threshold, the Salary column is not hidden.

http://www.oracle.com/technology/deploy/security/database-security/label-security/ols_cs1.html

Table: Comparing Oracle Virtual Private Database with Oracle Label Security compares the features of Oracle Virtual Private Database with Oracle Label Security.

Comparing Oracle Virtual Private Database with Oracle Label Security

Feature	VPD	OLS
Provides row-level security	Yes	Yes
Provides column-level security (column masking)	Yes	No
Binds a user-defined PL/SQL package to a table, view, or synonym	Yes	No^Foot 1
Modifies SQL by dynamically adding a `WHERE` clause returned from the PL/SQL procedures	Yes	No
Restricts database operations by privileged users^Foot 2	No	No
Controls access to a set of rows based on the sensitivity label of the row and the security level of the user	No	Yes
Adds a column (optionally hidden) designed to store sensitivity labels for rows in the protected table^Foot 3	No	Yes
Provides a user account to manage its administration	No^Foot 4	Yes^Foot 5
Provides pre-defined PL/SQL packages for row-level security	No	Yes
Is provided in the default installation of Oracle Database	Yes	No
Is provided as an additional option to Oracle Database and must be licensed	No	Yes

^Footnote 1Oracle Label Security uses predefined PL/SQL packages, not user-created packages, to attach security policies to tables.

^Footnote 2If you must restrict privileged user access, consider using Oracle Database Vault.

^Footnote 3Usually, this column is hidden to achieve transparency and not break applications that are not designed to show an additional column.

^Footnote 4Oracle Virtual Private Database does not provide a user account, but you can create a user account that is solely responsible for managing Virtual Private Database policies.

^Footnote 5The LBACSYS account manages Oracle Label Security policies. This provides an additional layer of security in that one specific user account is responsible for these policies, which reduces the risk of another user tampering with the policies.

Choosing Between Oracle Virtual Private Database and Oracle Label Security

Related Topics