Oracle encryption

[Eric_Fall]

Does On-Base support Transparent Data Encryption in an Oracle database?

[Jim_Arko]

Hi Eric,

Transparent Data Encryption is supported since it occurs at the DBMS level and isn't visible to OnBase.  Our recommendation when considering TDE is to keep in mind it can create additional overhead. 

Thanks!

[Michael_Finney]

How can the database/tablespaces be encrypted during creation by DB Utils? I am told by our Oracle DBA that the only time the encryption can be done during creation, or afterwards the only option would be to create a new encrypted DB and then copy the contents of the current DB into it, which seems that it would be a problem for Onbase to link back to the database afterwards.

Update:I think there may be two issues here I am overlapping. Is it possible and supported to have the main configuration DB (tablespaces) encrypted? If so, after talking further with our DBA, I am being asked if it is possible to get the DB creation scripts so that the encryption calls can be added to the scripts. Possible? Thank you!

MikeF

[Eric_Fall]

Mike,

Yes, you can only encrypt a tablespace at creation time, however, there are several methods of converting to encrypted tablespace.

1 - Export the tablespaces to be encrypted, drop and recreate the tablespaces with encryption enabled, then import the data.

2 - One tablespace at a time, move the data to a temporary location, say 'datareorg' tablespace, drop and recreate the tablespace encrypted and move the data back to the original tablespace.

3 - Use Oracle Online redefinition. This can be done on a live running system, but is more complex. There are some whitepapers on Metalink which describe this process in detail.

[Michael_Finney]

Thanks for replying Eric, most appreciated. This seems a bit painful as opposed to having an option or plugin during install, perhaps the database script cold be displayed in a window with the option to add commands? We will see what we can work out with the security auditors, I am trying to convince them we don't need to encrypt this database as it shouldn't have sensitive information contained in it.