### Oracle Database Security Risk Assessment - Highly Confidential ###

* Assessment Date & Time *
Date of Data Collection  Date of Report           Reporter Version           
------------------------ ------------------------ ---------------------------
Thu Oct 12 2017 12:32:00 Thu Oct 12 2017 12:38:21 1.0.2 (October 2016) - 7409

* Database Identity *
Name    Platform         Database Role Log Mode     Created                  Container Database Container ID Container Name
------- ---------------- ------------- ------------ ------------------------ ------------------ ------------ --------------
ORCLCDB Linux x86 64-bit PRIMARY       NOARCHIVELOG Sat Apr 01 2017 23:18:00 True               1            CDB$ROOT      

### Summary ###

Section                     Pass Evaluate Opportunity Some Risk Significant Risk Severe Risk Total Findings
--------------------------- ---- -------- ----------- --------- ---------------- ----------- --------------
Basic Information              0        0           0         0                0           1              1
User Accounts                  6        0           0         2                1           1             10
Privileges and Roles           6       12           0         0                0           0             18
Authorization Control          0        0           2         0                0           0              2
Data Encryption                0        1           1         0                0           0              2
Fine-Grained Access Control    0        0           5         0                0           0              5
Auditing                       3        4           1         0                3           1             12
Database Configuration         6        4           0         1                1           0             12
Network Configuration          1        0           0         0                1           0              2
Operating System               2        1           0         1                0           0              4
Total                         24       22           9         4                6           3             68

### Basic Information ###

* Database Version *
Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production
Security options used: (none)                                               

* Security Features *
Feature                               Currently Used
------------------------------------- --------------
AUTHORIZATION CONTROL                               
Database Vault                              No      
Privilege Analysis                          No      
                                                    
DATA ENCRYPTION                                     
Column Encryption                           No      
Tablespace Encryption                       No      
Network Encryption                          No      
                                                    
FINE-GRAINED ACCESS CONTROL                         
Data Redaction                              No      
Virtual Private Database                    No      
Real Application Security                   No      
Label Security                              No      
Transparent Sensitive Data Protection       No      
                                                    
AUDITING                                            
Traditional Audit                          Yes      
Fine Grained Audit                          No      
Unified Audit                              Yes      
                                                    
USER AUTHENTICATION                                 
External Authentication                     No      
Global Authentication                       No      

* Patch Check *
Status: Severe Risk
Summary:
    Latest Oracle Database PSU not found.
Details:
    Patch Inventory:
    (none)

    Patch History:
    (none)
Remarks:
    It is vital to keep the database software up-to-date with security
    fixes as they are released. Oracle issues Patch Set Updates (PSU) on a
    regular quarterly schedule. These updates should be applied as soon as
    they are available. For releases prior to Oracle Database 12c,
    quarterly updates may be delivered by patches not marked as PSUs.

### User Accounts ###

    Note: Predefined Oracle accounts which are locked are not included in
    this report. To include all user accounts, run the report with the -a
    option.

* User Accounts *
User Name Status Profile Tablespace Predefined Type    
--------- ------ ------- ---------- ---------- --------
SYS       OPEN   DEFAULT SYSTEM        Yes     PASSWORD
SYSTEM    OPEN   DEFAULT SYSTEM        Yes     PASSWORD

* User Accounts in SYSTEM or SYSAUX Tablespace *
Status: Pass
Summary:
    No user uses SYSTEM or SYSAUX tablespace.
Remarks:
    The SYSTEM and SYSAUX tablespaces are reserved for Oracle-supplied user
    accounts. To avoid a possible denial of service caused by exhausting
    these resources, regular user accounts should not use these
    tablespaces. Prior to Oracle Database 12.2, the SYSTEM tablespace
    cannot be encrypted, and this is another reason to avoid user schemas
    in this tablespace.

* Sample Schemas *
Status: Pass
Summary:
    No sample schemas found.
Remarks:
    Sample schemas are well-known accounts provided by Oracle to serve as
    simple examples for developers. They generally serve no purpose in a
    production database and should be removed because they unnecessarily
    increase the attack surface of the database.

* Inactive Users *
Status: Some Risk
Summary:
    Found 1 unlocked user inactive for more than 30 days.
Details:
    Inactive users: SYS
Remarks:
    If a user account is no longer in use, it increases the attack surface
    of the system unnecessarily while providing no corresponding benefit.
    Furthermore, unauthorized use is less likely to be noticed when no one
    is regularly using the account. Accounts that have been unused for more
    than 30 days should be investigated to determine whether they should
    remain active.

* Case-Sensitive Passwords *
Status: Pass
Summary:
    Case-sensitive passwords are used.
Details:
    Initialization parameter SEC_CASE_SENSITIVE_LOGON is set to TRUE.
Remarks:
    Case-sensitive passwords are recommended because including both upper
    and lower-case letters greatly increases the set of possible passwords
    that must be searched by an attacker who is attempting to guess a
    password by exhaustive search. Setting SEC_CASE_SENSITIVE_LOGON to TRUE
    ensures that the database distinguishes between upper and lower-case
    letters in passwords.

* Users with Expired Passwords *
Status: Pass
Summary:
    No unlocked users with password expired for more than 30 days found.
Remarks:
    Password expiration is used to ensure that users change their passwords
    on a regular basis. If a user's password has been expired for more than
    30 days, it indicates that the user has not logged in for at least that
    long. Accounts that have been unused for an extended period of time
    should be investigated to determine whether they should remain active.

* Users with Default Passwords *
Status: Severe Risk
Summary:
    Found 2 unlocked user accounts with default password.
Details:
    Users with default password: SYS, SYSTEM
Remarks:
    Default account passwords for predefined Oracle accounts are well
    known. Open accounts with default passwords provide a trivial means of
    entry for attackers, but well-known passwords should be changed for
    locked accounts as well.

* Password Verifiers *
Status: Pass
Summary:
    All user accounts support the latest password version.  No user
    accounts have HTTP verifiers.
Details:
    Database supports password versions up to 12C.
    Users requiring updated password verifiers: (none)

    Users with HTTP verifiers: (none)
Remarks:
    For each user account, the database may store multiple verifiers, which
    are hashes of the user password. Each verifier supports a different
    version of the password authentication algorithm. Every user account
    should include a verifier for the latest password version supported by
    the database so that the user can be authenticated using the latest
    algorithm supported by the client. When all clients have been updated,
    the security of user accounts can be improved by removing the obsolete
    verifiers. HTTP password verifiers are used for XML Database
    authentication. Use the ALTER USER command to remove these verifiers
    from user accounts that do not require this access.

* User Profiles *
Profile Name     Resource                 Value                      
---------------- ------------------------ ---------------------------
DEFAULT          (Number of Users)        2                          
DEFAULT          CONNECT_TIME             UNLIMITED                  
DEFAULT          FAILED_LOGIN_ATTEMPTS    10                         
DEFAULT          IDLE_TIME                UNLIMITED                  
DEFAULT          PASSWORD_GRACE_TIME      7                          
DEFAULT          PASSWORD_LIFE_TIME       UNLIMITED                  
DEFAULT          PASSWORD_LOCK_TIME       1                          
DEFAULT          PASSWORD_REUSE_MAX       UNLIMITED                  
DEFAULT          PASSWORD_REUSE_TIME      UNLIMITED                  
DEFAULT          PASSWORD_VERIFY_FUNCTION NULL                       
ORA_STIG_PROFILE (Number of Users)        0                          
ORA_STIG_PROFILE CONNECT_TIME             UNLIMITED (DEFAULT)        
ORA_STIG_PROFILE FAILED_LOGIN_ATTEMPTS    3                          
ORA_STIG_PROFILE IDLE_TIME                15                         
ORA_STIG_PROFILE PASSWORD_GRACE_TIME      5                          
ORA_STIG_PROFILE PASSWORD_LIFE_TIME       60                         
ORA_STIG_PROFILE PASSWORD_LOCK_TIME       UNLIMITED                  
ORA_STIG_PROFILE PASSWORD_REUSE_MAX       10                         
ORA_STIG_PROFILE PASSWORD_REUSE_TIME      365                        
ORA_STIG_PROFILE PASSWORD_VERIFY_FUNCTION ORA12C_STIG_VERIFY_FUNCTION

* Users with Unlimited Password Lifetime *
Status: Some Risk
Summary:
    Found 2 users with passwords that never expire.
Details:
    Profiles with unlimited password lifetime: DEFAULT
    Profiles with limited password lifetime: ORA_STIG_PROFILE
    Users using profiles with unlimited password lifetime: SYS, SYSTEM
Remarks:
    Password expiration is used to ensure that users change their passwords
    on a regular basis. Passwords that never expire may remain unchanged
    for an extended period of time. When passwords do not have to be
    changed regularly, users are also more likely to use the same passwords
    for multiple accounts.

* Users with Unlimited Failed Login Attempts *
Status: Pass
Summary:
    No users have unlimited failed login attempts.
Remarks:
    Attackers sometimes attempt to guess a user's password by simply trying
    all possibilities from a set of common passwords. To defend against
    this attack, it is advisable to lock a user account when there are
    multiple failed login attempts without a successful login.

* Password Verification Functions *
Status: Significant Risk
Summary:
    Found 2 users not using password verification function.
Details:
    Profiles with password verification function: ORA_STIG_PROFILE
    Profiles without password verification function: DEFAULT
    Users using profiles without password verification function: SYS,
        SYSTEM
Remarks:
    Password verification functions are used to ensure that user passwords
    meet minimum requirements for complexity, which may include factors
    such as length, use of numbers or punctuation characters, difference
    from previous passwords, etc. Oracle supplies several predefined
    functions, or a custom PL/SQL function can be used. Every user profile
    should include a password verification function.

### Privileges and Roles ###

* All System Privileges *
Status: Evaluate
Summary:
    239 grants of system privileges
Details:
    Users directly or indirectly granted each system privilege:

    ADMINISTER ANY SQL TUNING SET: SYSTEM
    ADMINISTER DATABASE TRIGGER: SYSTEM
    ADMINISTER KEY MANAGEMENT: (none)
    ADMINISTER RESOURCE MANAGER: SYSTEM
    ADMINISTER SQL MANAGEMENT OBJECT: SYSTEM
    ADMINISTER SQL TUNING SET: SYSTEM
    ADVISOR: SYSTEM
    ALTER ANY ANALYTIC VIEW: SYSTEM
    ALTER ANY ASSEMBLY: SYSTEM
    ALTER ANY ATTRIBUTE DIMENSION: SYSTEM
    ALTER ANY CLUSTER: SYSTEM
    ALTER ANY CUBE: SYSTEM
    ALTER ANY CUBE BUILD PROCESS: SYSTEM
    ALTER ANY CUBE DIMENSION: SYSTEM
    ALTER ANY DIMENSION: SYSTEM
    ALTER ANY EDITION: SYSTEM
    ALTER ANY EVALUATION CONTEXT: SYSTEM
    ALTER ANY HIERARCHY: SYSTEM
    ALTER ANY INDEX: SYSTEM
    ALTER ANY INDEXTYPE: SYSTEM
    ALTER ANY LIBRARY: SYSTEM
    ALTER ANY MATERIALIZED VIEW: SYSTEM
    ALTER ANY MEASURE FOLDER: SYSTEM
    ALTER ANY MINING MODEL: SYSTEM
    ALTER ANY OPERATOR: SYSTEM
    ALTER ANY OUTLINE: SYSTEM
    ALTER ANY PROCEDURE: SYSTEM
    ALTER ANY ROLE: SYSTEM
    ALTER ANY RULE: SYSTEM
    ALTER ANY RULE SET: SYSTEM
    ALTER ANY SEQUENCE: SYSTEM
    ALTER ANY SQL PROFILE: SYSTEM
    ALTER ANY SQL TRANSLATION PROFILE: SYSTEM
    ALTER ANY TABLE: SYSTEM
    ALTER ANY TRIGGER: SYSTEM
    ALTER ANY TYPE: SYSTEM
    ALTER DATABASE: SYSTEM
    ALTER LOCKDOWN PROFILE: SYSTEM
    ALTER PROFILE: SYSTEM
    ALTER RESOURCE COST: SYSTEM
    ALTER ROLLBACK SEGMENT: SYSTEM
    ALTER SESSION: SYSTEM
    ALTER SYSTEM: SYSTEM
    ALTER TABLESPACE: SYSTEM
    ALTER USER: SYSTEM
    ANALYZE ANY: SYSTEM
    ANALYZE ANY DICTIONARY: SYSTEM
    AUDIT ANY: SYSTEM
    AUDIT SYSTEM: SYSTEM
    BACKUP ANY TABLE: SYSTEM
    BECOME USER: SYSTEM
    CHANGE NOTIFICATION: SYSTEM
    COMMENT ANY MINING MODEL: SYSTEM
    COMMENT ANY TABLE: SYSTEM
    CREATE ANALYTIC VIEW: SYSTEM
    CREATE ANY ANALYTIC VIEW: SYSTEM
    CREATE ANY ASSEMBLY: SYSTEM
    CREATE ANY ATTRIBUTE DIMENSION: SYSTEM
    CREATE ANY CLUSTER: SYSTEM
    CREATE ANY CONTEXT: SYSTEM
    CREATE ANY CREDENTIAL: SYSTEM
    CREATE ANY CUBE: SYSTEM
    CREATE ANY CUBE BUILD PROCESS: SYSTEM
    CREATE ANY CUBE DIMENSION: SYSTEM
    CREATE ANY DIMENSION: SYSTEM
    CREATE ANY DIRECTORY: SYSTEM
    CREATE ANY EDITION: SYSTEM
    CREATE ANY EVALUATION CONTEXT: SYSTEM
    CREATE ANY HIERARCHY: SYSTEM
    CREATE ANY INDEX: SYSTEM
    CREATE ANY INDEXTYPE: SYSTEM
    CREATE ANY JOB: SYSTEM
    CREATE ANY LIBRARY: SYSTEM
    CREATE ANY MATERIALIZED VIEW: SYSTEM
    CREATE ANY MEASURE FOLDER: SYSTEM
    CREATE ANY MINING MODEL: SYSTEM
    CREATE ANY OPERATOR: SYSTEM
    CREATE ANY OUTLINE: SYSTEM
    CREATE ANY PROCEDURE: SYSTEM
    CREATE ANY RULE: SYSTEM
    CREATE ANY RULE SET: SYSTEM
    CREATE ANY SEQUENCE: SYSTEM
    CREATE ANY SQL PROFILE: SYSTEM
    CREATE ANY SQL TRANSLATION PROFILE: SYSTEM
    CREATE ANY SYNONYM: SYSTEM
    CREATE ANY TABLE: SYSTEM
    CREATE ANY TRIGGER: SYSTEM
    CREATE ANY TYPE: SYSTEM
    CREATE ANY VIEW: SYSTEM
    CREATE ASSEMBLY: SYSTEM
    CREATE ATTRIBUTE DIMENSION: SYSTEM
    CREATE CLUSTER: SYSTEM
    CREATE CREDENTIAL: SYSTEM
    CREATE CUBE: SYSTEM
    CREATE CUBE BUILD PROCESS: SYSTEM
    CREATE CUBE DIMENSION: SYSTEM
    CREATE DATABASE LINK: SYSTEM
    CREATE DIMENSION: SYSTEM
    CREATE EVALUATION CONTEXT: SYSTEM
    CREATE EXTERNAL JOB: SYSTEM
    CREATE HIERARCHY: SYSTEM
    CREATE INDEXTYPE: SYSTEM
    CREATE JOB: SYSTEM
    CREATE LIBRARY: SYSTEM
    CREATE LOCKDOWN PROFILE: SYSTEM
    CREATE MATERIALIZED VIEW: SYSTEM
    CREATE MEASURE FOLDER: SYSTEM
    CREATE MINING MODEL: SYSTEM
    CREATE OPERATOR: SYSTEM
    CREATE PLUGGABLE DATABASE: SYSTEM
    CREATE PROCEDURE: SYSTEM
    CREATE PROFILE: SYSTEM
    CREATE PUBLIC DATABASE LINK: SYSTEM
    CREATE PUBLIC SYNONYM: SYSTEM
    CREATE ROLE: SYSTEM
    CREATE ROLLBACK SEGMENT: SYSTEM
    CREATE RULE: SYSTEM
    CREATE RULE SET: SYSTEM
    CREATE SEQUENCE: SYSTEM
    CREATE SESSION: SYSTEM
    CREATE SQL TRANSLATION PROFILE: SYSTEM
    CREATE SYNONYM: SYSTEM
    CREATE TABLE: SYSTEM
    CREATE TABLESPACE: SYSTEM
    CREATE TRIGGER: SYSTEM
    CREATE TYPE: SYSTEM
    CREATE USER: SYSTEM
    CREATE VIEW: SYSTEM
    DEBUG ANY PROCEDURE: SYSTEM
    DEBUG CONNECT ANY: SYSTEM
    DEBUG CONNECT SESSION: SYSTEM
    DELETE ANY CUBE DIMENSION: SYSTEM
    DELETE ANY MEASURE FOLDER: SYSTEM
    DELETE ANY TABLE: SYSTEM
    DEQUEUE ANY QUEUE: SYSTEM
    DROP ANY ANALYTIC VIEW: SYSTEM
    DROP ANY ASSEMBLY: SYSTEM
    DROP ANY ATTRIBUTE DIMENSION: SYSTEM
    DROP ANY CLUSTER: SYSTEM
    DROP ANY CONTEXT: SYSTEM
    DROP ANY CUBE: SYSTEM
    DROP ANY CUBE BUILD PROCESS: SYSTEM
    DROP ANY CUBE DIMENSION: SYSTEM
    DROP ANY DIMENSION: SYSTEM
    DROP ANY DIRECTORY: SYSTEM
    DROP ANY EDITION: SYSTEM
    DROP ANY EVALUATION CONTEXT: SYSTEM
    DROP ANY HIERARCHY: SYSTEM
    DROP ANY INDEX: SYSTEM
    DROP ANY INDEXTYPE: SYSTEM
    DROP ANY LIBRARY: SYSTEM
    DROP ANY MATERIALIZED VIEW: SYSTEM
    DROP ANY MEASURE FOLDER: SYSTEM
    DROP ANY MINING MODEL: SYSTEM
    DROP ANY OPERATOR: SYSTEM
    DROP ANY OUTLINE: SYSTEM
    DROP ANY PROCEDURE: SYSTEM
    DROP ANY ROLE: SYSTEM
    DROP ANY RULE: SYSTEM
    DROP ANY RULE SET: SYSTEM
    DROP ANY SEQUENCE: SYSTEM
    DROP ANY SQL PROFILE: SYSTEM
    DROP ANY SQL TRANSLATION PROFILE: SYSTEM
    DROP ANY SYNONYM: SYSTEM
    DROP ANY TABLE: SYSTEM
    DROP ANY TRIGGER: SYSTEM
    DROP ANY TYPE: SYSTEM
    DROP ANY VIEW: SYSTEM
    DROP LOCKDOWN PROFILE: SYSTEM
    DROP PROFILE: SYSTEM
    DROP PUBLIC DATABASE LINK: SYSTEM
    DROP PUBLIC SYNONYM: SYSTEM
    DROP ROLLBACK SEGMENT: SYSTEM
    DROP TABLESPACE: SYSTEM
    DROP USER: SYSTEM
    EM EXPRESS CONNECT: SYSTEM
    ENQUEUE ANY QUEUE: SYSTEM
    EXECUTE ANY ASSEMBLY: SYSTEM
    EXECUTE ANY CLASS: SYSTEM
    EXECUTE ANY EVALUATION CONTEXT: SYSTEM
    EXECUTE ANY INDEXTYPE: SYSTEM
    EXECUTE ANY LIBRARY: SYSTEM
    EXECUTE ANY OPERATOR: SYSTEM
    EXECUTE ANY PROCEDURE: SYSTEM
    EXECUTE ANY PROGRAM: SYSTEM
    EXECUTE ANY RULE: SYSTEM
    EXECUTE ANY RULE SET: SYSTEM
    EXECUTE ANY TYPE: SYSTEM
    EXECUTE ASSEMBLY: SYSTEM
    EXEMPT ACCESS POLICY: (none)
    EXEMPT DDL REDACTION POLICY: SYSTEM
    EXEMPT DML REDACTION POLICY: SYSTEM
    EXEMPT REDACTION POLICY: SYSTEM
    EXPORT FULL DATABASE: SYSTEM
    FLASHBACK ANY TABLE: SYSTEM
    FLASHBACK ARCHIVE ADMINISTER: SYSTEM
    FORCE ANY TRANSACTION: SYSTEM
    FORCE TRANSACTION: SYSTEM
    GLOBAL QUERY REWRITE: SYSTEM
    GRANT ANY OBJECT PRIVILEGE: SYSTEM
    GRANT ANY PRIVILEGE: SYSTEM
    GRANT ANY ROLE: SYSTEM
    IMPORT FULL DATABASE: SYSTEM
    INHERIT ANY PRIVILEGES: (none)
    INSERT ANY CUBE DIMENSION: SYSTEM
    INSERT ANY MEASURE FOLDER: SYSTEM
    INSERT ANY TABLE: SYSTEM
    LOCK ANY TABLE: SYSTEM
    LOGMINING: SYSTEM
    MANAGE ANY FILE GROUP: SYSTEM
    MANAGE ANY QUEUE: SYSTEM
    MANAGE FILE GROUP: SYSTEM
    MANAGE SCHEDULER: SYSTEM
    MANAGE TABLESPACE: SYSTEM
    MERGE ANY VIEW: SYSTEM
    ON COMMIT REFRESH: SYSTEM
    QUERY REWRITE: SYSTEM
    READ ANY FILE GROUP: SYSTEM
    READ ANY TABLE: SYSTEM
    REDEFINE ANY TABLE: SYSTEM
    RESTRICTED SESSION: SYSTEM
    RESUMABLE: SYSTEM
    SELECT ANY CUBE: SYSTEM
    SELECT ANY CUBE BUILD PROCESS: SYSTEM
    SELECT ANY CUBE DIMENSION: SYSTEM
    SELECT ANY DICTIONARY: SYSTEM
    SELECT ANY MEASURE FOLDER: SYSTEM
    SELECT ANY MINING MODEL: SYSTEM
    SELECT ANY SEQUENCE: SYSTEM
    SELECT ANY TABLE: SYSTEM
    SELECT ANY TRANSACTION: SYSTEM
    SET CONTAINER: SYSTEM
    UNDER ANY TABLE: SYSTEM
    UNDER ANY TYPE: SYSTEM
    UNDER ANY VIEW: SYSTEM
    UNLIMITED TABLESPACE: SYSTEM
    UPDATE ANY CUBE: SYSTEM
    UPDATE ANY CUBE BUILD PROCESS: SYSTEM
    UPDATE ANY CUBE DIMENSION: SYSTEM
    UPDATE ANY TABLE: SYSTEM
    USE ANY JOB RESOURCE: SYSTEM
    USE ANY SQL TRANSLATION PROFILE: SYSTEM
Remarks:
    System privileges provide the ability to access data or perform
    administrative operations for the entire database. Consistent with the
    principle of least privilege, these privileges should be granted
    sparingly. The Privilege Analysis feature of Database Vault may be
    helpful to determine the minimum set of privileges required by a user
    or role. In some cases, it may be possible to substitute a more limited
    object privilege grant in place of a system privilege grant that
    applies to all objects. System privileges should be granted with admin
    option only when the recipient needs the ability to grant the privilege
    to others.

* All Roles *
Status: Evaluate
Summary:
    23 grants of roles
Details:
    Users directly or indirectly granted each role:

    AQ_ADMINISTRATOR_ROLE: SYSTEM
    CAPTURE_ADMIN: SYSTEM
    CDB_DBA: (none)
    CONNECT: (none)
    CTXAPP: (none)
    DATAPUMP_EXP_FULL_DATABASE: SYSTEM
    DATAPUMP_IMP_FULL_DATABASE: SYSTEM
    DBA: SYSTEM
    DBFS_ROLE: (none)
    DV_ADMIN: (none)
    DV_AUDIT_CLEANUP: (none)
    DV_DATAPUMP_NETWORK_LINK: (none)
    DV_GOLDENGATE_ADMIN: (none)
    DV_GOLDENGATE_REDO_ACCESS: (none)
    DV_MONITOR: (none)
    DV_PATCH_ADMIN: (none)
    DV_POLICY_OWNER: (none)
    DV_PUBLIC: (none)
    DV_SECANALYST: (none)
    DV_STREAMS_ADMIN: (none)
    DV_XSTREAM_ADMIN: (none)
    EM_EXPRESS_ALL: SYSTEM
    EM_EXPRESS_BASIC: SYSTEM
    EXECUTE_CATALOG_ROLE: SYSTEM
    EXP_FULL_DATABASE: SYSTEM
    GATHER_SYSTEM_STATISTICS: SYSTEM
    GSMADMIN_ROLE: (none)
    GSMUSER_ROLE: (none)
    GSM_POOLADMIN_ROLE: (none)
    HS_ADMIN_EXECUTE_ROLE: SYSTEM
    HS_ADMIN_SELECT_ROLE: SYSTEM
    IMP_FULL_DATABASE: SYSTEM
    JAVAUSERPRIV: (none)
    JAVA_ADMIN: SYSTEM
    JAVA_DEPLOY: SYSTEM
    LBAC_DBA: (none)
    OEM_MONITOR: (none)
    OLAP_DBA: SYSTEM
    OLAP_XS_ADMIN: SYSTEM
    OPTIMIZER_PROCESSING_RATE: SYSTEM
    RECOVERY_CATALOG_OWNER: (none)
    RECOVERY_CATALOG_USER: (none)
    RESOURCE: (none)
    SCHEDULER_ADMIN: SYSTEM
    SELECT_CATALOG_ROLE: SYSTEM
    SODA_APP: (none)
    SPATIAL_CSW_ADMIN: (none)
    SYSUMF_ROLE: (none)
    WM_ADMIN_ROLE: SYSTEM
    XDBADMIN: SYSTEM
    XDB_SET_INVOKER: SYSTEM
Remarks:
    Roles are a convenient way to manage groups of related privileges,
    especially when the privileges are required for a particular task or
    job function. Beware of broadly defined roles, which may confer more
    privileges than an individual recipient requires. Roles should be
    granted with admin option only when the recipient needs the ability to
    modify the role or grant it to others.

* Account Management Privileges *
Status: Evaluate
Summary:
    16 grants of account management privileges
Details:
    Grants of ALTER USER, CREATE USER, DROP USER:

    SYSTEM <- DBA: ALTER USER, CREATE USER, DROP USER
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: ALTER USER
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE: ALTER
        USER, CREATE USER, DROP USER
    SYSTEM <- DBA <- EM_EXPRESS_ALL: ALTER USER, CREATE USER, DROP USER
    SYSTEM <- DBA <- IMP_FULL_DATABASE: ALTER USER, CREATE USER, DROP USER

    (no users) <- DV_ACCTMGR: ALTER USER, CREATE USER, DROP USER

Remarks:
    User management privileges (ALTER USER, CREATE USER, DROP USER) can be
    used to create and modify other user accounts, including changing
    passwords. This power can be abused to gain access to another user's
    account, which may have greater privileges.

* Privilege Management Privileges *
Status: Evaluate
Summary:
    31 grants of privilege management privileges
Details:
    Grants of ALTER ANY ROLE, CREATE ROLE, DROP ANY ROLE, GRANT ANY OBJECT
        PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE:

    SYSTEM <- DBA: ALTER ANY ROLE, CREATE ROLE, DROP ANY ROLE, GRANT ANY
        OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: GRANT ANY OBJECT
        PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
        CREATE ROLE, DROP ANY ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY
        PRIVILEGE, GRANT ANY ROLE
    SYSTEM <- DBA <- EM_EXPRESS_ALL: ALTER ANY ROLE, CREATE ROLE, DROP ANY
        ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY
        ROLE
    SYSTEM <- DBA <- IMP_FULL_DATABASE: CREATE ROLE, DROP ANY ROLE, GRANT
        ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE

    (no users) <- DV_REALM_OWNER: ALTER ANY ROLE, CREATE ROLE, DROP ANY
        ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY
        ROLE

Remarks:
    Users with privilege management privileges (ALTER ANY ROLE, CREATE
    ROLE, DROP ANY ROLE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE,
    GRANT ANY ROLE) can change the set of privileges granted to themselves
    and other users. This ability should be granted sparingly, since it can
    be used to circumvent many security controls in the database.

* Audit Management Privileges *
Status: Evaluate
Summary:
    10 grants of audit privilege
Details:
    Grants of AUDIT ANY, AUDIT SYSTEM:

    SYSTEM <- DBA: AUDIT ANY, AUDIT SYSTEM
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: AUDIT ANY, AUDIT SYSTEM
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE: AUDIT
        ANY, AUDIT SYSTEM
    SYSTEM <- DBA <- IMP_FULL_DATABASE: AUDIT ANY, AUDIT SYSTEM

    (no users) <- AUDIT_ADMIN: AUDIT ANY, AUDIT SYSTEM

Remarks:
    Audit management privileges (AUDIT ANY, AUDIT SYSTEM) can be used to
    change the audit policies for the database. This ability should be
    granted sparingly, since it may be used to hide malicious activity.

* Data Access Privileges *
Status: Evaluate
Summary:
    49 grants of data access privileges
Details:
    Grants of ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX, CREATE
        ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY
        TABLE, READ ANY TABLE, SELECT ANY DICTIONARY, SELECT ANY TABLE,
        UPDATE ANY TABLE:

    SYSTEM: SELECT ANY TABLE
    SYSTEM <- DBA: ALTER ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX,
        CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT
        ANY TABLE, READ ANY TABLE, SELECT ANY DICTIONARY, SELECT ANY TABLE,
        UPDATE ANY TABLE
    SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
        SELECT ANY TABLE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: DELETE ANY TABLE, SELECT
        ANY TABLE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
        SELECT ANY TABLE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE: ALTER
        ANY TABLE, ALTER ANY TRIGGER, CREATE ANY INDEX, CREATE ANY
        PROCEDURE, CREATE ANY TRIGGER, DELETE ANY TABLE, INSERT ANY TABLE,
        SELECT ANY TABLE, UPDATE ANY TABLE
    SYSTEM <- DBA <- EXP_FULL_DATABASE: SELECT ANY TABLE
    SYSTEM <- DBA <- IMP_FULL_DATABASE: ALTER ANY TABLE, ALTER ANY TRIGGER,
        CREATE ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE
        ANY TABLE, INSERT ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE
    SYSTEM <- DBA <- OLAP_DBA: DELETE ANY TABLE, INSERT ANY TABLE, SELECT
        ANY TABLE, UPDATE ANY TABLE

    (no users) <- DV_REALM_OWNER: ALTER ANY TABLE, ALTER ANY TRIGGER,
        CREATE ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE
        ANY TABLE, INSERT ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE

    (no users) <- OEM_MONITOR: SELECT ANY DICTIONARY

Remarks:
    Users with data access privileges (ALTER ANY TABLE, ALTER ANY TRIGGER,
    CREATE ANY INDEX, CREATE ANY PROCEDURE, CREATE ANY TRIGGER, DELETE ANY
    TABLE, INSERT ANY TABLE, READ ANY TABLE, SELECT ANY DICTIONARY, SELECT
    ANY TABLE, UPDATE ANY TABLE) can override various access controls on
    data. Most administrative tasks do not require access to the data
    itself, so these privileges should be granted rarely even to
    administrators. In addition to minimizing grants of these privileges,
    consider the use of Database Vault realms to limit the use of these
    privileges to access sensitive data.

* Access Control Exemption Privileges *
Status: Evaluate
Summary:
    3 grants of access control exemption privileges
Details:
    Grants of EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY:

    SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
        EXEMPT REDACTION POLICY
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
        EXEMPT REDACTION POLICY
    SYSTEM <- DBA <- EXP_FULL_DATABASE: EXEMPT REDACTION POLICY

Remarks:
    Users with exemption privileges (EXEMPT ACCESS POLICY, EXEMPT REDACTION
    POLICY) can bypass the access control policies created using Virtual
    Private Database and Data Redaction. Most administrative tasks do not
    require access to the data itself, so these privileges should be
    granted rarely even to administrators.

* Access to Password Verifier Tables *
Status: Pass
Summary:
    No grants of object privileges on restricted objects
Remarks:
    Users with these privileges can access objects that contain user
    password verifiers. The verifiers can be used in offline attacks to
    discover user passwords.

* Access to Restricted Objects *
Status: Evaluate
Summary:
    665 grants of object privileges on restricted objects
Details:
    Grants of DELETE, INSERT, UPDATE on SYS, DVSYS, or LBACSYS objects:

    SYSTEM <- DBA: DELETE on SYS.MAP_OBJECT, INSERT on SYS.MAP_OBJECT,
        INSERT on SYS.XSDB$SCHEMA_ACL, UPDATE on SYS.MAP_OBJECT, UPDATE on
        SYS.XSDB$SCHEMA_ACL
    SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE <- EXP_FULL_DATABASE:
        DELETE on SYS.INCEXP, DELETE on SYS.INCFIL, DELETE on SYS.INCVID,
        INSERT on SYS.INCEXP, INSERT on SYS.INCFIL, INSERT on SYS.INCVID,
        UPDATE on SYS.INCEXP, UPDATE on SYS.INCFIL, UPDATE on SYS.INCVID
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- EXP_FULL_DATABASE:
        DELETE on SYS.INCEXP, DELETE on SYS.INCFIL, DELETE on SYS.INCVID,
        INSERT on SYS.INCEXP, INSERT on SYS.INCFIL, INSERT on SYS.INCVID,
        UPDATE on SYS.INCEXP, UPDATE on SYS.INCFIL, UPDATE on SYS.INCVID
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE <- IMP_FULL_DATABASE:
        DELETE on SYS.EXPIMP_TTS_CT$, DELETE on SYS.RADM_FPTM$, INSERT on
        SYS.EXPIMP_TTS_CT$, INSERT on SYS.RADM_FPTM$, UPDATE on
        SYS.EXPIMP_TTS_CT$
    SYSTEM <- DBA <- EXP_FULL_DATABASE: DELETE on SYS.INCEXP, DELETE on
        SYS.INCFIL, DELETE on SYS.INCVID, INSERT on SYS.INCEXP, INSERT on
        SYS.INCFIL, INSERT on SYS.INCVID, UPDATE on SYS.INCEXP, UPDATE on
        SYS.INCFIL, UPDATE on SYS.INCVID
    SYSTEM <- DBA <- GATHER_SYSTEM_STATISTICS: DELETE on SYS.AUX_STATS$,
        DELETE on SYS.WRI$_OPTSTAT_AUX_HISTORY, INSERT on SYS.AUX_STATS$,
        INSERT on SYS.WRI$_OPTSTAT_AUX_HISTORY, UPDATE on SYS.AUX_STATS$,
        UPDATE on SYS.WRI$_OPTSTAT_AUX_HISTORY
    SYSTEM <- DBA <- IMP_FULL_DATABASE: DELETE on SYS.EXPIMP_TTS_CT$,
        DELETE on SYS.RADM_FPTM$, INSERT on SYS.EXPIMP_TTS_CT$, INSERT on
        SYS.RADM_FPTM$, UPDATE on SYS.EXPIMP_TTS_CT$
    SYSTEM <- DBA <- OPTIMIZER_PROCESSING_RATE: DELETE on
        SYS.OPT_CALIBRATION_STATS$, INSERT on SYS.OPT_CALIBRATION_STATS$,
        UPDATE on SYS.OPT_CALIBRATION_STATS$

    (no users) <- DATAPATCH_ROLE: DELETE on SYS.DBA_REGISTRY_SQLPATCH,
        INSERT on SYS.DBA_REGISTRY_SQLPATCH, UPDATE on
        SYS.DBA_REGISTRY_SQLPATCH

    (no users) <- DV_ADMIN: DELETE on DVSYS.SIMULATION_LOG$

    (no users) <- DV_AUDIT_CLEANUP: DELETE on DVSYS.AUDIT_TRAIL$, DELETE on
        DVSYS.DV$CONFIGURATION_AUDIT, DELETE on DVSYS.DV$ENFORCEMENT_AUDIT

    (no users) <- DV_OWNER <- DV_ADMIN: DELETE on DVSYS.SIMULATION_LOG$
    (no users) <- DV_OWNER <- DV_AUDIT_CLEANUP: DELETE on
        DVSYS.AUDIT_TRAIL$, DELETE on DVSYS.DV$CONFIGURATION_AUDIT, DELETE
        on DVSYS.DV$ENFORCEMENT_AUDIT

    (no users) <- SYSUMF_ROLE: DELETE on SYS.UMF$_LINK, DELETE on
        SYS.UMF$_REGISTRATION, DELETE on SYS.UMF$_SERVICE, DELETE on
        SYS.UMF$_TOPOLOGY, DELETE on SYS.WRH$_ACTIVE_SESSION_HISTORY,
        DELETE on SYS.WRH$_ASM_BAD_DISK, DELETE on SYS.WRH$_ASM_DISKGROUP,
        DELETE on SYS.WRH$_ASM_DISKGROUP_STAT, DELETE on
        SYS.WRH$_BG_EVENT_SUMMARY, DELETE on SYS.WRH$_BUFFERED_QUEUES,
        DELETE on SYS.WRH$_BUFFERED_SUBSCRIBERS, DELETE on
        SYS.WRH$_BUFFER_POOL_STATISTICS, DELETE on SYS.WRH$_CELL_CONFIG,
        DELETE on SYS.WRH$_CELL_CONFIG_DETAIL, DELETE on SYS.WRH$_CELL_DB,
        DELETE on SYS.WRH$_CELL_DISK_SUMMARY, DELETE on
        SYS.WRH$_CELL_GLOBAL, DELETE on SYS.WRH$_CELL_GLOBAL_SUMMARY,
        DELETE on SYS.WRH$_CELL_IOREASON, DELETE on
        SYS.WRH$_CELL_IOREASON_NAME, DELETE on SYS.WRH$_CELL_METRIC_DESC,
        DELETE on SYS.WRH$_CELL_OPEN_ALERTS, DELETE on
        SYS.WRH$_CHANNEL_WAITS, DELETE on SYS.WRH$_CLUSTER_INTERCON, DELETE
        on SYS.WRH$_COMP_IOSTAT, DELETE on SYS.WRH$_CON_SYSMETRIC_HISTORY,
        DELETE on SYS.WRH$_CON_SYSMETRIC_SUMMARY, DELETE on
        SYS.WRH$_CON_SYSSTAT, DELETE on SYS.WRH$_CON_SYSTEM_EVENT, DELETE
        on SYS.WRH$_CON_SYS_TIME_MODEL, DELETE on SYS.WRH$_CR_BLOCK_SERVER,
        DELETE on SYS.WRH$_CURRENT_BLOCK_SERVER, DELETE on
        SYS.WRH$_DATAFILE, DELETE on SYS.WRH$_DB_CACHE_ADVICE, DELETE on
        SYS.WRH$_DISPATCHER, DELETE on SYS.WRH$_DLM_MISC, DELETE on
        SYS.WRH$_DYN_REMASTER_STATS, DELETE on SYS.WRH$_ENQUEUE_STAT,
        DELETE on SYS.WRH$_EVENT_HISTOGRAM, DELETE on SYS.WRH$_EVENT_NAME,
        DELETE on SYS.WRH$_FILEMETRIC_HISTORY, DELETE on
        SYS.WRH$_FILESTATXS, DELETE on SYS.WRH$_IC_CLIENT_STATS, DELETE on
        SYS.WRH$_IC_DEVICE_STATS, DELETE on SYS.WRH$_IM_SEG_STAT, DELETE on
        SYS.WRH$_IM_SEG_STAT_OBJ, DELETE on SYS.WRH$_INSTANCE_RECOVERY,
        DELETE on SYS.WRH$_INST_CACHE_TRANSFER, DELETE on
        SYS.WRH$_INTERCONNECT_PINGS, DELETE on SYS.WRH$_IOSTAT_DETAIL,
        DELETE on SYS.WRH$_IOSTAT_FILETYPE, DELETE on
        SYS.WRH$_IOSTAT_FILETYPE_NAME, DELETE on SYS.WRH$_IOSTAT_FUNCTION,
        DELETE on SYS.WRH$_IOSTAT_FUNCTION_NAME, DELETE on
        SYS.WRH$_JAVA_POOL_ADVICE, DELETE on SYS.WRH$_LATCH, DELETE on
        SYS.WRH$_LATCH_CHILDREN, DELETE on SYS.WRH$_LATCH_MISSES_SUMMARY,
        DELETE on SYS.WRH$_LATCH_NAME, DELETE on SYS.WRH$_LATCH_PARENT,
        DELETE on SYS.WRH$_LIBRARYCACHE, DELETE on SYS.WRH$_LMS_STATS,
        DELETE on SYS.WRH$_LOG, DELETE on SYS.WRH$_MEMORY_RESIZE_OPS,
        DELETE on SYS.WRH$_MEMORY_TARGET_ADVICE, DELETE on
        SYS.WRH$_MEM_DYNAMIC_COMP, DELETE on SYS.WRH$_METRIC_NAME, DELETE
        on SYS.WRH$_MTTR_TARGET_ADVICE, DELETE on SYS.WRH$_MUTEX_SLEEP,
        DELETE on SYS.WRH$_MVPARAMETER, DELETE on SYS.WRH$_OPTIMIZER_ENV,
        DELETE on SYS.WRH$_OSSTAT, DELETE on SYS.WRH$_OSSTAT_NAME, DELETE
        on SYS.WRH$_PARAMETER, DELETE on SYS.WRH$_PARAMETER_NAME, DELETE on
        SYS.WRH$_PERSISTENT_QMN_CACHE, DELETE on
        SYS.WRH$_PERSISTENT_QUEUES, DELETE on
        SYS.WRH$_PERSISTENT_SUBSCRIBERS, DELETE on SYS.WRH$_PGASTAT, DELETE
        on SYS.WRH$_PGA_TARGET_ADVICE, DELETE on
        SYS.WRH$_PLAN_OPERATION_NAME, DELETE on SYS.WRH$_PLAN_OPTION_NAME,
        DELETE on SYS.WRH$_PROCESS_MEMORY_SUMMARY, DELETE on
        SYS.WRH$_RECOVERY_PROGRESS, DELETE on
        SYS.WRH$_REPLICATION_TBL_STATS, DELETE on
        SYS.WRH$_REPLICATION_TXN_STATS, DELETE on SYS.WRH$_RESOURCE_LIMIT,
        DELETE on SYS.WRH$_ROWCACHE_SUMMARY, DELETE on
        SYS.WRH$_RSRC_CONSUMER_GROUP, DELETE on SYS.WRH$_RSRC_METRIC,
        DELETE on SYS.WRH$_RSRC_PDB_METRIC, DELETE on SYS.WRH$_RSRC_PLAN,
        DELETE on SYS.WRH$_RULE_SET, DELETE on SYS.WRH$_SEG_STAT, DELETE on
        SYS.WRH$_SEG_STAT_OBJ, DELETE on SYS.WRH$_SERVICE_NAME, DELETE on
        SYS.WRH$_SERVICE_STAT, DELETE on SYS.WRH$_SERVICE_WAIT_CLASS,
        DELETE on SYS.WRH$_SESSMETRIC_HISTORY, DELETE on
        SYS.WRH$_SESS_SGA_STATS, DELETE on SYS.WRH$_SESS_TIME_STATS, DELETE
        on SYS.WRH$_SGA, DELETE on SYS.WRH$_SGASTAT, DELETE on
        SYS.WRH$_SGA_TARGET_ADVICE, DELETE on SYS.WRH$_SHARED_POOL_ADVICE,
        DELETE on SYS.WRH$_SHARED_SERVER_SUMMARY, DELETE on
        SYS.WRH$_SQLCOMMAND_NAME, DELETE on SYS.WRH$_SQLSTAT, DELETE on
        SYS.WRH$_SQLTEXT, DELETE on SYS.WRH$_SQL_BIND_METADATA, DELETE on
        SYS.WRH$_SQL_PLAN, DELETE on SYS.WRH$_SQL_SUMMARY, DELETE on
        SYS.WRH$_SQL_WORKAREA_HISTOGRAM, DELETE on SYS.WRH$_STAT_NAME,
        DELETE on SYS.WRH$_STREAMS_APPLY_SUM, DELETE on
        SYS.WRH$_STREAMS_CAPTURE, DELETE on SYS.WRH$_STREAMS_POOL_ADVICE,
        DELETE on SYS.WRH$_SYSMETRIC_HISTORY, DELETE on
        SYS.WRH$_SYSMETRIC_SUMMARY, DELETE on SYS.WRH$_SYSSTAT, DELETE on
        SYS.WRH$_SYSTEM_EVENT, DELETE on SYS.WRH$_SYS_TIME_MODEL, DELETE on
        SYS.WRH$_TABLESPACE, DELETE on SYS.WRH$_TABLESPACE_SPACE_USAGE,
        DELETE on SYS.WRH$_TABLESPACE_STAT, DELETE on SYS.WRH$_TEMPFILE,
        DELETE on SYS.WRH$_TEMPSTATXS, DELETE on SYS.WRH$_THREAD, DELETE on
        SYS.WRH$_TOPLEVELCALL_NAME, DELETE on SYS.WRH$_UNDOSTAT, DELETE on
        SYS.WRH$_WAITCLASSMETRIC_HISTORY, DELETE on SYS.WRH$_WAITSTAT,
        DELETE on SYS.WRHS$_CELL_IOREASON_NAME, DELETE on
        SYS.WRHS$_CELL_METRIC_DESC, DELETE on SYS.WRHS$_DATAFILE, DELETE on
        SYS.WRHS$_EVENT_NAME, DELETE on SYS.WRHS$_IM_SEG_STAT_OBJ, DELETE
        on SYS.WRHS$_IOSTAT_FILETYPE_NAME, DELETE on
        SYS.WRHS$_IOSTAT_FUNCTION_NAME, DELETE on SYS.WRHS$_LATCH_NAME,
        DELETE on SYS.WRHS$_METRIC_NAME, DELETE on SYS.WRHS$_OPTIMIZER_ENV,
        DELETE on SYS.WRHS$_OSSTAT_NAME, DELETE on
        SYS.WRHS$_PARAMETER_NAME, DELETE on SYS.WRHS$_PLAN_OPERATION_NAME,
        DELETE on SYS.WRHS$_PLAN_OPTION_NAME, DELETE on
        SYS.WRHS$_SEG_STAT_OBJ, DELETE on SYS.WRHS$_SERVICE_NAME, DELETE on
        SYS.WRHS$_SQLCOMMAND_NAME, DELETE on SYS.WRHS$_SQLTEXT, DELETE on
        SYS.WRHS$_SQL_BIND_METADATA, DELETE on SYS.WRHS$_SQL_PLAN, DELETE
        on SYS.WRHS$_STAT_NAME, DELETE on SYS.WRHS$_TABLESPACE, DELETE on
        SYS.WRHS$_TEMPFILE, DELETE on SYS.WRHS$_TOPLEVELCALL_NAME, DELETE
        on SYS.WRI$_ADV_ACTIONS, DELETE on SYS.WRI$_ADV_DEF_PARAMETERS,
        DELETE on SYS.WRI$_ADV_DIRECTIVE_DEFS, DELETE on
        SYS.WRI$_ADV_DIRECTIVE_INSTANCES, DELETE on
        SYS.WRI$_ADV_EXECUTIONS, DELETE on SYS.WRI$_ADV_EXEC_PARAMETERS,
        DELETE on SYS.WRI$_ADV_FINDINGS, DELETE on SYS.WRI$_ADV_INST_FDG,
        DELETE on SYS.WRI$_ADV_JOURNAL, DELETE on
        SYS.WRI$_ADV_MESSAGE_GROUPS, DELETE on SYS.WRI$_ADV_OBJECTS, DELETE
        on SYS.WRI$_ADV_PARAMETERS, DELETE on SYS.WRI$_ADV_RATIONALE,
        DELETE on SYS.WRI$_ADV_RECOMMENDATIONS, DELETE on
        SYS.WRI$_ADV_REC_ACTIONS, DELETE on SYS.WRI$_ADV_SQLT_BINDS, DELETE
        on SYS.WRI$_ADV_SQLT_PLANS, DELETE on SYS.WRI$_ADV_SQLT_PLAN_HASH,
        DELETE on SYS.WRI$_ADV_SQLT_PLAN_STATS, DELETE on
        SYS.WRI$_ADV_SQLT_RTN_PLAN, DELETE on SYS.WRI$_ADV_SQLT_STATISTICS,
        DELETE on SYS.WRI$_ADV_TASKS, DELETE on SYS.WRI$_ADV_USAGE, DELETE
        on SYS.WRI$_ALERT_HISTORY, DELETE on SYS.WRI$_OPTSTAT_OPR, DELETE
        on SYS.WRI$_SEGADV_CNTRLTAB, DELETE on SYS.WRI$_SEGADV_OBJLIST,
        DELETE on SYS.WRI$_SQLSET_DEFINITIONS, DELETE on
        SYS.WRI$_SQLSET_REFERENCES, DELETE on SYS.WRI$_SQLTEXT_REFCOUNT,
        DELETE on SYS.WRM$_ACTIVE_PDBS, DELETE on SYS.WRM$_BASELINE, DELETE
        on SYS.WRM$_BASELINE_DETAILS, DELETE on SYS.WRM$_BASELINE_TEMPLATE,
        DELETE on SYS.WRM$_COLORED_SQL, DELETE on
        SYS.WRM$_DATABASE_INSTANCE, DELETE on SYS.WRM$_PDB_INSTANCE, DELETE
        on SYS.WRM$_PDB_IN_SNAP, DELETE on SYS.WRM$_SNAPSHOT, DELETE on
        SYS.WRM$_SNAPSHOT_DETAILS, DELETE on SYS.WRM$_SNAP_ERROR, DELETE on
        SYS.WRM$_WR_CONTROL, DELETE on SYS.WRM$_WR_SETTINGS, DELETE on
        SYS.WRM$_WR_USAGE, DELETE on SYS.WRMS$_SNAPSHOT, INSERT on
        SYS.UMF$_LINK, INSERT on SYS.UMF$_REGISTRATION, INSERT on
        SYS.UMF$_SERVICE, INSERT on SYS.UMF$_TOPOLOGY, INSERT on
        SYS.WRH$_ACTIVE_SESSION_HISTORY, INSERT on SYS.WRH$_ASM_BAD_DISK,
        INSERT on SYS.WRH$_ASM_DISKGROUP, INSERT on
        SYS.WRH$_ASM_DISKGROUP_STAT, INSERT on SYS.WRH$_BG_EVENT_SUMMARY,
        INSERT on SYS.WRH$_BUFFERED_QUEUES, INSERT on
        SYS.WRH$_BUFFERED_SUBSCRIBERS, INSERT on
        SYS.WRH$_BUFFER_POOL_STATISTICS, INSERT on SYS.WRH$_CELL_CONFIG,
        INSERT on SYS.WRH$_CELL_CONFIG_DETAIL, INSERT on SYS.WRH$_CELL_DB,
        INSERT on SYS.WRH$_CELL_DISK_SUMMARY, INSERT on
        SYS.WRH$_CELL_GLOBAL, INSERT on SYS.WRH$_CELL_GLOBAL_SUMMARY,
        INSERT on SYS.WRH$_CELL_IOREASON, INSERT on
        SYS.WRH$_CELL_IOREASON_NAME, INSERT on SYS.WRH$_CELL_METRIC_DESC,
        INSERT on SYS.WRH$_CELL_OPEN_ALERTS, INSERT on
        SYS.WRH$_CHANNEL_WAITS, INSERT on SYS.WRH$_CLUSTER_INTERCON, INSERT
        on SYS.WRH$_COMP_IOSTAT, INSERT on SYS.WRH$_CON_SYSMETRIC_HISTORY,
        INSERT on SYS.WRH$_CON_SYSMETRIC_SUMMARY, INSERT on
        SYS.WRH$_CON_SYSSTAT, INSERT on SYS.WRH$_CON_SYSTEM_EVENT, INSERT
        on SYS.WRH$_CON_SYS_TIME_MODEL, INSERT on SYS.WRH$_CR_BLOCK_SERVER,
        INSERT on SYS.WRH$_CURRENT_BLOCK_SERVER, INSERT on
        SYS.WRH$_DATAFILE, INSERT on SYS.WRH$_DB_CACHE_ADVICE, INSERT on
        SYS.WRH$_DISPATCHER, INSERT on SYS.WRH$_DLM_MISC, INSERT on
        SYS.WRH$_DYN_REMASTER_STATS, INSERT on SYS.WRH$_ENQUEUE_STAT,
        INSERT on SYS.WRH$_EVENT_HISTOGRAM, INSERT on SYS.WRH$_EVENT_NAME,
        INSERT on SYS.WRH$_FILEMETRIC_HISTORY, INSERT on
        SYS.WRH$_FILESTATXS, INSERT on SYS.WRH$_IC_CLIENT_STATS, INSERT on
        SYS.WRH$_IC_DEVICE_STATS, INSERT on SYS.WRH$_IM_SEG_STAT, INSERT on
        SYS.WRH$_IM_SEG_STAT_OBJ, INSERT on SYS.WRH$_INSTANCE_RECOVERY,
        INSERT on SYS.WRH$_INST_CACHE_TRANSFER, INSERT on
        SYS.WRH$_INTERCONNECT_PINGS, INSERT on SYS.WRH$_IOSTAT_DETAIL,
        INSERT on SYS.WRH$_IOSTAT_FILETYPE, INSERT on
        SYS.WRH$_IOSTAT_FILETYPE_NAME, INSERT on SYS.WRH$_IOSTAT_FUNCTION,
        INSERT on SYS.WRH$_IOSTAT_FUNCTION_NAME, INSERT on
        SYS.WRH$_JAVA_POOL_ADVICE, INSERT on SYS.WRH$_LATCH, INSERT on
        SYS.WRH$_LATCH_CHILDREN, INSERT on SYS.WRH$_LATCH_MISSES_SUMMARY,
        INSERT on SYS.WRH$_LATCH_NAME, INSERT on SYS.WRH$_LATCH_PARENT,
        INSERT on SYS.WRH$_LIBRARYCACHE, INSERT on SYS.WRH$_LMS_STATS,
        INSERT on SYS.WRH$_LOG, INSERT on SYS.WRH$_MEMORY_RESIZE_OPS,
        INSERT on SYS.WRH$_MEMORY_TARGET_ADVICE, INSERT on
        SYS.WRH$_MEM_DYNAMIC_COMP, INSERT on SYS.WRH$_METRIC_NAME, INSERT
        on SYS.WRH$_MTTR_TARGET_ADVICE, INSERT on SYS.WRH$_MUTEX_SLEEP,
        INSERT on SYS.WRH$_MVPARAMETER, INSERT on SYS.WRH$_OPTIMIZER_ENV,
        INSERT on SYS.WRH$_OSSTAT, INSERT on SYS.WRH$_OSSTAT_NAME, INSERT
        on SYS.WRH$_PARAMETER, INSERT on SYS.WRH$_PARAMETER_NAME, INSERT on
        SYS.WRH$_PERSISTENT_QMN_CACHE, INSERT on
        SYS.WRH$_PERSISTENT_QUEUES, INSERT on
        SYS.WRH$_PERSISTENT_SUBSCRIBERS, INSERT on SYS.WRH$_PGASTAT, INSERT
        on SYS.WRH$_PGA_TARGET_ADVICE, INSERT on
        SYS.WRH$_PLAN_OPERATION_NAME, INSERT on SYS.WRH$_PLAN_OPTION_NAME,
        INSERT on SYS.WRH$_PROCESS_MEMORY_SUMMARY, INSERT on
        SYS.WRH$_RECOVERY_PROGRESS, INSERT on
        SYS.WRH$_REPLICATION_TBL_STATS, INSERT on
        SYS.WRH$_REPLICATION_TXN_STATS, INSERT on SYS.WRH$_RESOURCE_LIMIT,
        INSERT on SYS.WRH$_ROWCACHE_SUMMARY, INSERT on
        SYS.WRH$_RSRC_CONSUMER_GROUP, INSERT on SYS.WRH$_RSRC_METRIC,
        INSERT on SYS.WRH$_RSRC_PDB_METRIC, INSERT on SYS.WRH$_RSRC_PLAN,
        INSERT on SYS.WRH$_RULE_SET, INSERT on SYS.WRH$_SEG_STAT, INSERT on
        SYS.WRH$_SEG_STAT_OBJ, INSERT on SYS.WRH$_SERVICE_NAME, INSERT on
        SYS.WRH$_SERVICE_STAT, INSERT on SYS.WRH$_SERVICE_WAIT_CLASS,
        INSERT on SYS.WRH$_SESSMETRIC_HISTORY, INSERT on
        SYS.WRH$_SESS_SGA_STATS, INSERT on SYS.WRH$_SESS_TIME_STATS, INSERT
        on SYS.WRH$_SGA, INSERT on SYS.WRH$_SGASTAT, INSERT on
        SYS.WRH$_SGA_TARGET_ADVICE, INSERT on SYS.WRH$_SHARED_POOL_ADVICE,
        INSERT on SYS.WRH$_SHARED_SERVER_SUMMARY, INSERT on
        SYS.WRH$_SQLCOMMAND_NAME, INSERT on SYS.WRH$_SQLSTAT, INSERT on
        SYS.WRH$_SQLTEXT, INSERT on SYS.WRH$_SQL_BIND_METADATA, INSERT on
        SYS.WRH$_SQL_PLAN, INSERT on SYS.WRH$_SQL_SUMMARY, INSERT on
        SYS.WRH$_SQL_WORKAREA_HISTOGRAM, INSERT on SYS.WRH$_STAT_NAME,
        INSERT on SYS.WRH$_STREAMS_APPLY_SUM, INSERT on
        SYS.WRH$_STREAMS_CAPTURE, INSERT on SYS.WRH$_STREAMS_POOL_ADVICE,
        INSERT on SYS.WRH$_SYSMETRIC_HISTORY, INSERT on
        SYS.WRH$_SYSMETRIC_SUMMARY, INSERT on SYS.WRH$_SYSSTAT, INSERT on
        SYS.WRH$_SYSTEM_EVENT, INSERT on SYS.WRH$_SYS_TIME_MODEL, INSERT on
        SYS.WRH$_TABLESPACE, INSERT on SYS.WRH$_TABLESPACE_SPACE_USAGE,
        INSERT on SYS.WRH$_TABLESPACE_STAT, INSERT on SYS.WRH$_TEMPFILE,
        INSERT on SYS.WRH$_TEMPSTATXS, INSERT on SYS.WRH$_THREAD, INSERT on
        SYS.WRH$_TOPLEVELCALL_NAME, INSERT on SYS.WRH$_UNDOSTAT, INSERT on
        SYS.WRH$_WAITCLASSMETRIC_HISTORY, INSERT on SYS.WRH$_WAITSTAT,
        INSERT on SYS.WRHS$_CELL_IOREASON_NAME, INSERT on
        SYS.WRHS$_CELL_METRIC_DESC, INSERT on SYS.WRHS$_DATAFILE, INSERT on
        SYS.WRHS$_EVENT_NAME, INSERT on SYS.WRHS$_IM_SEG_STAT_OBJ, INSERT
        on SYS.WRHS$_IOSTAT_FILETYPE_NAME, INSERT on
        SYS.WRHS$_IOSTAT_FUNCTION_NAME, INSERT on SYS.WRHS$_LATCH_NAME,
        INSERT on SYS.WRHS$_METRIC_NAME, INSERT on SYS.WRHS$_OPTIMIZER_ENV,
        INSERT on SYS.WRHS$_OSSTAT_NAME, INSERT on
        SYS.WRHS$_PARAMETER_NAME, INSERT on SYS.WRHS$_PLAN_OPERATION_NAME,
        INSERT on SYS.WRHS$_PLAN_OPTION_NAME, INSERT on
        SYS.WRHS$_SEG_STAT_OBJ, INSERT on SYS.WRHS$_SERVICE_NAME, INSERT on
        SYS.WRHS$_SQLCOMMAND_NAME, INSERT on SYS.WRHS$_SQLTEXT, INSERT on
        SYS.WRHS$_SQL_BIND_METADATA, INSERT on SYS.WRHS$_SQL_PLAN, INSERT
        on SYS.WRHS$_STAT_NAME, INSERT on SYS.WRHS$_TABLESPACE, INSERT on
        SYS.WRHS$_TEMPFILE, INSERT on SYS.WRHS$_TOPLEVELCALL_NAME, INSERT
        on SYS.WRI$_ADV_ACTIONS, INSERT on SYS.WRI$_ADV_DEF_PARAMETERS,
        INSERT on SYS.WRI$_ADV_DIRECTIVE_DEFS, INSERT on
        SYS.WRI$_ADV_DIRECTIVE_INSTANCES, INSERT on
        SYS.WRI$_ADV_EXECUTIONS, INSERT on SYS.WRI$_ADV_EXEC_PARAMETERS,
        INSERT on SYS.WRI$_ADV_FINDINGS, INSERT on SYS.WRI$_ADV_INST_FDG,
        INSERT on SYS.WRI$_ADV_JOURNAL, INSERT on
        SYS.WRI$_ADV_MESSAGE_GROUPS, INSERT on SYS.WRI$_ADV_OBJECTS, INSERT
        on SYS.WRI$_ADV_PARAMETERS, INSERT on SYS.WRI$_ADV_RATIONALE,
        INSERT on SYS.WRI$_ADV_RECOMMENDATIONS, INSERT on
        SYS.WRI$_ADV_REC_ACTIONS, INSERT on SYS.WRI$_ADV_SQLT_BINDS, INSERT
        on SYS.WRI$_ADV_SQLT_PLANS, INSERT on SYS.WRI$_ADV_SQLT_PLAN_HASH,
        INSERT on SYS.WRI$_ADV_SQLT_PLAN_STATS, INSERT on
        SYS.WRI$_ADV_SQLT_RTN_PLAN, INSERT on SYS.WRI$_ADV_SQLT_STATISTICS,
        INSERT on SYS.WRI$_ADV_TASKS, INSERT on SYS.WRI$_ADV_USAGE, INSERT
        on SYS.WRI$_ALERT_HISTORY, INSERT on SYS.WRI$_OPTSTAT_OPR, INSERT
        on SYS.WRI$_SEGADV_CNTRLTAB, INSERT on SYS.WRI$_SEGADV_OBJLIST,
        INSERT on SYS.WRI$_SQLSET_DEFINITIONS, INSERT on
        SYS.WRI$_SQLSET_REFERENCES, INSERT on SYS.WRI$_SQLTEXT_REFCOUNT,
        INSERT on SYS.WRM$_ACTIVE_PDBS, INSERT on SYS.WRM$_BASELINE, INSERT
        on SYS.WRM$_BASELINE_DETAILS, INSERT on SYS.WRM$_BASELINE_TEMPLATE,
        INSERT on SYS.WRM$_COLORED_SQL, INSERT on
        SYS.WRM$_DATABASE_INSTANCE, INSERT on SYS.WRM$_PDB_INSTANCE, INSERT
        on SYS.WRM$_PDB_IN_SNAP, INSERT on SYS.WRM$_SNAPSHOT, INSERT on
        SYS.WRM$_SNAPSHOT_DETAILS, INSERT on SYS.WRM$_SNAP_ERROR, INSERT on
        SYS.WRM$_WR_CONTROL, INSERT on SYS.WRM$_WR_SETTINGS, INSERT on
        SYS.WRM$_WR_USAGE, INSERT on SYS.WRMS$_SNAPSHOT, UPDATE on
        SYS.UMF$_LINK, UPDATE on SYS.UMF$_REGISTRATION, UPDATE on
        SYS.UMF$_SERVICE, UPDATE on SYS.UMF$_TOPOLOGY, UPDATE on
        SYS.WRH$_ACTIVE_SESSION_HISTORY, UPDATE on SYS.WRH$_ASM_BAD_DISK,
        UPDATE on SYS.WRH$_ASM_DISKGROUP, UPDATE on
        SYS.WRH$_ASM_DISKGROUP_STAT, UPDATE on SYS.WRH$_BG_EVENT_SUMMARY,
        UPDATE on SYS.WRH$_BUFFERED_QUEUES, UPDATE on
        SYS.WRH$_BUFFERED_SUBSCRIBERS, UPDATE on
        SYS.WRH$_BUFFER_POOL_STATISTICS, UPDATE on SYS.WRH$_CELL_CONFIG,
        UPDATE on SYS.WRH$_CELL_CONFIG_DETAIL, UPDATE on SYS.WRH$_CELL_DB,
        UPDATE on SYS.WRH$_CELL_DISK_SUMMARY, UPDATE on
        SYS.WRH$_CELL_GLOBAL, UPDATE on SYS.WRH$_CELL_GLOBAL_SUMMARY,
        UPDATE on SYS.WRH$_CELL_IOREASON, UPDATE on
        SYS.WRH$_CELL_IOREASON_NAME, UPDATE on SYS.WRH$_CELL_METRIC_DESC,
        UPDATE on SYS.WRH$_CELL_OPEN_ALERTS, UPDATE on
        SYS.WRH$_CHANNEL_WAITS, UPDATE on SYS.WRH$_CLUSTER_INTERCON, UPDATE
        on SYS.WRH$_COMP_IOSTAT, UPDATE on SYS.WRH$_CON_SYSMETRIC_HISTORY,
        UPDATE on SYS.WRH$_CON_SYSMETRIC_SUMMARY, UPDATE on
        SYS.WRH$_CON_SYSSTAT, UPDATE on SYS.WRH$_CON_SYSTEM_EVENT, UPDATE
        on SYS.WRH$_CON_SYS_TIME_MODEL, UPDATE on SYS.WRH$_CR_BLOCK_SERVER,
        UPDATE on SYS.WRH$_CURRENT_BLOCK_SERVER, UPDATE on
        SYS.WRH$_DATAFILE, UPDATE on SYS.WRH$_DB_CACHE_ADVICE, UPDATE on
        SYS.WRH$_DISPATCHER, UPDATE on SYS.WRH$_DLM_MISC, UPDATE on
        SYS.WRH$_DYN_REMASTER_STATS, UPDATE on SYS.WRH$_ENQUEUE_STAT,
        UPDATE on SYS.WRH$_EVENT_HISTOGRAM, UPDATE on SYS.WRH$_EVENT_NAME,
        UPDATE on SYS.WRH$_FILEMETRIC_HISTORY, UPDATE on
        SYS.WRH$_FILESTATXS, UPDATE on SYS.WRH$_IC_CLIENT_STATS, UPDATE on
        SYS.WRH$_IC_DEVICE_STATS, UPDATE on SYS.WRH$_IM_SEG_STAT, UPDATE on
        SYS.WRH$_IM_SEG_STAT_OBJ, UPDATE on SYS.WRH$_INSTANCE_RECOVERY,
        UPDATE on SYS.WRH$_INST_CACHE_TRANSFER, UPDATE on
        SYS.WRH$_INTERCONNECT_PINGS, UPDATE on SYS.WRH$_IOSTAT_DETAIL,
        UPDATE on SYS.WRH$_IOSTAT_FILETYPE, UPDATE on
        SYS.WRH$_IOSTAT_FILETYPE_NAME, UPDATE on SYS.WRH$_IOSTAT_FUNCTION,
        UPDATE on SYS.WRH$_IOSTAT_FUNCTION_NAME, UPDATE on
        SYS.WRH$_JAVA_POOL_ADVICE, UPDATE on SYS.WRH$_LATCH, UPDATE on
        SYS.WRH$_LATCH_CHILDREN, UPDATE on SYS.WRH$_LATCH_MISSES_SUMMARY,
        UPDATE on SYS.WRH$_LATCH_NAME, UPDATE on SYS.WRH$_LATCH_PARENT,
        UPDATE on SYS.WRH$_LIBRARYCACHE, UPDATE on SYS.WRH$_LMS_STATS,
        UPDATE on SYS.WRH$_LOG, UPDATE on SYS.WRH$_MEMORY_RESIZE_OPS,
        UPDATE on SYS.WRH$_MEMORY_TARGET_ADVICE, UPDATE on
        SYS.WRH$_MEM_DYNAMIC_COMP, UPDATE on SYS.WRH$_METRIC_NAME, UPDATE
        on SYS.WRH$_MTTR_TARGET_ADVICE, UPDATE on SYS.WRH$_MUTEX_SLEEP,
        UPDATE on SYS.WRH$_MVPARAMETER, UPDATE on SYS.WRH$_OPTIMIZER_ENV,
        UPDATE on SYS.WRH$_OSSTAT, UPDATE on SYS.WRH$_OSSTAT_NAME, UPDATE
        on SYS.WRH$_PARAMETER, UPDATE on SYS.WRH$_PARAMETER_NAME, UPDATE on
        SYS.WRH$_PERSISTENT_QMN_CACHE, UPDATE on
        SYS.WRH$_PERSISTENT_QUEUES, UPDATE on
        SYS.WRH$_PERSISTENT_SUBSCRIBERS, UPDATE on SYS.WRH$_PGASTAT, UPDATE
        on SYS.WRH$_PGA_TARGET_ADVICE, UPDATE on
        SYS.WRH$_PLAN_OPERATION_NAME, UPDATE on SYS.WRH$_PLAN_OPTION_NAME,
        UPDATE on SYS.WRH$_PROCESS_MEMORY_SUMMARY, UPDATE on
        SYS.WRH$_RECOVERY_PROGRESS, UPDATE on
        SYS.WRH$_REPLICATION_TBL_STATS, UPDATE on
        SYS.WRH$_REPLICATION_TXN_STATS, UPDATE on SYS.WRH$_RESOURCE_LIMIT,
        UPDATE on SYS.WRH$_ROWCACHE_SUMMARY, UPDATE on
        SYS.WRH$_RSRC_CONSUMER_GROUP, UPDATE on SYS.WRH$_RSRC_METRIC,
        UPDATE on SYS.WRH$_RSRC_PDB_METRIC, UPDATE on SYS.WRH$_RSRC_PLAN,
        UPDATE on SYS.WRH$_RULE_SET, UPDATE on SYS.WRH$_SEG_STAT, UPDATE on
        SYS.WRH$_SEG_STAT_OBJ, UPDATE on SYS.WRH$_SERVICE_NAME, UPDATE on
        SYS.WRH$_SERVICE_STAT, UPDATE on SYS.WRH$_SERVICE_WAIT_CLASS,
        UPDATE on SYS.WRH$_SESSMETRIC_HISTORY, UPDATE on
        SYS.WRH$_SESS_SGA_STATS, UPDATE on SYS.WRH$_SESS_TIME_STATS, UPDATE
        on SYS.WRH$_SGA, UPDATE on SYS.WRH$_SGASTAT, UPDATE on
        SYS.WRH$_SGA_TARGET_ADVICE, UPDATE on SYS.WRH$_SHARED_POOL_ADVICE,
        UPDATE on SYS.WRH$_SHARED_SERVER_SUMMARY, UPDATE on
        SYS.WRH$_SQLCOMMAND_NAME, UPDATE on SYS.WRH$_SQLSTAT, UPDATE on
        SYS.WRH$_SQLTEXT, UPDATE on SYS.WRH$_SQL_BIND_METADATA, UPDATE on
        SYS.WRH$_SQL_PLAN, UPDATE on SYS.WRH$_SQL_SUMMARY, UPDATE on
        SYS.WRH$_SQL_WORKAREA_HISTOGRAM, UPDATE on SYS.WRH$_STAT_NAME,
        UPDATE on SYS.WRH$_STREAMS_APPLY_SUM, UPDATE on
        SYS.WRH$_STREAMS_CAPTURE, UPDATE on SYS.WRH$_STREAMS_POOL_ADVICE,
        UPDATE on SYS.WRH$_SYSMETRIC_HISTORY, UPDATE on
        SYS.WRH$_SYSMETRIC_SUMMARY, UPDATE on SYS.WRH$_SYSSTAT, UPDATE on
        SYS.WRH$_SYSTEM_EVENT, UPDATE on SYS.WRH$_SYS_TIME_MODEL, UPDATE on
        SYS.WRH$_TABLESPACE, UPDATE on SYS.WRH$_TABLESPACE_SPACE_USAGE,
        UPDATE on SYS.WRH$_TABLESPACE_STAT, UPDATE on SYS.WRH$_TEMPFILE,
        UPDATE on SYS.WRH$_TEMPSTATXS, UPDATE on SYS.WRH$_THREAD, UPDATE on
        SYS.WRH$_TOPLEVELCALL_NAME, UPDATE on SYS.WRH$_UNDOSTAT, UPDATE on
        SYS.WRH$_WAITCLASSMETRIC_HISTORY, UPDATE on SYS.WRH$_WAITSTAT,
        UPDATE on SYS.WRHS$_CELL_IOREASON_NAME, UPDATE on
        SYS.WRHS$_CELL_METRIC_DESC, UPDATE on SYS.WRHS$_DATAFILE, UPDATE on
        SYS.WRHS$_EVENT_NAME, UPDATE on SYS.WRHS$_IM_SEG_STAT_OBJ, UPDATE
        on SYS.WRHS$_IOSTAT_FILETYPE_NAME, UPDATE on
        SYS.WRHS$_IOSTAT_FUNCTION_NAME, UPDATE on SYS.WRHS$_LATCH_NAME,
        UPDATE on SYS.WRHS$_METRIC_NAME, UPDATE on SYS.WRHS$_OPTIMIZER_ENV,
        UPDATE on SYS.WRHS$_OSSTAT_NAME, UPDATE on
        SYS.WRHS$_PARAMETER_NAME, UPDATE on SYS.WRHS$_PLAN_OPERATION_NAME,
        UPDATE on SYS.WRHS$_PLAN_OPTION_NAME, UPDATE on
        SYS.WRHS$_SEG_STAT_OBJ, UPDATE on SYS.WRHS$_SERVICE_NAME, UPDATE on
        SYS.WRHS$_SQLCOMMAND_NAME, UPDATE on SYS.WRHS$_SQLTEXT, UPDATE on
        SYS.WRHS$_SQL_BIND_METADATA, UPDATE on SYS.WRHS$_SQL_PLAN, UPDATE
        on SYS.WRHS$_STAT_NAME, UPDATE on SYS.WRHS$_TABLESPACE, UPDATE on
        SYS.WRHS$_TEMPFILE, UPDATE on SYS.WRHS$_TOPLEVELCALL_NAME, UPDATE
        on SYS.WRI$_ADV_ACTIONS, UPDATE on SYS.WRI$_ADV_DEF_PARAMETERS,
        UPDATE on SYS.WRI$_ADV_DIRECTIVE_DEFS, UPDATE on
        SYS.WRI$_ADV_DIRECTIVE_INSTANCES, UPDATE on
        SYS.WRI$_ADV_EXECUTIONS, UPDATE on SYS.WRI$_ADV_EXEC_PARAMETERS,
        UPDATE on SYS.WRI$_ADV_FINDINGS, UPDATE on SYS.WRI$_ADV_INST_FDG,
        UPDATE on SYS.WRI$_ADV_JOURNAL, UPDATE on
        SYS.WRI$_ADV_MESSAGE_GROUPS, UPDATE on SYS.WRI$_ADV_OBJECTS, UPDATE
        on SYS.WRI$_ADV_PARAMETERS, UPDATE on SYS.WRI$_ADV_RATIONALE,
        UPDATE on SYS.WRI$_ADV_RECOMMENDATIONS, UPDATE on
        SYS.WRI$_ADV_REC_ACTIONS, UPDATE on SYS.WRI$_ADV_SQLT_BINDS, UPDATE
        on SYS.WRI$_ADV_SQLT_PLANS, UPDATE on SYS.WRI$_ADV_SQLT_PLAN_HASH,
        UPDATE on SYS.WRI$_ADV_SQLT_PLAN_STATS, UPDATE on
        SYS.WRI$_ADV_SQLT_RTN_PLAN, UPDATE on SYS.WRI$_ADV_SQLT_STATISTICS,
        UPDATE on SYS.WRI$_ADV_TASKS, UPDATE on SYS.WRI$_ADV_USAGE, UPDATE
        on SYS.WRI$_ALERT_HISTORY, UPDATE on SYS.WRI$_OPTSTAT_OPR, UPDATE
        on SYS.WRI$_SEGADV_CNTRLTAB, UPDATE on SYS.WRI$_SEGADV_OBJLIST,
        UPDATE on SYS.WRI$_SQLSET_DEFINITIONS, UPDATE on
        SYS.WRI$_SQLSET_REFERENCES, UPDATE on SYS.WRI$_SQLTEXT_REFCOUNT,
        UPDATE on SYS.WRM$_ACTIVE_PDBS, UPDATE on SYS.WRM$_BASELINE, UPDATE
        on SYS.WRM$_BASELINE_DETAILS, UPDATE on SYS.WRM$_BASELINE_TEMPLATE,
        UPDATE on SYS.WRM$_COLORED_SQL, UPDATE on
        SYS.WRM$_DATABASE_INSTANCE, UPDATE on SYS.WRM$_PDB_INSTANCE, UPDATE
        on SYS.WRM$_PDB_IN_SNAP, UPDATE on SYS.WRM$_SNAPSHOT, UPDATE on
        SYS.WRM$_SNAPSHOT_DETAILS, UPDATE on SYS.WRM$_SNAP_ERROR, UPDATE on
        SYS.WRM$_WR_CONTROL, UPDATE on SYS.WRM$_WR_SETTINGS, UPDATE on
        SYS.WRM$_WR_USAGE, UPDATE on SYS.WRMS$_SNAPSHOT

Remarks:
    Users with these privileges can directly modify objects in the SYS,
    DVSYS, or LBACSYS schemas. Manipulating these system objects may allow
    security protections to be circumvented or otherwise interfere with
    normal operation of the database.

* User Impersonation *
Status: Pass
Summary:
    No grants of EXECUTE on restricted packages
Remarks:
    These PL/SQL packages (DBMS_SCHEDULER, DBMS_SYS_SQL) allow for
    execution of SQL code or external jobs using the identity of a
    different user. Access should be strictly limited and granted only to
    users with a legitimate need for this functionality.

* Data Exfiltration *
Status: Pass
Summary:
    No grants of EXECUTE on restricted packages
Remarks:
    These PL/SQL packages (DBMS_BACKUP_RESTORE) can send data from the
    database using the network or file system. Access should be granted
    only to users with a legitimate need for this functionality.

* System Privileges Granted to PUBLIC *
Status: Pass
Summary:
    No grants of system privileges to PUBLIC
Remarks:
    Privileges granted to PUBLIC are available to all users. This generally
    should include few, if any, system privileges since these will not be
    needed by ordinary users who are not administrators.

* Roles Granted to PUBLIC *
Status: Pass
Summary:
    No grants of roles to PUBLIC
Remarks:
    Roles granted to PUBLIC are available to all users. Most roles contain
    privileges that are not appropriate for all users.

* Column Privileges Granted to PUBLIC *
Status: Pass
Summary:
    No grants of column privileges to PUBLIC
Remarks:
    Privileges granted to PUBLIC are available to all users. This should
    include column privileges only for data that is intended to be
    accessible to everyone.

* DBA Role *
Status: Evaluate
Summary:
    1 grant of DBA role
Details:
    Grants of DBA role:

    SYSTEM: DBA

Remarks:
    The DBA role is very powerful and can be used to bypass many security
    protections. It should be granted to only a small number of trusted
    administrators. Furthermore, each trusted user should have an
    individual account for accountability reasons. As with any powerful
    role, avoid granting the DBA role with admin option unless absolutely
    necessary.

* Other Powerful Roles *
Status: Evaluate
Summary:
    8 grants of powerful roles (1 with admin option)
Details:
    Grants of AQ_ADMINISTRATOR_ROLE, EM_EXPRESS_ALL, EXP_FULL_DATABASE,
        IMP_FULL_DATABASE, OEM_MONITOR roles:

    SYSTEM: AQ_ADMINISTRATOR_ROLE(*)
    SYSTEM <- DBA: EM_EXPRESS_ALL, EXP_FULL_DATABASE, IMP_FULL_DATABASE
    SYSTEM <- DBA <- DATAPUMP_EXP_FULL_DATABASE: EXP_FULL_DATABASE
    SYSTEM <- DBA <- DATAPUMP_IMP_FULL_DATABASE: EXP_FULL_DATABASE,
        IMP_FULL_DATABASE

    (no users) <- GSMADMIN_ROLE: AQ_ADMINISTRATOR_ROLE

    (*) = granted with admin option
Remarks:
    Like the DBA role, these roles (AQ_ADMINISTRATOR_ROLE, EM_EXPRESS_ALL,
    EXP_FULL_DATABASE, IMP_FULL_DATABASE, OEM_MONITOR) contain powerful
    privileges that can be used to bypass security protections. They should
    be granted only to a small number of trusted administrators.

* Java Permissions *
Status: Evaluate
Summary:
    Found 5 users or roles with Java permission.
Details:
    Grantee: DBJAVASCRIPT
    GRANT, Name: oracle.DbmsJavaScriptUser, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission

    Grantee: EJBCLIENT
    GRANT, Name: *, Type Schema: SYS, Type Name: java.net.SocketPermission,
        Action: connect,resolve
    GRANT, Name: createClassLoader, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: getClassLoader, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission

    Grantee: JMXSERVER
    GRANT, Name: *, Type Schema: SYS, Type Name: java.net.SocketPermission,
        Action: accept,connect,listen,resolve
    GRANT, Name: control, Type Schema: SYS, Type Name:
        java.util.logging.LoggingPermission
    GRANT, Name: monitor, Type Schema: SYS, Type Name:
        java.lang.management.ManagementPermission
    GRANT, Name: setContextClassLoader, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: createMBeanServer, Type Schema: SYS, Type Name:
        javax.management.MBeanServerPermission
    GRANT, Name: control, Type Schema: SYS, Type Name:
        java.lang.management.ManagementPermission
    GRANT, Name: javax.net.ssl.*, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: https.proxyHost, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: javax.net.debug, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: java.rmi.server.randomIDs, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: com.sun.jmx.*, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: com.sun.management.*, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read,write
    GRANT, Name: *, Type Schema: SYS, Type Name:
        javax.management.MBeanPermission, Action: *
    GRANT, Name: javavm/lib/management/*, Type Schema: SYS, Type Name:
        java.io.FilePermission, Action: read
    GRANT, Name: javavm/lib/management/jmxremote.access, Type Schema: SYS,
        Type Name: java.io.FilePermission, Action: read
    GRANT, Name: javavm/lib/management/management.properties, Type Schema:
        SYS, Type Name: java.io.FilePermission, Action: read
    GRANT, Name: createAccessControlContext, Type Schema: SYS, Type Name:
        java.security.SecurityPermission
    GRANT, Name: accessClassInPackage.sun.management.*, Type Schema: SYS,
        Type Name: java.lang.RuntimePermission

    Grantee: PUBLIC
    GRANT, Name: DUMMY, Type Schema: SYS, Type Name:
        oracle.aurora.security.JServerPermission
    GRANT, Name: *, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: read
    GRANT, Name: user.language, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: write
    GRANT, Name: exitVM, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: createSecurityManager, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: modifyThread, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: modifyThreadGroup, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: getenv.TNS_ADMIN, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: preferences, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    GRANT, Name: LoadClassInPackage.*, Type Schema: SYS, Type Name:
        oracle.aurora.security.JServerPermission
    GRANT, Name: oracle.net.tns_admin, Type Schema: SYS, Type Name:
        java.util.PropertyPermission, Action: write
    GRANT, Name: getenv.ORACLE_HOME, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    RESTRICT, Name: LoadClassInPackage.oracle.jdbc.*, Type Schema: SYS,
        Type Name: oracle.aurora.security.JServerPermission
    RESTRICT, Name: LoadClassInPackage.oracle.aurora.*, Type Schema: SYS,
        Type Name: oracle.aurora.security.JServerPermission
    RESTRICT, Name: LoadClassInPackage.java.*, Type Schema: SYS, Type Name:
        oracle.aurora.security.JServerPermission
    RESTRICT, Name: loadLibrary.*, Type Schema: SYS, Type Name:
        java.lang.RuntimePermission
    RESTRICT, Name: 0:java.lang.RuntimePermission#loadLibrary.*, Type
        Schema: SYS, Type Name:
        oracle.aurora.rdbms.security.PolicyTablePermission
    RESTRICT, Name: LoadClassInPackage.oracle.ord.*, Type Schema: SYS, Type
        Name: oracle.aurora.security.JServerPermission

    Grantee: SYSTEM
    GRANT, Name: <<ALL FILES>>, Type Schema: SYS, Type Name:
        java.io.FilePermission, Action: read
Remarks:
    Java permission grants control the ability of database users to execute
    Java classes within the database server. A database user executing Java
    code must have both Java security permissions and database privileges
    to access resources within the database. These resources include
    database resources, such as tables and PL/SQL packages, operating
    system resources, such as files and sockets, Oracle JVM classes, and
    user-loaded classes. Make sure that these permissions are limited to
    the minimum required by each user.

* Users with Administrative Privileges *
Status: Evaluate
Summary:
    Found 4 users granted administrative privileges. Found 0 administrative
    privileges not granted to any user.
Details:
    SYSDBA    (1): SYS
    SYSOPER   (1): SYS
    SYSBACKUP (1): SYSBACKUP
    SYSDG     (1): SYSDG
    SYSKM     (1): SYSKM
Remarks:
    Administrative privileges allow a user to perform maintenance
    operations, including some that may occur while the database is not
    open. The SYSDBA privilege allows the user to run as SYS and perform
    virtually all privileged operations. Starting with Oracle Database
    12.1, less powerful administrative privileges were introduced to allow
    users to perform common administrative tasks with less than full SYSDBA
    privileges. To achieve the benefit of this separation of duty, each of
    these administrative privileges should be granted to at least one user
    account.

### Authorization Control ###

* Database Vault *
Status: Opportunity
Summary:
    Database Vault is not enabled.
Remarks:
    Database Vault provides for configurable policies to control the
    actions of privileged administrative users, in order to protect against
    insider threats, stolen credentials, and human error. Data realms
    prevent unauthorized access to sensitive data objects, even by users
    with system privileges. Command rules limit the SQL commands and
    options that administrators can execute.

* Privilege Analysis *
Status: Opportunity
Summary:
    No privilege analysis policies found.
Details:

    Users with EXECUTE on SYS.DBMS_PRIVILEGE_CAPTURE: SYSTEM
Remarks:
    Privilege Analysis records the privileges used during a real or
    simulated workload. After collecting data about the privileges that are
    actually used, this information can be used to revoke privilege grants
    that are no longer needed.

### Data Encryption ###

* Transparent Data Encryption *
Status: Opportunity
Summary:
    No encrypted tablespaces found. No encrypted columns found. Examined 1
    initialization parameter.
Details:
    ENCRYPT_NEW_TABLESPACES=CLOUD_ONLY. Recommended value is ALWAYS.
Remarks:
    Encryption of some sensitive data is a requirement in certain regulated
    environments. Transparent Data Encryption automatically encrypts data
    as it is stored and decrypts it upon retrieval. This protects sensitive
    data from attacks that bypass the database to read data files directly.
    Encryption keys may be stored in wallets on the database server itself,
    or stored remotely in Oracle Key Vault for improved security. The
    ENCRYPT_NEW_TABLESPACES parameter ensures that TDE tablespace
    encryption is applied to all newly created tablespaces. Setting this
    parameter to ALWAYS is recommended in order to protect all data
    regardless of the options specified when the tablespace is created.

* Encryption Key Wallet *
Status: Evaluate
Summary:
    Found 1 wallet. No wallets are stored in the data file directory.
Details:
    Wallet location: /opt/oracle/admin/ORCLCDB/wallet
    Wallet type: FILE
    Status: NOT_AVAILABLE
    Keystore type: UNKNOWN
    Wallet order: SINGLE

    Data file directory: /opt/oracle/product/12.2.0.1/db_1/dbs
Remarks:
    Wallets are encrypted files used to store encryption keys, passwords,
    and other sensitive data. Wallet files should not be stored in the same
    directory with database data files, to avoid accidentally creating
    backups that include both encrypted data files and the wallet
    containing the master key protecting those files. For maximum
    separation of keys and data, consider storing encryption keys in Oracle
    Key Vault instead of wallet files.

### Fine-Grained Access Control ###

* Data Redaction *
Status: Opportunity
Summary:
    No data redaction policies found.
Details:

    Users with EXEMPT REDACTION POLICY privilege: SYSTEM
    Users with EXECUTE on SYS.DBMS_REDACT: SYSTEM
Remarks:
    Data Redaction automatically masks sensitive data found in the results
    of a database query. The data is masked immediately before it is
    returned as part of the result set, so it does not interfere with any
    conditions specified as part of the query. Access by users with the
    EXEMPT REDACTION POLICY privilege will not be affected by the redaction
    policy. Users who can execute the DBMS_REDACT package are able to
    create and modify redaction policies. Also consider the use of Oracle
    Data Masking and Subsetting to permanently mask sensitive data when
    making copies for test or development use.

* Virtual Private Database *
Status: Opportunity
Summary:
    No VPD policies found.
Details:

    Users with EXEMPT ACCESS POLICY privilege: (none)
    Users with EXECUTE on SYS.DBMS_RLS: SYSTEM
Remarks:
    Virtual Private Database (VPD) allows for fine-grained control over
    which rows and columns of a table are visible to a SQL statement.
    Access control using VPD limits each database session to only the
    specific data it should be able to access. Access by users with the
    EXEMPT ACCESS POLICY privilege will not be affected by VPD policies.
    Users who can execute the DBMS_RLS package are able to create and
    modify these policies.

* Real Application Security *
Status: Opportunity
Summary:
    No RAS policies found.
Details:

    Users with EXEMPT ACCESS POLICY privilege: (none)
    Users with ADMIN_ANY_SEC_POLICY privilege: SYSTEM
    Users with ADMIN_SEC_POLICY privilege: DBSFWUSER, SYSTEM
    Users with APPLY_SEC_POLICY privilege: (none)
Remarks:
    Like Virtual Private Database, Real Application Security (RAS) provides
    fine-grained control over the rows and columns of a table that are
    visible to a SQL statement. Specification of RAS data access policies
    uses a declarative syntax based on access control lists. Access by
    users with the EXEMPT ACCESS POLICY privilege will not be affected by
    RAS access policies. Users with ADMIN_SEC_POLICY and APPLY_SEC_POLICY
    privileges are able to create and modify these policies.

* Label Security *
Status: Opportunity
Summary:
    Label Security is not enabled.
Remarks:
    Oracle Label Security provides the ability to tag data with a data
    label or a data classification. Access to sensitive data is controlled
    by comparing the data label with the requesting user's label or
    security clearance. A user label or security clearance can be thought
    of as an extension to standard database privileges and roles. Access by
    users with the EXEMPT ACCESS POLICY privilege will not be affected by
    the Label Security policies. Each policy has a corresponding role;
    users who have this role are able to administer the policy.

* Transparent Sensitive Data Protection *
Status: Opportunity
Summary:
    No sensitive types and columns found.  Found 0 TSDP policies.
Details:
    Policies: (none)

    Users with EXECUTE on SYS.DBMS_TSDP_MANAGE: (none)
    Users with EXECUTE on SYS.DBMS_TSDP_PROTECT: (none)
Remarks:
    Transparent Sensitive Data Protection (TSDP), introduced in Oracle
    Database 12.1, allows a data type to be associated with each column
    that contains sensitive data. TSDP can then apply various data security
    features to all instances of a particular type so that protection is
    uniform and consistent. Data from columns marked as sensitive is also
    automatically redacted in the database audit trail and trace logs.
    Users who can execute the DBMS_TSDP_MANAGE and DBMS_TSDP_PROTECT
    packages are able to manage sensitive data types and the protection
    actions that are applied to them.

### Auditing ###

* Audit Records *
Status: Severe Risk
Summary:
    Examined 3 audit trails. Found no audit records. Found 1 error in audit
    initialization parameters.
Details:
    Traditional Audit Trail: No records found
    FGA Audit Trail: No records found
    Unified Audit Trail: No records found

    AUDIT_FILE_DEST=/opt/oracle/admin/ORCLCDB/adump
    AUDIT_SYSLOG_LEVEL is not set.
    AUDIT_TRAIL=NONE. Recommended value is OS, DB, DB,EXTENDED, XML, or
        XML,EXTENDED.
Remarks:
    Auditing is an essential component for securing any system. The audit
    trail allows for monitoring the activities of highly privileged users.
    For any attack that exploits gaps in other security policies, auditing
    cannot prevent the attack but it forms the critical last line of
    defense by detecting the malicious activity. Sending audit data to a
    remote system is recommended in order to prevent any possible tampering
    with the audit records. The AUDIT_SYSLOG_LEVEL parameter can be set to
    send an abbreviated version of some audit records to a remote syslog
    collector. A better solution is to use Oracle Audit Vault and Database
    Firewall to centrally collect full audit records from multiple
    databases.

* Statement Audit *
Status: Evaluate
Summary:
    Auditing enabled for 17 statements.
Details:
    Unified Audit (17): ALTER DATABASE LINK, ALTER PLUGGABLE DATABASE,
        ALTER PROFILE, ALTER ROLE, ALTER USER, CREATE DATABASE LINK, CREATE
        DIRECTORY, CREATE PLUGGABLE DATABASE, CREATE PROFILE, CREATE ROLE,
        DROP DATABASE LINK, DROP DIRECTORY, DROP PLUGGABLE DATABASE, DROP
        PROFILE, DROP ROLE, LOGON, SET ROLE
Remarks:
    This finding shows the SQL statements that are audited by enabled audit
    policies.

* Object Audit *
Status: Evaluate
Summary:
    Auditing enabled for 214 objects.
Details:
    Traditional Audit:
    Schema DVF (1): DBMS_MACSEC_FUNCTION
    Schema DVSYS (91): AUDIT_TRAIL$, AUDIT_TRAIL$_SEQ, CODE$, CODE$_SEQ,
        COMMAND_RULE$, COMMAND_RULE$_SEQ, DBA_DV_CODE, DBA_DV_COMMAND_RULE,
        DBA_DV_FACTOR, DBA_DV_FACTOR_LINK, DBA_DV_FACTOR_TYPE,
        DBA_DV_IDENTITY, DBA_DV_IDENTITY_MAP, DBA_DV_MAC_POLICY,
        DBA_DV_MAC_POLICY_FACTOR, DBA_DV_POLICY_LABEL, DBA_DV_REALM,
        DBA_DV_REALM_AUTH, DBA_DV_REALM_OBJECT, DBA_DV_ROLE, DBA_DV_RULE,
        DBA_DV_RULE_SET, DBA_DV_RULE_SET_RULE, DBMS_MACADM, DBMS_MACAUD,
        DBMS_MACOLS, DBMS_MACOLS_SESSION, DBMS_MACSEC, DBMS_MACSEC_ROLES,
        DBMS_MACSEC_RULES, DBMS_MACUTL, DV$CODE, DV$COMMAND_RULE,
        DV$FACTOR, DV$FACTOR_LINK, DV$FACTOR_TYPE, DV$IDENTITY,
        DV$IDENTITY_MAP, DV$MAC_POLICY, DV$MAC_POLICY_FACTOR,
        DV$OLS_POLICY, DV$OLS_POLICY_LABEL, DV$POLICY_LABEL, DV$REALM,
        DV$REALM_AUTH, DV$REALM_OBJECT, DV$ROLE, DV$RULE, DV$RULE_SET,
        DV$RULE_SET_RULE, DV$SYS_GRANTEE, DV$SYS_OBJECT,
        DV$SYS_OBJECT_OWNER, EVALUATE_RULE_SET, FACTOR$, FACTOR$_SEQ,
        FACTOR_LINK$, FACTOR_LINK$_SEQ, FACTOR_TYPE$, FACTOR_TYPE$_SEQ,
        GET_FACTOR, GET_TRUST_LEVEL, GET_TRUST_LEVEL_FOR_IDENTITY,
        IDENTITY$, IDENTITY$_SEQ, IDENTITY_MAP$, IDENTITY_MAP$_SEQ,
        MACOLS_INIT_SESSION, MAC_POLICY$, MAC_POLICY$_SEQ,
        MAC_POLICY_FACTOR$, MAC_POLICY_FACTOR$_SEQ, POLICY_LABEL$,
        POLICY_LABEL$_SEQ, PREDICATE_TRUE, REALM$, REALM$_SEQ, REALM_AUTH$,
        REALM_AUTH$_SEQ, REALM_OBJECT$, REALM_OBJECT$_SEQ, ROLE$,
        ROLE$_SEQ, ROLE_IS_ENABLED, RULE$, RULE$_SEQ, RULE_SET$,
        RULE_SET$_SEQ, RULE_SET_RULE$, RULE_SET_RULE$_SEQ, SET_FACTOR
    Schema LBACSYS (122): ALL_SA_AUDIT_OPTIONS, ALL_SA_COMPARTMENTS,
        ALL_SA_DATA_LABELS, ALL_SA_GROUPS, ALL_SA_GROUP_HIERARCHY,
        ALL_SA_LABELS, ALL_SA_LEVELS, ALL_SA_POLICIES, ALL_SA_PROGRAMS,
        ALL_SA_PROG_PRIVS, ALL_SA_SCHEMA_POLICIES, ALL_SA_TABLE_POLICIES,
        ALL_SA_USERS, ALL_SA_USER_COMPARTMENTS, ALL_SA_USER_GROUPS,
        ALL_SA_USER_LABELS, ALL_SA_USER_LEVELS, ALL_SA_USER_PRIVS,
        DBA_LBAC_DATA_LABELS, DBA_LBAC_LABELS, DBA_LBAC_LABEL_TAGS,
        DBA_LBAC_POLICIES, DBA_LBAC_SCHEMA_POLICIES,
        DBA_LBAC_TABLE_POLICIES, DBA_OLS_AUDIT_OPTIONS,
        DBA_SA_AUDIT_OPTIONS, DBA_SA_COMPARTMENTS, DBA_SA_DATA_LABELS,
        DBA_SA_GROUPS, DBA_SA_GROUP_HIERARCHY, DBA_SA_LABELS,
        DBA_SA_LEVELS, DBA_SA_POLICIES, DBA_SA_PROGRAMS, DBA_SA_PROG_PRIVS,
        DBA_SA_SCHEMA_POLICIES, DBA_SA_TABLE_POLICIES, DBA_SA_USERS,
        DBA_SA_USER_COMPARTMENTS, DBA_SA_USER_GROUPS, DBA_SA_USER_LABELS,
        DBA_SA_USER_LEVELS, DBA_SA_USER_PRIVS, LBAC$CACHE_LIBT,
        LBAC$EVENT_LIBT, LBAC$LABEL_LIBT, LBAC$LABLT_LIBT, LBAC$PRIVS_LIBT,
        LBAC$SA, LBAC$SA_LABELS, LBAC$STD_LIBT, LBAC$TYPE_LIBT,
        LBAC$USER_LIBT, LBAC_BIN_LABEL, LBAC_CACHE, LBAC_ERRORS,
        LBAC_EVENTS, LBAC_FRAME_GRANT, LBAC_LABEL, LBAC_LABEL_LIST,
        LBAC_NAME_LIST, LBAC_POLICY_ADMIN, LBAC_PRIVS, LBAC_RLS,
        LBAC_SERVICES, LBAC_SESSION, LBAC_STANDARD, LBAC_SYSDBA, LBAC_UTL,
        LDAP_ATTR, LDAP_ATTR_LIST, LDAP_EVENT, LDAP_EVENT_STATUS,
        NUMERIC_DOMINATED_BY, NUMERIC_DOMINATES, NUMERIC_GREATEST_LBOUND,
        NUMERIC_LABEL_TO_CHAR, NUMERIC_LEAST_UBOUND, NUMERIC_MERGE_LABEL,
        NUMERIC_STRICTLY_DOMINATED_BY, NUMERIC_STRICTLY_DOMINATES,
        OLS$AUDIT, OLS$AUDIT_ACTIONS, OLS$COMPARTMENTS, OLS$DIP_DEBUG,
        OLS$DIP_EVENTS, OLS$GROUPS, OLS$INSTALLATIONS, OLS$LAB,
        OLS$LAB_SEQUENCE, OLS$LEVELS, OLS$POL, OLS$POLICY_ADMIN,
        OLS$POLICY_COLUMNS, OLS$POLS, OLS$POLT, OLS$PROFILES, OLS$PROG,
        OLS$PROPS, OLS$TAG_SEQUENCE, OLS$TRUSTED_PROGS, OLS$USER,
        OLS$USER_COMPARTMENTS, OLS$USER_GROUPS, OLS$USER_LEVELS,
        OLS_DIP_NTFY, PRIVS_TO_CHAR, SA$ADMIN, SA$POL, SA_AUDIT_ADMIN,
        SA_COMPONENTS, SA_LABEL_ADMIN, SA_POLICY_GRANT, SA_SESSION,
        SA_SYSDBA, SA_USER_ADMIN, SA_UTL, TO_LBAC_DATA_LABEL,
        TO_LBAC_LABEL, TO_NUMERIC_DATA_LABEL, TO_NUMERIC_LABEL,
        USER_SA_SESSION
Remarks:
    This finding shows the object accesses that are audited by enabled
    audit policies.

* Privilege Audit *
Status: Evaluate
Summary:
    Auditing enabled for 30 privileges.
Details:
    Unified Audit (30): ADMINISTER KEY MANAGEMENT, ALTER ANY PROCEDURE,
        ALTER ANY SQL TRANSLATION PROFILE, ALTER ANY TABLE, ALTER DATABASE,
        ALTER SYSTEM, AUDIT SYSTEM, BECOME USER, CREATE ANY JOB, CREATE ANY
        LIBRARY, CREATE ANY PROCEDURE, CREATE ANY SQL TRANSLATION PROFILE,
        CREATE ANY TABLE, CREATE EXTERNAL JOB, CREATE PUBLIC SYNONYM,
        CREATE SQL TRANSLATION PROFILE, CREATE USER, DROP ANY PROCEDURE,
        DROP ANY SQL TRANSLATION PROFILE, DROP ANY TABLE, DROP PUBLIC
        SYNONYM, DROP USER, EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY,
        GRANT ANY OBJECT PRIVILEGE, GRANT ANY PRIVILEGE, GRANT ANY ROLE,
        LOGMINING, PURGE DBA_RECYCLEBIN, TRANSLATE ANY SQL
Remarks:
    This finding shows the privileges that are audited by enabled audit
    policies.

* Administrative User Audit *
Status: Significant Risk
Summary:
    Actions of the SYS user are not audited.
Details:
    Traditional Audit: AUDIT_SYS_OPERATIONS is set to FALSE.

    Unified Audit policies enabled for administrators: (none)
Remarks:
    It is important to audit administrative actions performed by the SYS
    user. Traditional audit policies do not apply to SYS, so the
    AUDIT_SYS_OPERATIONS parameter must be set to record SYS actions to a
    separate audit trail. Beginning with Oracle 12c, the same Unified Audit
    policies can be applied to SYS that are used to monitor other users.

* Privilege Management Audit *
Status: Pass
Summary:
    Actions related to privilege management are sufficiently audited.
Details:
    Traditional audit - auditing enabled: (none)
    Unified audit - auditing enabled: GRANT ANY OBJECT PRIVILEGE, GRANT ANY
        PRIVILEGE, GRANT ANY ROLE
Remarks:
    Granting additional privileges to users or roles potentially affects
    most security protections and should be audited. Each action or
    privilege listed here should be included in at least one enabled audit
    policy.

* Account Management Audit *
Status: Pass
Summary:
    Actions related to account management are sufficiently audited.
Details:
    Traditional audit - auditing enabled: (none)
    Unified audit - auditing enabled: ALTER PROFILE, ALTER USER, CREATE
        PROFILE, CREATE USER, DROP PROFILE, DROP USER
Remarks:
    Creation of new user accounts or modification of existing accounts can
    be used to gain access to the privileges of those accounts and should
    be audited. Each action or privilege listed here should be included in
    at least one enabled audit policy.

* Database Management Audit *
Status: Significant Risk
Summary:
    Actions related to database management are not sufficiently audited.
Details:
    Auditing not enabled: ALTER PUBLIC DATABASE LINK, AUDIT ANY, CREATE ANY
        DIRECTORY, CREATE PUBLIC DATABASE LINK, CREATE SPFILE, DROP ANY
        DIRECTORY, DROP PUBLIC DATABASE LINK, SYSTEM AUDIT

    Traditional audit - auditing enabled: (none)
    Unified audit - auditing enabled: ADMINISTER KEY MANAGEMENT, ALTER
        DATABASE, ALTER DATABASE LINK, ALTER PLUGGABLE DATABASE, ALTER
        SYSTEM, CREATE ANY LIBRARY, CREATE DATABASE LINK, CREATE EXTERNAL
        JOB, CREATE PLUGGABLE DATABASE, CREATE PUBLIC SYNONYM, DROP
        DATABASE LINK, DROP PLUGGABLE DATABASE, DROP PUBLIC SYNONYM,
        EXECUTE ON SYS.DBMS_RLS
Remarks:
    Actions that affect the management of database features should always
    be audited. Each action or privilege listed here should be included in
    at least one enabled audit policy.

* Privilege Usage Audit *
Status: Significant Risk
Summary:
    Usages of powerful system privileges are not sufficiently audited.
Details:
    Auditing not enabled: CREATE ANY TRIGGER

    Traditional audit - auditing enabled: (none)
    Unified audit - auditing enabled: ALTER ANY SQL TRANSLATION PROFILE,
        BECOME USER, CREATE ANY JOB, CREATE ANY PROCEDURE, CREATE ANY SQL
        TRANSLATION PROFILE, EXEMPT ACCESS POLICY, EXEMPT REDACTION POLICY,
        LOGMINING, TRANSLATE ANY SQL
Remarks:
    Usage of powerful system privileges should always be audited. Each
    privilege listed here should be included in at least one enabled audit
    policy.

* Database Connection Audit *
Status: Pass
Summary:
    Database connections are sufficiently audited.
Details:
    Traditional audit - auditing enabled: (none)
    Unified audit - auditing enabled: LOGON
Remarks:
    Successful user connections to the database should be audited to assist
    with future forensic analysis. Unsuccessful connection attempts can
    provide early warning of an attacker's attempt to gain access to the
    database.

* Fine Grained Audit *
Status: Opportunity
Summary:
    No fine grained audit policies found.
Details:

    Users with EXECUTE on SYS.DBMS_FGA: SYSTEM
Remarks:
    Fine Grained Audit policies can record highly specific activity, such
    as access to particular table columns or access that occurs under
    specified conditions. This is a useful way to monitor unexpected data
    access while avoiding unnecessary audit records that correspond to
    normal activity.

* Unified Audit *
Status: Evaluate
Summary:
    Found 9 unified audit policies. Found 49 objects or statements being
    audited.
Details:
    Policy ORA_ACCOUNT_MGMT (Disabled): Audits 9 objects/statements
    Policy ORA_CIS_RECOMMENDATIONS (Disabled): Audits 26 objects/statements
    Policy ORA_DATABASE_PARAMETER (Disabled): Audits 3 objects/statements
    Policy ORA_DV_AUDPOL (Disabled): Audits 2096 objects/statements
    Policy ORA_DV_AUDPOL2 (Disabled): Audits 19 objects/statements
    Policy ORA_LOGON_FAILURES (Enabled): Audits 1 objects/statements
    Policy ORA_RAS_POLICY_MGMT (Disabled): Audits 35 objects/statements
    Policy ORA_RAS_SESSION_MGMT (Disabled): Audits 14 objects/statements
    Policy ORA_SECURECONFIG (Enabled): Audits 48 objects/statements
Remarks:
    Unified Audit, available in Oracle Database 12.1 and later releases,
    combines multiple audit trails into a single unified view. It also
    introduces new syntax for specifying effective audit policies.

### Database Configuration ###

* Initialization Parameters for Security *
Name                              Value                              
--------------------------------- -----------------------------------
AUDIT_FILE_DEST                   /opt/oracle/admin/ORCLCDB/adump    
AUDIT_SYSLOG_LEVEL                                                   
AUDIT_SYS_OPERATIONS              FALSE                              
AUDIT_TRAIL                       NONE                               
COMPATIBLE                        12.2.0                             
DBFIPS_140                        FALSE                              
DISPATCHERS                       (PROTOCOL=TCP) (SERVICE=ORCLCDBXDB)
ENCRYPT_NEW_TABLESPACES           CLOUD_ONLY                         
GLOBAL_NAMES                      FALSE                              
LDAP_DIRECTORY_ACCESS             NONE                               
LDAP_DIRECTORY_SYSAUTH            no                                 
O7_DICTIONARY_ACCESSIBILITY       FALSE                              
OS_AUTHENT_PREFIX                 ops$                               
OS_ROLES                          FALSE                              
PDB_LOCKDOWN                                                         
PDB_OS_CREDENTIAL                                                    
REMOTE_LISTENER                                                      
REMOTE_LOGIN_PASSWORDFILE         EXCLUSIVE                          
REMOTE_OS_AUTHENT                 FALSE                              
REMOTE_OS_ROLES                   FALSE                              
RESOURCE_LIMIT                    TRUE                               
SEC_CASE_SENSITIVE_LOGON          TRUE                               
SEC_MAX_FAILED_LOGIN_ATTEMPTS     3                                  
SEC_PROTOCOL_ERROR_FURTHER_ACTION (DROP,3)                           
SEC_PROTOCOL_ERROR_TRACE_ACTION   TRACE                              
SEC_RETURN_SERVER_RELEASE_BANNER  FALSE                              
SQL92_SECURITY                    TRUE                               
UNIFIED_AUDIT_SGA_QUEUE_SIZE      1048576                            
UTL_FILE_DIR                                                         

* Access to Dictionary Objects *
Status: Pass
Summary:
    Access to dictionary objects is properly limited.
Details:
    O7_DICTIONARY_ACCESSIBILITY=FALSE
Remarks:
    When O7_DICTIONARY_ACCESSIBILITY is set to FALSE, tables owned by SYS
    are not affected by the ANY TABLE system privileges. This parameter
    should always be set to FALSE because tables owned by SYS control the
    overall state of the database and should not be subject to manipulation
    by users with ANY TABLE privileges.

* Inference of Table Data *
Status: Pass
Summary:
    Data inference attacks are properly blocked.
Details:
    SQL92_SECURITY=TRUE
Remarks:
    When SQL92_SECURITY is set to TRUE, UPDATE and DELETE statements that
    refer to a column in their WHERE clauses will succeed only when the
    user has the privilege to SELECT from the same column. This parameter
    should be set to TRUE so that this requirement is enforced in order to
    prevent users from inferring the value of a column which they do not
    have the privilege to view.

* Network Communications *
Status: Pass
Summary:
    Examined 3 initialization parameters. No issues found.
Details:
    SEC_PROTOCOL_ERROR_FURTHER_ACTION=(DROP,3)
    SEC_PROTOCOL_ERROR_TRACE_ACTION=TRACE
    SEC_RETURN_SERVER_RELEASE_BANNER=FALSE
Remarks:
    The SEC_PROTOCOL_ERROR parameters control the database server's
    response when it receives malformed network packets from a client.
    Because these malformed packets may indicate an attempted attack by a
    malicious client, the parameters should be set to log the incident and
    terminate the connection. SEC_RETURN_SERVER_RELEASE_BANNER should be
    set to FALSE to limit the information that is returned to an
    unauthenticated client, which could be used to help determine the
    server's vulnerability to a remote attack.

* External Authorization *
Status: Pass
Summary:
    Examined 2 initialization parameters. No issues found.
Details:
    REMOTE_OS_ROLES=FALSE
    OS_ROLES=FALSE
Remarks:
    The OS_ROLES and REMOTE_OS_ROLES parameters determine whether roles
    granted to users are controlled by GRANT statements in the database or
    by the operating system environment. Both parameters should be set to
    FALSE so that the authorizations of database users are managed by the
    database itself.

* File System Access *
Status: Pass
Summary:
    Examined 1 initialization parameter. No issues found.
Details:
    UTL_FILE_DIR=''
Remarks:
    The UTL_FILE_DIR parameter controls which part of the server's file
    system can be accessed by PL/SQL code. Note that as the directories
    specified in the UTL_FILE_DIR parameter may be accessed by any database
    user, it should be set to specify one or more safe directories that do
    not contain restricted files such as the configuration or data files
    for the database. For maximum security, use directory objects which
    allow finer grained control of access, rather than relying on this
    parameter.

* Triggers *
Status: Pass
Summary:
    No logon triggers found.  No disabled triggers found.
Remarks:
    A trigger is code that executes whenever a specific event occurs, such
    as inserting data in a table or connecting to the database. Disabled
    triggers are a potential cause for concern because whatever protection
    or monitoring they may be expected to provide is not active.

* Disabled Constraints *
Status: Some Risk
Summary:
    Found 1 disabled constraint.
Details:
    Disabled constraints: STS_CHUNKS on GSMADMIN_INTERNAL.SHARD_TS
Remarks:
    Constraints are used to enforce and guarantee specific relationships
    between data items stored in the database. Disabled constraints are a
    potential cause for concern because the conditions they ensure are not
    enforced.

* External Procedures *
Status: Evaluate
Summary:
    Found 5 external procedures. No external services found.
Details:
    External procedures: ORDSYS.ORDIMLIBS, SYS.DBMSHADOOPLIB,
        SYS.DBMS_SUMADV_LIB, SYS.DM$RQEXTLIB, SYS.KUBSAGT_LIB

Remarks:
    External procedures allow code written in other languages to be
    executed from PL/SQL. Note that modifications to external code cannot
    be controlled by the database. Be careful to ensure that only trusted
    code libraries are available to be executed. Although the database can
    spawn its own process to execute the external procedure, it is
    advisable to configure a listener service for this purpose so that the
    external code can run as a less-privileged OS user. The listener
    configuration should set EXTPROC_DLLS to identify the specific shared
    library code that can be executed rather than using the default value
    ANY.

* Directory Objects *
Status: Significant Risk
Summary:
    Found 12 directory objects. Found 1 directory object allowing access to
    restricted Oracle directory paths. No directory objects allow both
    write and execute access.
Details:
    Directory Name: DATA_PUMP_DIR
    Path = /opt/oracle/admin/ORCLCDB/dpdump/
    Users or roles with access: EXP_FULL_DATABASE(READ),
        EXP_FULL_DATABASE(READ), EXP_FULL_DATABASE(WRITE),
        EXP_FULL_DATABASE(WRITE), IMP_FULL_DATABASE(READ),
        IMP_FULL_DATABASE(READ), IMP_FULL_DATABASE(WRITE),
        IMP_FULL_DATABASE(WRITE)

    Directory Name: OPATCH_INST_DIR
    Path = /opt/oracle/product/12.2.0.1/db_1/OPatch/

    Directory Name: OPATCH_LOG_DIR
    Path = /opt/oracle/product/12.2.0.1/db_1/rdbms/log/

    Directory Name: OPATCH_SCRIPT_DIR
    Path = /opt/oracle/product/12.2.0.1/db_1/QOpatch/

    Directory Name: ORACLE_BASE
    Path = /opt/oracle/

    Directory Name: ORACLE_HOME
    Path = /opt/oracle/product/12.2.0.1/db_1/

    Directory Name: ORACLE_OCM_CONFIG_DIR
    Path = /opt/oracle/product/12.2.0.1/db_1/ccr/state/
    Users or roles with access: ORACLE_OCM(READ), ORACLE_OCM(WRITE)

    Directory Name: ORACLE_OCM_CONFIG_DIR2
    Path = /opt/oracle/product/12.2.0.1/db_1/ccr/state/
    Users or roles with access: ORACLE_OCM(READ), ORACLE_OCM(WRITE)

    Directory Name: ORA_DBMS_FCP_ADMINDIR
    Path = /opt/oracle/product/12.2.0.1/db_1/rdbms/admin/

    Directory Name: ORA_DBMS_FCP_LOGDIR
    Path = /opt/oracle/product/12.2.0.1/db_1/cfgtoollogs/

    Directory Name: XMLDIR
    Path = /opt/oracle/product/12.2.0.1/db_1/rdbms/xml/

    Directory Name: XSDDIR
    Path = /opt/oracle/product/12.2.0.1/db_1/rdbms/xml/schema/


    $ORACLE_HOME: ORACLE_HOME
Remarks:
    Directory objects allow access to the server's file system from PL/SQL
    code within the database. Access to files that are used by the database
    kernel itself should not be permitted, as this may alter the operation
    of the database and bypass its access controls.

* Database Links *
Status: Evaluate
Summary:
    Found 1 database link.
Details:
    Users with CREATE DATABASE LINK privilege: SYSTEM
    Users with CREATE PUBLIC DATABASE LINK privilege: SYSTEM

    Private links:
    SYS: SYS_HUB

Remarks:
    Database links allow users to execute SQL statements that access tables
    in other databases. This allows for both querying and storing data on
    the remote database.

* Network Access Control *
Status: Evaluate
Summary:
    Found 2 network ACLs.
Details:
    NETWORK_ACL_4700D20FF5FF557EE05387E5E50A8899 (Host: *, Ports: Min -
        Max)
    Principal: ORACLE_OCM, Action: deny, Privilege: resolve
    Principal: GGSYS, Action: deny, Privilege: resolve
    Principal: GSMADMIN_INTERNAL, Action: deny, Privilege: resolve

    /sys/acls/oracle-sysman-ocm-Resolve-Access.xml (Host: localhost, Ports:
        Min - Max)
    Principal: ORACLE_OCM, Action: deny, Privilege: resolve
    Principal: GGSYS, Action: deny, Privilege: resolve
    Principal: GSMADMIN_INTERNAL, Action: deny, Privilege: resolve

Remarks:
    Network ACLs control the external servers that database users can
    access using network packages such as UTL_TCP and UTL_HTTP.
    Specifically, a database user needs the connect privilege to an
    external network host computer if he or she is connecting using the
    UTL_TCP, UTL_HTTP, UTL_SMTP, and UTL_MAIL utility packages. To convert
    between a host name and its IP address using the UTL_INADDR package,
    the resolve privilege is required. Make sure that these permissions are
    limited to the minimum required by each user.

* XML Database Access Control *
Status: Evaluate
Summary:
    Found 9 XML Database ACLs.
Details:
    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Public:All privileges to PUBLIC
    Principal: PUBLIC, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Private:All privileges to OWNER only and not accessible to
        others
    Principal: dav:owner, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Read-Only:Readable by all and writeable by none
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve
    Principal: OLAP_XS_ADMIN, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve
    Principal: OLAP_XS_ADMIN, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve
    Principal: OLAP_XS_ADMIN, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve
    Principal: OLAP_XS_ADMIN, Action: grant, Privileges: all

    Namespace: {http://xmlns.oracle.com/xdb/acl.xsd}
    Description: Protected:Readable by PUBLIC and all privileges to OWNER
    Principal: dav:owner, Action: grant, Privileges: all
    Principal: XDBADMIN, Action: grant, Privileges: all
    Principal: PUBLIC, Action: grant, Privileges: read-properties, read-
        contents, read-acl, resolve
    Principal: OLAP_XS_ADMIN, Action: grant, Privileges: all

Remarks:
    XML ACLs control access to database resources using the XML DB feature.
    Every resource in the Oracle XML DB Repository hierarchy has an
    associated ACL. The ACL mechanism specifies a privilege-based access
    control for resources to principals, which are database users or roles.
    Whenever a resource is accessed, a security check is performed, and the
    ACL determines if the requesting user has sufficient privileges to
    access the resource. Make sure that these privileges are limited to the
    minimum required by each user.

### Network Configuration ###

* Network Listener Configuration *
Status: Significant Risk
Summary:
    Examined 1 listener. Found 1 listener not configured properly.
Details:
    Listeners not configured properly: LISTENER

    Parameter setting for LISTENER:
    DYNAMIC_REGISTRATION_LISTENER is not set (default value = ON).
        Recommended value is OFF.
    VALID_NODE_CHECKING_REGISTRATION_LISTENER is not set (default value =
        OFF). Should not be set to OFF.
    SECURE_PROTOCOL_LISTENER is not set.
    SECURE_CONTROL_LISTENER is not set.
    SECURE_REGISTER_LISTENER is not set.

Remarks:
    These parameters are used to limit changes to the network listener
    configuration. One of the following restrictions should be implemented:
    (a) prevent changes by disabling DYNAMIC_REGISTRATION, (b) limit the
    nodes that can make changes by enabling
    VALID_NODE_CHECKING_REGISTRATION, or (c) limit the network sources for
    changes using the COST parameters SECURE_PROTOCOL, SECURE_CONTROL, and
    SECURE_REGISTER.

* Listener Logging Control *
Status: Pass
Summary:
    Examined 1 listener. Found 0 listeners not configured properly.
Details:
    Listeners configured properly: LISTENER

    Parameter setting for LISTENER:
    LOGGING_LISTENER is not set (default value = ON).
Remarks:
    This parameter enables logging of listener activity. Log information
    can be useful for troubleshooting and to provide early warning of
    attempted attacks.

### Operating System ###

* OS Authentication *
Status: Evaluate
Summary:
    1 OS user can connect to the database via OS authentication.
Details:
    SYSDBA [dba group]: oracle
    SYSOPER [dba group]: oracle
    SYSBACKUP [dba group]: oracle
    SYSKM [dba group]: oracle
    SYSDG [dba group]: oracle
    SYSRAC [dba group]: oracle
Remarks:
    OS authentication allows operating system users within the specified
    user group to connect to the database with administrative privileges.
    This shows the OS group names and users that can exercise each
    administrative privilege.

* Process Monitor Process *
Status: Pass
Summary:
    Found 1 PMON process. The owner of the PMON process matches the
    ORACLE_HOME owner.
Details:
    PMON process: ora_pmon_ORCLCDB, Owner: oracle
    ORACLE_HOME owner: oracle
Remarks:
    The PMON process monitors user processes and frees resources when they
    terminate. This process should run with the user ID of the ORACLE_HOME
    owner.

* Agent Processes *
Status: Pass
Summary:
    No Agent processes found. Agent process owners do not overlap with
    Listener or PMON process owners.
Remarks:
    Agent processes are used by Oracle Enterprise Manager to monitor and
    manage the database. These processes should run with a user ID separate
    from the database and listener processes.

* Listener Processes *
Status: Some Risk
Summary:
    Found 1 Listener process. Some Listener process owners overlap with
    Agent or PMON process owners.
Details:
    Owner: oracle
    Command: /opt/oracle/product/12.2.0.1/db_1/bin/tnslsnr LISTENER
        -inherit
Remarks:
    Listener processes accept incoming network connections and connect them
    to the appropriate database server process. These processes should run
    with a user ID separate from the database and agent processes.

### Diagnostics ### 

Failed to parse sqlnet.ora: expected =, found EZCONNECT 

Failed to parse sqlnet.ora: expected =, found EZCONNECT 

Skip Allowed Logon Version check 

Failed to parse sqlnet.ora: expected =, found EZCONNECT 

Skipped SQLNET Parameters 


----------
    This report is focused on detecting areas of potential security
    vulnerabilities or misconfigurations and providing recommendations on
    how to mitigate those potential vulnerabilities. 

    The report provides a view on the current status. These recommendations
    are provided for informational purposes only and should not be used as
    a substitute for a thorough analysis or interpreted to contain any
    legal or regulatory advice or guidance. 

    You are solely responsible for your system, and the data and
    information gathered during the production of this report. You are also
    solely responsible for the execution of software to produce this
    report, and for the effect and results of the execution of any
    mitigating actions identified herein. 

    Oracle provides this analysis on an "as is" basis without warranty of
    any kind and Oracle hereby disclaims all warranties and conditions
    whether express, implied or statutory.