Oracle Database SQL Firewall provides an additional layer of protection by validating SQL statements before they are executed by the database.
What is SQL Firewall?
SQL Firewall allows administrators to establish a trusted set of SQL statements generated by an application. Once enforcement is enabled, SQL statements that do not match the approved allow list can be identified and handled according to the configured policy.
This approach helps organizations strengthen application security directly at the database layer.
Benefits of SQL Firewall
SQL Firewall provides several advantages for enterprise applications:
- Helps protect against SQL injection attacks
- Identifies unauthorized SQL statements
- Reduces the impact of compromised application credentials
- Improves visibility into application SQL activity
- Provides centralized administration
Typical SQL Firewall Workflow
A typical implementation follows these steps:
Step 1 – Enable SQL Firewall
Enable SQL Firewall using the DBMS_SQL_FIREWALL package.
SQL> EXEC DBMS_SQL_FIREWALL.ENABLE;
Step 2 – Capture Application SQL
Run the application in learning mode to capture normal SQL statements generated during typical business operations.
Step 2 – Capture Application SQL
Run the application in learning mode to capture normal SQL statements generated during typical business operations.
DBMS_SQL_FIREWALL.CREATE_CAPTURE(
username => 'HR',
top_level_only => TRUE,
start_capture => TRUE
);
END;
/
If the capture already exists, you can use
SQL> EXEC DBMS_SQL_FIREWALL.START_CAPTURE('HR');
If the capture already exists, you can use
SQL> EXEC DBMS_SQL_FIREWALL.START_CAPTURE('HR');
Step 3 – Generate an Allow List
Create an allow list based on the captured SQL. This list represents the SQL statements that are expected for the application.
Create an allow list based on the captured SQL. This list represents the SQL statements that are expected for the application.
SQL> EXEC DBMS_SQL_FIREWALL.STOP_CAPTURE('HR');
Generate the allow list using
SQL> EXEC DBMS_SQL_FIREWALL.GENERATE_ALLOW_LIST('HR');
Step 4 – Enable Enforcement
Once the allow list has been validated, enable enforcement so that SQL Firewall evaluates incoming SQL against the approved list.
BEGIN
DBMS_SQL_FIREWALL.ENABLE_ALLOW_LIST(
username => 'HR',
enforce => DBMS_SQL_FIREWALL.ENFORCE_SQL,
block => TRUE
);
END;
/
This configuration enforces the SQL allow list and blocks SQL statements that are not part of the approved list.
Step 5 – Monitor Violations
Regularly review SQL Firewall violations to identify unexpected SQL activity and update allow lists when legitimate application changes occur.
Regularly review SQL Firewall violations to identify unexpected SQL activity and update allow lists when legitimate application changes occur.
Review captured SQL using
SQL> SELECT *
FROM DBA_SQL_FIREWALL_CAPTURE_LOGS;
Review SQL violations using
SQL> SELECT *
FROM DBA_SQL_FIREWALL_VIOLATIONS;
Review allowed SQL using
SQL> SELECT *
FROM DBA_SQL_FIREWALL_ALLOWED_SQL;
Check SQL Firewall status.
SQL> SELECT *
FROM DBA_SQL_FIREWALL_STATUS;
SQL Firewall Enforcement Modes
SQL Firewall can be configured to:
Monitoring SQL Firewall
Oracle Database provides several data dictionary views for monitoring SQL Firewall activity, including:
SQL Firewall can be configured to:
- Log Mode – Record violations without blocking SQL statements.
- Block Mode – Prevent SQL statements that are not part of the approved allow list from executing.
Monitoring SQL Firewall
Oracle Database provides several data dictionary views for monitoring SQL Firewall activity, including:
- DBA_SQL_FIREWALL_STATUS
- DBA_SQL_FIREWALL_ALLOWED_SQL
- DBA_SQL_FIREWALL_CAPTURE_LOGS
- DBA_SQL_FIREWALL_VIOLATIONS
Implementation Best Practices
When implementing SQL Firewall, consider the following recommendations:
- Capture SQL during peak business activity to build a complete allow list.
- Rebuild or append the allow list after application upgrades.
- Review SQL Firewall violations regularly.
- Test enforcement in a non-production environment before enabling it in production.
- Combine SQL Firewall with Unified Auditing and Database Vault for layered security.
- SQL Firewall is most effective for applications with predictable SQL workloads.
- Application upgrades or new functionality may require capturing additional SQL statements and updating the allow list.
- SQL Firewall complements secure coding practices, input validation, and application security testing—it is not a replacement for them.
- Proper testing is recommended before enabling enforcement in production to minimize the risk of blocking legitimate application SQL.
Why SQL Firewall Matters
Application security is strongest when multiple layers of protection work together.
While secure application development remains essential, SQL Firewall adds another layer of defense by validating SQL statements inside the database before execution. This additional validation helps reduce the risk associated with unexpected or unauthorized SQL activity.
SQL Firewall provides Oracle DBAs with an additional layer of protection against SQL injection and unauthorized SQL execution. By learning trusted application behavior and enforcing an approved SQL allow list, organizations can significantly strengthen database security. When combined with Transparent Data Encryption (TDE), Unified Auditing, Database Vault, and least privilege administration, SQL Firewall becomes an important component of a comprehensive defense-in-depth strategy for Oracle Database 26ai.
Application security is strongest when multiple layers of protection work together.
While secure application development remains essential, SQL Firewall adds another layer of defense by validating SQL statements inside the database before execution. This additional validation helps reduce the risk associated with unexpected or unauthorized SQL activity.
SQL Firewall provides Oracle DBAs with an additional layer of protection against SQL injection and unauthorized SQL execution. By learning trusted application behavior and enforcing an approved SQL allow list, organizations can significantly strengthen database security. When combined with Transparent Data Encryption (TDE), Unified Auditing, Database Vault, and least privilege administration, SQL Firewall becomes an important component of a comprehensive defense-in-depth strategy for Oracle Database 26ai.
