ODBC Access to Oracle

["George J. Silowash" <gsilowas () NORWICH EDU>]

Hello,

I am currently researching the security implications of allowing ODBC access to an Oracle database, in particular, 
Ellucian Banner.  I have a user requesting ODBC access to the Banner database. My gut feeling is to prohibit this 
access, but I need more information.

Does anyone have best practices for implementing this? Or, what are the reasons for prohibiting access? I am most 
concerned about:

-Data integrity
-Access control of tables and fields
-Accidental database denial of service (a query that is not constrained appropriately, etc.)

Is Oracle security enforced on an ODBC connection? Some research on other applications implies that it is not. Any help 
or guidance would be greatly appreciated.

Regards,
George
----------------------------------------------------------------
George J. Silowash, MSIA, CISSP-ISSMP, CCFP, GCFE
Chief Information Security Officer
Norwich University
158 Harmon Drive
Northfield VT 05663
http://www.norwich.edu