The question is: "Which security architecture should be used when J2EE application communicates with the database (Oracle DB) in real-time?"

I would appreciate your comments.

When you go from a closed production environment to 3*net, the main challenge becomes the security as the database becomes available for Internet.

Of course, one developes this solid J2EE application with a lot of security features. The J2EE application and the application server uses a priviliged user to communicate with the database. Although one thinks that J2EE application is secure enough, it can never be secure enough!

Some people I have talked to have suggested a replication between two databases within and outside the firewall. This solution does not solve the problem with real-time.

Some questions:
1. Is there any Java-application which we can put between our J2EE application and the database for security purpose?
2. Is there any database-related product which should put in between?
3. Should one change the security settings of the database?
E.g. create shadow tables or create an under-priviliged user in the database whom J2EE uses?
4. Is there any real-time synchronization product out there?

For your inforation, the following has been already taken care of in our environement:

1. The firewalls, security on the IP-level is in place
Application server, database server etc are behind several firewalls....
2. The security within J2EE application is under developement

Thanks

There is a Sun blue-print for the physical aspect of security for n-tier applications: Building Secure N-tier Environments on www.sun.com. You'll like the "defense-in-depth" paradigm.

You should also look into system/os-hardening for your systems. Vendors sometimes have guidelines for it. (Sun has one for its Solaris OS on the above site, it is pretty much valid for most Unixes).

Other than that, I just don't know what you are talking about: J2EE applications do not make a DPC insecure (or secure, for that matter). If your app is not security-aware, no technology will add security features on it. If it is, no technology will rob it of its security features.

There's something definitely wrong with your scenario: "Some people I have talked to have suggested a replication between two databases within and outside the firewall." Do you really need database-level access from outside your firewall?

And to complement the previous post: also look into Intrusion Detection Systems. IDS are "invisible/transparent" network sentries you install on your network which will listen to all the traffic and detect attempts to break into your systems.

Thanks for the feedbacks

Let me explain the issue more in detail.

Presume that the J2EE application has been secured (you are never sure, anyway)

Now the application server communicates with the database(Oracle) using a common user, e.g. common_user. No matter, what I do with J2EE application, in the end, the application server uses common_user. Now common_user may have some restricted user priviliges. But still, these priviliges may be enough for a cracker to harm the data...
So my question is: what should I do?

Thanks