Bettina: Intro Texts - updated introduction text of all 6 feature labs

data-safe/assess-database-configurations/assess-database-configurations.md

@@ -2,25 +2,51 @@
 
 ## Introduction
 
-Security Assessment helps you assess the security of your database configurations. It analyzes database configurations, user accounts, and security controls, and then reports the findings with recommendations for remediation activities that follow best practices to reduce or mitigate risk. 
+Imagine that you are a database security administrator responsible for keeping your organization's databases securely configured. 
 
-Oracle Data Safe automatically creates a security assessment of your target database during registration. This assessment is referred to as the *latest assessment* and is automatically updated on a weekly basis. All assessments are stored in the Assessment History. You can analyze assessment data across all your target databases and for each target database. You can monitor security drift on your target databases by comparing the latest assessment to a baseline or to another assessment.
+Your team has established an approved security posture for a database, but database configurations do not remain static. Administrators grant privileges, application requirements change, and configuration settings are modified. A change that seems harmless can introduce a security risk, and manually reviewing every database configuration change is difficult.
+
+You need a way to answer questions such as:
+- What security risks exist in my database today?
+- Which findings should I investigate first?
+- Does the database still comply with the security posture my team previously approved?
+- Has a recent database change introduced a new security risk?
+- What changed, and how can I remediate it?
+
+Oracle Data Safe Security Assessment helps you answer these questions by analyzing database configurations, user accounts, and security controls and identifying findings that could introduce risk.
+
+When you register a target database, Data Safe automatically creates its latest security assessment and updates it weekly. You can also refresh an assessment on demand. By establishing an assessment as a baseline, you can detect security drift and identify changes to the database's security posture.
+
+### Scenario
+
+In this lab, assume that you are responsible for monitoring the security posture of a database used by your organization.
+
+You will first review the database's current security assessment and determine that its existing configuration represents an acceptable starting point. You will establish that assessment as your baseline.
+
+Next, a database privilege will be granted to PUBLIC, simulating a potentially risky administrative change.
+
+Rather than relying on someone to tell you that the change occurred, you will use Security Assessment to:
+1.	Reassess the database.
+2.	Detect that its security posture has changed.
+3.	Investigate the new high-risk finding.
+4.	Compare the current assessment with your approved baseline.
+5.	Identify exactly what changed.
+
+By the end of the lab, you will have experienced the workflow a security or database administrator can use to identify security configuration drift.
 
-In this lab, you explore Security Assessment.
 
 Estimated Time: 20 minutes
 
 ### Objectives
 
 In this lab, you will:
 
-- View the landing page for Security Assessment
-- View the latest security assessment for your target database
-- Adjust the risk level of a risk finding
-- Set the latest assessment as the baseline assessment
-- Create a risk on the target database
-- Refresh the latest security assessment and analyze the results
-- Compare your assessment with the baseline
+- Evaluate the current security posture of your target database
+- Establish an approved security posture as a baseline
+- Simulate a risky database privilege change
+- Reassess the database to detect the new risk
+- Investigate the security finding and its remediation guidance
+- Compare the current security posture with the baseline to identify security drift
 
 ### Prerequisites
 
@@ -134,11 +160,11 @@ You can defer or change the risk level of a finding. In this task, you defer the
 
     Setting an expiration date is optional. Upon expiry, the next assessment resumes evaluating the finding and displays as found. With no expiration date, the risk finding is deferred indefinitely. 
 
-   ![Update risk for finding panel](images/update-risk-for-finding.png "Update risk for finding panel")
+    ![Update risk for finding panel](images/update-risk-for-finding.png "Update risk for finding panel")
 
 4. Notice that the risk finding is recategorized as **DEFERRED**.
 
-   ![Deferred risk finding](images/deferred-risk-finding.png "Deferred risk finding")
+    ![Deferred risk finding](images/deferred-risk-finding.png "Deferred risk finding")
 
 5. Select the **X** to remove the filter.
 

data-safe/assess-database-users/assess-database-users.md

@@ -2,21 +2,55 @@
 
 ## Introduction
 
-User Assessment helps you assess the security of your database users and identify potential high risk users. This allows you to review the potential risk to your data in case any of your user accounts get compromised or go rogue. By default, Oracle Data Safe automatically generates user assessments for your target databases and stores them in the Assessment History. You can analyze assessment data across all your target databases and for each target database. You can monitor user or entitlement changes on your target databases by comparing the latest assessment to a baseline or to another assessment.
+In the previous lab, you acted as a database security administrator responsible for monitoring the security posture of a target database. You established an approved configuration as a baseline, introduced a risky privilege change, and used Oracle Data Safe Security Assessment to detect and investigate security drift.
+
+A secure database configuration is only part of the security picture. Who can access the database, what they can do, and whether their accounts are still appropriate are equally important.
+
+Imagine that you are responsible for reviewing access to a database containing sensitive business data. Your security team needs to know:
+- Which database users represent the greatest potential risk?
+- Which users have powerful administrative roles?
+- Which users have access to many schemas?
+- Are privileged accounts actively being used?
+- Have users or their entitlements changed since the last review?
+- Did a new privileged account appear, or did an existing risky account disappear?
+
+Oracle Data Safe User Assessment helps answer these questions by analyzing database users, their roles and privileges, account status, login activity, password information, and schema access.
+
+Data Safe automatically generates user assessments for registered target databases and stores assessment copies in Assessment History. You can analyze users across your target databases, investigate individual users, and compare assessments to identify changes in users and their entitlements.
+
+
+### Scenario
+
+You have just completed a security configuration review of your database and discovered that its configuration had drifted from the approved baseline.
+
+Now your security team asks you to perform an access review.
+
+During the review, you discover a user account with a CRITICAL potential risk rating. You need to understand why this account is considered risky and what privileges and access it has.
+
+Then, imagine that changes are made to the database:
+- The high-risk EVIL_RICH account is removed.
+- A new user, JOE_SMITH, is created.
+- JOE_SMITH is granted the PDB_DBA role.
+
+You will refresh the user assessment and compare it with the earlier assessment to determine what changed.
+
+The goal is not simply to find users. The goal is to answer a security question:
+How has database access changed, and did the change introduce a new potentially dangerous user?
 
-In this lab, you explore User Assessment.
 
 Estimated Time: 20 minutes
 
+
 ### Objectives
 
 In this lab, you will:
 
-- View the landing page for User Assessment
-- Analyze users in the latest user assessment
-- Change users and entitlements on the target database
-- Refresh the latest user assessment
-- Compare the latest user assessment with the initial user assessment
+- Evaluate the current potential risk of database users
+- Investigate a potentially critical-risk user and its entitlements
+- Simulate changes to database users and privileges
+- Refresh the user assessment to detect access changes
+- Compare user assessments to identify new and removed users and entitlement changes
+- Determine the security significance of a newly created privileged user
 
 
 ### Prerequisites

data-safe/audit-database-activity/audit-database-activity.md

@@ -2,20 +2,64 @@
 
 ## Introduction
 
-Audit resources for Oracle Data Safe (audit profiles, audit policies, and audit trails) are automatically created for all registered target databases. 
+In the previous labs, you have been building a progressively deeper understanding of the database you are responsible for protecting.
 
-In this lab, you use the auditing wizard to enable alert and audit policies on your target database, start audit data collection in Oracle Data Safe, and configure the retention periods for your audit data. You then perform activity on your target database and review the alerts and audit events generated in Oracle Data Safe.
+You have already answered four important questions:
+Is the database securely configured?
+You used Security Assessment to identify configuration risks and detect security drift.
+
+Who can access the database?
+You used User Assessment to investigate potentially risky users and changes to roles and privileges.
+
+What sensitive information could that access expose?
+You used Data Discovery to identify sensitive data and build a sensitive data model.
+
+How can we safely provide that data to non-production users?
+You used Data Masking to protect sensitive information while preserving useful data for development and testing.
+
+Now there is one more critical question:
+What are people actually doing in the database?
+
+Knowing that an account has powerful privileges does not necessarily mean that the account is being misused. Conversely, an unexpected login or creation of a new privileged account can be an important warning sign.
+
+As the database security administrator, you want to detect suspicious activity, investigate what happened, and maintain an audit trail of database events.
+
+Oracle Data Safe Activity Auditing allows you to configure audit and alert policies, collect audit data, identify activity that matches alert conditions, and investigate the resulting audit events.
+
+### Scenario
+
+Continue with the same database security investigation.
+
+You have already identified potentially risky users and know where sensitive data resides. You have also protected that data for non-production use.
+
+Now your security team wants continuous visibility into activity on the database.
+
+You decide to configure monitoring for two situations that could indicate a security problem:
+•	Repeated failed logins by an administrative user
+•	Creation or modification of a database user
+
+You will then deliberately generate both types of activity so that you can see how Data Safe detects them.
+
+First, you will configure auditing and alert policies and begin collecting audit data. You will then simulate suspicious activity by attempting several unsuccessful ADMIN logins and creating a new privileged MALFOY user.
+
+Finally, you will investigate the resulting alerts and audit events.
+The goal is to connect identity, privilege, and activity:
+
+A risky user or privilege is important, but activity auditing helps answer the next question:
+Is something actually happening that we need to investigate?
 
 Estimated Lab Time: 10 minutes
 
 ### Objectives
 
 In this lab, you will:
 
-- Configure auditing and alerts for your target database
-- Perform activities on your target database to generate audit data
-- Review alerts in Oracle Data Safe
-- Review audit events in Oracle Data Safe
+- Configure audit and alert policies for your target database
+- Configure audit data retention
+- Generate database activity that should trigger alerts
+- Review security alerts generated by that activity
+- Investigate the underlying audit events
+- Understand how Data Safe can provide visibility into potentially suspicious database activity
 
 
 ### Prerequisites
@@ -60,12 +104,12 @@ This lab assumes you have:
     ![Activity Auditing wizard - Alert policies](images/activity-auditing-wizard-alert-policy.png "Activity Auditing wizard - Alert policies") 
 
 
- 6. For **Step 3 - Security policies**, do the following to enable security policies:
+6. For **Step 3 - Security policies**, do the following to enable security policies:
 
     a) Select **Manage security policies**. The **Manage security policies** panel opens.
-   
+
     b) Select **Admin activity auditing** and **Basic auditing**.
-    
+
     c) Select the **Custom security policies** tile.
 
     d) Select one of the security policies; for example, **CIS\_POLICY**.  <!-- Note: **APP\_USER\_NOT\_APP\_SERVER** is not listed -->
@@ -75,7 +119,7 @@ This lab assumes you have:
     ![Activity Auditing wizard - security policies](images/activity-auditing-wizard-security-policies.png "Activity Auditing wizard - security policies")
 
 
-7. For **Step 4 - Audit trails**, do the following:
+8. For **Step 4 - Audit trails**, do the following:
 
     a) Select **UNIFIED\_AUDIT\_TRAIL**. 
 
@@ -86,7 +130,7 @@ This lab assumes you have:
     ![Activity Auditing wizard - Audit trails](images/activity-auditing-wizard-audit-trails.png "Activity Auditing wizard - Audit Trails")
 
 
-8. For **Step 5 - Audit profile**, configure the following, and then click **Next**.
+9. For **Step 5 - Audit profile**, configure the following, and then click **Next**.
 
     - Audit data online retention months = 12
     - Audit data offline retention months = 0
@@ -99,7 +143,7 @@ This lab assumes you have:
     - All initial audit profile settings for your target database are inherited from the global settings for Oracle Data Safe.
     - By default, paid usage is not enabled for all target databases. You cannot enable paid usage for a free trial account.
 
-9. For **Step 6 - Review and submit**, review the configuration, and then select **Submit** if everything is correct. Wait for the policies to be provisioned, and then select **Close**.
+10. For **Step 6 - Review and submit**, review the configuration, and then select **Submit** if everything is correct. Wait for the policies to be provisioned, and then select **Close**.
 
 
 ## Task 2: Perform activities on your target database to generate audit data

data-safe/discover-sensitive-data/discover-sensitive-data.md

@@ -2,21 +2,59 @@
 
 ## Introduction
 
-Data Discovery helps you find sensitive data in your target databases. You tell Data Discovery what kind of sensitive data to search for, and it inspects the actual data in your target database and its data dictionary, and then returns to you a list of sensitive columns. By default, Data Discovery can search for a wide variety of sensitive data pertaining to identification, biographic, IT, financial, healthcare, employment, and academic information.
+In the previous two labs, you investigated the security posture of the database and then reviewed who can access it and what they can do.
 
-In this lab, you use Oracle Data Safe to discover sensitive data on your target database and then adjust the sensitive data model.
+You have now identified risky configuration changes and changes to privileged users and entitlements. The next question is more fundamental:
+
+What data are we actually trying to protect?
+
+Knowing that a user has access to a database does not tell you whether that access puts sensitive information at risk. To understand the potential impact of a compromised or over-privileged account, you need to know where sensitive data resides.
+
+For example, a user might have access to a schema containing:
+- Employee information
+- Contact information
+- Identification information
+- Financial information
+- Healthcare information
+- Academic information
+- Other information that your organization considers sensitive
+
+Manually locating this information across database tables and columns can be difficult, particularly as databases grow and application schemas change.
+
+Oracle Data Safe Data Discovery helps you build an inventory of sensitive data by inspecting the actual data in your target database and its data dictionary. You specify the types of sensitive information you are interested in, and Data Safe identifies columns that contain or are related to that information.
+
+### Scenario
+
+Continue acting as the database security administrator from the previous labs.
+
+You have already:
+1.	Reviewed the database's configuration and established an approved security baseline.
+2.	Detected a risky configuration change.
+3.	Reviewed database users and identified changes to privileged access.
+
+Now your security team asks a different question:
+If one of these accounts were compromised, what sensitive information could potentially be exposed?
+
+Your first step is to discover where sensitive data exists in the database.
+
+You will use Data Discovery to examine the HCM1 schema and identify sensitive columns. You will review the results and sample data to understand what information is being protected.
+
+During the review, you will also recognize that automated discovery does not necessarily capture every piece of information your organization considers sensitive. You will therefore extend the sensitive data model by explicitly adding another sensitive column.
+
+This creates a more complete inventory that can support the security and data protection activities you will perform in subsequent labs.
 
 Estimated Lab Time: 15 minutes
 
 ### Objectives
 
 In this lab, you will:
 
-- Discover sensitive data in your target database by using Data Discovery
-- Analyze the sensitive data model
-- Perform an incremental discovery
-- Remove a column from the sensitive data model
-- Add a column to the sensitive data model
+- Discover sensitive data in your target database
+- Review where sensitive information is stored
+- Examine the sensitive data model
+- Understand how Data Safe uses sensitive types and data relationships
+- Extend the sensitive data model with an additional sensitive column
+- Build a more complete view of the data that needs protection
 
 
 ### Prerequisites