Oracle Encryption and Key Management Consulting

Drop the guesswork and get independent expertise from the person who helped build Oracle's encryption products — and helped 300+ customers deploy them.

Encrypting Oracle databases, migrating to centralized key management, or passing a regulator's audit on encryption controls is high-stakes work. Get it wrong and you risk downtime, failed audits, or LOB outages. Get it right the first time.

Why work with me?

Three decades at Oracle, on both sides of the product: Product Manager for Transparent Data Encryption from its inception through 12.1.0.2, then a Sales Consultant across North America and Canada working hands-on with customers, then again Product Manager for TDE and Oracle Key Vault combined until March 2026.

  • Field-tested the documentation. I corrected and rewrote the TDE documentation based on what actually happens in production, not just how features were designed.
  • Managed Oracle's HSM partnerships before Oracle Key Vault existed; I understand key management for Oracle TDE.
  • Guided 300+ implementations, mostly in banking, insurance, and government, where encryption isn't optional and audits are unforgiving.

When to engage me, and how:

The best time to bring me in is before anyone starts implementing TDE, with or without key management (Oracle Key Vault or any third-party key manager). Getting the architecture right up front avoids the rework, downtime, and audit findings that come from trying it yourselves, especially in large-scale deployments.

I'm equally glad to review or rescue a project already underway: a stalled OKV migration, a failed audit finding, an encrypted environment that's drifted from best practices.

Reach out by email or WhatsApp, whichever is easier for you.

The new risk: AI agents with database access

Oracle's access controls (VPD, Data Redaction, Database Vault) restrict what a user or AI agent can see - necessary, but not sufficient. AI agents increasingly get broad, standing credentials. If one is compromised or over-provisioned, access controls do nothing for data in an unencrypted tablespace, backup, snapshot, or export file.

Access control governs who's allowed to ask. Encryption protects the data regardless of who - or what - gets past that gate. If you're running AI agents against production Oracle databases and haven't revisited your encryption posture in the last year, that's a gap worth closing.

How I can help:

  • Implement military-grade separation of duties between DBAs and the team responsible for TDE key management, leveraging OKV's unique ability to store and manage both TDE master keys and randomly generated, maximum-strength passwords uniquely tied to the correct database.
  • TDE implementation & rollout - strategy, deployment, key rotation policy
  • TDE best-practices review - audit your environment against current standards before drift becomes an escalation
  • Oracle Key Vault migration - local wallets to centralized management, including RAC, Data Guard, sharded databases
  • Cloud & on-prem migration - any direction, any provider
  • Compliance & audit readiness
  • Key management integration - OKV, Thales CipherTrust, any other third-party HSM; I'll help you find the best key management option for you.
  • Extension of your DBA team — for when encryption and key management expertise isn't in-house, or your DBAs simply don't have the free cycles to go as deep into TDE and OKV as I have over the decades. I implement alongside your team, then transfer knowledge so they own it going forward. After that, I'm an email away.

Let's talk!

Planning an encryption or key management project — or inheriting one that's gone sideways? I'd like to hear about it. Email me or reach out on WhatsApp.

Popular posts from this blog

TDE Healthcheck

TDE HEALTHCHECK  The TDE health-check was planned to give Oracle Support personnel a quick overview about your TDE setup, but eventually it was decided to include it in recent Oracle Database RUs in 19c and 26ai. In Oracle database 19c before 19.30, you need to apply patch 38486044 . It is very easy to use: First, compile it with: SQL> @$ORACLE_HOME/rdbms/admin/tde_healthcheck.sql To get the complete results, simply execute: SQL> execute tde_healthcheck.get_tde_healthcheck_report; Individual checks allow for a more targeted validation: SQL> exec tde_healthcheck.get_wallet_root; Display WALLET_ROOT from gv$parameter.  SQL> exec tde_healthcheck.get_wallet_ location; Where are my TDE wallets? Usually in WALLET_ROOT/tde   SQL> exec tde_healthcheck.get_tde_config; Shows the value of the parameter TDE_CONFIGURATION. SQL> exec tde_healthcheck.get_props_ details; Read the TDE configuration from internal tables.  SQL> exec tde_healthcheck.valida...
Read more

Upgrade encrypted databases to 26ai

  Oracle AI Database 26ai has been made available to all customers (on-prem or any cloud). With this, the "upgrade" question will come sooner rather than later. Upgrading to Oracle AI Database 26ai  is only possible from 19c and 21c , older releases cannot be directly upgraded to 26ai. If your 19c or 21c databases are encrypted, and TDE is set up with the old (desupported) sqlnet.ora parameters (ENCRYPTION_WALLET_LOCATION), upgrades will be blocked and pre-upgrade checks will fail with 'TDE_WALLET_ROOT_NOT_IN_USE'. You need to have WALLET_ROOT and TDE_CONFIGURATION set before the upgrade. Also, the GOST and ARIA encryption algorithms are desupported in 26ai; before upgrading, online-rekey those tablespaces to AES with XTS cipher mode; for upgrades via database links to 26ai CDBs, we have introduced the "rekey using" parameter: SQL> create pluggable database "FINANCE" from FINANCE@dblink rekey using 'AES256' MODE 'XTS'; ...
Read more

Encryption and Compression in Exadata: How It Really Works

After a great vacation, I'm finally back with a new blog post. This one is about two weeks later than my usual Thursday schedule, but I hope you'll find it worth the wait. Today's topic is a question that comes up surprisingly often: how do compression and Transparent Data Encryption (TDE) actually work in Oracle Exadata? The answer is actually quite simple - with one important exception. Everything described here applies equally to Oracle Exadata and all of its deployment models, including ExaDB-C@C, ADB-C@C, ADB-D, and ExaDB-D, whether deployed on-premises, in OCI, or in supported third-party clouds. The Normal Data Path The fundamental rule is simple: Compression always happens before encryption. This has to be the case because encrypted data is essentially random and therefore cannot be compressed efficiently. Oracle's implementation of TDE tablespace encryption is fully compatible with Oracle compression technologies, including Exadata Hybrid Columnar Compression ...
Read more