We have a web application (a COTS product) and we need to query the application DB periodically using an external scheduler for alert purposes. DB is Oracle, se we decided to schedule a job on the application's server using sqlplus. Our security team complained the this is considered a bad practice since sqlplus is intended to be a client application.
I personally can't see it as a bad practice. Could someboby point me towards some use case that can result in security issues? Thanks.