old idea, keep oracle servers in a secure zone by themselves behind a firewall so only oracle calls can get at them and you can beat the DBA's when they go Tango Uniform.
new idea, separate all parts of the application by firewalls putting one more breakpoint in the chain and add overhead/timing issues/and different groups fingerpointing
thanx,
bill