If a database file can be copied, the temporary public login_mode option should be used (both for integrated and Kerberos logins). This way, integrated and Kerberos logins are not supported by default if the file is copied.
If a database contains sensitive information that needs to be protected from unauthorized access, the computer where the database files are stored should be protected from unauthorized access. If this is not possible, then there is a security risk since the database files could be copied and unauthorized access to the data may be obtained on another computer. To increase security in such environments, the following steps are recommended:
User passwords, especially those with DBA authority, should be complex and difficult to guess.
The PUBLIC.login_mode database option should be set to Standard. To enable integrated or Kerberos logins, only the temporary public option should be changed each time the server is started. This ensures that only Standard logins are allowed if the database is copied. See Security concerns: Setting temporary public options for added security.
You should strongly encrypt the database file using the AES encryption algorithm. The encryption key should be complex and difficult to guess.