oracle: deny naked sql statements
The account that owns the database objects should not be used by anyone to access that data.  (Except by you and your fellow DBAs, who know what they're doing!)  

A simple, "additive", security model is far easier to understand and maintain. 

Create "Application" and "User" roles and grant the appropriate levels of access, then grant these to user and application accounts. 

create user data_owner ... ; 
create table data_owner.table1 ... ; 

create role app_role_1 ; 
grant select, insert, update, delete on data_owner.table1 to app_role_1 ; 

create role user_role_2 ; 
grant select on data_owner.table1 to user_role_2 ; 

grant app_role_1 to application_1_account ; 
grant user_role_2 to fred, wilma ;