Oracle - Is a separate database more secure than using the same database and a separate schema We have very few developers and the ask from management is insane (computer vision, AI, IoT, etc.). Management wants to split the production database which uses Oracle Apex because the Apex application will be on the public internet and therefore security is an issue. Is a separate database more secure than using the same database and a separate schema when using the Oracle database? I hate REST and all the complications like authentication that comes with it, so I would much rather be on the same database and just do a straight SQL select. Can I just grant select on specific tables between two schemas and thereby keep sensitive financial data equally secure as when having it on a separate database and sharing data using REST or a slow database link?
Management wants to split the production database which uses Oracle Apex because the Apex application will be on the public internet and therefore security is an issue.

If Management don't want the database server that hosts the Apex application on the &quot;public internet&quot; then that's what they want.  That database server will move to somewhere &quot;inside&quot; the Firewall.

Is a separate database more secure than using the same database and a separate schema when using the Oracle database?

From an Information Security stand-point?  Almost certainly.
Machines tend to be compromised, not Applications.
If this database server were to be compromised then the attacker would presumably target the root account and thereby gain access to any other account on the machine.  If, like most other DBAs, you've allowed O/S authentication for your &quot;oracle&quot; account, then the whole database is vulnerable.
From a cross-application perspective?  Not if you've set up your security model properly.
You can (and should) set up Roles that grant specific permissions on specific objects and grant these Roles to the Application Accounts that need to use them.  In that way, Application A can access the tables in Schema B that it needs to use but nothing more.
REST and other API-based strategies move this into the Application layer, where Developers are move &quot;comfortable&quot;, but even these still need access to database objects so the creation/granting of Roles still applies.