In case you're not familiar with the Security Configuration Wizard(SCW) it's a great tool that's shipped with Service Pack 1 for Windows Server 2003. You can read all about it here. SCW ships with schema definitions for fifty applications - mainly Microsoft. The whole idea of SCW is that the schema can be extended to include definitions of the required security control settings for any application. Running SCW enables you to quickly and easily remove functionality that's not required for your server to meet it's business function(s).
Does anyone know of SCW extensions for Oracle?