I find it ridiculously easy to open up excel or access and set up a ODBC
connection to the database using a basic user account, and they have free
reign on all the tables owned by the application owner of our ERP
application. I don't know if you know of any way to restrict this access,
other than removing ODBC drivers in Microsoft Office for all the end
users... Removing rights in Oracle from the users would limit their ability
to run the application correctly.

Oracle LazyDBA home page