ODBC vs. SQL*Net security
For Oracle, ODBC is just a layer on top of SQL*Net. All of Oracle's ODBC drivers just translate the ODBC calls made by the application into OCI calls that are transported to the database server via SQL*Net. I'm not sure that there are any additional security concerns surrounding ODBC, but there certainly are some performance issues that you may encounter. If you can avoid ODBC completely, that's the best thing. If you must use ODBC, I would highly recommend using Oracle's ODBC drivers (available for download at http://otn.oracle.com/software/tech/windows/odbc/index.html) instead of any other vendor's ODBC drivers (i.e. Microsoft, Merant, etc.).