The Oracle contract can be further modified to include more features. From a security perspective, we can use a modifier to accept callbacks only from trusted oracles:

pragma solidity ^0.4.24;

contract OracleRng {

    // Address of trusted oracle
    address trustedOracle;

    // Modifier to restrict oracle calls
    modifier onlyTrustedOracle() {
        require(msg.sender == trustedOracle);
        _;
    }

    // Function to change trusted oracle
    function setTrustedOracle(address _oracle) {
        trustedOracle = _oracle;
    }

    function _callback(uint _random) public 
        onlyTrustedOracle {
        //...
    }
}