Managing Oracle E-Business Suite Security

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Managing Oracle E-Business Suite Security"

Transcription

1

2 Managing Oracle E-Business Suite Security Erik Graversen, Senior Principal Software Developer Elke Phelps, Senior Principal Product Manager Oracle E-Business Suite Applications Technology Oracle Open World, September 2014

3 Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

4 Program Agenda Follow Oracle E-Business Suite Secure Deployment & Configuration Guidelines Leverage the Oracle Technology Stack to Deploy Additional Security Options Utilize New Security Features in Oracle E-Business Suite Release 12.2

5 Follow Oracle E-Business Suite Secure Deployment & Configuration Guidelines

6 How to Deploy Oracle E-Business Suite Securely 1 2 Stay current with patching Follow secure deployment recommendations

7 How to Deploy Oracle E-Business Suite Securely 1 2 Stay current with patching Follow secure deployment recommendations

8 How to Deploy Oracle E-Business Suite Securely Stay Current with Patching Apply Critical Patch Updates (CPUs) + Security Alerts Critical Patch Advisory Page Patch Setup Update (PSUs) are an option for the database PSUs include CPUs + other database recommended patches EBS customers may apply either CPUs or PSUs for the DB As of 12c only PSUs will be released Apply latest maintenance pack or release update pack Yes, Oracle E-Business Suite maintenance packs release update packs improve security as well

9 How to Deploy Oracle E-Business Suite Securely 1 2 Stay current with patching Follow secure deployment recommendations

10 How to Deploy Oracle E-Business Suite Securely Follow Secure Deployment Recommendations Secure Configuration Guide for Oracle E-Business Suite Previously known as Best Practice documents Release 11i, MOS Doc ID Release 12.0.x, 12.1.x and 12.2.x, MOS Doc ID Oracle E-Business Suite Configuration in a DMZ Follow this guide if your Oracle E-Business environment is internet accessible Release 11i, MOS Note Release 12.0.x and 12.1.x, MOS Note Release 12.2.x, MOS Note

11 How to Deploy Oracle E-Business Suite Securely Follow Secure Deployment Recommendations Guidelines are based upon current patch levels , , , and Advice for security-related switches to set/verify Advice also provided for optional security related products (such as database options) Many recommendations automated via AutoConfig and Oracle Application Manager (OAM) Please raise an SR with support against the Guides if you feel there are problems or omissions with the advice

12 Secure Configuration Scripts MOS Note , Secure Configuration Guide for Oracle E-Business Suite Scripts are packaged as SQL and Shell scripts Periodically check for updated scripts EBSSecConfigChecks.sql runs all (12) other SQL scripts Results are compiled into a single report Comments in the scripts often contain hints for resolution EBSCheckModSecurity.sh shell script You should perform routine configuration Health Checks Create a baseline for your environment Run scripts often and compare against your baseline check for differences

13 Oracle Enterprise Manager: Oracle E-Business Suite Plug-In Compliance Rules Out-of-box security compliance checks for Oracle E-Business Suite Integration with Enterprise Manager compliance framework Security compliance violations and trends are generated Real-time observations of security compliance in your environment

14 Leverage the Oracle Technology Stack to Deploy Additional Security Options

15 Enable SSL/TLS for Web Listener Enable SSL (https) for web listener R12, MOS Doc ID R12.2, MOS Doc ID Tip: Avoid weak ciphers and protocols (<128 bit & SSLv2) Use Telnet Mobile Web Apps? Mechanism for securing MWA Telnet communication with SSL MOS Doc ID

16 Encrypting SQL*Net Traffic SQL*Net encryption now provided as a free option In R12 add the following lines to the sqlnet_ifile.ora file: SQLNET.ENCRYPTION_SERVER = REQUIRED SQLNET.ENCRYPTION_TYPES_SERVER= (AES256, AES192, 3DES168) SQLNET.CRYPTO_SEED = somelongandrandomstring

17 Reverse Proxy Server Makes requests to the Oracle E- Business Suite application server on behalf of the client Allows use of standard ports (80, 443) on external side; higher ports internally Filters requests to web server via rules

18 Demilitarized Zone (DMZ) Perimeter network Single or multi-segment DMZ-based servers have restricted responsibilities Security breaches remain contained within DMZ

19 Oracle E-Business Suite DMZ Features Reduce Attack Surface Limited number of Oracle E-Business Suite products certified for internet access Release 11i, MOS Doc ID Release 12.0.x and 12.1.x, MOS Doc ID Release 12.2.x, MOS Doc ID External Oracle E-Business Suite application tier access limited by setting Node Trust Level Responsibilities available for external use only upon configuration URL Firewall exposes only the pages that are required

20 Oracle Audit Vault and Database Firewall Consolidate database audit trail into secure centralized repository Detect and alert on suspicious activities, including privileged users Out-of-the box compliance reports for SOX, PCI, and other regulations For example; privileged user audit, entitlements, failed logins, regulated data changes Integrates with Oracle E-Business Suite security system

21 Oracle Audit Vault and Database Firewall Monitor inbound SQL activity in passive mode Alert security operations of unexpected activity Execute standard or develop custom reports

22 Oracle Database Vault Privileged Account Controls Enforce least privilege by defining who, where, when, and how data can be accessed Securely enable applications consolidation and outsourcing / offshoring Default realm for E-Business Suite is available use it as-is or choose a subset

23 Oracle Database Vault Define Access by Application Server Protect sensitive objects based upon application tier Create custom realm with command rules to define access

24 Oracle E-Business Suite Security Architecture Multiple Layers of Protection, Multiple Components for Monitoring DMZ Reverse Proxy External App Server Secure VLAN Audit Vault and Database Firewall Database Vault

25 Transparent Data Encryption Defense in Depth, Guard Against Out-of-Band Attacks Encrypt data at rest Decrypt data on-the-fly while E- Business Suite is running Encrypt tablespaces or individual columns Store keys in Oracle Wallet Hardware Device

26 Oracle E-Business Suite Data Masking Template Enterprise Manager 11g, 12c Data Masking Pack What is data masking? Production LAST_NAME SSN SALARY AGUILAR ,000 BENSON ,000 Non-Production LAST_NAME SSN SALARY ANSKEKSL ,000 BKJHHEIEDK ,000 The act of anonymizing customer, financial, or company-confidential data to create new, legible data that retains the data's properties, such as its width, type, and format Why mask your data? To protect confidential data in nonproduction environments when the data is shared with non-production users without revealing sensitive information

27 Utilize New Security Features in Oracle E- Business Suite Release 12.2

28 New Security Features in Oracle E-Business Suite Cookie Domain Scoping Allowed JSPs Allowed Redirects Proxy User

29 Feature Overview for Cookie Domain Scoping Principles Reduces the attack surface of Oracle E-Business Suite Provides additional protection for communication between the browser and the Oracle E-Business Suite web tier Provides the ability to define the scope for cookie sharing to avoid unnecessary exposure Allows for a custom scope to be defined

30 What is a Cookie? Not just a baked goodie, in the World Wide Web, a cookie is also a mechanism of storing state across web requests When a site is accessed, a user s browser stores information in the cookie such as a session identifier When the site is accessed again, the information in the cookie can be reused «Set-Cookie: mycookie=7er852» Cookie: mycookie=7er852 apps.us.example.com

31 What is a Cookie? If a domain is not specified, the browser does not send the cookie beyond the originating host If you explicitly set the cookie domain scope this tells the browser where the cookie can be sent «Set-Cookie: mycookie=7er852 ; domain=.us.example.com» Cookie: mycookie=7er852 apps.us.example.com

32 Cookie Domain Scoping Configuration Profile Option Profile: Oracle Applications Session Cookie Domain Profile code : ICX_SESSION_COOKIE_DOMAIN Profile scope: Profile may be set at the Site or Server level Default value: DOMAIN Profile Value HOST DOMAIN Description Domain attribute of the cookie will not be set Cookie will be scoped to the originating server Minimal attack surface Domain attribute of the cookie will be set Value is derived from the APPS_WEB_AGENT profile option [CUSTOM] User defined value for the domain

33 New Security Features in Oracle E-Business Suite Cookie Domain Scoping Allowed JSPs Allowed Redirects Proxy User

34 Feature Overview of Allowed JSPs Principles Reduces the attack surface of Oracle E-Business Suite Defines whitelist of allowed JSPs for Oracle E-Business Suite Release 12.2 A whitelist is an explicit list of items that are allowed for access Prevents access to JSPs which are not used Enables configuration of actively allowed JSPs to avoid unnecessary exposure Allows custom JSPs to be defined in the list of allowed JSPs

35 Allowed JSPs Compared to DMZ Whitelist Principles Internet User DMZ Web Tier Database Tier Internal Web Tier Intranet User DMZ tier has a whitelist mechanism (URL Firewall) Controls resources exposed to internet Allowed JSPs implementation on internal web tier is similar to DMZ web tier whitelist mechanism

36 Using Allowed JSPs What You Should Do Evaluate product family usage Cross-check restricted JSPs against access_log Add used Oracle E-Business Suite and custom JSPs to configuration files Turn on the Allowed JSPs feature Continue to refine the list Comment out Product Families not used Comment out Products not used Add custom JSPS as needed

37 Allowed JSPs Configuration Overview Configuration files $FND_SECURE/allowed_jsps.conf - master configuration file $FND_SECURE/allowed_jsps_<Family>.conf $FND_SECURE/allowed_jsps_<Family>_<Product>.conf Profile Option Allow Unrestricted JSP Access A mid-tier restart is not required for configuration files and profile option updates to go into effect.

38 Allowed JSP Configuration Profile Option Profile: Allow Unrestricted JSP Access Profile code : FND_SEC_ALLOW_JSP_UNRESTRICTED_ACCESS Profile scope: Profile may be set at the Site or Server level Default value: YES at Site level Profile Value YES NO NULL Description Unrestricted access to JSPs Restricted access to the allowed JSPs per the JSP whitelist filter If the JSP servlet filter is configured, then restricted access is enabled

39 New Security Features in Oracle E-Business Suite Cookie Domain Scoping Allowed JSPs Allowed Redirects Proxy User

40 Feature Overview for Allowed Redirects Principles Provides defense-in-depth protection against phishing redirect attacks Defines whitelist of allowed redirects for Oracle E-Business Suite 12.2 A whitelist is an explicit list of hosts that are allowed for redirects Prevents redirects that are not listed as allowed Enables configuration of allowed redirects to avoid unnecessary exposure Allows custom redirects to be defined in the list of allowed redirects Allows all redirects by default

41 Which Redirects Should Be Allowed? Configuration Delivered in Configuration File Oracle E-Business Suite built-in use of redirects for functionality Examples include: Report Launcher, Self-Service Applications, Help System Single sign-on integration with Oracle Access Manager using Oracle E-Business AccessGate and Oracle Internet Directory Reporting with Oracle Discoverer Viewer, Oracle Discoverer Server and Oracle Business Intelligence Enterprise Edition Integration with Oracle Portal irecruitment Background Check URL

42 Which Redirects Should Be Allowed? Configuration You Need to Add to the Configuration File Oracle E-Business Suite iprocurement with Punchout Add host or domain entry for each Punchout site Oracle E-Business Suite Configurator integration with Agile or Siebel using Oracle Application Integration Architecture Add host or domain entry for each integration point Any custom redirects used in your environment

43 Allowed Redirects Configuration Overview Configuration files $FND_SECURE/allowed_redirects.conf Content should be a list of hosts, domains, site/server level profiles and/or additional configuration files Profile Option Allow Unrestricted Redirects

44 Allowed Redirects Configuration Profile Option Profile: Allow Unrestricted Redirects Profile code : FND_SEC_ALLOW_UNRESTRICTED_REDIRECT Profile scope: Profile may be set at the Site or Server level Default value: YES at Site level Profile Value YES NO NULL Description Unrestricted access to all redirects Restricted access to the allowed redirects per the redirect whitelist filter If the redirect servlet filter is configured, then restricted access is enabled

45 New Security Features in Oracle E-Business Suite Cookie Domain Scoping Allowed JSPs Allowed Redirects Proxy User

46 Proxy User Terminology Delegator: user who needs to delegate functionality to another user (the proxy user) Proxy User: user who is the delegate or proxy who uses functionality on behalf of the delegator

47 Feature Overview for Proxy User Reasons to Delegate Access Executive delegates to assistant for routine tasks User going on vacation or leave delegates to coworker, manager, or subordinate User delegates to help desk agent or other agent for assistance or training Users delegate to internal audit personnel to monitor compliance Several users access a shared account as proxy users to make tracking easier Benefits of Delegating Access Keep business running smoothly when key personnel are out Allow users to share work without sharing passwords Control who can delegate what to whom

48 Feature Overview for Proxy User Users can delegate some or all of their access to Oracle E-Business Suite functionality to other users, who can then act on the delegator s behalf. Functionality works seamlessly across all Forms and OA Framework-based Oracle E-Business Suite modules Simple delegation interface for users Users can delegate by responsibility or workflow notification type Delegation is not all or nothing functionality Delegator can audit proxy user access along with time of access

49 Feature Overview for Proxy User The Role of the Proxy User Administrator Defines who can use the proxy user functionality Defines which responsibilities cannot be delegated Example: Employee self-service with payslips and personal information Defines who the delegator can delegate to as a proxy user Seeded policies Direct Line of Command, Second Line of Command, Third Line of Command Immediate Supervisor and peers, Supervisor s peers and his peers All employees, All Users, Custom delegation policies may also be created

50 Administrator Setup Define the Roles and Responsibilities Allowed to Delegate to Proxy

51 Administrator Setup Restrict Responsibilities from Delegation

52 Administrator Setup Define Who Can Be a Proxy User

53 Example: User Delegating to Proxy Logon as Self, then Go to Tools and Click on Preferences

54 Example: User Delegating to Proxy Navigate to Manage Proxies, then Click Add Proxy

55 Example: User Delegating to Proxy One Page Setup for Proxy User

56 Example: User Delegating to Proxy Add the User Name of the Proxy User

57 Example: User Delegating to Proxy Grant the Responsibility Access to the Proxy User

58 Example: User Delegating to Proxy Grant Workflow Notification Type to Proxy

59 Example: User Delegating to Proxy Your Proxy User is Now Defined

60 Example: Perform Work as Proxy on Behalf of Delegator Logon as Self, then Switch User Switch user to work as proxy user

61 Example: Perform Work as Proxy on Behalf of Delegator Next, Choose which User to Switch To (Proxy)

62 Example: Perform Work as Proxy on Behalf of Delegator Choose Actions to Perform Your User Name Delegator Name

63 Example: Perform Work as Proxy on Behalf of Delegator Choose Actions to Perform No Preferences or Favorites Your User Name Delegator Name

64 Example: Perform Work as Proxy on Behalf of Delegator Choose Actions to Perform No Preferences or Favorites Your User Name Delegator s Granted Responsibilities Delegator Name Delegator s Worklist (limited to delegated types)

65 Example: Perform Work as Proxy on Behalf of Delegator Appearance in Forms-based Interface Your User Name Delegator Name

66 Example: Delegator Reviewing Proxy User Activity

67

68

Copyright 2013, Oracle and/or its affiliates. All rights reserved.

Copyright 2013, Oracle and/or its affiliates. All rights reserved. 1 Security Inside-Out with Oracle Database 12c Denise Mallin, CISSP Oracle Enterprise Architect - Security The following is intended to outline our general product direction. It is intended for information

More information

Complete Database Security. Thomas Kyte http://asktom.oracle.com/

Complete Database Security. Thomas Kyte http://asktom.oracle.com/ Complete Database Security Thomas Kyte http://asktom.oracle.com/ Agenda Enterprise Data Security Challenges Database Security Strategy Oracle Database Security Solutions Defense-in-Depth Q&A 2 Copyright

More information

Oracle Database Security. Paul Needham Senior Director, Product Management Database Security

Oracle Database Security. Paul Needham Senior Director, Product Management Database Security Oracle Database Security Paul Needham Senior Director, Product Management Database Security Safe Harbor Statement The following is intended to outline our general product direction. It is intended for

More information

Copyright 2013, Oracle and/or its affiliates. All rights reserved.

Copyright 2013, Oracle and/or its affiliates. All rights reserved. 1 Solutions for securing and auditing Oracle database Edgars Ruņģis Technology Consultant Why Are Databases Vulnerable? 80% of IT Security Programs Don t Address Database Security Forrester Research Enterprises

More information

Protecting Sensitive Data Reducing Risk with Oracle Database Security

Protecting Sensitive Data Reducing Risk with Oracle Database Security Protecting Sensitive Data Reducing Risk with Oracle Database Security Antonio.Mata.Gomez@oracle.com Information Security Architect Agenda 1 2 Anatomy of an Attack Three Steps to Securing an Oracle Database

More information

Oracle Database Security

Oracle Database Security Oracle Database Security Paul Needham, Senior Director, Product Management, Database Security Target of Data Breaches 2010 Data Breach Investigations Report Type Category % Breaches

More information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information 1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information Proteggere i dati direttamente nel database Una proposta tecnologica Angelo Maria Bosis Sales Consulting Senior Manager

More information

Securing Data in Oracle Database 12c

Securing Data in Oracle Database 12c Securing Data in Oracle Database 12c Thomas Kyte http://asktom.oracle.com/ Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes

More information

How to Audit the Top Ten E-Business Suite Security Risks

How to Audit the Top Ten E-Business Suite Security Risks In-Source Your IT Audit Series How to Audit the Top Ten E-Business Suite Security Risks February 28, 2012 Jeffrey T. Hare, CPA CISA CIA Industry Analyst, Author, Consultant ERP Risk Advisors Stephen Kost

More information

<Insert Picture Here> Oracle Database Security Overview

<Insert Picture Here> Oracle Database Security Overview Oracle Database Security Overview Tammy Bednar Sr. Principal Product Manager tammy.bednar@oracle.com Data Security Challenges What to secure? Sensitive Data: Confidential, PII, regulatory

More information

Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Copyright 2012, Oracle and/or its affiliates. All rights reserved. 1 The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any

More information

Copyright 2013, Oracle and/or its affiliates. All rights reserved.

Copyright 2013, Oracle and/or its affiliates. All rights reserved. 1 Security Inside Out Latest Innovations in Oracle Database 12c Jukka Männistö Database Architect Oracle Nordic Coretech Presales The 1995-2014 Security Landscape Regulatory Landscape HIPAA, SOX (2002),

More information

Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet

Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development

More information

Security It s an ecosystem thing

Security It s an ecosystem thing Security It s an ecosystem thing Joseph Alhadeff Vice President Global Public Policy, Chief Privacy Strategist The Security challenge in the before time. Today s Threat Environment

More information

Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Copyright 2012, Oracle and/or its affiliates. All rights reserved. 1 Seguridad en profundidad Jaime Briggs MSc CS, CISSP, CCSK Sales Manager Strategic accounts Agenda Los Controles ISO 27001 Defensa en Profundidad Productos que dan respuesta Roadmap a seguridad Q&A 3

More information

Oracle Database 11g: Security Release 2. Course Topics. Introduction to Database Security. Choosing Security Solutions

Oracle Database 11g: Security Release 2. Course Topics. Introduction to Database Security. Choosing Security Solutions Oracle Database 11g: Security Release 2 In this course, students learn how they can use Oracle Database features to meet the security, privacy and compliance requirements of their organization. The current

More information

Oracle Database 11g: Security. What you will learn:

Oracle Database 11g: Security. What you will learn: Oracle Database 11g: Security What you will learn: In Oracle Database 11g: Security course students learn how they can use Oracle database features to meet the security, privacy and compliance requirements

More information

<Insert Picture Here> PCI DSS-Payment Card Industry. Security Summit 2010. Master Principal Sales Consultant - Alfredo Valenza - Oracle Italia

<Insert Picture Here> PCI DSS-Payment Card Industry. Security Summit 2010. Master Principal Sales Consultant - Alfredo Valenza - Oracle Italia PCI DSS-Payment Card Industry Data Security Standard Security Summit 2010 Master Principal Sales Consultant - Alfredo Valenza - Oracle Italia This document is for informational purposes.

More information

D50323GC20 Oracle Database 11g: Security Release 2

D50323GC20 Oracle Database 11g: Security Release 2 D50323GC20 Oracle Database 11g: Security Release 2 What you will learn In this course, you'll learn how to use Oracle Database features to meet the security, privacy and compliance requirements of their

More information

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you

More information

New Security Features in Oracle E-Business Suite 12.2

New Security Features in Oracle E-Business Suite 12.2 New Security Features in Oracle E-Business Suite 12.2 October 24, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About

More information

Developing Value from Oracle s Audit Vault For Auditors and IT Security Professionals

Developing Value from Oracle s Audit Vault For Auditors and IT Security Professionals Developing Value from Oracle s Audit Vault For Auditors and IT Security Professionals November 13, 2014 Michael Miller Chief Security Officer Integrigy Corporation Stephen Kost Chief Technology Officer

More information

Oracle Database 11g: Security Release 2

Oracle Database 11g: Security Release 2 Oracle University Contact Us: 1.800.529.0165 Oracle Database 11g: Security Release 2 Duration: 5 Days What you will learn In this course, you'll learn how to use Oracle Database features to meet the security,

More information

Copyright 2013, Oracle and/or its affiliates. All rights reserved.

Copyright 2013, Oracle and/or its affiliates. All rights reserved. 1 The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any

More information

Oracle Audit Vault and Database Firewall. Morana Kobal Butković Principal Sales Consultant Oracle Hrvatska

Oracle Audit Vault and Database Firewall. Morana Kobal Butković Principal Sales Consultant Oracle Hrvatska Oracle Audit Vault and Database Firewall Morana Kobal Butković Principal Sales Consultant Oracle Hrvatska The following is intended to outline our general product direction. It is intended for information

More information

Oracle Database 11g: Security

Oracle Database 11g: Security Oracle University Contact Us: +27 (0)11 319-4111 Oracle Database 11g: Security Duration: 5 Days What you will learn In Oracle Database 11g: Security course students learn how to use Oracle database features

More information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information 1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information The following is intended to outline our general product direction. It is intended for information purposes only,

More information

The Weakest Link : Securing large, complex, global Oracle ebusiness Suite solutions

The Weakest Link : Securing large, complex, global Oracle ebusiness Suite solutions The Weakest Link : Securing large, complex, global Oracle ebusiness Suite solutions Radomir Vranesevic Director and IT Architect Oracle Certified Master, CISSP Fusion Professionals 1 Agenda Introduction

More information

An Oracle White Paper June 2009. Oracle Database 11g: Cost-Effective Solutions for Security and Compliance

An Oracle White Paper June 2009. Oracle Database 11g: Cost-Effective Solutions for Security and Compliance An Oracle White Paper June 2009 Oracle Database 11g: Cost-Effective Solutions for Security and Compliance Protecting Sensitive Information Information ranging from trade secrets to financial data to privacy

More information

MySQL Security: Best Practices

MySQL Security: Best Practices MySQL Security: Best Practices Sastry Vedantam sastry.vedantam@oracle.com Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes

More information

Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping

Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control

More information

Oracle Database Security Solutions

Oracle Database Security Solutions Oracle Database Security Solutions Eric Cheung Senior Manager, Technology Sales Consulting Eric.cheung@oracle.com May 2008 Key Drivers for Data Security Privacy and Compliance Sarbanes-Oxley

More information

Hayri Tarhan, Sr. Manager, Public Sector Security, Oracle Ron Carovano, Manager, Business Development, F5 Networks

Hayri Tarhan, Sr. Manager, Public Sector Security, Oracle Ron Carovano, Manager, Business Development, F5 Networks EXTENDING ACCESS WHILE ENHANCING CONTROL FOR YOUR ORGANIZATION S DATA LEVERAGE THE POWER OF F5 AND ORACLE TO DELIVER SECURE ACCESS TO APPLICATIONS AND DATABASES Hayri Tarhan, Sr. Manager, Public Sector

More information

Deploying the BIG-IP System with Oracle E-Business Suite 11i

Deploying the BIG-IP System with Oracle E-Business Suite 11i Deploying the BIG-IP System with Oracle E-Business Suite 11i Introducing the BIG-IP and Oracle 11i configuration Configuring the BIG-IP system for deployment with Oracle 11i Configuring the BIG-IP system

More information

<Insert Picture Here> Oracle Database Vault

<Insert Picture Here> Oracle Database Vault Oracle Database Vault Kamal Tbeileh Senior Principal Product Manager, Database Security The following is intended to outline our general product direction. It is intended for information

More information

ITAR Compliant Data Exchange

ITAR Compliant Data Exchange ITAR Compliant Data Exchange Managing ITAR Data Across Collaborative Project Teams WebSpace Customers Aerospace & Defense Manufacturing High Tech & Contract Manufacturing Automotive Manufacturing Medical/

More information

DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12

DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12 DEPLOYMENT GUIDE Version 1.2 Deploying F5 with Oracle E-Business Suite 12 Table of Contents Table of Contents Introducing the BIG-IP LTM Oracle E-Business Suite 12 configuration Prerequisites and configuration

More information

Managing R12 EBS using OEM with the Application Management and Application Change Management Packs

Managing R12 EBS using OEM with the Application Management and Application Change Management Packs Managing R12 EBS using OEM with the Application Management and Application Change Management Packs John Stouffer john.w.stouffer@gmail.com www.justadba.com John Stouffer Board Member 2010-2011, OAUG Oracle

More information

Database Security & Compliance with Audit Vault and Database Firewall. Pierre Leon Database Security

Database Security & Compliance with Audit Vault and Database Firewall. Pierre Leon Database Security Database Security & Compliance with Audit Vault and Database Firewall Pierre Leon Database Security 1 Topics Encryption Authentication Authorising highly privileged users Access control by data classification

More information

Security Implications of Oracle Product Desupport April 23, 2015

Security Implications of Oracle Product Desupport April 23, 2015 Security Implications of Oracle Product Desupport April 23, 2015 Stephen Kost Chief Technology Officer Integrigy Corporation About Integrigy ERP Applications Oracle E-Business Suite Databases Oracle and

More information

DMZ Network Visibility with Wireshark June 15, 2010

DMZ Network Visibility with Wireshark June 15, 2010 DMZ Network Visibility with Wireshark June 15, 2010 Ashok Desai Senior Network Specialist Intel Information Technology SHARKFEST 10 Stanford University June 14-17, 2010 Outline Presentation Objective DMZ

More information

Web Applications Access Control Single Sign On

Web Applications Access Control Single Sign On Web Applications Access Control Single Sign On Anitha Chepuru, Assocaite Professor IT Dept, G.Narayanamma Institute of Technology and Science (for women), Shaikpet, Hyderabad - 500008, Andhra Pradesh,

More information

Oracle Database 11g: Security

Oracle Database 11g: Security Oracle University Entre em contato: 0800 891 6502 Oracle Database 11g: Security Duração: 5 Dias Objetivos do Curso In Oracle Database 11g: Security course students learn how they can use Oracle database

More information

Oracle Health Sciences Network. 1 Introduction. 1.1 General Security Principles

Oracle Health Sciences Network. 1 Introduction. 1.1 General Security Principles Oracle Health Sciences Network Security Guide Release 2.0.0.0 E50290-02 September 2015 1 Introduction The main challenge sponsors face in clinical trials is the elapsed time from the start of the protocol

More information

Secure Web Appliance. Reverse Proxy

Secure Web Appliance. Reverse Proxy Secure Web Appliance Reverse Proxy Table of Contents 1. Introduction... 1 1.1. About CYAN Secure Web Appliance... 1 1.2. About Reverse Proxy... 1 1.3. About this Manual... 1 1.3.1. Document Conventions...

More information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information

1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information 1 Copyright 2012, Oracle and/or its affiliates. All rights reserved. Public Information The following is intended to outline our general product direction. It is intended for information purposes only,

More information

STERLING SECURE PROXY. Raj Kumar Integration Management, Inc. Raj.Kumar@integrationmgmt.com

STERLING SECURE PROXY. Raj Kumar Integration Management, Inc. Raj.Kumar@integrationmgmt.com STERLING SECURE PROXY Raj Kumar Integration Management, Inc. Raj.Kumar@integrationmgmt.com Agenda Terminology Proxy Definition Sterling Secure Proxy Overview Architecture Components Architecture Diagram

More information

NEFSIS DEDICATED SERVER

NEFSIS DEDICATED SERVER NEFSIS TRAINING SERIES Nefsis Dedicated Server version 5.2.0.XXX (DRAFT Document) Requirements and Implementation Guide (Rev5-113009) REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER Nefsis

More information

RSA Authentication Manager 7.1 Security Best Practices Guide. Version 2

RSA Authentication Manager 7.1 Security Best Practices Guide. Version 2 RSA Authentication Manager 7.1 Security Best Practices Guide Version 2 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks

More information

Installation and configuration guide

Installation and configuration guide Installation and Configuration Guide Installation and configuration guide Adding X-Username support to Forward and Reverse Proxy TMG Servers Published: December 2010 Applies to: Winfrasoft X-Username for

More information

Oracle Enterprise Manager 12c Cloud Control for Managing Oracle E-Business Suite 12.2

Oracle Enterprise Manager 12c Cloud Control for Managing Oracle E-Business Suite 12.2 Oracle Enterprise Manager 12c Cloud Control for Managing Oracle E-Business Suite 12.2 Angelo Rosado Senior Principal Product Manager Oracle E-Business Suite Development, Applications Technology Group September

More information

CA Performance Center

CA Performance Center CA Performance Center Single Sign-On User Guide 2.4 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is

More information

WhatsUp Gold v16.3 Installation and Configuration Guide

WhatsUp Gold v16.3 Installation and Configuration Guide WhatsUp Gold v16.3 Installation and Configuration Guide Contents Installing and Configuring WhatsUp Gold using WhatsUp Setup Installation Overview... 1 Overview... 1 Security considerations... 2 Standard

More information

Enabling Single Sign-On for Oracle Applications Oracle Applications Users Group PAGE 1

Enabling Single Sign-On for Oracle Applications Oracle Applications Users Group PAGE 1 Enabling Single Sign-On for Oracle Applications Oracle Applications Users Group PAGE 1 Agenda Introduction PAGE 2 Organization Speakers Security Spectrum Information Security Spectrum Oracle Identity Management

More information

How to configure SSL proxying in Zorp 3 F5

How to configure SSL proxying in Zorp 3 F5 How to configure SSL proxying in Zorp 3 F5 June 14, 2013 This tutorial describes how to configure Zorp to proxy SSL traffic Copyright 1996-2013 BalaBit IT Security Ltd. Table of Contents 1. Preface...

More information

Oracle E-Business Suite Security Myths

Oracle E-Business Suite Security Myths Oracle E-Business Suite Security Myths November 13, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About Integrigy

More information

All Things Oracle Database Encryption

All Things Oracle Database Encryption All Things Oracle Database Encryption January 21, 2016 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation Agenda Database Encryption

More information

DirX Identity V8.5. Secure and flexible Password Management. Technical Data Sheet

DirX Identity V8.5. Secure and flexible Password Management. Technical Data Sheet Technical Data Sheet DirX Identity V8.5 Secure and flexible Password Management DirX Identity provides a comprehensive password management solution for enterprises and organizations. It delivers self-service

More information

ENABLING RPC OVER HTTPS CONNECTIONS TO M-FILES SERVER

ENABLING RPC OVER HTTPS CONNECTIONS TO M-FILES SERVER M-FILES CORPORATION ENABLING RPC OVER HTTPS CONNECTIONS TO M-FILES SERVER VERSION 2.3 DECEMBER 18, 2015 Page 1 of 15 CONTENTS 1. Version history... 3 2. Overview... 3 2.1. System Requirements... 3 3. Network

More information

Proxies. Chapter 4. Network & Security Gildas Avoine

Proxies. Chapter 4. Network & Security Gildas Avoine Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open

More information

Microsoft SQL Server Security Best Practices

Microsoft SQL Server Security Best Practices Microsoft SQL Server Security Best Practices This white paper contains administrative and operational best practices that should be performed from a security perspective when using Microsoft SQL Server.

More information

Quest InTrust. Version 8.0. What's New. Active Directory Exchange Windows

Quest InTrust. Version 8.0. What's New. Active Directory Exchange Windows Quest InTrust Version 8.0 What's New Active Directory Exchange Windows Abstract This document describes the new features and capabilities of Quest InTrust 8.0. Copyright 2004 Quest Software, Inc. and Quest

More information

NETWRIX USER ACTIVITY VIDEO REPORTER

NETWRIX USER ACTIVITY VIDEO REPORTER NETWRIX USER ACTIVITY VIDEO REPORTER ADMINISTRATOR S GUIDE Product Version: 1.0 January 2013. Legal Notice The information in this publication is furnished for information use only, and does not constitute

More information

Making Database Security an IT Security Priority

Making Database Security an IT Security Priority Sponsored by Oracle Making Database Security an IT Security Priority A SANS Whitepaper November 2009 Written by Tanya Baccam Security Strategy Overview Why a Database Security Strategy? Making Databases

More information

APPLICATION COMPLIANCE AUDIT & ENFORCEMENT

APPLICATION COMPLIANCE AUDIT & ENFORCEMENT TELERAN SOLUTION BRIEF Building Better Intelligence APPLICATION COMPLIANCE AUDIT & ENFORCEMENT For Exadata and Oracle 11g Data Warehouse Environments BUILDING BETTER INTELLIGENCE WITH BI/DW COMPLIANCE

More information

Securing Oracle E-Business Suite in the Cloud

Securing Oracle E-Business Suite in the Cloud Securing Oracle E-Business Suite in the Cloud November 18, 2015 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation Agenda The

More information

Oracle E-Business Suite APPS, SYSADMIN, and oracle Securing Generic Privileged Accounts. Stephen Kost Chief Technology Officer Integrigy Corporation

Oracle E-Business Suite APPS, SYSADMIN, and oracle Securing Generic Privileged Accounts. Stephen Kost Chief Technology Officer Integrigy Corporation Oracle E-Business Suite APPS, SYSADMIN, and oracle Securing Generic Privileged Accounts May 15, 2014 Mike Miller Chief Security Officer Integrigy Corporation Stephen Kost Chief Technology Officer Integrigy

More information

F-Secure Messaging Security Gateway. Deployment Guide

F-Secure Messaging Security Gateway. Deployment Guide F-Secure Messaging Security Gateway Deployment Guide TOC F-Secure Messaging Security Gateway Contents Chapter 1: Deploying F-Secure Messaging Security Gateway...3 1.1 The typical product deployment model...4

More information

Table of Contents. Page 1 of 6 (Last updated 30 July 2015)

Table of Contents. Page 1 of 6 (Last updated 30 July 2015) Table of Contents What is Connect?... 2 Physical Access Controls... 2 User Access Controls... 3 Systems Architecture... 4 Application Development... 5 Business Continuity Management... 5 Other Operational

More information

Oracle E-Business Suite Controls: Application Security Best Practices

Oracle E-Business Suite Controls: Application Security Best Practices Table of Contents Table of Contents vi Acknowledgements 1 Foreword 2 What Makes This Book Different 3 Who Should Read this Book 3 Organization of this Book 4 Chapter 1: Introduction 5 Chapter 2: Introduction

More information

Brocade Virtual Traffic Manager and Oracle EBS 12.1 Deployment Guide

Brocade Virtual Traffic Manager and Oracle EBS 12.1 Deployment Guide September 2015 Brocade Virtual Traffic Manager and Oracle EBS 12.1 Deployment Guide 2015 Brocade Communications Systems, Inc. All Rights Reserved. ADX, Brocade, Brocade Assurance, the B-wing symbol, DCX,

More information

MAXIMUM DATA SECURITY with ideals TM Virtual Data Room

MAXIMUM DATA SECURITY with ideals TM Virtual Data Room MAXIMUM DATA SECURITY with ideals TM Virtual Data Room WWW.IDEALSCORP.COM ISO 27001 Certified Account Settings and Controls Administrators control users settings and can easily configure privileges for

More information

Security Compliance and Data Governance: Dual problems, single solution CON8015

Security Compliance and Data Governance: Dual problems, single solution CON8015 Security Compliance and Data Governance: Dual problems, single solution CON8015 David Wolf Director of Product Management Oracle Development, Enterprise Manager Steve Ries Senior Systems Architect Technology

More information

NETWRIX EVENT LOG MANAGER

NETWRIX EVENT LOG MANAGER NETWRIX EVENT LOG MANAGER ADMINISTRATOR S GUIDE Product Version: 4.0 July/2012. Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment

More information

QuickBooks Online: Security & Infrastructure

QuickBooks Online: Security & Infrastructure QuickBooks Online: Security & Infrastructure May 2014 Contents Introduction: QuickBooks Online Security and Infrastructure... 3 Security of Your Data... 3 Access Control... 3 Privacy... 4 Availability...

More information

Credit Cards and Oracle E-Business Suite Security and PCI Compliance Issues

Credit Cards and Oracle E-Business Suite Security and PCI Compliance Issues Credit Cards and Oracle E-Business Suite Security and PCI Compliance Issues August 16, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy

More information

<Insert Picture Here> Application Change Management and Data Masking

<Insert Picture Here> Application Change Management and Data Masking Application Change Management and Data Masking Jagan R. Athreya (jagan.athreya@oracle.com) Director of Database Manageability Oracle Corporation 1 The following is intended to outline

More information

NETWRIX EVENT LOG MANAGER

NETWRIX EVENT LOG MANAGER NETWRIX EVENT LOG MANAGER QUICK-START GUIDE FOR THE ENTERPRISE EDITION Product Version: 4.0 July/2012. Legal Notice The information in this publication is furnished for information use only, and does not

More information

LOAD BALANCING TECHNIQUES FOR RELEASE 11i AND RELEASE 12 E-BUSINESS ENVIRONMENTS

LOAD BALANCING TECHNIQUES FOR RELEASE 11i AND RELEASE 12 E-BUSINESS ENVIRONMENTS LOAD BALANCING TECHNIQUES FOR RELEASE 11i AND RELEASE 12 E-BUSINESS ENVIRONMENTS Venkat Perumal IT Convergence Introduction Any application server based on a certain CPU, memory and other configurations

More information

Encrypting Sensitive Data in Oracle E-Business Suite

Encrypting Sensitive Data in Oracle E-Business Suite Encrypting Sensitive Data in Oracle E-Business Suite December 19, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation About Integrigy ERP Applications Oracle E-Business Suite Databases Oracle

More information

Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Copyright 2012, Oracle and/or its affiliates. All rights reserved. 1 Oracle Database Security Advanced Security Option Thanos Terentes Printzios DB & Options Specialist A&C Technology Adoption Office Oracle Partner Business Development, ECEMEA 2 What is a customers INFORMATION

More information

HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide

HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide Product overview... 3 Vulnerability scanning components... 3 Vulnerability fix and patch components... 3 Checklist... 4 Pre-installation

More information

Secret Server Qualys Integration Guide

Secret Server Qualys Integration Guide Secret Server Qualys Integration Guide Table of Contents Secret Server and Qualys Cloud Platform... 2 Authenticated vs. Unauthenticated Scanning... 2 What are the Advantages?... 2 Integrating Secret Server

More information

F5 and Microsoft Exchange Security Solutions

F5 and Microsoft Exchange Security Solutions F5 PARTNERSHIP SOLUTION GUIDE F5 and Microsoft Exchange Security Solutions Deploying a service-oriented perimeter for Microsoft Exchange WHAT'S INSIDE Pre-Authentication Mobile Device Security Web Application

More information

March 2012 www.tufin.com

March 2012 www.tufin.com SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...

More information

Application and Database Security with F5 BIG-IP ASM and IBM InfoSphere Guardium

Application and Database Security with F5 BIG-IP ASM and IBM InfoSphere Guardium Application and Database Security with F5 BIG-IP ASM and IBM InfoSphere Guardium Organizations need an end-to-end web application and database security solution to protect data, customers, and their businesses.

More information

Password Reset PRO INSTALLATION GUIDE

Password Reset PRO INSTALLATION GUIDE Password Reset PRO INSTALLATION GUIDE This guide covers the new features and settings available in Password Reset PRO. Please read this guide completely to ensure a trouble-free installation. March 2009

More information

Agenda. How to configure

Agenda. How to configure dlaw@esri.com Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context of ArcGIS Server/Portal for ArcGIS Access Authentication Authorization: securing web services

More information

Copyright http://support.oracle.com/

Copyright http://support.oracle.com/ Primavera Portfolio Management 9.0 Security Guide July 2012 Copyright Oracle Primavera Primavera Portfolio Management 9.0 Security Guide Copyright 1997, 2012, Oracle and/or its affiliates. All rights reserved.

More information

Configuration Information

Configuration Information This chapter describes some basic Email Security Gateway configuration settings, some of which can be set in the first-time Configuration Wizard. Other topics covered include Email Security interface navigation,

More information

Remote Access Platform. Architecture and Security Overview

Remote Access Platform. Architecture and Security Overview Remote Access Platform Architecture and Security Overview NOTICE This document contains information about one or more ABB products and may include a description of or a reference to one or more standards

More information

Workday Mobile Security FAQ

Workday Mobile Security FAQ Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy

More information

REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER

REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER NEFSIS TRAINING SERIES Nefsis Dedicated Server version 5.1.0.XXX Requirements and Implementation Guide (Rev 4-10209) REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER Nefsis Training Series

More information

Securing access to Citrix applications using Citrix Secure Gateway and SafeWord. PremierAccess. App Note. December 2001

Securing access to Citrix applications using Citrix Secure Gateway and SafeWord. PremierAccess. App Note. December 2001 Securing access to Citrix applications using Citrix Secure Gateway and SafeWord PremierAccess App Note December 2001 DISCLAIMER: This White Paper contains Secure Computing Corporation product performance

More information

My Oracle Support Portal

My Oracle Support Portal My Oracle Support Portal Fuad Samara Customer Service Manager Global Customer Management The following is intended to outline our general product direction. It is intended for information

More information

HP Service Manager. Software Version: 9.40 For the supported Windows and Linux operating systems. Application Setup help topics for printing

HP Service Manager. Software Version: 9.40 For the supported Windows and Linux operating systems. Application Setup help topics for printing HP Service Manager Software Version: 9.40 For the supported Windows and Linux operating systems Application Setup help topics for printing Document Release Date: December 2014 Software Release Date: December

More information

Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Copyright 2012, Oracle and/or its affiliates. All rights reserved. 1 Cumplimiento de PMG SSI para sector Gobierno en Chile Jaime Briggs MSc CS, CISSP, CCSK Sales Manager Strategic accounts jaime.briggs@oracle.com Agenda Pilares Fundamentales de SSI Desafios de Seguridad

More information

Web Plus Security Features and Recommendations

Web Plus Security Features and Recommendations Web Plus Security Features and Recommendations (Based on Web Plus Version 3.x) Centers for Disease Control and Prevention National Center for Chronic Disease Prevention and Health Promotion Division of

More information

Oracle 1Z0-528 Exam Questions & Answers

Oracle 1Z0-528 Exam Questions & Answers Oracle 1Z0-528 Exam Questions & Answers Number: 1Z0-528 Passing Score: 660 Time Limit: 120 min File Version: 21.1 http://www.gratisexam.com/ Oracle 1Z0-528 Exam Questions & Answers Exam Name: Oracle Database

More information

DirX Identity V8.4. Secure and flexible Password Management. Technical Data Sheet

DirX Identity V8.4. Secure and flexible Password Management. Technical Data Sheet Technical Data Sheet DirX Identity V8.4 Secure and flexible Password Management DirX Identity provides a comprehensive password management solution for enterprises and organizations. It delivers self-service

More information