Privacy and Security in the Cloud

Transcription

1 Privacy and Security in the Cloud A real experience with current technologies Milano 23 febbraio 2012 Roma 1 marzo 2012 Docenti: Alessandro Vallega (Clusit) Claudio Telmon (Clusit) Matteo Cavallini (CSA Italy per Roma) Mauro Gris (CSA Italy per Milano) Angelo Bosis (Oracle)

2 This document is for informational purposes. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle. This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. This document and information contained herein may not be disclosed, copied, reproduced or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

3 Agenda Oracle Public Cloud Overview (Secure) DataBase Cloud Service Identity Management Service Q&A

4 Oracle s Cloud Computing Strategy Deliver systems and software to build public and private clouds Oracle ExaLogic and Oracle Exadata for IaaS Oracle Fusion Middleware and Oracle Database for PaaS Oracle Fusion Applications for SaaS Ensure that cloud computing is fully enterprise grade Highly efficient, performant, available, scalable and secure infrastructure Complete, integrated, and standards-based development platform Modern set of enterprise applications, including social and mobile Provide flexible consumption choices Private cloud, as-a-service from Oracle Partners or Oracle directly Flexibility to move applications between these choices

5 Ops Center Cloud Management Oracle Enterprise Manager Cloud Control Oracle Cloud Offerings Private Cloud Products Applications Oracle Applications Private & Public Cloud Services Oracle Cloud Services Oracle Applications On Demand Oracle Public Cloud Fusion HCM Cloud Service Fusion CRM Cloud Service Oracle Social Network SOA Suite & BPM Suite Platform as a Service Data Integration & GoldenGate Identity & Access Mgmt Cloud Application Foundation: WebLogic Server, Coherence, JRockit, Exalogic Elastic Cloud Oracle Database, MySQL, Exadata Database Machine WebCenter User Engagement Middleware On Demand Exalogic On Demand Database On Demand Exadata On Demand Oracle Java Cloud Service Oracle Database Cloud Service Infrastructure as a Service Oracle Solaris Oracle VM for SPARC (LDom) Solaris Zones Oracle Linux Oracle VM for x86 Servers, SuperCluster Storage Network Fabric

6

7 Oracle Public Cloud Data Center One of the Top 10 Public Clouds in the World World Class Physical Infrastructure World Class Operational Expertise 100,000+ Sq Feet Raised Floor 2,500 Server Racks 300,000+ Computers 15 Petabytes+ Storage 4 Data Center Locations Dual Active Power Feeds Six 600-ton Chillers Seven 2MW Cat Gen sets Fully redundant, 7.5 MW Power Embassy-grade Physical Security Federal Zone (NIST & DIACAP) 1,500 Experts, 27 Languages Assessment services Pre-production services Migration & Upgrade services Infrastructure services Application admin services Help desk services CEMLI services Integration services Security services Governance services

8 Oracle Public Cloud An Enterprise Cloud for your Business Oracle Fusion CRM Cloud Service Oracle Fusion HCM Cloud Service Oracle Social Network Sell smarter with Fusion CRM in the cloud Oracle Database Cloud Service Bring power to your people with Fusion HCM in the cloud Oracle Java Cloud Service A secure collaboration tool for everyone you work with The Oracle Database you love, now in the cloud All the productivity of Java, without the IT

9 Oracle Public Cloud Shared Infrastructure Services Security & Identity Service Integration Service Enterprise Repository Service Enterprise Manager Virus Scanning & High Availability, Backup Cloud Support Service White List Service & Recovery Service in IDEs

10 Oracle Public Cloud Architecture Application Services The applications hosted in our cloud are identical to the versions that you can run in your own data center. Shared Enterprise Services Oracle cloud provide a series of shared enterprise services to simplify management. In our cloud console, we enable you to manage all of your service subscriptions in a single place. This includes upgrades, downgrades, billing, account management, and product access. Identity Management A shared identity management service integrates identities and access controls across the various services giving you a single security domain. Runtime Infrastructure Oracle cloud is powered by Exalogic and Exadata, which give you screaming performance and rock-solid reliability. Running on top of these systems is a shared service architecture that gives you your own dedicated set of resources while simultaneously isolating you from the data and systems of other users.

11 Oracle Public Cloud CSA Security Guidance Domain Mapping Oracle Fusion CRM Cloud Service Domain 10: Application Security Oracle Fusion HCM Cloud Service Domain 10: Application Security Oracle Social Network Domain 10: Application Security Oracle Database Cloud Service Oracle Java Cloud Service Domain 5: Information Management and Data Security Domain 11: Encription and Key Management

12 Oracle Public Cloud CSA Security Guidance Domain Mapping Security & Identity Service Domain 12: Identity, Entitlement and Access Management Integration Service Domain 6: Interoperability & Portability Enterprise Repository Service Enterprise Manager Service Virus Scanning & White List Service Domain 6: Data Center Operations Domain 6: Interoperability & Portability High Availability, Backup & Recovery Service Domain 7: Traditional Security, Business Continuity and Disaster Recovery Cloud Support in IDEs

13 Oracle Public Cloud: Database Cloud Service

14 Database Cloud Service Overview #1 database; in the cloud Rapid provisioning Simple pricing Easy to use and manage Rapid cloud-based application development Access using Java, RESTful Web Services and Oracle APEX Packaged business productivity applications

15 DB DB DB DB DB DB DB DB Database Cloud Architectures Common building blocks are shared servers and storage pools Infrastructure Cloud Database Cloud H R CR M ER P H R ER P CR M H R ER P CR M H R H R H R OS OS OS Hypervisor Hypervisor OS OS OS OS OS OS Server Consolidation Deploy in dedicated VMs Server virtualization Platform Consolidation Share server pool Share database instances Real Application Clusters Real Application Clusters RISK Database Consolidation Schema Consolidation Extreme Scalability VPD, Sharded, or Partitioned 2011 Oracle Corporation

16 Database Cloud Service Schema Isolation Service 1 Schema 1 APEX Service 2 Schema 2 SQL Developer Service 3 Schema 3 Rest Service 4 Schema 4 Oracle Database with Application Express

17 Oracle Database Cloud Service Architecture DataBase Service Each instance of our service is a single schema with an expandable tablespace. You get unlimited tables, rows, and columns spanning the full range of Oracle's data types to structure your data however you see fit. Identity Management User credentials for your Database Cloud Service are managed by Oracle Identify Management (IdM). Java and APEX applications can use IdM for authentication services. Access Control Allows you to assign different levels of access to your database objects, which are implemented for all data access. Fine-grained Access Control Allows you to limit access to your data based on values in the data objects in any way. Data Encryption For protection against unauthorized access, your data is encrypted when stored or backed up, without any need for programming to encrypt and decrypt.

18 Database Defense-in-Depth Solutions Encryption and Masking Oracle Advanced Security Oracle Secure Backup Oracle Data Masking Access Control Oracle Database Vault Enterprise User Security Oracle Label Security Auditing and Monitoring Oracle Audit Vault Oracle Configuration Management Oracle Total Recall Blocking and Logging Oracle Database Firewall

19 Oracle Advanced Security Comprehensive Standards-Based Encryption Disk Backups Exports Off-Site Facilities Transparent data at rest encryption Data stays encrypted when backed up Encryption for data in transit Strong authentication of users and servers

20 Oracle Database Vault Privileged User Access Control and Multi-Factor Authorization Application Procurement HR Finance DBA select * from finance.customers Keep privileged database users from abusing their powers Address Separation of Duties requirements Enforce security policies and block unauthorized database activities Prevent application by-pass to protect application data

21 Enterprise User Security (EUS) Centralized User Management HR Database EUS CRM Database Database Sevice EUS Oracle Directory Services AD or other LDAP Centralized DataBase user management in a Directory Server Map directory users to shared database schemas Audit with end user identity

22 Oracle Public Cloud: Identity Management Services

23 A key enabler and differentiator of Oracle Public Cloud Security & Identity Management Services Single Sign On and Identity Federation Integration between Oracle Public Cloud & onpremise identity management systems Fully delegated administration and dashboards Multi-factor authentication Use of standards for application visibility into public identity profiles Built on Oracle Identity Management

24 Identity Management Service Architecture

25 Oracle Identity Management Portfolio Complete, Hot-Pluggable, & Service-Oriented Security Identity Administration Access Management Directory Services Identity Manager Access Manager Identity Federation Adaptive Access Manager Enterprise Single Sign-On Entitlements Server Enterprise Gateway Web Services Security Identity & Access Governance Identity Analytics Platform Security Services Unified Directory Server Directory Server EE Internet Directory Virtual Directory Operational Manageability Management Pack For Identity Management

26 Identity Administration Oracle Identity Manager On-Premise Applications Self-Service Registration HRMS Reconciliation HRMS Engine Identity Store Provisioning Workflow Connector SPML Employee/ Contractor Cloud Applications Automated provisioning / de-provisioning to cloud applications Self-service registration to cloud and on-premise applications Compliance reports across on-premise and off-premise applications

27 Access Manager Authentication, authorization and auditing to enable single sign-on Centralized policy management Better compliance

28 Identity Federation Federated Single Sign-On Employees/Partners/C ustomers Oracle Identity Federation SAML 1.x SAML 2.0 Windows CardSpace WS-Fed OpenID On-Premise Applications Business Affiliates/Subsidiaries Cloud Applications Seamless SSO between on-premise and cloud applications Standards-based federation enables interoperability Rapid deployment

29 Identity Assurance Risk-Based Access Control Oracle Adaptive Access Manager Secure Mutual Authentication Risk Scoring Risk-Based Authorization Employees/Partners/ Customer Device Geography Time Activity Cloud Apps Fraudster On-Premise Apps Out-of-band authentication Identity proofing Real time fraud prevention

30 Cloud Security with Oracle Security Solutions Real World Examples Offers managed identity services including managed fraud prevention and identity verification services Federated provisioning deployment spans hosted PeopleSoft hosted and on-premise apps Federated user provisioning to Microsoft Live Offers Oracle Identity Management Suite to partners as a hosted/managed service

31

32