Critical Controls for Oracle E-Business Suite

Written by Mike Miller, Onapsis

Over the past months, cyber threat activity has increased to unprecedented levels, with threat actors expanding their capabilities to target critical infrastructure and mission-critical applications. From hacktivists to cyber-criminals and state-sponsored, these actors possess the knowledge to target critical applications, as highlighted by different CERTs recently:

• Malicious Cyber Activity Targeting Critical SAP Applications | CISA
• Advisory: Further TTPs associated with SVR cyber actors The NCSC, CISA, FBI and NSA publish advice

The last example shows the use of a vulnerability in the Weblogic Application Server, part of the technology stack of Oracle E-Business Suite, providing further evidence of the increased risk for mission-critical applications, including Oracle E-Business Suite.

The Cloud Security Alliance’s Enterprise Resource Planning (ERP) Working Group is pleased to release the latest in a series of security guidance for deploying ERP systems in the cloud. This latest whitepaper focuses on the Oracle E-Business Suite (EBS).

Oracle E-Business Suite clients should address cloud migration as much more than a data center migration project. Cloud migration is a significant opportunity to “start over” regarding security by using best practices, tools, services, and techniques unique to the cloud. Moving an EBS implementation to the cloud can significantly strengthen an organization’s security posture.

However, deploying EBS in the cloud can also open the door to significant risks if not done right. This paper outlines 20 critical controls that will help an organization determine what security changes are needed when deploying Oracle EBS in the cloud. These controls map to CSA’s overarching Top 20 Critical Controls for Cloud Enterprise Resource Planning Customers.

Please note that this is a reference document whose purpose is to promote best practices for cloud deployments of the Oracle E-Business Suite. It does not replace Oracle Corporation's documentation and specific instructions. Specifically, this document is to be used as part of the Enterprise Resource Planning Working Group's ongoing dialogue.

Key Takeaways:

• The control implementation (rationale) for 20 critical controls, including: segregation of duties, change management, continuous monitoring, data encryption, and more
• The specific requirements and steps needed to implement the 20 critical controls

Who It’s For: Information security professionals, compliance professionals, and database and system administrators who belong to organizations that deploy (or want to deploy) EBS in the cloud.

Please contact us with any questions and/or join our next meeting.

Download the full publication here.