The tent needs to prevent dangerous settings, discover problems and protect information. No secluded service resolves all these tasks.
Key concepts
At model of shared liability, Oracle protects cloud infrastructure and operates components that match service. The client sets up his resources, controls identities and protects his data and applications. A IaaS VM also manages the guest operating system and its patching. A run service can move tasks to Oracle but doesn't decide who to read your orders for you. See Security of OCI.
The in-depth defence combines controls: IAM authorizes operations about resources; network rules stop traffic; The operational system and implementation apply their own controls. cipher protects information searches and detection allow for an investigation. To allow HTTPS into a NSG does not by itself valid the contents of a request web.
Prevent, detect and respond
Cloud Guard and activity to identify risks. A target delimits what to observe. the recipes of detectors determine checks; and replies allow correction actions according to configuration and permissions. Detection of a problem does not mean an automatic correction.
Security Zones applying a recipe policies to a compartments and their scope. A transaction that violates an applicable policy is refused. For example, a recipe can prevent public buckets or demand client-run keys. Security Advisorat the demonstration, guides the creation of resources following security controls. does not replace politics or turn any resource into insurance by itself.
Web Application Firewall (WAF) It inspects requests web and can filter bad patterns, such as SQL injection attempts or crosssite Scripting, as established. It does not replace the validation of inputs from the application. Audit record API actions for research; Logging sets up service or application records; Monitoring He works with metrics and alarms. To figure out who changed an resource, seek audit evidence. To figure out if his CPU's up, look at them.
Filling, keys and secrets
Figure Reforms legible text into cipher text using an algorithm and a key. Decipher Reforms the contents if the cryptographic and access conditions are met. The encryption symmetric uses a shared key. and asymmetricA couple of keys with related functions. A hash isn't just cipher that you can undo with a key.
The encryption at rest protects stored data; in transit protect your transport, for example by using TLS. Do not confuse anything with permission: a legitimately authorized user can get his or her deciphered data. A public cipher but exposed can continue to reveal information through the service.
OCI Vault manages keys and secrets. One cryptographic key It is used in encryption operations; a secret may contain a password, token or other sensitive material. Separate them from the code prevents them from embedded into distributed configuration files. Key protection modes, such as software or HSM, and their options should be chosen according to service requirements.
A service can use keys administered by Oracle or a client-supported key. The latter gives additional monitoring of the life cycle with responsibilities about permissions, availability and disposal. Rotate a key and rotate a password are different processes. Query Key Management and Vault.
Step-by-step example
- The store identifies orders as private data and sets up minimum access to your picket.
- Apply a Security Zone whose recipe requires a client's key. First check the recipe and create the necessary cryptographic resources with an authorized manager.
- When trying to create the picket with a key administered by Oracle, the operation is refused by that particular rule. The message describes the unmet requirement.
- Select a matching key that the service has access to and create a bug as required by the recipe. At the demonstration, Security Advisor helps to get through that flow.
- Configure Cloud Guard with appropriate scope and responses Check findings and confirm their correction. It protects web entry with WAF depending on the risk of application.
The Vault demonstration identifies vault, key and version and what service you will use. Do not remove the key as simply cleanup from a lab if there are still data that depend on it.
Common errors
- "Cloud Guard prevents bad configuration." Their main role is to detect and facilitate correction. Security Zones can deny incompatible operations.
- "The figure equals private." The service's authorized reading access remains crucial.
- "A firewall rule protects from any SQL injection." To allow a port is different from to inspect HTTP content. The application should also validate inputs and check data securely.
Retirement exercise
The store calls for three measures: denying public buckets before creating them, constantly revising risk settings and filtering HTTP attacks to its web. Assign a service to each measure and explain what customer controls are still necessary.
Solution
Security Zones with a recipe to ban public exposure Cloud Guard for set up detection and responses WAF for monitoring requests web. The client should define IAM policies, set up rules and scope, review findings and maintain their secure application. The names of the services do not replace their configuration.
Sources and review
Query Cloud Guard, Security Zones, WAF y Vault. Compare detector and answer, secret and key, encryption and authorization.