Secure Configuration Guide

Size: px

Start display at page:

Download "Secure Configuration Guide"

Pearl O’Brien’
5 years ago
Views:

1 Secure Configuration Guide Oracle Health Sciences InForm Publisher On Demand Release 2.0 Part Number: E

2 Copyright 2014, Oracle and/or its affiliates. All rights reserved. The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited. The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose. If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR , Commercial Computer Software -- Restricted Rights (June 1987). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs. The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. This documentation may include references to materials, offerings, or products that were previously offered by Phase Forward Inc. Certain materials, offerings, services, or products may no longer be offered or provided. Oracle and its affiliates cannot be held responsible for any such references should they appear in the text provided.

3 Contents About this guide Overview of this guide... vi Audience... vi Documentation... vii Documentation accessibility... vii If you need assistance... viii Finding product information and patches on My Oracle Support... viii Finding Oracle documentation... ix Chapter 1 Security overview 1 Application security overview... 2 General security principles... 3 Keep software up to date... 3 Keep up to date on the latest Critical Patch Updates... 3 Configure strong passwords on the database... 3 Follow the principle of least privilege... 3 Design multiple layers of protection... 4 Chapter 2 Secure installation and configuration 5 Installation overview... 6 Secure Sockets Layer (SSL)... 6 About entering passwords... 6 Configure strong administrator passwords... 6 Close all unused ports... 6 Disable all unused services... 6 Disable unnecessary services provided by the operating system... 7 Revoke unnecessary grants... 7 Post-installation configuration... 8 Restrict access to the InForm Publisher server... 8 Restrict access to the file server... 8 Chapter 3 Security features 9 Data security features Restricted viewing of Protected Health Information v Oracle Health Sciences InForm Publisher On Demand 2.0 iii

4 Contents iv Oracle Health Sciences InForm Publisher On Demand 2.0

5 About this guide In this preface Overview of this guide... vi Documentation... vii If you need assistance... viii Oracle Health Sciences InForm Publisher On Demand 2.0 v

6 About this guide Overview of this guide The Secure Configuration Guide provides essential secure configuration considerations for the InForm Publisher application. Audience This guide is for everyone who installs and configures the InForm Publisher application. vi Oracle Health Sciences InForm Publisher On Demand 2.0

7 Secure Configuration Guide Documentation The product documentation is available from the following locations: Oracle Software Delivery Cloud ( The complete documentation set. My Oracle Support ( Release Notes and Known Issues. Oracle Technology Network ( The most current documentation set, excluding the Release Notes and Known Issues. All documents may not be updated for every InForm Publisher release. Therefore, the version numbers for the documents in a release may differ. Document Installation Guide Release Notes Known Issues Integration Guide Description The Installation Guide provides instructions for installing the InForm Publisher software. The Release Notes document includes: System requirements. Descriptions of the new features, enhancements, and bug fixes. The Known Issues document provides detailed information about the known issues in this release, along with workarounds, if available. The Integration Guide provides detailed information about defining custom events and triggers and publishing events using web services, FTP, and Local Directory. Secure Configuration Guide The Secure Configuration Guide provides essential secure configuration considerations for the InForm Publisher application. Third Party Licenses and Notices This document includes licenses and notices for third party technology that may be included in or distributed with the InForm Publisher software. Documentation accessibility For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at Oracle Health Sciences InForm Publisher On Demand 2.0 vii

8 About this guide If you need assistance Oracle customers have access to support through My Oracle Support. For information, visit or if you are hearing impaired, visit Finding product information and patches on My Oracle Support The latest information about the InForm Publisher application is on the Oracle Support self-service website, My Oracle Support. Before you install and use the InForm Publisher application, check My Oracle Support for the latest information, including Release Notes and Known Issues, alerts, white papers, bulletins, and patches. Creating a My Oracle Support account You must register at My Oracle Support to obtain a user name and password account before you can enter the site. 1 Open a Web browser to 2 Click the Register link. 3 Follow the instructions on the registration page. Finding information and articles 1 Sign in to My Oracle Support at 2 If you know the ID number of the article you need, enter the number in the text box at the top right of any page, and then click the magnifying glass icon or press Enter. 3 To search the knowledge base, click the Knowledge tab, and then use the options on the page to search by: Product name or family. Key words or exact terms. Finding patches You can search for patches by patch ID or number, product, or family. 1 Sign in to My Oracle Support at 2 Click the Patches & Updates tab. 3 Enter your search criteria and click Search. 4 Click the patch ID number. The system displays details about the patch. You can view the Read Me file before downloading the patch. 5 Click Download, and then follow the instructions on the screen to download, save, and install the patch files. viii Oracle Health Sciences InForm Publisher On Demand 2.0

9 Secure Configuration Guide Finding Oracle documentation The Oracle website contains links to Oracle user and reference documentation. You can view or download a single document or an entire product library. Finding Oracle Health Sciences documentation For Oracle Health Sciences applications, go to the Oracle Health Sciences documentation page at Note: Always check the Oracle Health Sciences Documentation page to ensure you have the most up-to-date documentation. Finding other Oracle documentation 1 Do one of the following: Go to Go to point to the Support tab, and then click Product Documentation. 2 Scroll to the product you need, and click the link. Oracle Health Sciences InForm Publisher On Demand 2.0 ix

10 About this guide x Oracle Health Sciences InForm Publisher On Demand 2.0

11 C HAPTER 1 Security overview In this chapter Application security overview... 2 General security principles... 3 Design multiple layers of protection... 4 Oracle Health Sciences InForm Publisher On Demand 2.0 1

12 Chapter 1 Security overview Application security overview To ensure security in the InForm Publisher application, carefully configure all system components, including the following third-party components: Firewalls Load balancers Virtual Private Networks (VPNs) 2 Oracle Health Sciences InForm Publisher On Demand 2.0

13 Secure Configuration Guide General security principles Keep software up to date Keep all software versions and patches up to date. Keep up to date on the latest Critical Patch Updates Oracle continually improves its software and documentation. Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of the following months: January April July October Oracle highly recommends that customers apply these patches as soon as they are released. Configure strong passwords on the database Make sure all your passwords are strong passwords. Oracle recommends that you use a mix of uppercase and lowercase letters, numbers, and symbols. You can strengthen passwords by creating and using password policies for your organization. For guidelines on securing passwords and for additional ways to protect passwords, see the Oracle Database Security Guide specific to the database release you are using. You should modify the following passwords so that they comply with your password policies, such as a minimum length or character requirements: Passwords for the database default accounts, such as SYS and SYSTEM. Passwords for the database application-specific schema accounts. Additionally, you should not configure a password for the database listener because a configured password enables remote administration. For more information, see Removing the Listener Password in the documentation for Oracle Database Net Services Reference 11g Release 2 (11.2). For more information about configuring strong passwords, see the Security Guide for Oracle Database 11g Release 2 (11.2). Follow the principle of least privilege The principle of least privilege states that users should be given the least amount of privilege to perform their jobs. Oracle recommends reviewing user privileges periodically to determine relevance to current job responsibilities. Before executing data definition language (DDL) scripts, create a database user with the specified limited set of privileges. Do not provide users with DBA access. Oracle Health Sciences InForm Publisher On Demand 2.0 3

14 Chapter 1 Security overview Design multiple layers of protection When designing a secure deployment, design multiple layers of protection. For example, if someone were to gain unexpected access to a layer, such as the application server, the person should not automatically have access to other layers, such as the database server. Providing multiple layers of protection might include the following activities: Enabling only those ports required for communication between different tiers. For example, you can allow communication to the database tier only on the port used for SQL*NET communications (1521 by default). Placing firewalls between servers so that only expected traffic can move between servers. 4 Oracle Health Sciences InForm Publisher On Demand 2.0

15 C HAPTER 2 Secure installation and configuration In this chapter Installation overview... 6 Post-installation configuration... 8 Oracle Health Sciences InForm Publisher On Demand 2.0 5

16 Chapter 2 Secure installation and configuration Installation overview Use the information in this chapter to ensure the InForm Publisher application is installed and configured securely. For information about installing and configuring the InForm Publisher application, see the Installation Guide. Secure Sockets Layer (SSL) Configure your environment so that the InForm Publisher application servers are hosted behind a firewall and all communication through the firewall is over HTTPS. About entering passwords The InForm Publisher software and installation scripts do not contain default or hard-coded passwords. You must supply passwords for predefined users, such as Oracle database users. Installation scripts prompt for passwords on the command line or allow a file containing the passwords to be passed in as parameters. For more information, see the Installation Guide. Note: If you use password parameter files, delete the files after installation. Configure strong administrator passwords When you install the InForm Publisher service, the InForm Publisher user is created. Make sure that the password for this user is strong. Close all unused ports Keep only the minimum number of ports open. Close all ports not in use. The InForm Publisher application defaults to the following ports, but can be configured to use nonstandard ports. Port 1521 Default connection to the Oracle database. Port 80 For the client connection (HTTP). Port 443 For the client connection (HTTPS). Port 22 For the client connection (SSH for secure file transfer) Note: The InForm Publisher application does not require both Port 80 and Port 443. However, you must configure the InForm Publisher application to use either HTTP or HTTPS. Disable all unused services Disable all unused services. The InForm Publisher application uses the InForm Publisher Service. 6 Oracle Health Sciences InForm Publisher On Demand 2.0

17 Secure Configuration Guide Disable unnecessary services provided by the operating system The InForm Publisher application does not use the following services: Identification Protocol (identd). This protocol is generally used to identify the owner of a TCP connection on UNIX. Simple Network Management Protocol (SNMP). This protocol is a method for managing and reporting information about different systems. If you are not using these services for other applications, Oracle recommends that you disable these services to minimize your security exposure. If you need SMTP, identd, or SNMP for other applications, upgrade to the latest version of the protocol to provide the most up-to-date security for your system. Revoke unnecessary grants For security purposes, you must revoke all unnecessary grants on the schema. You must have DBA privileges to perform this action. Oracle Health Sciences InForm Publisher On Demand 2.0 7

18 Chapter 2 Secure installation and configuration Post-installation configuration Restrict access to the InForm Publisher server Allow only administrator and system accounts access to the InForm Publisher server. Limit the number of users with access to the server machine. Disable or delete any unnecessary users. Restrict access to the file server The InForm Publisher application can be configured to write files to a remote file server using secure file transfer protocol. Allow only administrator and system accounts access to the file server. Limit the number of users with access to the server machine. Disable or delete any unnecessary users. 8 Oracle Health Sciences InForm Publisher On Demand 2.0

19 C HAPTER 3 Security features In this chapter Data security features Oracle Health Sciences InForm Publisher On Demand 2.0 9

20 Chapter 3 Security features Data security features Restricted viewing of Protected Health Information You can configure the InForm Publisher software to write clinical data that might contain protected health information (PHI) to local directory or remote file server. For example, ODM extract files might contain PHI. You must restrict access to these locations to administrator or system users. 10 Oracle Health Sciences InForm Publisher On Demand 2.0

Primavera Portfolio Management Reporting Views for SQL Server databases

Primavera Portfolio Management Reporting Views for SQL Server databases Portfolio Management Reporting Views for SQL Server Databases 16 R1 Copyright 1999-2016, Oracle and/or its affiliates. The Programs (which include both the software and documentation) contain proprietary