Oracle SaaS applications like Oracle ERP Cloud and Oracle HCM Cloud are inherently very secure.
In a shared responsibility model, Oracle is responsible for the security of the cloud
and the application, and the customer is responsible for the data and security within that application.
If you’re adopting Oracle SAAS applications, you might need:
Active monitoring.
Visibility across all cloud applications.
Notification in case of changes within an application, such as escalation of privileges
or a role change that may lead to segregation of duties violations, or other risks.
And notification when applications are accessed in violation of access policies or anomalous
behavior patterns within your cloud-based applications.
A Cloud Access Security Broker (CASB) solution helps address these needs.
Oracle’s CASB solution protects Oracle cloud applications such as Oracle ERP Cloud and
Oracle HCM Cloud.
Oracle CASB knows more about the data model in Oracle cloud apps, and works with identity
management solutions to maximize security and remediate any abnormal activity.
It’s challenging for a security team to make sure that users across these applications
and their respective services are secure, especially if they don’t have a single pane
of glass to monitor and correlate activities across them.
With Oracle applications, that’s where Oracle CASB comes in.
We have a customer whose entire HR team was in San Francisco and the customer wanted to
be notified if anyone tried to access Oracle HCM Cloud from a different location.
Oracle CASB was perfect for this.
They set a policy so that any login to Oracle HCM Cloud from a different location than the
one permitted, San Francisco, was flagged.
So if a user logged in from New York, Oracle CASB would capture the user access information
and notify the information security team.
Customers also need to be notified when something changes within the application.
If an HR Business Partner logs into HCM Cloud and changes the role of an employee from Accounts
Payable Specialist to Accounts Payable Manager, then that would increase their privileges,
and possibly responsibilities, within other applications such as ERP Cloud.
If it’s a malicious act where the HR Business Partner’s account has been compromised,
it could allow the user to move laterally across and accumulate privileges, which may
indicate a potential attack.
Also, from an audit perspective, the resulting privileges might violate segregation of duties
(SOD) as mandated by regulations.
Without Oracle CASB, it would take the information security team a lot longer to determine the
source of the change in the ERP Cloud and track it back to the change effected in the
HCM Cloud application, which would put the system at risk.
Oracle CASB monitors changes to roles within specific applications and can send alerts
to the information security and audit teams to mitigate potential risk.
Customers also want insight into anomalous action like changes to a name, an email address,
or other PII information in cloud applications.
If an HR business partner managing a particular department routinely makes around 5 salary
changes per day to various people in that department, Oracle CASB uses machine learning
to maintain this as the baseline behavior for that user.
If there is any deviation, a risk alert is flagged to the information security team,
as a potential risk.
So if they make 10 changes in one day, an alert is sent immediately.
Given the sensitivity of critical data stored in Oracle SaaS applications, sufficient controls
have to be in place to store it securely.
Oracle CASB plays an important role in keeping your data protected.