Remerciez-le!

Remerciez @Admin pour avoir partagé cet document gratuitement, de la manière la plus simple, en partageant sur les réseaux sociaux.

Oracle® Fusion Applications Security Guide 11g Release 7 (11.1.7) Part Number E

Oracle® Fusion Applications Security Guide 11g Release 7 (11.1.7) Part Number E16689-07 March 2013 Oracle® Fusion Applications Security Guide Part Number E16689-07 Copyright © 2011-2013, Oracle and/or its affiliates. All rights reserved. Author: Tina Brand Contributor: Mahesh Sabapathy This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Contents 1 Introduction Security: Overview ........................................................................................................... 1-1 Oracle Fusion Applications Security Business Fit: Explained ........................................... 1-5 Security: Information Roadmap ........................................................................................1-5 Differences in Security Terminology: Explained ............................................................... 1-9 FAQs for Security Introduction .......................................................................................1-10 2 Security T asks Security Tasks: Highlights ................................................................................................ 2-1 Security Tasks and Oracle Fusion Applications: How They Fit Together ..........................2-4 Security Setup Tasks: How They Fit Together .................................................................. 2-7 Getting Started with an Implementation: Overview .......................................................2-10 Initial Security Administration: Critical Choices ............................................................ 2-11 Initial Security Administration: Worked Example .......................................................... 2-13 Defining Security After Enterprise Setup: Points to Consider .........................................2-17 Defining Data Security After Enterprise Setup: Points to Consider ................................ 2-21 Defining Trading Partner Security After Enterprise Setup: Points to Consider ............... 2-23 Security Tasks After Enterprise Changes: Points To Consider ........................................ 2-24 Top Security Tasks .......................................................................................................... 2-25 FAQs for Security Tasks ..................................................................................................2-27 3 Security Infrastructure Security Components: How They Fit Together .................................................................3-1 Access Components: Explained ........................................................................................ 3-5 Regulatory Frameworks in Oracle Fusion Applications Security: How They Are Applied ...................................................................................................................................................3-7 Security Standards: How They Are Applied .................................................................... 3-8 Security Principles: How They Are Applied .....................................................................3-9 Security Products: How They Are Applied .................................................................... 3-12 Security Processes: How They Are Applied ................................................................... 3-15 Secured Oracle Fusion Applications Deployments: Points To Consider ..........................3-18 4 Role-Based Access Control Role-Based Access Control: Explained ..............................................................................4-1 Role Types : How They Fit Together .................................................................................4-5 5 Function Security Function Security: Explained ............................................................................................5-1 Securing Functions: Points to Consider ............................................................................ 5-1 FAQs for Role Based Access Control ................................................................................5-3 6 Data Security Data Security: Explained .................................................................................................. 6-1 Database Resources and Data Security Policies: How They Work Together ......................6-4 Securing Data Access: Points to Consider ........................................................................ 6-6 Data Role Templates: Explained ....................................................................................... 6-7 7 Privacy Privacy: Explained ............................................................................................................ 7-1 Personally Identifiable Information: How It Is Processed .................................................7-5 Privacy Safeguards: Points To Consider ........................................................................... 7-9 Privacy Breach Prevention and Recovery: Points To Consider ........................................7-10 FAQs for Privacy ............................................................................................................ 7-11 8 Enforcem ent Across T ools, T echnologies, Data T ransform ations, and Access Methods Enforcement Across Tools, Technologies, Data Transformations, and Access Methods: Explained .............................................................................................................................. 8-1 Enforcement Across Tools and Technologies: Points to Consider ..................................... 8-3 Security Across Access Methods: How It Is Enforced .......................................................8-9 Enforcement of Security Policies: Points To Consider .....................................................8-12 9 Segregation of Duties Segregation of Duties: Explained ......................................................................................9-1 Defining Segregation of Duties Policies: Points To Consider ............................................ 9-2 Managing Segregation of Duties Risks and Violations: Critical Choices ........................... 9-4 10 Identity M anagem ent and Access Provisioning Identity Management and Access Provisioning: Explained ............................................ 10-1 Securing Identities and Users: Points To Consider ......................................................... 10-3 Provisioning Access: Points To Consider ........................................................................10-6 Role Provisioning and Segregation of Duties: How They Work Together ....................... 10-8 11 Security Reference Im plem entation Scope of the Security Reference Implementation: Explained .......................................... 11-1 Role Types in the Security Reference Implementation: Explained .................................. 11-3 Function Security in the Security Reference Implementation: Explained ........................ 11-5 Data Security in the Security Reference Implementation: Explained .............................. 11-7 Segregation of Duties in the Security Reference Implementation: Explained .................. 11-8 Extending the Security Reference Implementation: Critical Choices .............................11-10 FAQs for Security Reference Implementation ...............................................................11-13 12 Enforcem ent Across the Inform ation Life Cycle Secure Information Life Cycle: Explained .......................................................................12-1 Types of Sensitive Data: Explained .................................................................................12-3 Protecting Sensitive Data: Points To Consider ................................................................ 12-5 Preface This Preface introduces the guides, online help, and other information sources available to help you more effectively use Oracle Fusion Applications. Oracle Fusion Applications Help You can access Oracle Fusion Applications Help for the current page, section, activity, or task by clicking the help icon. The following figure depicts the help icon. You can add custom help files to replace or supplement the provided content. Each release update includes new help content to ensure you have access to the latest information. Patching does not affect your custom help content. Oracle Fusion Applications Guides Oracle Fusion Applications guides are a structured collection of the help topics, examples, and FAQs from the help system packaged for easy download and offline reference, and sequenced to facilitate learning. You can access the guides from the Guides menu in the global area at the top of Oracle Fusion Applications Help pages. Guides are designed for specific audiences: • User Guides address the tasks in one or more business processes. They are intended for users who perform these tasks, and managers looking for an overview of the business processes. They are organized by the business process activities and tasks. • Implementation Guides address the tasks required to set up an offering, or selected features of an offering. They are intended for implementors. They are organized to follow the task list sequence of the offerings, as displayed within the Setup and Maintenance work area provided by Oracle Fusion Functional Setup Manager. • Concept Guides explain the key concepts and decisions for a specific area of functionality. They are intended for decision makers, such as chief financial officers, financial analysts, and implementation consultants. They are organized by the logical flow of features and functions. • Security Reference Manuals describe the predefined data that is included in the security reference implementation for one offering. They are intended for implementors, security administrators, and auditors. They are organized by role. These guides cover specific business processes and offerings. Common areas are addressed in the guides listed in the following table. Guide Intended Audience Purpose Common User Guide All users Explains tasks performed by most users. Common Implementation Guide Implementors Explains tasks within the Define Common Applications Configuration task list, which is included in all offerings. Functional Setup Manager User Guide Implementors Explains how to use Oracle Fusion Functional Setup Manager to plan, manage, and track your implementation projects, migrate setup data, and validate implementations. Technical Guides System administrators, application developers, and technical members of implementation teams Explain how to install, patch, administer, and customize Oracle Fusion Applications. Note Limited content applicable to Oracle Cloud implementations. For guides that are not available from the Guides menu, go to Oracle Technology Network at http://www.oracle.com/technetwork/indexes/documentation. Other Inform ation Sources My Oracle Support Oracle customers have uploads/Geographie/ fusion-applications-security-guide.pdf