# Oracle EBS 12.2 Security Hardening Assessment > Source: https://netray.co/tools/oracle-ebs-security-hardening-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 14 questions about patching, configuration, accounts, network and auditing to see how hardened your Oracle EBS 12.2 instance is. ## Category oracle ## Erp Oracle E-Business Suite ## Audience - EBS DBA - Security engineer - IT auditor - ERP administrator ## Tool **Kind:** assessment **Questions:** #### How current is your Critical Patch Update (CPU) level for EBS and its technology stack? **Options:** ##### 3 or more quarters behind **Score:** 0 ##### 2 quarters behind **Score:** 1 ##### 1 quarter behind **Score:** 2 ##### Current quarter applied **Score:** 3 #### Has the Secure Configuration Console been reviewed (12.2.6 and later)? **Help:** Opened by a local system administrator from the Functional Administrator responsibility. After an upgrade or ATG RUP that delivers it, user logins stay locked until an administrator reviews the checks or chooses to ignore them. **Options:** ##### Never opened, or lockdown cleared by ignoring the checks **Score:** 0 ##### Reviewed once, many critical checks still failing **Score:** 1 ##### Critical checks pass, some lower-severity checks open **Score:** 2 ##### All checks pass or have a documented exception **Score:** 3 #### Default and seeded application accounts (SYSADMIN, GUEST, demo and sample users)? **Options:** ##### Some still have default passwords **Score:** 0 ##### Passwords changed, unused seeded users still active **Score:** 1 ##### Changed and unused accounts end-dated **Score:** 2 ##### Changed, end-dated and checked every quarter in FND_USER **Score:** 3 #### Database account passwords (APPS, APPLSYS, product schemas, SYSTEM)? **Options:** ##### APPS password unchanged since install or known to many **Score:** 0 ##### Changed occasionally, by hand, outside AFPASSWD **Score:** 1 ##### Changed with AFPASSWD, no defined rotation **Score:** 2 ##### Changed with AFPASSWD on a schedule, product schemas not default **Score:** 3 #### Are Allowed Redirects and Allowed Resources enabled? **Options:** ##### Neither enabled **Score:** 0 ##### One enabled **Score:** 1 ##### Both enabled **Score:** 2 ##### Both enabled and unused resources denied **Score:** 3 #### Transport encryption? **Options:** ##### HTTP only internally **Score:** 0 ##### HTTPS on the web tier, older TLS versions still allowed **Score:** 1 ##### TLS 1.2 or later on the web tier **Score:** 2 ##### TLS 1.2 or later on the web tier and database network encryption **Score:** 3 #### External-facing modules (iSupplier Portal, iRecruitment, iStore)? **Options:** ##### Internal nodes exposed directly to the internet **Score:** 0 ##### Reverse proxy only, no dedicated external node **Score:** 1 ##### Dedicated external node in a DMZ per Oracle's DMZ configuration note **Score:** 2 ##### DMZ node, responsibilities flagged for external use only, regularly tested **Score:** 3 #### Sign-On:Audit Level profile and audit data? **Help:** Values are None, User, Responsibility and Form; data lands in FND_LOGINS and related tables. **Options:** ##### None **Score:** 0 ##### User **Score:** 1 ##### Responsibility or Form, never purged or reviewed **Score:** 2 ##### Responsibility or Form, reviewed and purged on a schedule **Score:** 3 #### Audit Trail on sensitive tables (supplier bank accounts, users, price lists)? **Options:** ##### Not used **Score:** 0 ##### Enabled once, not maintained **Score:** 1 ##### Audit groups defined and AuditTrail Update Tables run after changes **Score:** 2 ##### Maintained and reports reviewed by the business owner **Score:** 3 #### Segregation of duties review of responsibilities? **Options:** ##### Never reviewed **Score:** 0 ##### Reviewed only at audit time, manual spreadsheets **Score:** 1 ##### Annual review from FND_USER_RESP_GROUPS with conflict rules **Score:** 2 ##### Quarterly review, conflicts tracked to closure **Score:** 3 #### Custom code security (PL/SQL, OAF, JSP)? **Options:** ##### No review **Score:** 0 ##### Ad hoc review **Score:** 1 ##### Review for dynamic SQL and SQL injection on new code **Score:** 2 ##### All custom code reviewed, bind variables enforced, findings tracked **Score:** 3 #### Database auditing and monitoring? **Options:** ##### No database auditing **Score:** 0 ##### Traditional auditing on, nobody reviews it **Score:** 1 ##### Unified Auditing enabled with an EBS policy **Score:** 2 ##### Unified Auditing plus central review, for example Oracle Data Safe or a SIEM **Score:** 3 #### Direct access to the APPS schema from desktop tools? **Options:** ##### Many users and developers connect as APPS in production **Score:** 0 ##### Some support staff use APPS in production **Score:** 1 ##### APPS restricted to DBAs; read-only accounts for others **Score:** 2 ##### Named read-only accounts, APPS use logged and approved **Score:** 3 #### Network access control lists for PL/SQL network packages (UTL_HTTP, UTL_SMTP)? **Options:** ##### Not configured **Score:** 0 ##### Broad ACLs granted to APPS **Score:** 1 ##### ACLs limited to needed hosts **Score:** 2 ##### Limited ACLs reviewed with each change **Score:** 3 **Bands:** #### High risk **Min:** 0 **Max:** 40 **Verdict:** Basic controls are missing. An attacker or an over-privileged insider would find default credentials, unpatched code or unaudited access. **Recommendations:** - Apply the latest CPU for EBS, database and middleware, and plan quarterly CPU cycles - Open the Secure Configuration Console and fix every critical check - Change default application and database passwords with AFPASSWD and end-date unused seeded users - Turn on Sign-On:Audit Level and Unified Auditing so you can see what happens next #### Gaps to close **Min:** 41 **Max:** 70 **Verdict:** The basics are in place but several controls are partial. Most gaps are configuration work, not projects. **Recommendations:** - Enable Allowed Redirects and Allowed Resources and deny unused resources - Restrict APPS access and move support staff to named read-only accounts - Set up Audit Trail groups on supplier bank, user and price tables - Compare your setup with the Oracle E-Business Suite Security Guide 12.2 and the secure configuration guidance in Doc ID 403537.1 #### Hardened **Min:** 71 **Max:** 100 **Verdict:** Your instance follows most of Oracle's secure configuration guidance. Keep it current and evidence it for auditors. **Recommendations:** - Recheck the Secure Configuration Console after every CPU and ATG RUP - Automate quarterly reviews of FND_USER and FND_USER_RESP_GROUPS - Send Unified Audit and sign-on data to a central review tool - Include custom code in penetration tests and code review ## Content **Intro:** This assessment scores an Oracle E-Business Suite 12.2 instance against the main controls in Oracle's security guidance: patch currency, the Secure Configuration Console, accounts and passwords, URL protections, encryption, DMZ, auditing and access to APPS. Answer honestly, export the result and use the recommendations as a work plan. **Sections:** #### How to use it **Body:** Answer each question for production, then repeat for one non-production clone, because clones often hold copies of production data with weaker controls. The score is the percentage of the maximum possible points. Questions are weighted equally, so treat any zero on patching, default passwords or external exposure as urgent even if the total looks fine. Export the answers to give your security team and auditors a single view. **Bullets:** - 0-40: high risk - 41-70: gaps to close - 71-100: hardened, keep evidencing #### Where these controls live in EBS 12.2 **Body:** The Secure Configuration Console, delivered from 12.2.6, is opened by a local system administrator through the Functional Administrator responsibility. It runs a list of security checks, such as Allowed Resources and Allowed Redirects enabled, default application and database passwords changed and HTTPS in use, and lets you mark each one as fixed or accepted. When it is first delivered, the system stays locked for normal users until a local administrator signs in through AppsLocalLogin.jsp and resolves, accepts or ignores the checks. Allowed Redirects and Allowed Resources are documented in the Oracle Application Object Library Security chapter of the Security Guide. Sign-on audit data is controlled by the Sign-On:Audit Level profile and purged with the Purge Signon Audit data program. #### Tables auditors ask about **Body:** FND_USER holds application users with start and end dates. FND_USER_RESP_GROUPS (a view over direct and indirect assignments) shows which responsibilities each user holds, the basis for segregation of duties reviews. FND_LOGINS and FND_LOGIN_RESPONSIBILITIES store sign-on audit records. For row-level change history on business tables, EBS AuditTrail writes shadow tables once you define audit groups and run AuditTrail Update Tables. **Bullets:** - FND_USER: who exists, who is end-dated - FND_USER_RESP_GROUPS: who can do what - FND_LOGINS: who signed on and when #### Common mistakes **Body:** Choosing to ignore the Secure Configuration Console checks to get past lockdown and never coming back. Changing the APPS password with ALTER USER instead of AFPASSWD, which breaks the instance. Enabling Allowed Resources in production before testing custom pages in a clone. Turning on sign-on auditing at Form level without a purge schedule, so FND_LOGINS grows without bound. And forgetting that clones need the same controls once production data is copied in. **Cta:** If you want auditors and admins to query EBS user and access data in plain English on your own servers, we can set up a read-only assistant for that. **Faq:** #### Where is the Oracle EBS 12.2 security guide? **Answer:** Oracle publishes the Oracle E-Business Suite Security Guide for Release 12.2 on docs.oracle.com. It covers Application Object Library security (including Allowed Redirects and Allowed Resources), auditing and sign-on audit, and the Secure Configuration Console. My Oracle Support also carries secure configuration guidance for Release 12 (Doc ID 403537.1). #### How do I enable audit trail in Oracle EBS? **Answer:** Set the AuditTrail:Activate profile, enable auditing for the application in Audit Installations, define an audit group with the tables and columns to track, then run the AuditTrail Update Tables concurrent program to create the shadow tables and triggers. Rerun it after any change to the audit group. #### Which tables hold EBS user security data? **Answer:** FND_USER for application users, FND_USER_RESP_GROUPS for user to responsibility assignments, FND_RESPONSIBILITY and FND_RESPONSIBILITY_TL for responsibility definitions, and FND_LOGINS with FND_LOGIN_RESPONSIBILITIES for sign-on audit records, depending on the Sign-On:Audit Level profile value. #### Can Oracle Data Safe be used with EBS 12.2? **Answer:** Oracle Data Safe can register on-premises Oracle databases through its on-premises connector, so the EBS database can be assessed for configuration, users and auditing. It works at the database level; application-level controls such as responsibilities and Allowed Resources are still managed inside EBS. ## Search terms oracle ebs security guide, oracle ebs security issue, oracle ebs audit trail, oracle data safe for ebs 12.2, security table in oracle ebs, oracle ebs secure configuration console, oracle ebs allowed resources --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json