OracleFree assessmentPDF, Excel, Word exportOracle E-Business SuiteAll Oracle E-Business Suite tools

Oracle EBS 12.2 Security Hardening Assessment

This assessment scores an Oracle E-Business Suite 12.2 instance against the main controls in Oracle's security guidance: patch currency, the Secure Configuration Console, accounts and passwords, URL protections, encryption, DMZ, auditing and access to APPS. Answer honestly, export the result and use the recommendations as a work plan.

0 of 14 answered0%

1. How current is your Critical Patch Update (CPU) level for EBS and its technology stack?

2. Has the Secure Configuration Console been reviewed (12.2.6 and later)?

Opened by a local system administrator from the Functional Administrator responsibility. After an upgrade or ATG RUP that delivers it, user logins stay locked until an administrator reviews the checks or chooses to ignore them.

3. Default and seeded application accounts (SYSADMIN, GUEST, demo and sample users)?

4. Database account passwords (APPS, APPLSYS, product schemas, SYSTEM)?

5. Are Allowed Redirects and Allowed Resources enabled?

6. Transport encryption?

7. External-facing modules (iSupplier Portal, iRecruitment, iStore)?

8. Sign-On:Audit Level profile and audit data?

Values are None, User, Responsibility and Form; data lands in FND_LOGINS and related tables.

9. Audit Trail on sensitive tables (supplier bank accounts, users, price lists)?

10. Segregation of duties review of responsibilities?

11. Custom code security (PL/SQL, OAF, JSP)?

12. Database auditing and monitoring?

13. Direct access to the APPS schema from desktop tools?

14. Network access control lists for PL/SQL network packages (UTL_HTTP, UTL_SMTP)?

Was this tool useful?

How to use it

Answer each question for production, then repeat for one non-production clone, because clones often hold copies of production data with weaker controls. The score is the percentage of the maximum possible points. Questions are weighted equally, so treat any zero on patching, default passwords or external exposure as urgent even if the total looks fine. Export the answers to give your security team and auditors a single view.

0-40: high risk
41-70: gaps to close
71-100: hardened, keep evidencing

Where these controls live in EBS 12.2

The Secure Configuration Console, delivered from 12.2.6, is opened by a local system administrator through the Functional Administrator responsibility. It runs a list of security checks, such as Allowed Resources and Allowed Redirects enabled, default application and database passwords changed and HTTPS in use, and lets you mark each one as fixed or accepted. When it is first delivered, the system stays locked for normal users until a local administrator signs in through AppsLocalLogin.jsp and resolves, accepts or ignores the checks. Allowed Redirects and Allowed Resources are documented in the Oracle Application Object Library Security chapter of the Security Guide. Sign-on audit data is controlled by the Sign-On:Audit Level profile and purged with the Purge Signon Audit data program.

Tables auditors ask about

FND_USER holds application users with start and end dates. FND_USER_RESP_GROUPS (a view over direct and indirect assignments) shows which responsibilities each user holds, the basis for segregation of duties reviews. FND_LOGINS and FND_LOGIN_RESPONSIBILITIES store sign-on audit records. For row-level change history on business tables, EBS AuditTrail writes shadow tables once you define audit groups and run AuditTrail Update Tables.

FND_USER: who exists, who is end-dated
FND_USER_RESP_GROUPS: who can do what
FND_LOGINS: who signed on and when

Common mistakes

Choosing to ignore the Secure Configuration Console checks to get past lockdown and never coming back. Changing the APPS password with ALTER USER instead of AFPASSWD, which breaks the instance. Enabling Allowed Resources in production before testing custom pages in a clone. Turning on sign-on auditing at Form level without a purge schedule, so FND_LOGINS grows without bound. And forgetting that clones need the same controls once production data is copied in.

Frequently Asked Questions

Where is the Oracle EBS 12.2 security guide?

Oracle publishes the Oracle E-Business Suite Security Guide for Release 12.2 on docs.oracle.com. It covers Application Object Library security (including Allowed Redirects and Allowed Resources), auditing and sign-on audit, and the Secure Configuration Console. My Oracle Support also carries secure configuration guidance for Release 12 (Doc ID 403537.1).

How do I enable audit trail in Oracle EBS?

Set the AuditTrail:Activate profile, enable auditing for the application in Audit Installations, define an audit group with the tables and columns to track, then run the AuditTrail Update Tables concurrent program to create the shadow tables and triggers. Rerun it after any change to the audit group.

Which tables hold EBS user security data?

FND_USER for application users, FND_USER_RESP_GROUPS for user to responsibility assignments, FND_RESPONSIBILITY and FND_RESPONSIBILITY_TL for responsibility definitions, and FND_LOGINS with FND_LOGIN_RESPONSIBILITIES for sign-on audit records, depending on the Sign-On:Audit Level profile value.

Can Oracle Data Safe be used with EBS 12.2?

Oracle Data Safe can register on-premises Oracle databases through its on-premises connector, so the EBS database can be assessed for configuration, users and auditing. It works at the database level; application-level controls such as responsibilities and Allowed Resources are still managed inside EBS.

If you want auditors and admins to query EBS user and access data in plain English on your own servers, we can set up a read-only assistant for that.

Talk to an Expert Explore More Free Tools