PeopleSoft Technology Blog

Do you have a great enhancement idea for PeopleTools? If so, PeopleTools wants to hear it. We are looking to gather as many great ideas as possible and let you, the customer, tell us what the best ideas are. So if you have a great idea, please join the PeopleTools Strategy group on Oracle Mix at https://mix.oracle.com/groups/18611 and enter your idea so that others can review it and vote on which ones are the best. If you feel your idea is not ready to be voted on or if you would like us to submit it on your behalf, even anonymously, please email your idea to peopletools_ww@oracle.com.

The best ideas will be discussed in the "Got Enhancements for PeopleTools" OOW session scheduled for Wednesday, October 14th from 1:00 - 1:30 PM.

Update on "Got PeopleTools enhancements?" posting

You may have seen that we are looking to gather as many great ideas as possible and let you, the customer/partner/consultant, tell us what the best ideas are. So if you have a great idea, please join the PeopleTools Strategy group on Oracle Mix at https://mix.oracle.com/groups/18611? and enter your idea so that others can review it and vote on which ones are the best. If you feel your idea is not ready to be voted on or if you would like us to submit it on your behalf, even anonymously, please email your idea to peopletools_ww@oracle.com.

The best ideas will be discussed in the "Got Enhancements for PeopleTools" OOW session scheduled for Wednesday, October 14th from 1:00 - 1:30 PM.

Check out the ideas, vote on those you like or suggest your own.

Some more great news: PeopleSoft HRMS 9.1 is now generally available. Customers can start downloading it from the Oracle Electronic Product Delivery (EPD) site now. Physical shipment delivery will be available on October 1.

There are numerous activities are planned for the upcoming HR Tech and Open World conferences.

To find out more, check out the following site:

• PeopleSoft HCM 9.1 Documentation Home Page on My Oracle Support here

also ...

Check out the PeopleSoft Information Portal
The PeopleSoft Enterprise Information Portal provides customers with a single entry point to locate the documentation, training, and other useful information they need to help with their implementation process and improve their daily experience with our products.
PeopleSoft Enterprise software offers many information solutions to help our customers succeed. By using our popular PeopleSoft Enterprise Information Solution data sheets, customers can easily access information and links to PeopleBooks, Documentation Updates, Instructor-Led Training, Online Classes, User Productivity Kits (UPK), Self-Study CDs, Certification Programs, and other helpful information.

Historically we had the view that properly configured firewalls and proxies would protect against intrusion. As direct attacks became more prevalent, technologies like Intrusion Protection Systems and Intrusion Detection Systems were introduced. However, as more and more "threat unaware" users are provided with access internally, the perimeter is disappearing. People take the work laptops home or on engagements and, without other controls, there is no limit on the sites they can access outside the corporate domain. In many cases people inside the domain have access to the Internet to "help" them work more efficiently. People are also using multiple email services. If you consider that after nearly 20 years of media coverage, people are still being caught by the 419, advance fee fraud, scams. In the corporate environment, even with constant internal notification, users will click on links they shouldn't, or visit those too good to be true malware sites, for example, "Turn your CD drive into a DVD burner and copy DVDs with this free software!" People have also learned to click the "Accept" or "OK" button on security or certificate notices without understanding the impact, other than they can keep going.

What is happening is that the owner of the malware site uploads the code after the browser user clicks "OK". This code can be binary that runs as a service or every time the workstation is started or BHO to run in every browser session. Once the code is running, it calls out to the malware site owners site on a "safe" port like 80 which is generally open outbound on most protected sites. This connection to port 80 opens a session for the malware site owner to control the target system which is inside the firewall and so the malware site owner can either automatically or manually upload additional code without the browser user being aware. The malware site owner also has the capability to scan the rest of the systems inside the firewall for other unprotected or susceptible systems.

This view of security compromise is known as de-perimeterization. The Jericho Forum from the Open Group has created awareness around this http://www.opengroup.org/jericho/deperim.htm
"... today's traditional approaches to securing a network boundary are at best flawed, and at worst ineffective"

This is a recent blog entry I posted - http://blogs.oracle.com/peopletools/2009/02/the_insidious_threat_the_hacke.html

Note: I do not have the link to the "Turn your CD drive into a DVD burner and copy DVDs with this free software!" site!

Additional References
PeopleSoft Enterprise supports Oracle 9i [and above] Advanced Security Option
https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=763255.1
"... PeopleSoft is pleased to announce that PeopleSoft Enterprise now supports Oracle 9i Advanced Security Option (ASO). We have had numerous requests from customers for this support and have recently completed the testing necessary for us to certify the use of ASO with Enterprise applications. Customers interested in using ASO can do so with any version of PeopleTools that supports Oracle 9i (PT 8.1x, PT 8.2x, and PT 8.4x)."

Oracle Database Security Checklist
http://www.oracle.com/technology/deploy/security/database-security/pdf/twp_security_checklist_database.pdf

Project Lockdown - A phased approach to securing your database infrastructure
http://www.oracle.com/technology/pub/articles/project_lockdown/project-lockdown.pdf

Oracle Adaptive Access Manager
http://www.oracle.com/technology/products/id_mgmt/oaam/pdf/wp_oaam.pdf