Recent Posts by David B. Cross

This week we wanted to share how Oracle’s SaaS Cloud Security (SCS) organization is always prepared to support our customers and provide reliable continuity of service. Service continuity is a key pillar of Oracle’s SaaS Cloud Security Services. Our SCS organization uses a formal Risk Management Resiliency Program to maintain a comprehensive business continuity management (BCM) framework to protect Oracle employees and business operations.  A few critical aspects of our BCM...

In this post, I want to compare the value and detection results of antivirus endpoint agents in datacenters, server systems, and SaaS environments to that of other security detection tools and techniques. Some people claim antivirus is only used and installed to meet audit and compliance requirements for certifications. At Oracle, the SaaS Cloud Security (SCS) team believes antivirus tools provide a necessary, clear defense in depth solution in SaaS environments. If you’ve...

This week, I have a contributing guest author, Kris Hatlelid, Vice President, SaaS Cloud Security engineering. How well would your organization fare in the face of a full-blown cyber attack? If that question makes your palms sweat and your eyes shift, read on for some lessons we’ve learned at Oracle about penetration testing and red teams. Different approaches, different results Penetration testing involves discovering as many vulnerabilities and misconfigurations as possible in...

We strive to build security into our applications and services in every phase of the DevSecOps engineering cycle. In this post, I want to address how the distributed engineering teams and the central security teams can join forces in the testing phase. I also want to discuss the advantage of their combined efforts in the DevSecOps model shown below. DevSecOps Model Distributed applications security testing In the Oracle Cloud SaaS infrastructure, security QA testing of our...

Many people ask, “what should the detection baseline be in a cloud-based security analytics system?" The industry standard is to use the MITRE ATT&CK enterprise matrix. The MITRE ATT&CK matrix is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It is a highly accepted and always evolving matrix that enables all enterprises and cloud providers to constantly evaluate their threat models, tools, and processes against the...

Our guest authors this week are Chirag Andani, Oracle SaaS Security Services, Vice President, and Atul Goyal, Oracle Identity Cloud Service, Sr Principal Product Manager. Secure your deployment of Oracle Fusion SaaS You might be among the thousands of Oracle application customers who are embarking on a journey of cloud transformation by rapidly adopting Oracle Fusion SaaS for HCM, ERP, Sales, CRM and Marketing business processes. Mobile devices and the cloud platform have...

I would like to share the unique advantages of building a zero-trust environment and a trusted applications environment when you have control of the entire stack.  Let’s discuss what are some of the unique advantages of using a building and managing an application stack on a tightly controlled platform.   In the Oracle SaaS Cloud, and as I shared at my session at Oracle OpenWorld, we take a “defense in depth” approach in building, deploying, and managing our SaaS applications....

I’m sure everyone is aware of how cyber security in the cloud is a constant battle and attackers are continuously becoming more sophisticated and agile in their techniques. However, operating and innovating the security infrastructure in a cloud environment is an advantage that next-generation cloud providers have in the fast-moving business environment. Collection, detection, and alerting are standard pillars in the cloud security infrastructure baselines, but I would like...

This week is Oracle OpenWorld in San Francisco, and I am personally quite excited to be speaking for the first time about how we build Oracle SaaS in a zero-trust cloud environment. It’s common knowledge that organizations are storing and using more business-critical data in the cloud than ever before. The rapid shift to cloud has naturally driven the need for a new approach in monitoring, not only for the threats of external attackers, but also for the risk of a known user...