Skip Headers
Oracle® Health Sciences Clinical Development Analytics Secure Installation and Configuration Guide
Release 2.2 for Standard Configuration
E25025-04
Go to Documentation Home
Home		 Go to Book List
Book List		 Go to Table of Contents
Contents		 Go to Index
Index		 Go to Feedback page
Contact Us
Go to previous page
Previous		 Go to next page
Next
PDF · Mobi · ePub

1 Before You Begin

This section presents an overview of the Oracle Health Sciences Clinical Development Analytics (OHSCDA) requirements. It also describes the tasks that you must complete before you can install the application.

This chapter includes the following section:

1.1 Technology Stack and System Requirements

The requisite technology stack for OHSCDA configuration is provided in the media pack, with the exception of Informatica. It consists of the following products:

Table 1-1 System Requirements References

Product Reference

Oracle Database 11.2.0.3

Database Installation Guide for <platform>

Oracle WebLogic Server 10.3.5

Oracle WebLogic Server Documentation Library

Oracle Business Intelligence Enterprise Edition (OBIEE) 11.1.1.6 and patches 14538078, 14538128, 14285344, 14538164, 14415773, 14405222, and 14409674.

System Requirements and Supported Platforms for Oracle Business Intelligence Suite Enterprise Edition

Oracle Business Intelligence Infrastructure Installation and Configuration Guide

Oracle Business Intelligence Data Warehouse Administration Console 10.1.3.4.1 and patch 14306642

Oracle Business Intelligence Data Warehouse Administration Console Installation, Configuration, and Upgrade Guide

Data Warehouse Administration Console User's Guide

Informatica PowerCenter 9.0.1 HotFix 2

Informatica PowerCenter Installation Guide

Oracle Healthcare Master Person Index 1.1.2 patch 12735093

Oracle Healthcare Master Person Index Documentation Library

Other Technology Stack Components

My Oracle Support / Certifications

Note:

It is important to get the technology stack products from the OHSCDA media pack because newer versions of the technology stack products may have become available but may not be compatible with OHSCDA.

Installation Considerations

Figure 1-1 Oracle Health Sciences Clinical Development Analytics Technology for Standard Configuration

Description of Figure 1-1 follows
Description of "Figure 1-1 Oracle Health Sciences Clinical Development Analytics Technology for Standard Configuration"

For more information about certifications, refer to Finding Certification Information.

1.1.1 Supported Browsers

OHSCDA supports those Internet browsers supported by OBIEE. For a list of the browsers supported by OBIEE, refer to Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition11g Release 1 (11.1.1).

1.1.2 Source Systems

CDA is designed to extract data from the following two systems:

  1. OC 4.5.0.23 or higher

  2. SC 8.0.x or 8.1.1.

1.2 General Security Principles

The following principles are fundamental to using any application securely.

1.2.1 Keep Software Up To Date

One of the principles of good security practice is to keep all software versions and patches up to date.

1.2.2 Keep Up To Date on Latest Security Information Critical Patch Updates

Oracle continually improves its software and documentation. Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of January, April, July and October. We highly recommend customers apply these patches as soon as they are released.

1.2.3 Configure Strong Passwords on the Database

Although the importance of passwords is well known, the following basic rule of security management is worth repeating:

Ensure all passwords are strong passwords.

You can strengthen passwords by creating and using password policies for your organization. For guidelines on securing passwords and for additional ways to protect passwords, refer to the Oracle® Database Security Guide specific to the database release you are using.

You should modify the following passwords to use your policy-compliant strings:

  • Passwords for the database default accounts, such as SYS and SYSTEM.

  • Passwords for the database application-specific schema accounts, such as RXI.

  • The password for the database listener. Oracle recommends that you do not configure a password for the database listener as that will enable remote administration. For more information, refer to Oracle® Database Net Services Reference 11g Release 2 (11.2)

1.2.4 Follow the Principle of Least Privilege

The principle of least privilege states that users should be given the least amount of privilege to perform their jobs. Overly ambitious granting of responsibilities, roles, grants — especially early on in an organization's life cycle when people are few and work needs to be done quickly — often leaves a system wide open for abuse. User privileges should be reviewed periodically to determine relevance to current job responsibilities.

1.2.5 Managing Default User Accounts

Lock and expire default user accounts.

1.2.6 Closing All Open Ports Not in Use

Keep only the minimum number of ports open. You should close all ports not in use.

1.2.7 Disabling the Telnet Service

Oracle Health Sciences Clinical Development Analytics Standard Configuration does not use the Telnet service.

Telnet listens on port 23 by default.

If the Telnet service is available on any computer, Oracle recommends that you disable Telnet in favor of Secure Shell (SSH). Telnet, which sends clear-text passwords and user names through a log-in, is a security risk to your servers. Disabling Telnet tightens and protects your system security.

1.2.8 Disabling Other Unused Services

In addition to not using Telnet, the Oracle Health Sciences Clinical Development Analytics Standard Configuration does not use the following services or information for any functionality:

  • Simple Mail Transfer Protocol (SMTP): This protocol is an Internet standard for E-mail transmission across Internet Protocol (IP) networks.

  • Identification Protocol (identd): This protocol is generally used to identify the owner of a TCP connection on UNIX.

  • Simple Network Management Protocol (SNMP): This protocol is a method for managing and reporting information about different systems.

Restricting these services or information does not affect the use of Oracle Health Sciences Clinical Development Analytics Standard Configuration. If you are not using these services for other applications, Oracle recommends that you disable these services to minimize your security exposure. If you need SMTP, identd, or SNMP for other applications, be sure to upgrade to the latest version of the protocol to provide the most up-to-date security for your system.

1.2.9 Designing for Multiple Layers of Protection

When designing a secure deployment, design multiple layers of protection. If a hacker should gain access to one layer, such as the application server, that should not automatically give them easy access to other layers, such as the database server.

Providing multiple layers of protection may include:

  • Enable only those ports required for communication between different tiers, for example, only allowing communication to the database tier on the port used for SQL*NET communications (1521 by default).

  • Place firewalls between servers so that only expected traffic can move between servers.

1.2.10 Enabling SSL

Due to the complexity in setting up SSL it is not enabled by default during installation. Communications between the browser and the application servers should be restricted to SSL. See the Oracle WebLogic Server 11g guidelines for instructions on enabling SSL.

1.3 Security Guidelines for Oracle Business Intelligence Data Warehouse Administration Console

While installing and configuring the DAC Server, follow the guidelines documented in Oracle Business Intelligence Data Warehouse Administration Console Installation, Configuration, and Upgrade Guide.

The OHSCDA DAC metadata consists of DAC Repository which must be deployed on the DAC Server.

After deploying the DAC Repository, make sure all connection configurations are altered as described in the DAC Installation Guide to point to the customer database connection parameters.

The DAC Repository contains only metadata for OHSCDA Informatica ETLs. The metadata is used within the context of the DAC Server. Follow the security guidelines applicable to the DAC Server while importing the metadata.

1.4 Security Guidelines for Oracle Healthcare Master Person Index

While installing and configuring OHMPI, follow the guidelines documented in Oracle Healthcare Master Person Index Installation Guide.

OHSCDA need to store the OHMPI username and password that is needed to set Context and call the OHMPI EJB during incremental dedup ETL execution. This user name and password is encrypted and stored in secret store wallet files. Key management is built in using a Java program, eliminating the complex task of creating, managing, and securing information.

Java program code in Informatica Java transformation is used to retrieve the password during incremental OHMPI program executions which are then used for setting context and executing the OHMPI EJB. These programs are executed with the privileges of Informatica OS user which works implicitly granting access to restricted folders and wallet files in them.

Note:

During the installation, the folder and Wallet files within are given restricted access at Operating System privileges; this is key technique by which OHSCDA secures the user_id and password.

While importing and setting up OHSCDA's OHMPI projects, follow the guidelines documented in OHMPI documents.

The OHSCDA's OHMPI metadata consists of 15 OHMPI projects which are zipped into individual files. Ensure that only an Administrator is given access to these files.

After importing the projects, make sure that the data source connection, JMS Servers, and JMS Topics are created in Oracle WebLogic Server console and the user created in Oracle WebLogic Server is assigned to MasterIndex.Admin group.

1.5 Security Guidelines for Oracle Business Intelligence Enterprise Edition

While installing and configuring the OBIEE Server, you should follow guidelines in the document Oracle® Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition 11g Release 1 (11.1.1)Part Number E10543-02.

1.5.1 Checking External Links that May Expose Account Data

It is possible to add customized links to web applications that are deployed in a web server. Through this mechanism, any information that can be made available through a URL can be made accessible to OHSCDA users. In addition, your customized links may support passing session parameters, such as the log-in user ID, and currently selected Product, Program, Study and Site to a URL. By passing these session parameters, you can access Web pages specific to you current selections on these attributes. However, you should be aware that in links that access external Web sites, passing account data and session information may pose a security risk.

1.6 Installing the Prerequisite Software

Following is a sample topology of technology components for OHSCDA:

Figure 1-2 Sample Topology

Description of Figure 1-2 follows
Description of "Figure 1-2 Sample Topology"

Before you can install the OHSCDA application, you must complete the following pre-installation tasks:

Note:

Oracle recommends that you enable HTTPS on middle-tier computers that are hosting the Web services, since otherwise the trusted user name and password that are passed can be intercepted.
Go to previous page
Previous		 Go to next page
Next
Go to Documentation Home
Home		 Go to Book List
Book List		 Go to Table of Contents
Contents		 Go to Index
Index		 Go to Feedback page
Contact Us