Security
Executive Summary
Oracle Government Orchestration Service (GovOS) applies security practices throughout software development, deployment, and service operations. These practices address the following areas:
- Secure Product Engineering
- Secure Deployment
- Secure Management
- Assessment and Audit
- Data Protection and Privacy
- Incident Response and Recovery
1. Secure Product Engineering
Security Development Lifecycle
GovOS development follows a Security Development Lifecycle (SDL) that incorporates security into each phase of development. Developers complete security training and follow secure coding standards before contributing to production systems.
OSCS scans third-party dependencies for known vulnerabilities.
Application Security Architecture
The application uses layered security controls across its technology stack:
- A Web Application Firewall (WAF) filters malicious traffic before it reaches application servers.
- An API Gateway enforces authentication, authorization, and rate limiting for all API endpoints.
- Application servers operate with minimal privileges and are hardened against security baselines.
- OCI Vault stores credentials and tokens.
Secure Coding Standards
Application code follows secure coding standards based on OWASP guidance and industry practices. These standards include:
- Managed credentials for access to external data sources.
- Industry-standard authentication and authorization protocols.
- Secure session tokens and appropriate session timeouts.
2. Secure Deployment
Infrastructure Security
Deployment infrastructure follows a zero-trust security model with multiple layers of protection. Infrastructure-as-code templates include security controls and undergo security review before deployment. Administrative access uses bastion hosts with session recording and monitoring.
Pipeline Security Controls
The continuous integration and continuous delivery (CI/CD) pipeline includes the following controls:
- Multi-factor authentication and branch protection restrict source repository access.
- Build environments are isolated and ephemeral, without persistent sensitive data.
- Security scanning is part of the build, with automatic failure for critical vulnerabilities.
- Deployment automation uses service accounts with only the privileges they require.
- Infrastructure changes require change-management approval.
- Post-deployment checks validate security configuration and perform smoke testing.
3. Secure Management
Standard Operating Procedures
Security-focused Standard Operating Procedures (SOPs) govern the tasks Oracle personnel perform when delivering GovOS services. SOPs are maintained centrally and are available to authorized personnel through Oracle’s intranet on a need-to-know basis.
SOPs are reviewed and updated regularly. Personnel complete relevant training and acknowledge the procedures before receiving access to systems or data.
Security Information and Event Management
Network devices, servers, operating systems, applications, and databases are configured for auditing and logging. Logs are forwarded to a Security Information and Event Management (SIEM) system managed by Security Engineering and monitored by Security Operations 24 hours a day, seven days a week.
The SIEM alerts Security Operations to potentially suspicious conditions for investigation. Log access is restricted to designated security administrators and operations personnel. Security-relevant logs are retained for at least one year; critical security logs can be retained for up to seven years for investigation and compliance purposes.
Identity and Access Management
Identity and Access Management (IAM) provides authentication and authorization at multiple layers through:
- A centralized identity provider with single sign-on (SSO).
- Role-based access control (RBAC) aligned with job functions and business requirements.
- Attribute-based access control (ABAC) using user, resource, and environmental attributes.
- Privileged access management (PAM) with session recording, approval workflows, and just-in-time provisioning.
Data Classification and Handling
Information is handled according to Oracle security protocols and the following classifications:
| Classification | Treatment |
|---|---|
| Public | Information intended for public use, without access restrictions. |
| Internal | Internal-use information protected by access controls and employee confidentiality requirements. |
| Confidential | Sensitive business information requiring enhanced protection and restricted access. |
| Restricted | Highly sensitive information, including personal and financial data and trade secrets, requiring maximum security controls. |
GovOS minimizes the personal information it stores. Where personal information is present, data minimization, access, and deletion processes support privacy requirements. Stored data is encrypted, and data in transit is protected using TLS.
The Oracle Cloud Hosting and Delivery Policies are available through Oracle Cloud Service Contracts.
Physical Security
Hosting facilities use physical and environmental safeguards to protect equipment, systems, and personnel. Governance controls limit who can access systems. Further information about physical safeguards is provided in the Oracle Cloud Hosting and Delivery Policies, available through Oracle Cloud Service Contracts.
4. Assessment and Audit
Oracle Cloud security practices follow the ISO/IEC 27002 Codes of Practice for Information Security Controls. Third-party audit reports and compliance letters for Oracle Cloud Services are published periodically.
Applicable policy and contract documents are available through Oracle Cloud Service Contracts.
5. Data Protection and Privacy
Data Protection
Technical and organizational controls protect personal data throughout its lifecycle. Processing activities are documented and assessed for their privacy impact. Controls include:
- Collecting only the personal data needed for legitimate business purposes.
- Restricting use to the original collection purpose unless consent is obtained.
- Using automated tools to discover and classify personal data.
- Managing requests for access, correction, and deletion.
- Performing privacy impact assessments for new processing activities.
- Providing granular consent controls for data processing.
- Automatically purging personal data according to retention policies.
- Using Standard Contractual Clauses and adequacy decisions for cross-border transfers.
Encryption and Key Management
Sensitive data is protected with industry-standard encryption, centralized key management, and regular key rotation.
Privacy Rights Management
Privacy-rights processes provide:
- A Subject Access Request (SAR) portal for requesting copies of personal data.
- Correction of inaccurate personal information.
- Erasure through automated deletion across systems.
- Restrictions on processing through granular consent controls.
6. Incident Response and Recovery
Recovery objectives support business continuity and limit disruption during incidents or disasters.
Recovery Time Objective (RTO): 24 Hours
The recovery time objective is the maximum acceptable period for restoring full service functionality after a disaster or significant incident. It covers the period from incident detection through operational recovery, including assessment, failover, system validation, and restoration.
Recovery Point Objective (RPO): 1 Hour
The recovery point objective is the maximum acceptable data-loss window following a disaster or system failure. It identifies the most recent point to which data must be recoverable and limits exposure to data loss.
Target Service Availability: 99.5%
The service targets 99.5% availability over a monthly period. For illustration, 0.5% of a 30-day month is 3.6 hours. Availability measurement, including the treatment of scheduled maintenance, follows the applicable service policies.
Oracle Cloud Policies and Pillar Documentation
Your order for this Oracle Cloud Service is subject to the Oracle Cloud Hosting and Delivery Policies and the Oracle Industries Cloud Service Pillar Document. These documents are available through Oracle Cloud Service Contracts.