Security Guidelines for the Middle Tier
This section describes the security guidelines for the OHTR middle tier.
Parent topic: Security Guide
Remove unused applications from WebLogic
Currently, the WebLogic Server installation includes the entire JDK and some additional WebLogic Server development utilities (for example, wlsvc). These development programs are not needed at runtime and can be safely removed. The following are recommendations for making a WebLogic Server installation more secure:
- Do not install the WebLogic Server sample applications.
- Delete development tools, such as the Configuration Wizard and the jCOM tools.
- Delete the Derby database, which is bundled with WebLogic Server for use by the sample applications and code examples as a demonstration database.
For more details, see the section on Determining Your Security Needs section in Oracle® Fusion Middleware Securing a Production Environment for Oracle WebLogic Server 12c (12.2.1.4) available at
http://docs.oracle.com/middleware/12211/wls/LOCKD/practices.htm#LOCKD116
Parent topic: Security Guidelines for the Middle Tier
Enable SSL/ TLS
To create a unique private identity key and trust certificate, TLS is not enabled by default during the installation. Enabling TLS is optional, but we recommend TLS for a production environment.
Note:
Communication between the browser and the application servers should be restricted to TLS.To enable Transport Layer Security:
You must also configure SSL, identity, and trust. For more information, see the Oracle® Fusion Middleware Securing Oracle WebLogic Server 12c (12.2.1.4).
Parent topic: Security Guidelines for the Middle Tier
Configure SSL/ TLS
To set up TLS, perform the following steps:
For further instructions on specifying the protocol and version, see the Specifying the SSL Protocol Version chapter in Oracle® Fusion Middleware Administering Security for Oracle WebLogic Server 12.2.1 available at
https://docs.oracle.com/middleware/1221/wls/SECMG/ssl_version.htm#SECMG636
For more details, see the section on Configuring SSL in Oracle® Fusion Middleware Securing Oracle WebLogic Server 12c (12.2.1.4) available at
https://docs.oracle.com/middleware/1221/core/ASADM/sslconfig.htm#ASADM1800
Parent topic: Security Guidelines for the Middle Tier
Protect user accounts
Oracle WebLogic Server defines a set of configuration options to protect user accounts from intruders. In the default security configuration, these options are set for maximum protection. You can use the Administration Console to modify these options on the Configuration > User Lockout page.
As a system administrator, you have the option of turning off all the configuration options, increasing the number of login attempts before a user account is locked, increasing the time period in which invalid login attempts are made before locking the user account, and changing the amount of time a user account is locked. Remember that changing the configuration options lessens security and leaves user accounts vulnerable to security attacks. For more details, see the section on Configuring Security for a WebLogic Domain section in Oracle® Fusion Middleware Securing Oracle WebLogic Server 12c (12.2.1.4) available at
https://docs.oracle.com/middleware/1221/wls/SECMG/conf-security-for-domain.htm#SECMG777
Monitor logs
If you suspect any unusual transactions in the Cohort UI, monitor the diagnostic logs for any real-time, abnormal business activity.
Application transactions should be monitored and real time corrective measures should be implemented to limit transaction rates outside application Service Level Agreements.
Password Validation Providers
WebLogic Server includes a Password Validation provider, which is configured by default in each security realm. The Password Validation provider manages and enforces a set of configurable password composition rules, and is automatically invoked by a supported authentication provider whenever a password is created or updated for a user in the realm. When invoked, the Password Validation provider performs a check to determine whether the password meets the criteria established by the composition rules. The password is then accepted or rejected as appropriate. For more information on the Password Validation provider, see the Oracle® Fusion Middleware Administering Security for Oracle WebLogic Server 12c (12.2.1.4) available at
https://docs.oracle.com/middleware/1221/wls/SECMG/password_atn.htm#SECMG206
Parent topic: Protect user accounts