TMA-ORACLE-SAAS-2.7

Ensure Qualified Target Filtering with WAF for SaaS is Enforced

보통레벨 2수동 검토oracle-saas

설명

Qualified Target Filtering in WAF for Oracle Fusion Applications enables differentiated access control at the module or endpoint level. This allows organizations to apply stricter policies for sensitive internal modules while permitting broader access to externally facing modules, such as Supplier Portal and Oracle ... Not all Fusion modules require the same level of exposure. Internal corporate modules should be tightly restricted, while external-facing portals must allow controlled access for third parties. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

1. Review Service Request (SR) records with Oracle SaaS Operations to confirm that Qualified Target Filtering has been enabled. 2. Verify which Fusion modules are included in the configuration (e.g., Supplier Portal, Candidate Experience). 3. Review allowlist/blocklist rules applied to each qualified target (CIDR ranges, countries, or both). 4. Optionally log a Service Request with Oracle SaaS Operations to confirm the current Qualified Target Filtering policies. 5.

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Submit a Service Request to Oracle SaaS Operations requesting Qualified Target Filtering to be enabled for the Fusion environment. 2. Provide Oracle with the list of Fusion modules requiring differentiated access (e.g., Supplier Portal, Candidate Experience) and their corresponding IP or geolocation restrictions. 3. Review Oracle's implementation to ensure policies match business and security requirements. 4. Test access for both corporate and external traffic (supplier, applicant) to confirm correct behavior. 5. Document exceptions where broader access must be maintained.

속성

운영 체제: 모두
태그: oracle-saasnetwork
참고 자료: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 2.7 Ensure Qualified Target Filtering with WAF for SaaS is Enforced