Security Testing of Oracle Interfaces using MFT process Swikruti Mohapatra, Sowmya Narayanarao & Vinay Kammar | FAI

Abstract This presentation outlines the security features of MFT and how it helps in Security Testing Security testing is a testing technique to determine if an information system protects data and maintains functionality as intended.  Overview of Oracle MFT :  Oracle Managed File Transfer (MFT) is a high performance, standards-based, end-to-end managed file gateway which is designed from the bottom up to make it easy for organizations to manage, monitor and secure file transfers. It protects against inadvertent access to unsecured files at every step in the end-to-end transfer of files  This presentation outlines how we can achieve greater agility and accelerate DevOps QA strategy This presentation outlines how we can achieve greater agility and accelerate. Applications.

Oracle MFT and Security features: Oracle Managed File Transfer (MFT) enables secure file exchange and management with internal departments and external partners. You can protect data in your DMZ by using the SSH/FTP reverse proxy. The MFT console includes transfer prioritization, file encryption, scheduling, and embedded FTP and sFTP servers. Security is maintained with security policies such as OWSM (Oracle Web Service Manager). KEY FEATURES:- End to End Auditability, Control and Reporting Built-in Security, Identity management, LDAP and PGP encryption Compression, Scheduling and fully extensible file handling framework Extensive endpoint support: embedded SSH, FTP, File, SOAP Very well Integrated with SOA and B2B Highly available and clustered including a DMZ reverse proxy Protects files with end to end security System consolidation, cost savings and multi-platform Enables cloud adoption for large files

Oracle Managed File Transfer Process You can perform various operations, such as scheduling, file encryption, resubmitting transfers, purging data, and many more such operations by using Oracle Managed File Transfer.   Oracle Managed File Transfer lets you perform the following operations during the transfer process: Scheduling Resubmitting Attaching inline or referencing Compression and decompression Encryption and decryption Archiving, renaming, and deletion Purging transfer instances and files Pausing and resuming Securing with OWSM policies

Oracle Managed File Transfer Architecture The main components of Oracle Managed File Transfer includes configuration data, the user-interface console, embedded FTP and sFTP servers, security, and interfaces to various types of file transfer endpoints. Oracle Managed File Transfer can consist of multiple managed servers that provide high availability Figure: Oracle Managed File Transfer Architecture

Attributes of security testing: Authentication: The origin of the application and its data is genuine. Authorization: Specific users should only get access to authorized functions. Confidentiality: Data/information is secure from theft. Integrity: The application and its data is not altered in course of time during transmission. Non repudiation: Guarantee that sender and receiver of information cannot deny having sent or received the data.   In the end, security testing makes applications reliable and minimizes the risk of theft or misuse of confidential data.  The goal of security testing is to identify the threats in the system and measure its potential vulnerabilities. It also helps in detecting all possible security risks in the system and help developers in fixing these problems through coding.

We deliver several benefits through our Security Testing Service: Testing focused on the business priorities to ensure business runs as usual Reduced spends on managing breaches and their consequences Enhanced ability to collaborate with external sources (vendors, developers, customers) Security Audit Security testing control and scope in Oracle using MFT: Oracle MFT has a build in feature of email notification/alert for different kind of events which keeps the system secured and the users informed of any data transfer. It is well equipped with the system which gives us an alert in case of any failed transfer. Notifications can be tailored to notify users as a part of security business requirements.  MFT provides a huge benefit in security audit as it provides detailed information on each transfer including: file name, partner name, endpoint name, transfer status, compression or encryption. It keeps records of all actions on the servers, which can be used for troubleshooting or turned in for audits which is required to prove that a company has displayed adequate accountability for its data.  High level of security using LDAP and PGP encryption  

Encryption and Decryption process

MFT Process used in FAI MFT helps to automatically send/receive the files to/from Third party without any manual intervention. It transfers the files from Oracle outbound directory to third party server or transfers file from third party server to Oracle inbound directory. It picks the file as soon as it comes to the location and transfers to third party and it can be scheduled to process the files as per business requirement. Figure: Process flow of Outbound interface

References & Appendix http://docs.oracle.com/middleware/12211/mft/mft-user-guide/GUID-8ACC7C8B-6251-4B13-A811-DFDE3BB60D89.htm#MFTUG4316 http://docs.oracle.com/middleware/12211/mft/mft-user-guide/GUID-E68C24F1-C51C-4863-805C-73331A6E6374.htm#MFTUG252 https://en.wikipedia.org/wiki/Managed_file_transfer https://www.sans.org/reading-room/whitepapers/testing/automated-security-testing-oracle-forms-applications-35970 http://www.oracle.com/technetwork/middleware/mft/learnmore/oraclemftgettingstarted-2226782.pdf http://soamagic.blogspot.com/2016/05/notification-from-oracle-mft-12c12.html

Author Biography Qualification: B.Tech Total 4 years of Experience in IT Industry 2.5 years of work Experience as an Oracle apps Consultant across PTP and Financial modules. Work responsibilities included Critical Batch monitoring, working on priority Oracle SR’s to provide customer solutions, Currently working as a QA Engineer with responsibilities of writing test scenarios, Developing Automation test scripts using OATS, Involved in various end-to-end testing across Oracle Modules.

Q & A

Logo of your organization