Securing OS Management

To use OS Management securely, learn about your security and compliance responsibilities.

In general, Oracle provides security of cloud infrastructure and operations, such as cloud operator access controls and infrastructure security patching. You are responsible for securely configuring your cloud resources. Security in the cloud is a shared responsibility between you and Oracle.

Oracle is responsible for the following security requirements:

• Physical Security: Oracle is responsible for protecting the global infrastructure that runs all services offered in Oracle Cloud Infrastructure. This infrastructure consists of the hardware, software, networking, and facilities that run Oracle Cloud Infrastructure services.

Your security responsibilities are described on this page, which include the following areas:

• Access Control: Limit privileges as much as possible. Users should be given only the access necessary to perform their work.
• Patching: Keep software up to date with the latest security patches to prevent vulnerabilities.

Use this checklist to identify the tasks you perform to secure OS Management in a new Oracle Cloud Infrastructure tenancy.

After getting started with OS Management, use this checklist to identify security tasks that we recommend you perform regularly.

Use policies to limit access to OS Management.

A policy specifies who can access Oracle Cloud Infrastructure resources and how. For more information, see How Policies Work.

Assign a group the least privileges that are required to perform their responsibilities. Each policy has a verb that describes what actions the group is allowed to do. From the least amount of access to the most, the available verbs are: inspect, read, use, and manage.

For more information about OS Management policies and to view examples, see Setting Up IAM Policies for OS Management and Setting Up Required IAM Policies for Autonomous Linux.

Remove software sources that are not required for your Oracle Linux instances.

OS Management uses software sources to provide packages to instances, and to track the available updates to those packages. Standard software sources are provided in the root compartment of the tenancy. The standard software sources are linked to the standard upstream repositories for the operating system.

When OS Management is enabled for an instance, a set of default software sources for the operating system are added to the instance. You can remove software sources that are not required for your instances to minimize the number of packages available to the instance, thus reducing the package installation footprint.

For more information about removing software sources, see Removing Software Sources.

You can further minimize the package installation footprint by creating custom software sources. For more information about custom software sources, see Software Sources for Oracle Linux.

Set your notification topic for Oracle Autonomous Linux instances

After creating an Oracle Autonomous Linux instance, set the notification topic for the instance using the Console, CLI, or API. Autonomous Linux uses Notifications service topics to send out notifications about autonomous updates and events.

For more information, see Managing Autonomous Linux Settings.

Ensure that your managed instances are running the latest security updates.

Keep instance software up to date with security patches. We recommend that you periodically apply the latest available software updates to your instances. For more information, see Managing Linux Packages and Managing Windows Updates.

• For Oracle Autonomous Linux instances, your instances receive automatic daily updates, including zero-downtime Ksplice updates for kernel, OpenSSL, and glibc libraries. For more information, see Autonomous Linux Overview.
• For Oracle Linux and Windows instances, schedule recurring jobs for tasks such as installing all package updates on managed instance groups (for Oracle Linux) and installing all updates on managed instance groups (for Windows). For information about setting up managed instances groups, see Administering Managed Instance Groups.

Run compliance reports regularly to ensure managed instances have installed the latest security updates.

Using the Python SDK with the OS Management service, you can run a security compliance report. For an example Python script that generates a security compliance report, either across a tenancy or per compartment, for all managed instances that are missing security updates, see Using the Python SDK to Generate Compliance Reports.