This is the second in a series of posts, as the title implies, that focuses on securing Oracle WebLogic Server. This software product is a full fledge Java Platform, Enterprise Edition (Java EE). Thus, this series is about technology, right? Yes, it will be primarily focused on technology. However, we have to consider information security holistically. Along these lines, I intend to share some of my reflections on topics that may be not be as relevant to system administrators such as risk management, information security strategy and information security policy. This will provide some context why WebLogic Server should be secured. In case of a breach, did you know that a WebLogic Server instance could become an entry point to a database, a data warehouse, or a business application?
First, I will cover basics, which will provide a lot of strategies and techniques to harden WebLogic Server quickly.
- Pre-Installation will address the preparation of the operating system where WebLogic Server will be installed. This post will discuss best practices, and make some recommendations to harden the environment.
- Installation and configuration will address hardening a WebLogic deployment (e.g. protecting critical configuration files).
- Management will address some key risks, challenges, and issues with the management of a WebLogic deployment (e.g. forgotten admin password).
Beyond the basics will cover non-technical and technical topics, including strategy and policy. If there are specific topics you would like to see addressed, please feel free to let me know.
