Securing Your PeopleSoft Application - Chapter 2This is a featured page

Required Reading

There are a number of books, publications and white papers on security that a security administrator should consult to get a comprehensive understanding of how to secure a site. At a minimum, please download and read Common Sense Guide for Senior Managers: Top Ten Recommended Information Security Practices published by Internet Security Alliance from http://www.isalliance.org/index.php?option=com_content&task=view&id=46&Itemid=187.

The document is an excellent starting guide for security administrators to ensure that basic security policies and practices are observed within an organization before any PeopleSoft-specific security is put into place. The document identifies ten of the highest priority and most frequently recommended security practices as a place to start for today's operational systems. These practices address dimensions of information security such as policy, process, people, and technology, all of which are necessary for deployment of a successful security process. It’'s up to each organization to determine where to position itself on this exponential curve, ( a symbolic reference to the full spectrum of “ dimensions of information security.”) and what amount of security investment they need to make to achieve a satisfactory level of security within the system. A satisfactory level of security also depends on the business goals of the security system. These considerations lead us to the need to create a security model targeted to address security threats and their business impact.

When it comes to information security, there are no silver bullets — no one process, technology, or certification that will guarantee 100% safety. Industry best practices dictate that an organization use a combination of processes and technoloogies that mitigate risk and limit damage. Security breaks down into three main areas: planning, prevention, and response. Without a plan, your company will not be well-prepared to repel attacks and deal with intrusions. Techniques and tools targeted at prevention should be where most of your energy and funding are directed. In the event that prevention fails, you must be ready to respond quickly and masterfully.

Keeping this in mind, the first step in securing a PeopleSoft environment is to create a security model for your site at the enterprise or organizational level. You can create a new model, or align your PeopleSoft security implementation strategy with your existing security model. One of the biggest errors that an organization can make when deploying new services, systems, and technologies is failing to align security capabilities with business objectives. Your organization should develop or leverage a security model that manages the inherent trade-offs between enablement and protection of an enterprise's most valuable resource — its information assets.

Let us first frame what we mean by security model. A security model is a formal description of a security policy. This naturally leads to the question: What is a security policy?

  • A security policy should capture the security requirements of an enterprise, or describe the steps that must be taken to achieve security.
  • Security models are used in security evaluation, and sometimes for proof of security.

Current wisdom has identified three widely accepted legs of security:

  • Computer Security – Use risk assessment, apply the CIA+ taxonimy (Confidentiality, Integrity, Availability, non-repudiation, and authentication), new goals and extended enterprise planning models.
  • Physical Security – Integrate physical access systems with network authorization systems.
  • Trustworthy People – Know who you give access to. Apply due diligence.
There are many security models that an organization can apply in an effort to meet the security criteria specific to that organization, and based upon their business processes and requirements as well as the level of risk they have determined to be “acceptable” (this can be driven by many criteria ranging from customer demands to industy standard practices to regulatory requirements).

In the following discussion we highlight a few of the more common security models.

The classic (traditional) security model followed by many organizations is what has come to be knows as the “CIA Model”. This model focuses on the Confidentiality, Integrity and Availability aspects of security. Many in the security industry would state that these core tenets are the ultimate goal of information security. However, there are other considerations that this approach may not address. Forged in the early days of the internet's commercialization, the classic CIA approach also took on authentication, access control, and nonrepudiation as goals in the mid-1990s. Since then, this model has become standard security fare. But this goal-oriented approach neglects today's critical security needs, where attacks are more sophisticated and frequent, and come from a wider range of sources. For example, the traditional architecture for implementing the CIA model — the firewall-based perimeter — is increasingly ineffective. Worse still, the goal-oriented approach doesn’t address the other half of good security planning: risk assessment. Risk assessment, which guides security managers in prioritizing security spending, is sorely neglected even in organizations that acknowledge its importance.

The CIA model (often referred to as a “goal oriented” approach) is still a good way to achieve high security. However, while it does a great job of addressing confidentiality and its five siblings as tried and true security goals, it’s critical to understand that these goals are only part of the plan. Other goals should be risk assessment and the creation of a modified version of a “demilitarized zone” (DMZ) perimeter. Critical, too, is the need to recognize new goals as they emerge.

Several Other Security models are also available:
  • Many security consulting organizations (Big 4 consulting firms and others) have devised an alternative security model that identifies security more as a “strategic business process that includes the organisation, the processes, and the technologies that enable access to, and protection of, an enterprise’s information assets.” This comprehensive security model illustrates how to identify, create, capture, and sustain the value of security in an organization by managing the inherent trade-offs between enablement and protection of an enterprise's most valuable resource — its information assets. In this model, these primary security activities are driven by business objectives and carried out in alignment with the enterprise’s supporting capabilities – its organization (people), firm processes, and technology infrastructure. This type of model centers on how security adds value to an organization. A security model of this nature is specifically designed to function as a roadmap. It helps an organization navigate the process of building a scalable and sustainable security infrastructure that both protects and enables access to critical business and information assets in alignment with strategic business objectives and appropriately balanced and associated costs.

  • Another alternative has been developed by the Burton Group; it’s commonly referred to as the Virtual Extended Network (VEN) model. The “goal-oriented” CIA model discussed previously often results in what many industry analysts call a “tootsie pop” syndrome — in other words, a security model that results in a hard shell with a soft chewy center infrastructure. The CIA model can produce significant security weakness, especially in light of the pervasiveness of “web enabled” applications and systems. Allowing users to “do anything possible” once they’re inside is no longer sufficient.


The VEN model is an alternative to the traditional DMZ. It consists of four layers that represent different techniques for different zones of use:

  • Resource – network, servers, data.
  • Control – employees and security systems.
  • Perimeter – partners.
  • Extended Perimeter – suppliers and customers.








    		•  Specifically, the VEN model defines four logical layers: the resource layer, which houses clients, servers, applications and data; the control layer, where authentication services reside, as do controls for security policies across layers; the perimeter layer, which defines an organization's physical boundaries and contains firewalls, proxies and gateways; and the extended perimeter, where companies engage technologies or services to secure resources physically located outside the perimeter. The result is a model that builds on the existing infrastructure, but plans for a distributed perimeter.


    Security is an integration of people, processes, and technology. Rather than merely a technology fix, security must now be defined in a way that incorporates the critical roles and interdependence that exist between an organization’s people, its firm processes, and its technology infrastructure. Leveraging a clearly defined security model will enable your organization to address these issues in combination, resulting in a PeopleSoft environment that provides a world-class security posture.

    The security model is essential to create critical requirements that support a secure enterprise. The success of these initiatives, however, hinges on several critical requirements, with profound implications for any organization:
    • Technology resources are connected and available to the appropriate users.
    • Checks and balances exist to ensure appropriate access and approvals.
    • Perimeter protection and monitoring are assured.
    • The supporting infrastructure:
    • Is resilient under variable circumstances.
    • Is reliable under all conditions.
    • Performs.
    • Scales.
    • Supports inter-operability.
    • Is efficiently maintained.



      • The purpose of this document is not a lengthy discussion about security models and how to develop and implement them, but it is critical to understand that the securing of your PeopleSoft environment should be done in alignment with your enterprise security policies. Those policies should be created from the foundation based upon the security model you’ve established. Securing your PeopleSoft environment should not be a one-off solution, but rather a comprehensive approach taken in concert with overall corporate security policies, guidelines and business requirements.

      Continued in "Chapter 2 - Security Model - Security Threats"






      edgar.x.vasquez@orac
      edgar.x.vasquez@orac       		Latest page update: made by edgar.x.vasquez@orac , Mar 3 2009, 10:10 AM EST (about this update About This Update edgar.x.vasquez@orac couple of spelling updates - edgar.x.vasquez@orac

      2 words added
      2 words deleted

      view changes
      - complete history)
      Keyword tags: None
      More Info: links to this page

      Threads for this page

      There are no threads for this page.  Be the first to start a new thread.