Within the same major version of Weblogic ie  12.1.x vs 12.2.x,
are the hardenings the same?   Have seen hardening docs from
Oracle for 11.x.y & 12.1.x  but I can't locate a doc that's for 12.2.x
so can I assume the hardening options for 12.1.x (specifically we
are on 12.1.3 & going to move to 12.2.x) are the same as for
12.2.x?
OraWLversions.jpg
Securing_Hardening_Oracle_Weblogic1.docx

I have a Java servlet installed on an IBMi.  OS is at 7.3.  I am using the integrated application server.
My servlet needs an external jar file.  On Tomcat on Windows, I put the jar in the /bin directory.  
Where to I put it in the 400?

I need to force a reboot of all our domain joined workstations to apply an update to our Trend AV. Asking everyone to do it via email has not done the trick. What is the best way to do that unattended?

hi guys

The environment I'm working in has around 150+ servers. Our team have to apply patches and keep these servers updated on a regular basis which they haven't done as yet. Now, the issue we have is that these servers are not just owned by the infrastructure and security teams, as that would be easy to manage. But the business analysts, business intelligence and applications teams own a good percentage of these too.

I need to put strategies in place so that my team, infrastructure&security, ensures that when these updates are applied that the impact is minimised and that we don't suddenly have updates which affect the applications sitting on those servers and firefighting errors.

One of my ideas was to ensure that there is a testing environment. But if I did, would I then liaise with the development teams to replicate everything that is on the production environment onto their testing too and regularly? So that when they make changes to development, they do the same onto testing?

What is the approach you have found works best?

Thanks for helping
Yash

Audit has raised to harden middlewares & CIS doesn't have many (other than Tomcat)
while we have the following (refer to attached Excel for details) :
Jas service
WSO2 AM
WSO2 IS
WSO2 ESB
Front-end
Redis
RabbitMQ
Marathon
etcd

Can point me to among the better sites for hardenings of above & ideally scripts that could be readily run.

Also, whereabout can we obtain patches for the above opensource middlewares?
ContainerMiddlewares.xlsx

Dont see such a benchmark guide at CIS site.
Anyone can share/point me to one?

Dear Experts

We have application servers hosted on-premise, the servers are behind the firewall.  users who access the application server from external network have to pass though the VPN network. I am looking for the network monitoring tool and also vulnerable scanning tool for web application server. I found following New Relic network monitoring tool and Qualys Security solution but these are cloud based. Please suggest for on premise deployment and suggestions please.
Thanks in advance.

Experts,
 We have 2013 sharepoint farm. We are planning to implement SSL (http to https) to our web application. We have 4 front end servers , 6 Application servers. We would like to know what is the advantage and  dis advantage to implement SSL on back end server or Load balance? Also we are planning to migrate our Sharepoint 2013 to Office 365 so what is the common practice to implement (server or load balance)?

Hi EE

I'd like to configure SSL for JBoss EAP 6.4 in domain mode.

1 domain controller (three server groups), 1 slave node (with three servers)

I need to configure SSL for all services
** domain Admin console access via https
** each server access via https.

Thanks

https://www.michalsons.com/blog/what-is-a-national-critical-information-infrastructure/17701
https://publicwiki-01.fraunhofer.de/CIPedia/index.php/Critical_Information_Infrastructure

I have to draft a guideline for systems that interface with a CII system & need inputs:
currently, the interfaces concerned are limited to 3 types only:

1. files transfer
============
I can only think that the generally practices ie:
 a) encryption of data in transit (eg: using sftp instead of ftp/mapping a drive or NFS)
 b) encryption of data at rest if it's sensitive (tampered with)

2. API
=====
how do we secure these (in particular APIs using microServices)??
I've heard of API needs to be certified so before requesting for it, need to be certain
else applications developers may question its relevance/usefulness

3. DBLink
========
Those sqlconnect  esp Oracle links to extract / update data.
Will need to define if the non-CII system is
   a) updating into CII, will have to be extra stringent but how?
   b) extracting from CII, just encrypting the sql calls
 

Oracle databases, weblogic are involved in the critical systems
while the less-critical systems may be Windows, Linux on
various apps (including mobile apps).

Editing thread to add Oracle as it relates to DBLink.

Greetings EE'ers,

Does anyone have any experience based recommendations on a good open source video camera solution?

please advise the clear steps..
How to make log rotation by file size in apache-tomcat

Hi All,

I am doing some housekeeping on application servers I am responsible for.  All applications are working fine I just want to free up space on the drives.

Having come across the WinSxS folder which I know is very important and should not just delete files as I could quite easily break the server or applications.

I was going to start with a simple disk cleanup but discovered this is not installed as standard on Windows Server 2012, it need to be added as a role then requires a reboot which I'd rather avoid outside of the monthly scheduled reboot.

What other options do I have and how do I know which files can or can't be deleted?