Security requirements?

Consider the Police Case study and identify 3 security requirements. For each of these security requirements:
•     Discuss the necessity for the feature and how it will be implemented;
•     Implement code for your security feature;
•     Demonstrate, discuss, testing of the security feature.
what types of security features available on oracle? I found sql to sql and access grant/revoke.....but I do not understand what sql to sql does?
need help

See the Oracle Security documentation :
Either the 2-Day Guide at http://download.oracle.com/docs/cd/E11882_01/server.112/e10575/toc.htm
Or the more detailed Guide at http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/toc.htm
Hemant K Chitale

Similar Messages

Windows 8.1 Mail app and Exchange 2010 EAS partnership - "Make Windows user account an Administrator" to meet security requirements?

As the title says, I have a new Windows 8.1 based device which I'm trying to connect to my Exchange 2010 box (SP3 Update Rollup 2). I currently have my iphone set up as an EAS client with no problems. I have an EAS policy on my mailbox
with the following settings surrounding passwords :
Require Password, Require Encryption, Allow Simple Password, Time without user input - 10 minutes. Allow non-provisional devices is also checked.
The Windows 8.1 device has Bitlocker enabled, which meets the encryption requirement - I know this because the 1st time I tried this it moaned about Bitlocker needing to be enabled to meet requirements, though at that time the local user account on the Windows
8.1 device was an admin level account so it never mentioned this issue, it worked normally.
Now, while using a std user account on the Windows 8.1 device and trying to connect up via EAS, it complains that my local windows user account must be an ADMIN level account to meet the security requirements...?
Anyone encountered this?

Did anyone solve this problem? I'm also struggling with this issue.
this is still a problem. I'm just hitting it now and it's not doing much for management's love of Microsoft devices.
Evidently, it has to be an admin to set the policies on the device to match the policies on the EAS. And once set, a user can be changed back.
But this is seriously not cool. Don't the "app" folks and the enterprise folks talk to each other?

Network Security Requirement : Confidential - Not Enforced

I am having a perplexing problem with the network security requirement feature in SJSAS 8 Update 1.
In deploytool, under my WAR, in the security tab, for my only SecurityConstraint, I set the Network Security Requirement to CONFIDENTIAL. This should cause any access to thse objects over port 80 to be redirected to https via for 443.
The failure is that it does not redirect clients accessing over port 80 to a secure connection. The tricky part is that it fails in a completely random way. Sometimes for some WARs it will work as expected, then after X number of server restarts / redeployments, some of the same WARs will not do the redirect as expected. Through continuous redeploys and restarts during development, all WARs will or will not do the redirect in any given situation.
Has anyone else experienced this problem and worked around it? Any help is greatly appreciated! Thanks in advance!
mod_critical

The following is the deployment descriptor for one of the WARs (this problem affects them all, on multiple different machines with different setups).
The following is from the Security Contraint:
<security-constraint> <display-name>SecurityConstraint</display-name> <web-resource-collection> <web-resource-name>WRCollection</web-resource-name> <url-pattern>/participant/*</url-pattern> <url-pattern>/assetmodel/*</url-pattern> <url-pattern>/*</url-pattern> <http-method>POST</http-method> <http-method>GET</http-method> </web-resource-collection> <auth-constraint> <role-name>asadmin</role-name> <role-name>cvbdataentry</role-name> <role-name>cvbadmin</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint>
The rest is as follows:
<?xml version='1.0' encoding='UTF-8'?> <web-app xmlns="http://java.sun.com/xml/ns/j2ee" version="2.4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" > <display-name>CVBadmin</display-name> <servlet> <display-name>assetmodel/OpenRecord</display-name> <servlet-name>assetmodel/OpenRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.OpenRecord</servlet-class> </servlet> <servlet> <display-name>participant/personell/account/Lookup</display-name> <servlet-name>participant/personell/account/Lookup</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.account.Lookup</servlet-class> </servlet> <servlet> <display-name>participant/personell/account/record</display-name> <servlet-name>participant/personell/account/record</servlet-name> <jsp-file>/participant/personell/account/record.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/line/Remove</display-name> <servlet-name>assetmodel/line/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.line.Remove</servlet-class> </servlet> <servlet> <display-name>participant/location/record</display-name> <servlet-name>participant/location/record</servlet-name> <jsp-file>/participant/location/record.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/Save</display-name> <servlet-name>assetmodel/Save</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.Save</servlet-class> </servlet> <servlet> <display-name>syncError</display-name> <servlet-name>syncError</servlet-name> <jsp-file>/syncError.jsp</jsp-file> </servlet> <servlet> <display-name>participant/Search</display-name> <servlet-name>participant/Search</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.Search</servlet-class> </servlet> <servlet> <display-name>participant/location/List</display-name> <servlet-name>participant/location/List</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.location.List</servlet-class> </servlet> <servlet> <display-name>participant/personell/account/Create</display-name> <servlet-name>participant/personell/account/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.account.Create</servlet-class> </servlet> <servlet> <display-name>participant/personell/listresults</display-name> <servlet-name>participant/personell/listresults</servlet-name> <jsp-file>/participant/personell/listresults.jsp</jsp-file> </servlet> <servlet> <display-name>participant/record</display-name> <servlet-name>participant/record</servlet-name> <jsp-file>/participant/record.jsp</jsp-file> </servlet> <servlet> <display-name>participant/personell/account/Passwd</display-name> <servlet-name>participant/personell/account/Passwd</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.account.Passwd</servlet-class> </servlet> <servlet> <display-name>participant/location/Create</display-name> <servlet-name>participant/location/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.location.Create</servlet-class> </servlet> <servlet> <display-name>Logout</display-name> <servlet-name>Logout</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.Logout</servlet-class> </servlet> <servlet> <display-name>participant/location/Remove</display-name> <servlet-name>participant/location/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.location.Remove</servlet-class> </servlet> <servlet> <display-name>participant/Save</display-name> <servlet-name>participant/Save</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.Save</servlet-class> </servlet> <servlet> <display-name>assetmodel/listresults</display-name> <servlet-name>assetmodel/listresults</servlet-name> <jsp-file>/assetmodel/listresults.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/line/record</display-name> <servlet-name>assetmodel/line/record</servlet-name> <jsp-file>/assetmodel/line/record.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/line/List</display-name> <servlet-name>assetmodel/line/List</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.line.List</servlet-class> </servlet> <servlet> <display-name>participant/personell/Save</display-name> <servlet-name>participant/personell/Save</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.Save</servlet-class> </servlet> <servlet> <display-name>assetmodel/line/Create</display-name> <servlet-name>assetmodel/line/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.line.Create</servlet-class> </servlet> <servlet> <display-name>participant/personell/List</display-name> <servlet-name>participant/personell/List</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.List</servlet-class> </servlet> <servlet> <display-name>assetmodel/Create</display-name> <servlet-name>assetmodel/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.Create</servlet-class> </servlet> <servlet> <display-name>participant/Remove</display-name> <servlet-name>participant/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.Remove</servlet-class> </servlet> <servlet> <display-name>participant/Create</display-name> <servlet-name>participant/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.Create</servlet-class> </servlet> <servlet> <display-name>assetmodel/line/listresults</display-name> <servlet-name>assetmodel/line/listresults</servlet-name> <jsp-file>/assetmodel/line/listresults.jsp</jsp-file> </servlet> <servlet> <display-name>participant/personell/Remove</display-name> <servlet-name>participant/personell/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.Remove</servlet-class> </servlet> <servlet> <display-name>assetmodel/List</display-name> <servlet-name>assetmodel/List</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.List</servlet-class> </servlet> <servlet> <display-name>assetmodel/record</display-name> <servlet-name>assetmodel/record</servlet-name> <jsp-file>/assetmodel/record.jsp</jsp-file> </servlet> <servlet> <display-name>participant/searchresults</display-name> <servlet-name>participant/searchresults</servlet-name> <jsp-file>/participant/searchresults.jsp</jsp-file> </servlet> <servlet> <display-name>menu</display-name> <servlet-name>menu</servlet-name> <jsp-file>/menu.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/line/OpenRecord</display-name> <servlet-name>assetmodel/line/OpenRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.line.OpenRecord</servlet-class> </servlet> <servlet> <display-name>participant/location/listresults</display-name> <servlet-name>participant/location/listresults</servlet-name> <jsp-file>/participant/location/listresults.jsp</jsp-file> </servlet> <servlet> <display-name>exception</display-name> <servlet-name>exception</servlet-name> <jsp-file>/exception.jsp</jsp-file> </servlet> <servlet> <display-name>participant/OpenRecord</display-name> <servlet-name>participant/OpenRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.OpenRecord</servlet-class> </servlet> <servlet> <display-name>participant/location/Save</display-name> <servlet-name>participant/location/Save</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.location.Save</servlet-class> </servlet> <servlet> <display-name>participant/personell/OpenRecord</display-name> <servlet-name>participant/personell/OpenRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.OpenRecord</servlet-class> </servlet> <servlet> <display-name>participant/personell/Create</display-name> <servlet-name>participant/personell/Create</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.Create</servlet-class> </servlet> <servlet> <display-name>participant/personell/account/Remove</display-name> <servlet-name>participant/personell/account/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.personell.account.Remove</servlet-class> </servlet> <servlet> <display-name>participant/personell/record</display-name> <servlet-name>participant/personell/record</servlet-name> <jsp-file>/participant/personell/record.jsp</jsp-file> </servlet> <servlet> <display-name>assetmodel/Remove</display-name> <servlet-name>assetmodel/Remove</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.Remove</servlet-class> </servlet> <servlet> <display-name>assetmodel/PreRecord</display-name> <servlet-name>assetmodel/PreRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.PreRecord</servlet-class> </servlet> <servlet> <display-name>assetmodel/line/Save</display-name> <servlet-name>assetmodel/line/Save</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.assetmodel.line.Save</servlet-class> </servlet> <servlet> <display-name>participant/location/OpenRecord</display-name> <servlet-name>participant/location/OpenRecord</servlet-name> <servlet-class>com.deerteck.cvb.servlet.CVBadmin.participant.location.OpenRecord</servlet-class> </servlet> <servlet-mapping> <servlet-name>assetmodel/OpenRecord</servlet-name> <url-pattern>/assetmodel/openrecord</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/account/Lookup</servlet-name> <url-pattern>/participant/personell/account/lookup</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/account/record</servlet-name> <url-pattern>/participant/personell/account/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/Remove</servlet-name> <url-pattern>/assetmodel/line/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/record</servlet-name> <url-pattern>/participant/location/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/Save</servlet-name> <url-pattern>/assetmodel/save</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>syncError</servlet-name> <url-pattern>/syncError</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/Search</servlet-name> <url-pattern>/participant/search</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/List</servlet-name> <url-pattern>/participant/location/list</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/account/Create</servlet-name> <url-pattern>/participant/personell/account/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/listresults</servlet-name> <url-pattern>/participant/personell/listresults</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/record</servlet-name> <url-pattern>/participant/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/account/Passwd</servlet-name> <url-pattern>/participant/personell/account/passwd</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/Create</servlet-name> <url-pattern>/participant/location/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>Logout</servlet-name> <url-pattern>/logout</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/Remove</servlet-name> <url-pattern>/participant/location/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/Save</servlet-name> <url-pattern>/participant/save</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/listresults</servlet-name> <url-pattern>/assetmodel/listresults</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/record</servlet-name> <url-pattern>/assetmodel/line/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/List</servlet-name> <url-pattern>/assetmodel/line/list</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/Save</servlet-name> <url-pattern>/participant/personell/save</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/Create</servlet-name> <url-pattern>/assetmodel/line/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/List</servlet-name> <url-pattern>/participant/personell/list</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/Create</servlet-name> <url-pattern>/assetmodel/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/Remove</servlet-name> <url-pattern>/participant/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/Create</servlet-name> <url-pattern>/participant/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/listresults</servlet-name> <url-pattern>/assetmodel/line/listresults</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/Remove</servlet-name> <url-pattern>/participant/personell/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/List</servlet-name> <url-pattern>/assetmodel/list</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/record</servlet-name> <url-pattern>/assetmodel/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/searchresults</servlet-name> <url-pattern>/participant/searchresults</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>menu</servlet-name> <url-pattern>/menu</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/OpenRecord</servlet-name> <url-pattern>/assetmodel/line/openrecord</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/listresults</servlet-name> <url-pattern>/participant/location/listresults</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>exception</servlet-name> <url-pattern>/exception</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/OpenRecord</servlet-name> <url-pattern>/participant/openrecord</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/Save</servlet-name> <url-pattern>/participant/location/save</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/OpenRecord</servlet-name> <url-pattern>/participant/personell/openrecord</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/Create</servlet-name> <url-pattern>/participant/personell/create</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/account/Remove</servlet-name> <url-pattern>/participant/personell/account/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/personell/record</servlet-name> <url-pattern>/participant/personell/record</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/Remove</servlet-name> <url-pattern>/assetmodel/remove</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/PreRecord</servlet-name> <url-pattern>/assetmodel/prerecord</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>assetmodel/line/Save</servlet-name> <url-pattern>/assetmodel/line/save</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>participant/location/OpenRecord</servlet-name> <url-pattern>/participant/location/openrecord</url-pattern> </servlet-mapping> <session-config> <session-timeout>60</session-timeout> </session-config> <error-page> <error-code>500</error-code> <location>/exception.jsp</location> </error-page> <security-constraint> <display-name>SecurityConstraint</display-name> <web-resource-collection> <web-resource-name>WRCollection</web-resource-name> <url-pattern>/participant/*</url-pattern> <url-pattern>/assetmodel/*</url-pattern> <url-pattern>/*</url-pattern> <http-method>POST</http-method> <http-method>GET</http-method> </web-resource-collection> <auth-constraint> <role-name>asadmin</role-name> <role-name>cvbdataentry</role-name> <role-name>cvbadmin</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>FORM</auth-method> <realm-name>ldap</realm-name> <form-login-config> <form-login-page>/login.jsp</form-login-page> <form-error-page>/loginFail.jsp</form-error-page> </form-login-config> </login-config> <security-role> <role-name>asadmin</role-name> </security-role> <security-role> <role-name>cvbdataentry</role-name> </security-role> <security-role> <role-name>cvbadmin</role-name> </security-role> <security-role> <role-name>customer</role-name> </security-role> <security-role> <role-name>accountant</role-name> </security-role> <security-role> <role-name>participant</role-name> </security-role> <ejb-local-ref> <ejb-ref-name>ejb/DataAccessBean</ejb-ref-name> <ejb-ref-type>Session</ejb-ref-type> <local-home>com.deerteck.cvb.ejb.session.DataAccessLocalHome</local-home> <local>com.deerteck.cvb.ejb.session.DataAccessLocalObject</local> <ejb-link>ejb-jar-ic1.jar#DataAccessBean</ejb-link> </ejb-local-ref> <ejb-local-ref> <ejb-ref-name>ejb/LDAPBean</ejb-ref-name> <ejb-ref-type>Session</ejb-ref-type> <local-home>com.deerteck.cvb.ejb.session.LDAPLocalHome</local-home> <local>com.deerteck.cvb.ejb.session.LDAPLocalObject</local> <ejb-link>ejb-jar-ic1.jar#LDAPBean</ejb-link> </ejb-local-ref> </web-app>

TS1702 I forgot security required 3 questions and answers.

I forgot my secure required 3questions and answers.
So I don,t buy the app.
Please check it out.

I want to buy the app for I.pad.
But I don,t buy it because I forgot my password and your secured required questions and answers.
I change my password successful. But i don,t know
your secured required questions and answers
I want to buy the apps.

Security Requirements Template for BOE XI3.1

I'm looking for the "Security Requirements Template" document, a template that can be used to setup a content plan in BOE XI3.1.
It is an Excel document, that shows by application the possible rights.

Hans - you're probably referring to Dwayne Hoffpauir's 2008 GBN User Conference presentation - it's really helped me set up our security for XI 3.1.
http://www.forumtopics.com/busobj/viewtopic.php?t=119849&highlight=mere+mortals

Security requirements to upgrade Master Data Services Database

What is the security requirements to upgrade an MDS database. When I choose Upgrade Database and after running the upgrade scripts I get the following exception:
Microsoft.MasterDataServices.Configuration.ConfigurationException: The user does not have access to the application.

Hi RicardoMarques182,
Did the error happen right after the upgrade was done and was trying the open the Master Data Service(MDS) application? Could you please help to post the full(more detailed) error message?
Just per the general error message, please ensure the currnt login user has the at least Explorer function permission:
http://msdn.microsoft.com/en-us/library/ff487017.aspx
Thanks,
Jinchun Chen

Failures with windows security requirements and binaries installed

We are in the process of getting our application certified for Windows Server 2012 for Gold certification and running into the following 2 issues:
1. Failure for "Applications must comply with Windows security requirements".
Looks like the MPR tool is trying to scan some .log files and .xml files when the test is running and these are being used/locked by the application at that time. So these are listed under "Checks that didn't complete". attached is a screenshot
of this.
2. Failure for "Were any binaries installed for this Component"
This is the log message for "No binaries were detected as installed". Ours is a Java app and Java binaries are the only executables.
======================================================================
Log generated by Microsoft Platform Ready Test Tool - Version 4.1.0.0 | Signed: Tuesday, March 26, 2013
======================================================================
Test name: PPSS 3.23 Gold
Test date: 05/01/2013 13:11:54
Tested on: Virtual Machine on Microsoft Windows Server 2012 Hyper-V
Test for: Windows Server 2012
======================================================================
Test case/Verification: 11.1.1 - Check if application installed binaries
======================================================================
To pass this test, binaries must have been installed for this Component by a method tester identified in the ‘Setup Information’ screen.
To validate an actual test was conducted, a waiver must be filed.
The Windows Server Logo Program requires a complete but brief, technically detailed explanation of the application/solution, installation method, and hosted platform (ex: IIS, SharePoint, etc.).
Document any client components, besides Internet Explorer. ISV client components must also be tested with MPR Tool, on either Client or Server OS concurrently.
Waiver link may be found on MPR Tool or on Windows Server Logo Program website.
======================================================================
Result: No binaries were detected as installed.
05/01/2013 13:11:54 ::
======================================================================
05/01/2013 13:11:54 :: Note: The files below were excluded from this test
======================================================================
C:\Windows\Installer\cce9a8.msi
======================================================================
Test case/Verification: 11.1.1 - Check if application installed binaries
05/01/2013 13:11:54 End of Log.
======================================================================
QUESTIONS:
How can we resolve these issues?
Is passing these 2 failures mandatory in order to get certified?
Can we file a waiver for these?
Thanks,
Neeha.

Update: We were not giving the right installation directory and corrected that.
After changing the installation directory, we end up with these 2 failures:
Log message for Binaries installed is below. As mentioned in the message above, ours is a Java application that does not have any binaries installed.
Can we submit a waiver for this?
=====================================================================
Log generated by Microsoft Platform Ready Test Tool - Version 4.1.0.0 | Signed: Tuesday, March 26, 2013
======================================================================
Test name: PPSS 3.23 Gold Certification
Test date: 05/06/2013 12:56:03
Tested on: Virtual Machine on Microsoft Windows Server 2012 Hyper-V
Test for: Windows Server 2012
======================================================================
Test case/Verification: 11.1.1 - Check if application installed binaries
======================================================================
To pass this test, binaries must have been installed for this Component by a method tester identified in the ‘Setup Information’ screen.
To validate an actual test was conducted, a waiver must be filed.
The Windows Server Logo Program requires a complete but brief, technically detailed explanation of the application/solution, installation method, and hosted platform (ex: IIS, SharePoint, etc.).
Document any client components, besides Internet Explorer. ISV client components must also be tested with MPR Tool, on either Client or Server OS concurrently.
Waiver link may be found on MPR Tool or on Windows Server Logo Program website.
======================================================================
Result: No binaries were detected as installed.
05/06/2013 12:56:03 ::
======================================================================
05/06/2013 12:56:03 :: Note: The files below were excluded from this test
======================================================================
C:\Windows\Installer\1ab2aa62.msi
======================================================================
Test case/Verification: 11.1.1 - Check if application installed binaries
05/06/2013 12:56:03 End of Log.
======================================================================
Log message for executables installed is below. Is a waiver needed for this? The highlighted part of the log message talks about not needing a waiver for the optional test. Is it talking about 3rd party binaries alone?
======================================================================
Log generated by Microsoft Platform Ready Test Tool - Version 4.1.0.0 | Signed: Tuesday, March 26, 2013
======================================================================
Test name: PPSS 3.23 Gold Certification
Test date: 05/06/2013 12:56:00
Tested on: Virtual Machine on Microsoft Windows Server 2012 Hyper-V
Test for: Windows Server 2012
======================================================================
Test case/Verification: TC2.3 - All binaries and installers must be Authenticode signed
======================================================================
Authenticode sign all setup files and binaries installed by the application.
Binaries not built by product group or company can be considered 3rd party.
3rd party binaries without valid signatures will fail this test case. No waiver is required for this optional test case.
======================================================================
05/06/2013 12:56:00 :: Binary list
No binary found for verification.
05/06/2013 12:56:00 ::
List of installers that failed signature verification:
C:\ppss_323_installer\install_PPSS_3_23_0\setup.exe
======================================================================
Note: The files below were excluded from this test
======================================================================
C:\Windows\Installer\1ab2aa62.msi
======================================================================
No executable files were detected as installed during test.
Microsoft Platform Ready Test Tool requires that your application physically installs executable files on this Computer.
======================================================================
Test case/Verification: TC2.3 - All binaries and installers must be Authenticode signed
05/06/2013 12:56:03 End of Log.
======================================================================
Any help of guidance in addressing these 2 issues will be great.
Thanks,
Neeha.

Is internet security required to keep my email from being hacked?

Is any type of Internet Security required to keep my email from being hacked?

No not needed for a non jailbroken apple device.

Security requirements on sender mail adapter

I have set up a sender mail adapter to fetch the email with attachment from MS exchange mail server. The sender mail adapter can process the attachment well and convert it to XML format. Now I have a new requirement to determine if the email comes from a particular user. I can see the FROM field in the payload "MailMessage" But I don't know how to get the value of this field. Any idea on how to set up the message mapping? Thanks in advance.

Before the sender mail adapter processes the attachment in the email, it need to determine the email is actaully from the business user not someone else on server. Cuz everyone can send email to the email address the mail adapter connects to, that is why this security issue comes from.
Basically when you fetch a email with attachment, in Sxi_monitor, you can see two field in the payload, One is MailMessage and the other is MailAttachment-1. In the MailMessage, you can see all the emial header fields, such as From, To, Subject, Content etc. I need to check if the FROM field is email address we allowed. That is basic requirements. Let me knwo if you want me to explain it further.
Edited by: Bai Li on Dec 23, 2010 6:02 AM

Security requirements ....Urgent

Hi All
I am preparing some proof of concepts and please provide me more information of the following questions.
1. Can organization structure/position-based security be incorporated into the roles?
2. Report Distribution - Report split into separate reports for individual groups without having to maintain multiple reports.
3. Data is encrypted
4. Meets auditing and compliance requirements
5. Reliability ( Insense of SAP software)
6. Scalability( Insense of SAP software)
7. Administration ( Insense of SAP software)
8. Provide development tools and SDK to integrate into business process and other applications. (Category: Development )
Please provide me help.sap.com links if you think that would be the best answer.

Any ideas

New security required for managing rejections in UAR?

I have been told by someone at SAP about several new authobjs required for SP06 UAR "reject" features.   Objects include:
   ManageRejectionsGenerateAction
   ViewManageRejectionReasons
   ManageRejectionsCancelGenerationAction
   ViewRejectUsers
   ViewManageRejections
   ViewReject
I'd like to find out more about these to determine if all these are needed by reviewers OR security administrators OR both.   Anyone know where these are documented?
TIA,
hb

Wild solution...
1) Create a New User ID, which will be used for Just resetting the password based on the security question. This ID will have a password which everybody will know.
This ID will have only few authorizations.
2) Create a Custom Program which will take the User ID and the Question. Also some way of storing the Answer in some table (encrypted).
Based on the ID, the question of the user will be displayed. Based on the Input by the user, the answer will be checked.
3) If the answer is correct, reset the password and send a mail to the user id of the user. (Solution for resetting the password needs some analysis) The custom table will store user id, question, answer and the email id to which the email has to be sent.
Reward Points if useful.
Regards,
Abhishek Jolly

CAS - Security Requirements

Hello,
I'm currently developing some applications using ODP.NET on Oracle9i.
Since my applications have explicit secutity demands, I'm faced with problems regarding ODP and code access security.
Neither Docs nor Internet give any hints on this. My question is:
What permissions do I need to connect to an oracle database using odp.net?
I already tried unmanagedcode, registry, socket, and dns permissions. Even if I grant FullTrust permissionset, the applications keeps throwing securityexception.
highest stacktrace entries are:
at System.Security.CodeAccessSecurityEngine.CheckHelper(PermissionSet grantedSet, PermissionSet deniedSet, CodeAccessPermission demand, PermissionToken permToken)
at Oracle.DataAccess.Client.OpsCon.AllocValCtx(OpoConValCtx*& pOpoConValCtx)
at Oracle.DataAccess.Client.OracleConnection.Open()
the application is running with administrative privileges.
I'd greatly appreciate any help on this issue.
Thanks

Hi Arnold,
thanks for concerning about my issue. I just found a solution for it.
Here's an update of my current proceedings regarding this....
I permvieved oracle.dataaccess and found that skipverification is set on requestminimum, that imho in turn would mean that no cas restrictions are applied once skipverification is granted...
so i required skipverification on my assembly which uses odp.net, wrote a simple test app utilizing it - and yes, everything worked fine.
however, my "real" application constantly throwed securityexception. After invesigating callstack again and again I finally found the problem. My app tried to use the assembly using another one which had no skipverification demand. In consequence, the intermediate assembly revoked skipverification (because I always explicitly revoke not used permissions using requestoptional/unrestricted=false).
But now another question arises. Does this skipverification demand have any affects on my application in productional state? My app will be used by "normal users" which won't have much privileges. It is an app running locally.
Thanks again for your time spent with my issue...

MDM Security Requirements

Hello All:
I am new to MDM Security Administration and would like to know how and what controls are available in the system. (Example controls on able, fields etc)?
I am trying to compile a Task/Function Matrix which will help the functional teams convey their access requirement in the system.
Help is much appreciated.
Khurram

Hi Khurram,
I am new to MDM Security Administration and would like to know how and what controls are available in the system. (Example controls on able, fields etc)?
I am trying to compile a Task/Function Matrix which will help the functional teams convey their access requirement in the system.
MDM security is largely maintained by the presence of roles and users. We can have roles defined in MDM which will have proper authorizations. We can then create users and then assign them roles so that we can maintain the security in MDM. This all can be done through MDM console.
These authorizations ensures that only users who have access or read/write authorization will be able to perform theie respective tasks.
This is what is mentioned in SAP Help documentation in this regard.
A.              MDM Repository Security
A traditional SQL DBMS allows you to define basic user-level security to prevent unauthorized access to the database. You can specify the tables to which each user has access, granting at the table level either: (1) no access to the table; or (2) complete read/write access to the table, including access to all of its fields and records.
By contrast, MDM supports a dramatically more flexible multidimensional security scheme that provides much more granular control over which users can access an MDM repository, which functions they can perform, and which tables, fields, and records they can access. The MDM security scheme includes:
●      Users. A user represents an entity that can connect to and access the MDM repository. Each user has a user name and password, and is assigned one or more roles that collectively specify the complete set of privileges for that particular user.
●      Roles. Each role specifies a set of privileges to access each of the MDM repositoryu2019s tables, fields, lookup record values, and records, and to perform each of the repository functions. The same role can be assigned to more than one user.
●      Privileges. For each repository function, you can either prevent or allow the role to perform the function, and for each table and field, you can grant the role full read/write access or read-only access.
●      Constraints. For the Masks table and some lookup tables (those referenced by at least one single-valued lookup field and no multi-valued lookup fields), you can specify the set of masks or lookup values that should be visible and accessible for the role.
Precisely defining each role u2013and then assigning one or more roles to each useru2013 provides very fine control over who can access an MDM repository and how they can access it.
You can define repository security from within the MDM Console by working on the following administrative tables, which are located under a repositoryu2019s Admin node in the Console Hierarchy tree:
●      Roles. Defines the sets of functional permissions, access privileges, and record constraints that can be assigned to MDM user names.
●      Users. Defines the MDM user names that can access the MDM repository and manages their role assignments.
Within a SQL-based DBMS, you can use views to precisely control field- and record-level access by various users. However, views are cumbersome to manage, and more importantly, degrade system response, often creating severe performance bottlenecks.
B.                  Console-Level Repository Security
Recall that MDMu2019s multi-level security model supports granular, role-based repository access to functions and data from within MDM client applications. This multi-level security model extends to administrative functions within the MDM Console itself.
The MDM Console security scheme includes:
●      Users
Repository administrators must connect to an MDM repository with an MDM user name and password before any administrative tasks can be performed in the MDM Console.
●      Roles
The roles assigned to an administratoru2019s MDM user name determine which administrative functions are permitted or restricted for that administrator in the MDM Console.
●      Privileges
Administrative, Schema, and Change Tracking functional groups on the Roles table enable granular control over access to all MDM Console functions.
With these features, you can precisely define limited administrative roles for each of your administrators or administrative tasks. You can then assign these targeted roles to users instead of the Admin role, which retains full access to all MDM privileges.
Kindly go through the link below to get additional info:
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
Go to ->Repository maintenance->MDM repository security
You will find enough information.
Hope it helps.
Kindly reward points if helpful
Thanks and Regards
Nitin Jain

Security requirements in WLS6.0

Hi everybody,
We need to povide following requirements to the client can you please suggest
if they are avialable on Weblogic 6.0 with some patches or Security Realms can
be used in some way.
1. Change Password: Each individual user should be allowed to change his/her password.
2. When the users tries ot log in to the system then after three unsuccessful
tries his account should be locked.
3. Having a single store of users and permissions when I have two applications
running on two individaul weblogic servers. Physically different machines.
Regards
Sunil

Hey Sunil,
1. Change Password: Each individual user should be allowed to change his/her password.You probably have to do this programatically.
try Security.getRealm, then call deleteUser and newUser on the returned realm object --
delete the user, then create the new user with the new password. You probably should
search WebLogic APIs on their site for more info on how to do this.
As far as I know there is currently no exposed WebLogic API that allows you to directly
change the password. -- you have do delete, then add a new user.
2. When the users tries ot log in to the system then after three unsuccessful
tries his account should be locked.Yeah. There is a configuration property that will do this for you.
Check out http://e-docs.bea.com/wls/docs61/////ConsoleHelp/security.html and search for
"Lockout Enabled."
>
3. Having a single store of users and permissions when I have two applications
running on two individaul weblogic servers. Physically different machines.You are going to want to use an alternate (pluggable) realm to do this --
NTrealm, UnixRealm, RDBMSrealm, LDAPRealm, or custom realm.
Search docs on BEA's website for more information on this stuff.
Right now if you are going to use an alternate realm and you have a choice of any of the
above options, BEA recommends that you go with an LDAP server.
You can then administer all users and groups on this single instance of LDAP.
And you can have any number of instances of WebLogic hooked to your single LDAP server.
Cheers,
Joe Jerry

HELP With security requirement

Dear All,
I�ve been working with J2EE for a while and now i am facing a requirement I assume J2EE can face but I would like some professional orientation.
I�m developing a financial systema, Web & server, using GalssFish. The requirement I have is that "any system service" as I call the operations accessible from the client (web app) should be permission secured, that means, that for each User or Role, I sould be able to configure wich system services it can access ( at least) or more in depth wich level of security it has.
Roles are not fixed, the sysadmin should be able to configure any Role, and assign to it any User, what is fixed are the system services. The permissions to each role for system service access should be configurable.
I hope the explanation is understandable,
Can anyone help me in order to assume this is possible with glassfish, and where could I read something nearly close to what I need (i�ve read JEE tutorial, and a buch of papers of security in EJB and Web tier but none provides information for my requieremtent).
Regards,
Germ�n Viera.

Marco,
One place you could put additional auth-check for you custom table is SE11 -> Utilities -> Table maintenance generator -> Environment -> Modification -> Events.
I believe Event 25 is for inserting Auth-Check on table fields.
Hope this help.
Lye

Security requirements?

Similar Messages

Maybe you are looking for