Please note I will be posting twice per day as we pass through and edit the Preliminary Specification.
Starting with the
Security & Access Control module we find that Oracle Corporation have a comprehensive suite of applications that provide for the security and access control that we are looking for. Falling under the Oracle Identity Management brand name. These products include tools for Access Management, Identity Administration, Directory Services and Governance. These product classifications come in a variety of different products and are configured in some specialty industry and management suites.
Two areas that are going to be challenging are going to be the Military Command & Control Metaphor (MCCM) and the inter-relatedness of the Joint Operating Committee and service industry representatives. Early on in the specification we noted a number of research areas that were needed to be conducted. These are two areas that will take some research dollars to resolve. To have the MCCM recognize members of different organizations will not be the challenge. To engage them and have them interact in the manner that we expect them to when we expect them to, will.
Oracle Identity Management resides within the Oracle Fusion Middleware product layer. As we indicated earlier in the Preliminary Specification this is Oracle’s Java Enterprise Server. Therefore these applications are open to be tailored to the user’s needs. So when we do sit down with Oracle and define the Security & Access Control module based on the user needs. These needs can be accommodated by the technologies that we have selected.
And it is through the efforts of the user community that we will resolve these issues. It is also one of the reasons that the budgets of People, Ideas & Objects software developments are where they are. We will have challenges to resolve in delivering these innovative systems to the industry. I would also remind producers that our value proposition sees the one time costs of these developments amortized over our subscribing base of producers. Yet each one of those producers receives the full scope of that development effort in terms of the software application.
We now look into the Oracle product classification of Access Management. Included in the Access Management classification are the following products; Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Entitlements Server, Oracle Identity Federation and Oracle Enterprise Single Sign-On Suite. Each of these products will be included in the Preliminary Specification as they have components that are required for the day to day use by the users, service providers, producers and Joint Operating Committees.
One area that I was surprised to learn that Oracle had been working on was in the area of working with partners, vendors and suppliers. Within the Oracle Access Manager it is noted that they are able to provide... “Building federated user communities that span company boundaries.” These are the beginning of both the pooling and Military Command & Control Metaphor (MCCM) that are critical to resolving so many of the issues that the oil and gas industry faces.
On the heels of Oracle Access Manager is their Adaptive Access Manager which takes the concept of intra partner interactions further with “Oracle Adaptive Access Manager makes exposing sensitive data, transactions and business processes to consumers, remote employees or partners via your intranet and extranet safer.” This is the nature of business in the future. Working with your partners, as is done in the Joint Operating Committee, is an effective means of reducing costs and increasing innovation in any industry. It’s only reasonable that the technologies are beginning to emulate these needs. In addition Oracle Adaptive Access Manager takes the level of security and authentication to a higher level. As a result, our demands regarding the pooling concept and the MCCM, I feel, will be less of a technical risk for the People, Ideas & Objects Preliminary Specification and subsequent developments.
The next application is the Oracle Entitlement Server which provides a dynamic access control element to the applications that use the server. Instead of hard wiring access control privileges into each application and user, you can dynamically generate them using the Oracle Entitlement Server. “The solution can manage complex entitlement policies with a standalone server or with a distributed approach that embeds information at the application level.” So when it needs to be determined if user X has access to Joint Operating Committee Y, a decision from the entitlement server, based on criteria within the application, can be made. If this information changes then the user would be denied access. This provides greater security based on policies and reduces the amount of detailed specific software development that is difficult, time consuming, and costly to maintain.
Federated Identities are also a major part of how the pooling concept and MCCM are implemented in the Preliminary Specification. Oracle Identity Federation provides high levels (attribute federation) to the applications that use it. We have specified in many of the modules, such as the Resource Marketplace module, the use of Federated Identities. Situations like where the contact and other information is maintained by the vendor. That information is comprehensive in nature and includes key organizational contacts, calendars and scheduling information. Working with the partners in the Joint Operating Committee and the representatives of the service industry in this way will effectively mitigate many of the technical software development issues we have.
One area that we will continue to face challenges however is in the Work Order. The ability to dynamically put together a working group to study some earth science or engineering research subject is critical to the innovative oil and gas producer. These are ad-hoc and made with partners that you may have no history with. Federated Identities will provide you with some of the information you need to form the partnership and grant application access, however, there is still the pooling of and sourcing of costs, and budgets which is the bureaucratic nightmare that mitigates and destroys the motivation for these working groups to form. We need to make sure these roadblocks do not get in the way. We have proposed to overcome these issues by developing an intuitive interface for the users forming the working group.
The last thing we want our users to be involved in is some form of mindless security access maze. Oracle Enterprise Single Sign-On Suite Plus promises to keep this from happening. Logging onto and off of systems as the user proceeds through the various modules and components of the applications is a must have. This product also promises the ability to provide this level of service on a remote basis. Which is much needed.
Oracle Identity Manager which will be used as the base product for role and identity management will also be the base of the Military Command & Control Metaphor for the People, Ideas & Objects Preliminary Specification. It is part of the Oracle Fusion Middleware product offering and as such is part of their Java Enterprise Server. Therefore we are able to build off the functionality that exists and enhance it with the user community's needs. Building off of the functionality will be somewhat limited as many of the concepts that are inherent in the MCCM are already captured in the Oracle Identity Manager.
Oracle Identity Manager is a highly flexible and scalable enterprise identity administration system that provides operational and business efficiency by providing centralized administration & complete automation of identity and user provisioning events across enterprise as well as extranet applications. It manages the entire identity and role lifecycle to meet changing business and regulatory requirements and provides essential reporting and compliance functionalities. By applying the business rules, roles, and audit policies, it ensures consistent enforcement of identity based controls and reduces ongoing operational and compliance costs
Oracle Internet Directory and Oracle Virtual Directory product offerings are up next. A little off topic but Oracle Internet Directory is a relational database derived directory server. That Oracle is providing the marketplace a directory server based on relational database technology speaks to the power of their relational database. They claim they have the performance for two billion users. I see advantages of using this product over their traditional directory server and have therefore selected it for the Preliminary Specification. It will provide us with some flexibility when we ask some of the comprehensive and demanding questions of the technologies.
Oracle Internet Directory could be deployed as an industry wide, and by that I mean oil and gas and service industry wide directory server. There it can integrate with the information that is held in other Oracle products, such as Oracle Identity Manager which would be deployed at the producer firm, Joint Operating Committee and service industry representative level. I think we could provide large volumes of information consisting of everything that exists in the industry. The producers, service industry, Joint Operating Committees, the people who work within the industry, etc. Because this is a database we have some interesting opportunities here.
And Oracle Virtual Directory may be the beginning of optimizing the relational database opportunities. So what we will have is a global database of names within the Oracle Internet Directory and these will relate to the information contained with Oracle Identity Manager and other applications. What Oracle Virtual Directory will provide us with is a seamless way in which to browse, and for applications to see, these datastores as one.
Within the Preliminary Specification we want to access the contact information of the people or firm that provide services or products to the producers or Joint Operating Committees. As we indicated we want the individuals and service industry providers to maintain their own contact and basic data. These will be maintained in the Oracle Internet Directory for each and every producer or Joint Operating Committee to access the most recent and up to date information. This will save an immense amount of time on behalf of the producers and Joint Operating Committees, as well as the individuals and service industry providers. When looking for someone the search capabilities will be significant as we have added the “Vendor / Supplier Contact Database” and the “Actionable Information Interface” to this base data in the Resource Marketplace module.
Now we want to look into Oracle Identity Analytics as part of the Security & Access Control module of the Preliminary Specification. The primary purpose of this application is to provide governance over the access privileges granted to the users of the People, Ideas & Objects application modules. Many of the functions and processes that are provided in Oracle Identity Analytics are either necessary or of significant value that it has been included in the Preliminary Specification.
The first area is the “why and how” of the users access. Providing documentation of what information was accessed by what users and if any of the access violates any of the established policies. Ensuring that data access by users is compliant with the corporate and application policies, that users are not unnecessarily being abused by overtly secure systems and overall good corporate governance is achieved. All of the data that is collected during data access, that is the “why and how” of the users access. Is compiled in a “Data Warehouse” for further analytical analysis and querying. This will help to show trends and usage patterns that will form new policies and procedures and security provisions.
Another useful function within the Oracle Identity Analytics application is the Segregation of Duties feature. In many areas of a corporation, certain process functions must be undertaken by specific individuals and in some cases different individuals. This feature provides for that assurance. It is also Sarbanes-Oxley compliant. This is important when the Joint Operating Committee is small, as we mentioned the other day. And we have to assign many roles to a few individuals. This application will ensure that the processes provide the appropriate governance is maintained by segregating the roles that need to be kept apart for compliance purposes.
There is a comprehensive and customizable dashboard interface for the users of the Oracle Identity Analytics software to analyze the data and particularly the data warehouse. Filled with reports and data that an effective user can use to determine where and how the People, Ideas & Object producer client might be susceptible to access control violations.
The last feature that I want to highlight is what Oracle calls their Role Lifecycle Management. This provides the Oracle Identity Analytics user with the ability to do “what if” analysis in terms of the implications to identities and roles within the People, Ideas & Objects application. It also contains a role change approval process, role versioning and a role rollback feature. These will be needed in determining and maintaining the Military Command & Control Metaphor.
We now step down from the Oracle Fusion Middleware layer to the actual Oracle Database for some of the security features that we seek. The first product in this stack is Oracle Advanced Security. It provides the authentication, and encryption of both the database and the network activity. It is possible, and I highly recommend that all the data and information that is used in the People, Ideas & Objects application modules be encrypted in the database and on the network. This increases the load on the systems and will require additional effort in terms of key management, however, I think the nature of the data and information and the manner in which the applications are provided, a “cloud based” solution, this level of security is necessary.
Oracle Audit Vault is another product that I recommend for the
Preliminary Specification. It provides a central location and management of the audit information for compliance purposes. Giving our users the ability to manage the data, information, privacy policies and security. Oracle Audit Vault is also Sarbanes Oxley compliant.
This next Oracle product is a definite addition to the Preliminary Specification. Oracle Label Security will work in many different ways within the modules however here is how I see just two examples. What the application does is designate certain individuals with higher level security clearances. It also designates certain data fields with certain levels of security clearances. Those with high enough security clearances and appropriate authorizations are then able to read these database fields. Within the People, Ideas & Objects application we want to make sure that the reserves, accounting information and strategy discussions of each producer firm remain confidential to a select group of individuals within that firm. With Oracle Label Security that is possible. We also want to ensure that the appropriate people within the chain of command in the Military Command & Control Metaphor have access to the appropriate materials to make the appropriate decisions. This will allow those individuals to have access to these materials without making it available to everyone in the chain of command.
Although not that pertinent to the users of the People, Ideas & Objects applications we have also included Oracle Configuration Management, Oracle Database Firewall and Oracle Database Vault as part of the Preliminary Specification. These will help to keep the applications and the Oracle Database running as they should. Oracle Configuration Management will determine if there is a change in the configuration, either a patch, or if something has gone wrong it will correct itself back to the specified configuration. Ensuring that what is promised to the users of People, Ideas & Objects is what is provided. Oracle Database Firewall ensures no SQL statements that are inconsistent with the users or applications are passed through to the database. And Oracle Database Vault provides the ability to have only certain IP addresses or users to run certain SQL commands and to lock databases from having any operations being conducted on them.
Backing up your data and information are two of Oracle’s strengths. They provide excellent tools for this in Oracle Secure Backup. With the database being encrypted it is interesting that the backup is of the encrypted database. What we will need to do in the Preliminary Specification is to determine in great detail what precisely will be the backup strategy that will be used for the People, Ideas & Objects application.
Lastly there is Oracle Total Recall. A product that helps in accessing historical data. Oracle Fusion Applications provides some interesting solutions with respect to how they handle legacy applications and we will get into those as we proceed through the Preliminary Specification.
The
Preliminary Specification provides the oil and gas producer with the most
profitable means of oil and gas operations. People, Ideas & Objects
Revenue Model specifies the means in which investors can participate in these user defined software developments. Users are welcome to join me
here. Together we can begin to meet the future demands for energy.