10.2 Security Zones & Vulnerability Scanning

7.4 Security Zones & Vulnerability Scanning

The Preventive Paradigm: OCI Security Zones

Cloud Guard is detective: a misconfigured resource exists for a while before Cloud Guard finds it. Security Zones are preventive: they stop the misconfiguration from being created at all.

A security zone associates a compartment (and, by default, its subcompartments) with a security zone recipe. When anyone creates, updates, or moves a resource in the zone, OCI validates the operation against every policy in the recipe. If a policy would be violated, the operation is denied. For example, if the recipe forbids public buckets, both creating a public bucket and changing an existing bucket to public fail with an error.

Key characteristics:

• Validated for every user. A security zone policy is checked regardless of which user performs the operation, so even users with broad IAM permissions cannot create a non-compliant resource in the zone.
• Deny-only. A security zone policy never grants permissions. IAM still decides who can act; the zone decides which configurations are allowed.
• One zone per compartment. A compartment cannot belong to more than one security zone, but a subcompartment can be given its own zone.
• Cloud Guard is required. You must enable Cloud Guard before creating security zones. A Cloud Guard security zone target then periodically checks for violations in resources that existed before the zone was created.
• Governance of the zone itself. Users who can manage security zones can change a zone's recipe or remove a compartment from it, so restrict those permissions to a small security team.

---

Recipes: Maximum Security Recipe and Custom Recipes

Every tenancy has an Oracle-managed recipe named Maximum Security Recipe, which includes a curated set of policies. You cannot modify it, but you can create custom recipes that select the policies your organization needs.

Oracle groups security zone policies by security principle:

Database policies do not apply to Oracle Exadata Database Service on Cloud@Customer.

---

Designing With Security Zones

Because a zone can block more than you expect, plan the architecture before attaching it:

• Put workloads that need internet-facing components (such as a public load balancer) in a separate compartment outside the zone, and keep data tiers inside it.
• Create Vault keys first so encrypted resources can be launched in the zone.
• Choose the recipe carefully: the Maximum Security Recipe suits the most sensitive data, while a custom recipe can allow, for example, a NAT gateway for patching.
• Test Terraform stacks against the zone in a non-production compartment, because a denied operation fails the job.

---

OCI Vulnerability Scanning Service (VSS): Architecture & Engines

While Security Zones enforce architectural guardrails, software running on compute instances and inside container images is continuously susceptible to newly discovered Common Vulnerabilities and Exposures (CVEs) and configuration drift. OCI Vulnerability Scanning Service (VSS) provides fully managed, continuous, and automated vulnerability assessment across compute fleets and container registries.

VSS operates two specialized scanning engines:

1. Host Scanning Engine

The Host Scanning engine continuously assesses virtual machine and bare metal compute instances for operating system vulnerabilities and configuration flaws:

• Agent-Based Scanning: Host scanning uses the Oracle Cloud Agent with the Vulnerability Scanning plugin enabled, so no third-party agent, SSH credentials, or inbound firewall rules are needed. Agent-based scanning is enabled by default in a scan recipe; Oracle notes that without it, VSS can only inspect open ports on public IPs. A recipe can also use Qualys VMDR as the agent-based scanner.
• CVE Detection: Compares installed operating system packages with the public CVE database to report unpatched vulnerabilities.
• CIS Benchmark Compliance: Evaluates instance OS configurations against Center for Internet Security (CIS) distribution-specific benchmarks, identifying insecure system settings, unhardened permissions, and compliance failures.
• Open Port Detection: Scans listening network sockets on the instance, flagging listening services on unauthorized or dangerous network ports.
• Scan Recipes and Targets: A compute scan recipe sets the agent scan level, the CIS benchmark level (None, Lightweight, Medium, or Strict), the public IP port scan level (None, Light, or Standard), and a daily or weekly schedule. A target applies the recipe to a compartment; targeting the root compartment covers every subcompartment.

2. Container Image Scanning Engine

The Container Scanning engine protects cloud-native microservice pipelines deployed on OCI Container Engine for Kubernetes (OKE):

• Registry Integration: Integrates natively with Oracle Cloud Infrastructure Registry (OCIR).
• Scan on Push: After you add an image scanner to a repository, VSS scans every image pushed to it. If the repository already has images, the four most recently pushed images are scanned immediately. Scanning reports vulnerabilities; it does not block a deployment by itself, so pipelines should check the results.
• Automatic Rescanning: Images in repositories with scanning enabled are rescanned when new vulnerabilities are added to the CVE database, so older images are flagged when new issues are published.

---

Vulnerability Remediation Workflows and OS Management Hub

VSS identifies vulnerabilities, but modern security governance requires automated remediation pipelines:

1. Posture Visibility: VSS reports individual CVE findings with Common Vulnerability Scoring System (CVSS) severity ratings, affected package versions, and vendor fix advisories.
2. Cloud Guard: Cloud Guard configuration detectors can raise problems for scanned hosts and container images that have vulnerabilities or open ports, so findings appear alongside other security problems.
3. Patching with OS Management Hub: VSS reports problems but does not patch. Teams use OS Management Hub to schedule package and security updates for the affected instances, typically promoting updates through development, test, and production lifecycle environments.

Architectural Comparison: Security Zones vs. Cloud Guard vs. VSS

The following matrix contrasts the operational layers, enforcement mechanisms, and administrative capabilities of OCI's core security governance services: