8.3 OCI Perimeter Protection, Vulnerability Scanning & Bastion Service

8.3 OCI Perimeter Protection, Vulnerability Scanning & Bastion Service

[!NOTE] Exam Blueprint Scope: Perimeter defense, threat prevention, and access management are core elements of Domain 3 (Security Services) on the OCI Foundations Associate (1Z0-1085-26) exam. Candidates must master the distinct capabilities of OCI Web Application Firewall (WAF) at Layer 7, the enterprise deep packet inspection of OCI Network Firewall, automated security hygiene via OCI Vulnerability Scanning Service (VSS), and serverless administrative jump-host access via OCI Bastion Service.

A resilient enterprise security architecture adheres to the principle of Defense-in-Depth—the deployment of multiple, layered security controls such that the failure of any single protective barrier does not result in a total compromise. In Oracle Cloud Infrastructure (OCI), defense-in-depth spans from the external public internet edge, through software-defined network perimeters and host operating systems, down to internal administrative access channels.

To safeguard workloads against sophisticated web exploits, malware incursions, unpatched vulnerabilities, and brute-force access attacks, OCI provides a specialized suite of perimeter defense and access management services: Web Application Firewall (WAF), Network Firewall, Vulnerability Scanning Service (VSS), and OCI Bastion.

---

OCI Web Application Firewall (WAF)

The OCI Web Application Firewall (WAF) is a comprehensive, enterprise-grade security service operating at Layer 7 (Application layer) of the OSI reference model. It inspects incoming HTTP and HTTPS web traffic to protect internet-facing applications, APIs, and microservices from malicious exploits, automated bots, and application-layer denial-of-service attacks.

Deployment Topologies

OCI WAF can be deployed in two flexible architectural modes:

1. Edge WAF (Global Anycast): Deployed across Oracle's globally distributed edge Points of Presence (PoPs). Client traffic is directed to the edge WAF via public DNS routing before ever reaching the customer's VCN, stopping threats as close to the attack source as possible.
2. Regional WAF (Load Balancer Integration): Attached directly to an OCI Public Load Balancer within a specific cloud region, providing deep Layer 7 inspection directly at the regional ingress boundary.

Core WAF Capabilities

• Protection Rules (OWASP Top 10): WAF inspects HTTP headers, query parameters, cookies, and POST request bodies against thousands of curated signatures to block the Open Web Application Security Project (OWASP) Top 10 web vulnerabilities. This includes mitigating SQL Injection (SQLi), Cross-Site Scripting (XSS), Remote Code Execution (RCE), Local File Inclusion (LFI), and Server-Side Request Forgery (SSRF).
• Access Control Rules: Administrators define deterministic policies to permit or restrict traffic based on client attributes, including source IP address CIDR blocks, HTTP request methods (e.g., blocking PUT or DELETE requests from public users), URL paths, user-agent strings, and Geo-blocking (allowing or prohibiting traffic originating from specific geographic countries).
• Rate Limiting Rules: Protects web applications against Layer 7 HTTP flood Distributed Denial of Service (DDoS) attacks and automated credential-stuffing brute force. When a client IP exceeds a designated request volume threshold within a rolling time window (e.g., more than 50 requests per second), WAF temporarily throttles or blocks subsequent requests from that client.
• Bot Management: Analyzes incoming client connections using advanced behavioral algorithms, JavaScript challenges, and CAPTCHA verifications to distinguish human users from malicious scraping bots, automated scalpers, and unauthorized scanners, while automatically whitelisting legitimate search engine crawlers (such as Googlebot).

---

OCI Network Firewall

While OCI WAF specializes in inspecting HTTP/HTTPS traffic at Layer 7, enterprise architectures require broad, stateful packet inspection across all network protocols (TCP, UDP, ICMP) entering, exiting, or traversing internal subnets. This is delivered by OCI Network Firewall.

Next-Generation Firewall Architecture

OCI Network Firewall is a fully managed, cloud-native, next-generation firewall (NGFW) service powered by industry-leading Palo Alto Networks technology:

• Cloud-Native & Scalable: Deployed directly into a dedicated subnet within your VCN as a highly available, managed network appliance. It automatically scales capacity to accommodate fluctuating traffic volumes without requiring administrators to manually cluster virtual appliances or manage underlying compute hosts.
• Operates Across Layers 3 through 7: Provides stateful packet filtering from Layer 3 (network IP) and Layer 4 (transport ports) up through Layer 7 (application inspection).

Advanced Capabilities of Network Firewall

• Deep Packet Inspection (DPI): Evaluates the full payload of network packets, identifying the true underlying application protocol regardless of the port number used (e.g., identifying SSH running over non-standard port 80).
• Intrusion Detection & Prevention System (IDS/IPS): Continuously scans network traffic flows against extensive threat intelligence and exploit signatures, actively detecting and intercepting network-borne vulnerabilities, malware propagation, Trojan beacons, and port sweeps.
• URL and Domain Filtering: Enforces granular outbound internet egress filtering. Instead of broad IP allowlists, administrators can configure strict domain and URL rules that restrict backend instances to connecting only to explicitly authorized fully qualified domain names (e.g., allowing updates only to *.oracle.com and repo.almalinux.org while blocking command-and-control servers).
• TLS Decryption & Forward Proxy: Inspects inbound and outbound encrypted SSL/TLS sessions to uncover hidden threats concealed within encrypted traffic streams.

Network Firewall vs. Security Lists / Network Security Groups

Understanding the distinction between native VCN packet filtering and Network Firewall is a common exam focus:

---

OCI Vulnerability Scanning Service (VSS)

Security defense is incomplete without continuous assessment of internal infrastructure hygiene. Unpatched operating systems and open network ports represent the most common entry points for attackers. OCI Vulnerability Scanning Service (VSS) provides automated, routine security scanning across compute instances and container images.

Core Scanning Capabilities

1. Compute Host Scanning:
   • Operates via the lightweight OCI Management Agent (or Oracle Cloud Agent) pre-installed on Oracle Linux, Ubuntu, Windows Server, and Red Hat Enterprise Linux instances.
   • OS Vulnerabilities: Checks installed packages against up-to-date repositories of known Common Vulnerabilities and Exposures (CVEs) and flags missing security patches.
   • Host Port Scanning: Probes the instance to identify open, listening network ports that may expose unnecessary attack surfaces.
   • CIS Benchmark Compliance: Evaluates OS configuration settings against Center for Internet Security (CIS) security benchmarks to identify insecure OS settings (such as permissive file permissions or disabled audit logging).
2. Container Image Scanning:
   • Automatically scans container images stored within Oracle Cloud Infrastructure Registry (OCIR).
   • Identifies vulnerable software packages, libraries, and dependencies within images before they are deployed to Oracle Container Engine for Kubernetes (OKE) or Container Instances.

Operational Workflow

• Administrators configure Scan Recipes (specifying scan frequency: daily, weekly, or on-demand) and assign them to Scan Targets (designated compartments).
• VSS generates comprehensive vulnerability reports in the OCI Console, categorizing findings by CVSS severity score (Critical, High, Medium, Low) and providing links to vendor security advisories and patch instructions.
• VSS is offered at no additional charge for standard compute and container scanning.

---

OCI Bastion Service: Serverless Private Administrative Access

In modern cloud architectures, best practice dictates placing all database systems, application backends, and sensitive compute workloads inside private subnets with zero public IP addresses, completely isolated from direct internet access. However, systems administrators still require secure administrative access (via SSH for Linux or RDP for Windows) to manage these private hosts.

The Failure of Traditional Bastion (Jump) Hosts

Historically, organizations solved this by deploying a traditional "bastion" or "jump box" virtual machine:

• An administrator provisioned a Linux VM in a public subnet, attached a public IP address, and opened SSH port 22 to the internet.
• Critical Vulnerabilities: Traditional jump hosts create severe security liabilities: they are subjected to relentless internet brute-force attacks, require continuous operating system patching, incur ongoing 24/7 compute licensing costs, and present a single point of failure where a compromised jump host grants the attacker full access to internal private subnets.

The OCI Bastion Solution

OCI Bastion is a fully managed, serverless, highly available service that provides secure, time-limited, session-based proxy access to private resources without public IPs:

+-----------------------------------------------------------------------------------------+
|                           OCI BASTION SERVICE ARCHITECTURE                              |
+-----------------------------------------------------------------------------------------+
|                                                                                         |
|   +--------------------------+                                                          |
|   | Administrator Workstation|                                                          |
|   | (Public Internet / Home) |                                                          |
|   +------------+-------------+                                                          |
|                |                                                                        |
|                | 1. Temporary Session Request (SSH Public Key + Client IP allowlist)    |
|                v                                                                        |
|   +--------------------------+                                                          |
|   |    OCI Bastion Service   | <--- Serverless, fully managed proxy (No VM to patch)     |
|   |   (Regional Endpoint)    | <--- Session auto-expires (Max 3 hours)                  |
|   +------------+-------------+                                                          |
|                |                                                                        |
|                | 2. Proxied Private Connection across internal VCN fabric               |
|                v                                                                        |
|   +--------------------------+                                                          |
|   | Private Compute Instance | <--- Resides in Regional Private Subnet (NO Public IP)   |
|   | (Linux SSH / Windows RDP)|                                                          |
|   +--------------------------+                                                          |
+-----------------------------------------------------------------------------------------+

Key Capabilities & Security Controls of OCI Bastion

• Serverless & Managed: There are no virtual machines to deploy, manage, patch, or pay for. The service is provisioned directly into a target VCN subnet.
• Zero Public IP Exposure: Target compute instances and databases remain strictly isolated in private subnets with no public IP addresses.
• Time-Limited Sessions: Bastion sessions are ephemeral; administrators configure a session Time-to-Live (TTL) with a maximum lifetime of 3 hours (180 minutes). When the session expires, access is immediately and automatically revoked.
• Client CIDR Allowlisting: Access through a bastion can be strictly constrained to accept connections only from designated client public IP addresses (e.g., corporate office CIDR ranges).
• SSH Key Authentication: Uses cryptographic SSH key pairs; raw private keys are retained exclusively on the administrator's local machine.
• Comprehensive Audit Trails: Every session creation request, connection attempt, and administrative access event is logged to OCI Audit and OCI Logging services for regulatory accountability.

Supported Bastion Session Types

1. Managed SSH Session:
   • Provides direct SSH shell access to private Linux compute instances.
   • Requires the target instance to run the OCI Compute Agent, which handles user authentication without requiring manual SSH key distribution to target hosts.
2. SSH Port Forwarding Session:
   • Establishes a secure SSH tunnel (port forward) from the administrator's local workstation through the Bastion service to any target private IP and port.
   • Enables secure connectivity for arbitrary TCP services that cannot run the compute agent, including Windows Remote Desktop Protocol (RDP port 3389), Oracle Database listeners (port 1521), MySQL/PostgreSQL endpoints, or Autonomous Databases on private endpoints.

---

OCI Security Services Decision Matrix