Oracle Security Zones

Cloud’s on-demand delivery model enables faster, more flexible, and more cost-effective application development, increasingly via DevOps, containers, and microservices. This same dynamism breaks assumptions behind legacy security, which evolved for slow-changing, physically owned infrastructure that could be catalogued in a CMDB and governed through periodic scans and manual access processes. In cloud environments, resources are created and destroyed continuously, inventories fluctuate, and teams may misconfigure unfamiliar services (including newer cloud service types), creating exploitable exposure. Rapid DevOps deployment further increases risk by allowing new components to be pushed without consistently enforced security checks, while excessive privileges in ephemeral components can expand the attack surface.

The needed response is “dynamic just-in-time” security: policy-based controls enforced automatically whenever resources are created, modified, moved, or deleted, ideally implemented by the cloud provider at the control plane. Oracle Cloud Infrastructure (OCI) Security Zones are presented as this enforcement capability. Security Zones overlay one or more OCI compartments and apply a chosen set of resource-based security policies to all resources created within them. Policies are enforced at the infrastructure control plane and cannot be overridden by privileged user actions, while Oracle Cloud Guard complements Security Zones by providing visibility and monitoring that reflects active zone policies.

Originally released as immutable Maximum Security Zones (Sept 2020), Security Zones evolved in May 2022 to allow customers to define and change their own policy sets from a predefined list. Policies cover areas such as denying public access, restricting resource movement/association, requiring encryption with customer-managed keys, ensuring backups and durability, preventing data copying outside the zone, and requiring Oracle-approved security configurations. Strengths include true enforcement (not just monitoring), customization, applicability to existing workloads, broad resource coverage, and Cloud Guard integration; challenges include limited predefined admin roles, gaps in network traffic policy, lack of managed immutability, and missing mappings to common standards/frameworks.

• OCI Security Zones were released in September 2020 as Maximum-Security Zones with strict, immutable security policies.
• In May 2022, OCI introduced an updated Security Zones version that allows customers to define their own policy sets and change them when needed.
• Security Zones overlay one or more OCI compartments with a customer-defined set of security policies.
• Operations that violate a Security Zone policy are denied when resources are created or updated inside a zone.
• Security Zone policies are enforced at the OCI infrastructure control plane.
• Security Zones complement Oracle Cloud Guard, which monitors security posture and reflects active Security Zone policies with monitoring targets.
• Administration of Security Zones is available via the OCI Console, REST APIs, CLI, SDK, and Terraform.
• Default access to Security Zones is limited to users with explicit administrative permissions.
• Policy themes include restricting resource movement, restricting resource association, denying public access, requiring encryption with customer-managed keys, and ensuring database backups remain within the zone.
• Security Zone policies currently cover resource areas including Networking, Compute, Storage, Database, Encryption, Backups, and sanctioned images.

• “Dynamic just-in-time infrastructure and development requires a dynamic just-in-time approach to IT security.”
• “In the race to deploy functionality, it is often the case that security takes second place.”
• “Dynamic just-in-time IT needs dynamic just-in-time security controls.”
• “These controls must be policy based and implemented automatically as IT service elements are created, modified, moved, and deleted.”
• “This is best implemented by the cloud service itself since this has intimate knowledge of the customers’ resources as well as the control plane to enforce controls.”
• “Security Zones enforce resource-based security policy on cloud infrastructure and help customers to implement effective cloud security practices by enforcing security posture from the start.”
• “If any policy is violated, that operation is denied.”
• “The security posture of existing compartments can be improved simply by applying Security Zone policy.”
• “Security Zone policies are enforced at a control plane level to provide robust protection against compromise.”
• “Weakness in tenant administrative practices and entitlement management could still be exploited to maliciously change Security Zone policies and weaken security posture.”