Locking Down EBS Configuration: The Foundation Layer
Eric Bing
August 31, 2026
Oracle gives you a long list of E-Business Suite security recommendations. The harder question is which ones matter most.
Over the next few posts I’m going to continue to drill into level one of the Chiton Guard EBS Security Maturity Model. Oracle already gives you a strong start — the Secure Configuration Console ships with the platform and currently runs 29 checks against your environment. These checks cover a set of recommendations from Oracle’s security guidance that can be evaluated directly from the application. Running these checks from the application is the first place to start. But the checks aren’t all equally important.
Level 1 of the Chiton maturity model, Basic Platform Hygiene, breaks into four pillars: patch level, TLS and web-tier configuration, Oracle’s built-in security features, and account and profile hygiene. I prioritize controls that prevent initial exposure or ingress above controls whose benefit is limiting damage after a successful attack. Here’s the order I’d work them in.
Patch Level
Keeping up to date with Oracle security patches has always been important but now is critical because of the quick turnaround for exploits. See my post on CVE-2026-46817 for why that’s so. But inside patch level, not everything carries equal weight. EBS application and web-tier patches close vulnerabilities that sit closer to what’s actually reachable.
EBS application and web-tier vulnerabilities that are directly reachable from untrusted networks deserve particular urgency. Database and Java patches matter too, but their practical exposure depends on how the affected component can be reached in your environment.
Cherry-picking has its own dangers. Oracle certifies and tests these layers together as part of the Oracle security patches, so applying these piecemeal will leave you in an untested configuration. In an ideal world you patch everything together. When time is short, patch EBS and middleware first and close the gap on database and Java as soon as you can.
Determining how to get current is its own exercise. Oracle’s ECPUC, EJCPUC, and ETCC tools exist for exactly that. I’ll do a deeper dive on these.
TLS and Web-Tier Configuration
TLS comes next, but once again not everything is the same priority. TLS at the edge, the load balancer (or the inbound connection to OHS), is the highest priority: it’s what’s actually facing the internet. TLS between the mid-tier and the database, or between nodes, is a lower exposure risk, though it’s still worth doing for defense-in-depth.
HTTP security headers and ModSecurity activation belong in this pillar too, both doing their work at the edge. This one also gets its own post.
Oracle’s Built-In Security Features
Understanding the status of Allowed Resources, Allowed Forwards, and Allowed Redirects lives in this area — although the implementation belongs in levels 3 and 4. These are critical security components that are relatively easy to validate and provide a lot of bang for the buck. The critical thing right now is to ensure that you are logging unrecognized resources on your production instance — this gives you the evidence you need before you start blocking things.
FND_SEC_LOG_RESOURCES = UNRECOGNIZEDFND_SEC_LOG_FORWARDS = UNRECOGNIZED
I’ll be drilling into these in later posts.
Account and Profile Hygiene
Profile option hardening spans a range of issues, from critical profiles that you want to ensure are always enabled to product-specific profiles that may not be relevant in your environment. Database lockdown includes password hygiene and restricting the PUBLIC role.
Validating who should have diagnostics enabled, and who should have access to diagnostic web pages, is a matter of enforcing least privilege.
Some of these controls are low-hanging fruit that should be addressed immediately, while others require more configuration and analysis. The point is not that you should ignore any of them, but rather that you should understand their relative importance and focus first on configuration weaknesses that leave the application open to initial external compromise.
What the Chiton Assessment Adds
The Secure Configuration Console gives you a strong baseline. The free Chiton Guard Assessment supplements the Console. It can be run repeatedly to track drift, so you see not just where you stand today but what has changed since the previous assessment. Because it examines the database, application, and web tiers, it can verify important settings outside the Console’s native view. It also checks for indicators associated with recent known exploits.
Eric Bing is the founder and principal security architect at Chiton Guard. He spent 32 years working on Oracle E-Business Suite, including 12 years leading the EBS security and privacy team.