5 Oracle SDM Cloud Security Patching
The Oracle® Session Delivery Management Cloud (Oracle SDM Cloud) cloud components follow the Continuous Integration-Continuous Delivery pipeline to patch any security vulnerabilities in the Oracle Cloud Infrastructure (OCI) and the Cloud Native Environment, as is Oracle's responsibility.
Security patches for the Management Cloud Engine (MCE) are a shared responsibility between Oracle and its customers. The MCE follows the Oracle Software Security Assurance requirement for handling security vulnerabilities and security fixes, which Oracle provides through the Oracle Critical Patch Update (CPU) process. Use the following link for the Oracle CPU portal: https://www.oracle.com/security-alerts/#CriticalPatchUpdates. It is the customer’s responsibility to check Oracle's CPU bulletin for security patches for the MCE. If available, it is the customer’s responsibility to download and apply the proper security patches.
Oracle SDM Cloud Data Privacy
Data privacy and isolation is part of the Oracle® Session Delivery Management Cloud (Oracle SDM Cloud) architecture, design, development, and operations for all customer data. When Personally Identifiable Information (PII) data is involved, Oracle SDM Cloud processes ensure that the product is compliant with the various data privacy regulations, including General Data Protection Regulation (GDPR).
In Oracle® Session Delivery Management Cloud (Oracle SDM Cloud) components, we make sure that logging includes no PII data. Oracle either removes or anonymizes such PII data fields after a certain usage period (30 days).
The data (call records, logs, and other artifacts with PII) from Oracle SDM Cloud on-premises components (Session Delivery NF and Management Cloud Engine (MCE)) are handled according to our customer's security policies. Any data process procedures are compliant with data privacy regulations applicable to the customer's jurisdiction.
Oracle SDM Cloud supports tenant isolation. Each tenant has their own environment and instances and no compute, memory, or storage is shared for any purposes, including in testing environments.
The Oracle SDM Cloud strictly follows Oracle Software Security Assurance (OSSA) guidelines for software development. Software security is always the top focus during software design, development, and deployment. Oracle Communications statically scans all source code and third-party software within our Continuous Integration-Continuous Delivery pipeline. Oracle Communications dynamically tests (for example, fuzzing and penetration) for all releases. For more information, see https://www.oracle.com/a/ocom/docs/oracle-cloud-infrastructure-security-architecture.pdf.