Oracle Linux - monitor file changes with auditd

As part of a security and audit strategy it is very common to ensure certain files are monitored for access, changes and execution. This is especially useful for systems that require level of security and where you need to ensure that every change to critical files is monitored. Also some auditors will require that you are able to provide proof of who has had access to a file. When you have those requirements auditd will be the solution you want to implement under Oracle Linux.

The auditd solution is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities.

Installing auditd
Installing auditd under Oracle Linux can be done by using YUM by executing the below command;

yum install audit

If you now do a check with which you will find that you now have auditd under /sbin/auditd which we now have to ensure will start when your system boots. This will ensure that all configuration you make for auditd will be active every time you boot.

To  ensure it will start at boot execute the below command.

chkconfig auditd on

To check if auditd is configured to start at boot use the chkconfig command. As you can see it is stated as "on" for runlevel 2, 3, 4 and 5.

[root@docker ~]# chkconfig --list auditd
auditd          0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@docker ~]# 

Now you will have to make sure auditd is running manually the first time. You can use the below example where we check the status of auditd, find out it is not running, start it, check again and see it is running. At the end of this we are sure we have auditd up and running.

[root@docker ~]# 
[root@docker ~]# service auditd status
auditd is stopped
[root@docker ~]# 
[root@docker ~]# service auditd start
Starting auditd:                                           [  OK  ]
[root@docker ~]# 
[root@docker ~]# service auditd status
auditd (pid  17993) is running...
[root@docker ~]# 

Configure auditd 
As an example we will create a rule to watch changes on a file. Based upon this rule the auditd daemon will monitor it and as soon as someone changes the file the audit data will be written to disk.

In this example we will place the repository file for the Oracle Linux repository under audit and we want to be informed when someone reads the file, changes the content or append the file. This is done with the below command:

[root@docker yum.repos.d]# auditctl -w /etc/yum.repos.d/public-yum-ol6.repo -p war -k main-repo-file
[root@docker yum.repos.d]#

In this example the following flags are used:

-w /etc/yum.repos.d.public-yum-ol6.repo is used to insert a watch on the file.
-p war is used to state the watch applies on write, append and read.
-k main-repo-file is used to make a simple naming for the watch rule.

Do note... that if you want to have your auditd rules persistent you have to ensure the rules are in the .rule file. An empty example is shown below:

[root@docker yum.repos.d]# cat /etc/audit/audit.rules 
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page

[root@docker yum.repos.d]# 

Watching auditd in action
with the rule in place you can see that changes (or views) are registered. An example is shown below where we (as root) made a change to the file:

----
time->Mon Oct 30 19:16:13 2017
type=PROCTITLE msg=audit(1509390973.068:30): proctitle=7669002F6574632F79756D2E7265706F732E642F7075626C69632D79756D2D6F6C362E7265706F
type=PATH msg=audit(1509390973.068:30): item=0 name="/etc/yum.repos.d/public-yum-ol6.repo" inode=138650 dev=fb:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1509390973.068:30):  cwd="/etc/yum.repos.d"
type=SYSCALL msg=audit(1509390973.068:30): arch=c000003e syscall=89 success=no exit=-22 a0=7ffd6bb1ed80 a1=7ffd6bb1fdd0 a2=fff a3=7ffd6bb1eb00 items=1 ppid=17847 pid=18206 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=16 comm="vi" exe="/bin/vi" key="main-repo-file"
----

You can use a number of tools such as aureport or ausearch to find the changes that have happend on your system. Having auditd up and running and ensuring you have the right configuration in place is just the beginning. You will have to ensure you that you have the right reporting, alerting and triggering in place. Just logging it is not providing security, (automatically) reviewing and taking action upon events is what will help you to get a higher level of security on your Oracle Linux system.

Oracle Linux - digging into the bioset Kernel working

when you are looking into the processes that are running on your Oracle Linux machine you might notice a process, or processes named bioset. In our example we are running an Oracle Linux 6 machine in a vagrant box, and for informational purposes, we are using it to run dockerd to serve Docker containers for development purposes.

As you can see in the below example, we find a number of bioset processes running on our Oracle Linux machine;

[root@docker ~]# ps -ef|grep bioset
root        30     2  0 12:04 ?        00:00:00 [bioset]
root       299     2  0 12:04 ?        00:00:00 [bioset]
root       302     2  0 12:04 ?        00:00:00 [bioset]
root      4136     2  0 14:20 ?        00:00:00 [bioset]
root      4138     2  0 14:20 ?        00:00:00 [bioset]
root      4140     2  0 14:20 ?        00:00:00 [bioset]
root      4379  3470  0 14:35 pts/0    00:00:00 grep bioset
[root@docker ~]# 

Finding bioset
To find out what bioset is and where it is being spawned from you can look at your processes in a number of ways. You can use the below command which provides a nice tree view of all the processes based upon the ps command or you can use the standard pstree command.

ps axfo pid,euser,egroup,args

using the above command we get the below output (cut down to the relevant part only);

As you can see bioset is a mentioned a number of times, and always as a "child" from kthreadd. Where kthreadd is within Oracle Linux (Linux in general) the kernel thread daemon and by doing so it is one of the backbone components of the Linux kernel which makes sure your kernel threads are handled in the right manner.

root@docker ~]# ps axfo pid,euser,egroup,args
  PID EUSER    EGROUP   COMMAND
    2 root     root     [kthreadd]
    3 root     root      \_ [ksoftirqd/0]
    5 root     root      \_ [kworker/0:0H]
    6 root     root      \_ [kworker/u4:0]
    7 root     root      \_ [rcu_sched]
    8 root     root      \_ [rcu_bh]
    9 root     root      \_ [rcuos/0]
   10 root     root      \_ [rcuob/0]
   11 root     root      \_ [migration/0]
   12 root     root      \_ [watchdog/0]
   13 root     root      \_ [watchdog/1]
   14 root     root      \_ [migration/1]
   15 root     root      \_ [ksoftirqd/1]
   16 root     root      \_ [kworker/1:0]
   17 root     root      \_ [kworker/1:0H]
   18 root     root      \_ [rcuos/1]
   19 root     root      \_ [rcuob/1]
   20 root     root      \_ [khelper]
   21 root     root      \_ [kdevtmpfs]
   22 root     root      \_ [netns]
   23 root     root      \_ [perf]
   24 root     root      \_ [khungtaskd]
   25 root     root      \_ [writeback]
   26 root     root      \_ [ksmd]
   27 root     root      \_ [khugepaged]
   28 root     root      \_ [crypto]
   29 root     root      \_ [kintegrityd]
   30 root     root      \_ [bioset]
   31 root     root      \_ [kblockd]
   32 root     root      \_ [ata_sff]
   33 root     root      \_ [md]
   34 root     root      \_ [kworker/0:1]
   36 root     root      \_ [kswapd0]
   37 root     root      \_ [fsnotify_mark]
   49 root     root      \_ [kthrotld]
   50 root     root      \_ [acpi_thermal_pm]
   51 root     root      \_ [kworker/u4:1]
   52 root     root      \_ [kworker/1:1]
   53 root     root      \_ [kpsmoused]
   54 root     root      \_ [bcache]
   55 root     root      \_ [deferwq]
   56 root     root      \_ [kworker/0:2]
  200 root     root      \_ [scsi_eh_0]
  201 root     root      \_ [scsi_tmf_0]
  202 root     root      \_ [scsi_eh_1]
  203 root     root      \_ [scsi_tmf_1]
  233 root     root      \_ [scsi_eh_2]
  234 root     root      \_ [scsi_tmf_2]
  298 root     root      \_ [kdmflush]
  299 root     root      \_ [bioset]
  301 root     root      \_ [kdmflush]
  302 root     root      \_ [bioset]
  368 root     root      \_ [kworker/0:1H]
  369 root     root      \_ [jbd2/dm-1-8]
  370 root     root      \_ [ext4-rsv-conver]
  626 root     root      \_ [iprt-VBoxWQueue]
  627 root     root      \_ [ttm_swap]
  738 root     root      \_ [jbd2/sda1-8]
  739 root     root      \_ [ext4-rsv-conver]
  827 root     root      \_ [kauditd]
  889 root     root      \_ [ipv6_addrconf]
 3744 root     root      \_ [kworker/1:1H]
 4122 root     root      \_ [loop0]
 4123 root     root      \_ [loop1]
 4126 root     root      \_ [kdmflush]
 4133 root     root      \_ [dm_bufio_cache]
 4136 root     root      \_ [bioset]
 4137 root     root      \_ [kcopyd]
 4138 root     root      \_ [bioset]
 4139 root     root      \_ [dm-thin]
 4140 root     root      \_ [bioset]

However, now we know where bioset is commong from and the parent is the kernel thread daemon we still do not know what bioset is doing.

What is bioset
As we now known bioset is part of the Linux kernel, it is used to Block Input Output instructions. This means it is an integrated part of the inner workings of the kernel when operations to a block device need to be done. bioset finds its origin in the struct bios_set located in bio.h within the Linux kernel code. The bio_set struct is shown below and can also be found in the kernel Github code repository.

/*
 * bio_set is used to allow other portions of the IO system to
 * allocate their own private memory pools for bio and iovec structures.
 * These memory pools in turn all allocate from the bio_slab
 * and the bvec_slabs[].
 */
#define BIO_POOL_SIZE 2

struct bio_set {
 struct kmem_cache *bio_slab;
 unsigned int front_pad;

 mempool_t *bio_pool;
 mempool_t *bvec_pool;
#if defined(CONFIG_BLK_DEV_INTEGRITY)
 mempool_t *bio_integrity_pool;
 mempool_t *bvec_integrity_pool;
#endif

 /*
  * Deadlock avoidance for stacking block drivers: see comments in
  * bio_alloc_bioset() for details
  */
 spinlock_t  rescue_lock;
 struct bio_list  rescue_list;
 struct work_struct rescue_work;
 struct workqueue_struct *rescue_workqueue;
};

If you explore the Linux kernel code you will find that within /block/bio.c will be include /linux/bio.h . The Linux block I/O subsystem includes bioset and this is a vital part of how BIOs are handled within the kernel.

Below images shows the Linux storage stack for kernel version 4.0 where you can see the flow of BIOs. BIOs are send from LIO (Linux I/O) or the VFS to the block I/O layer who in return will communicate with the I/O scheduler who will schedule the I/O operation to be send on the actual block device.

In conclusion
A lot of posts are being written that would indicate that bioset would be something that could be removed or would be malicious for the system, as outlined in the above post bioset is however a vital part of the Linux Kernel and an integrated part of the I/O subsystem for handling I/O requests in combination with block devices.

Oracle Linux - Check your kernel modules

Knowing and understanding what is running on your Oracle Linux system is vital for proper maintenance and proper tuning. As operating systems are seen more and more as something that is just there and should not be hindrance for development, as we see the rise of container based solutions and serverless computing it might look like that the operating system becomes less and less important. However, the opposite is true, the operating system becomes more and more important as it need to be able to facilitate all the requirements from the containers and functions running on top of it without human intervention or at least as less human intervention as possible.

This brings that, if you operate a large deployment of servers and you have to ensure everything is automated and operating at the best of performance at any moment in time without having to touch the systems or at least as less as possible, you need to optimize it and automate it. To be able to do so you need to be able to understand every component and be able to check if you need it or that you can drop it. Whatever you do not need, drop it, it can be a security risk or it can be a consumer of resources without having the need for it.

Oracle Linux Kernel modules
Kernel modules are an important part of the Oracle Linux operating system, understanding them and being able to check what is loaded and what is not should be something that you need to understand. Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system.

udev
Today, all necessary modules loading is handled automatically by udev, so if you do not need to use any out-of-tree kernel modules, there is no need to put modules that should be loaded at boot in any configuration file. However, there are cases where you might want to load an extra module during the boot process, or blacklist another one for your computer to function properly.

Kernel modules can be explicitly loaded during boot and are configured as a static list in files under /etc/modules-load.d/. Each configuration file is named in the style of /etc/modules-load.d/.conf. Configuration files simply contain a list of kernel modules names to load, separated by newlines. Empty lines and lines whose first non-whitespace character is # or ; are ignored.

lsmod
Checking which kernel modules are loaded in the kernel can be done by using the lsmod command. lsmod will list all the modules. Basically it is a representation of everything you will find in the /proc/modules file however in a somewhat more understandable way. An example of the lsmod command on an Oracle Linux system running in a Vagrant box is shown below:

[root@localhost ~]# lsmod
Module                  Size  Used by
vboxsf                 38491  1 
ipv6                  391530  20 [permanent]
ppdev                   8323  0 
parport_pc             21178  0 
parport                37780  2 ppdev,parport_pc
sg                     31734  0 
pcspkr                  2094  0 
i2c_piix4              12269  0 
snd_intel8x0           33895  0 
snd_ac97_codec        127589  1 snd_intel8x0
ac97_bus                1498  1 snd_ac97_codec
snd_seq                61406  0 
snd_seq_device          4604  1 snd_seq
snd_pcm               113293  2 snd_intel8x0,snd_ac97_codec
snd_timer              26196  2 snd_seq,snd_pcm
snd                    79940  6 snd_intel8x0,snd_ac97_codec,snd_seq,snd_seq_device,snd_pcm,snd_timer
soundcore               7412  1 snd
e1000                 134545  0 
vboxvideo              42469  1 
ttm                    88927  1 vboxvideo
drm_kms_helper        120123  1 vboxvideo
drm                   343055  4 vboxvideo,ttm,drm_kms_helper
i2c_core               53097  3 i2c_piix4,drm_kms_helper,drm
vboxguest             306752  3 vboxsf,vboxvideo
sysimgblt               2595  1 vboxvideo
sysfillrect             4093  1 vboxvideo
syscopyarea             3619  1 vboxvideo
acpi_cpufreq           12697  0 
ext4                  604127  2 
jbd2                  108826  1 ext4
mbcache                 9265  1 ext4
sd_mod                 36186  3 
ahci                   26684  2 
libahci                27932  1 ahci
pata_acpi               3869  0 
ata_generic             3811  0 
ata_piix               27059  0 
video                  15828  0 
dm_mirror              14787  0 
dm_region_hash         11613  1 dm_mirror
dm_log                  9657  2 dm_mirror,dm_region_hash
dm_mod                106591  8 dm_mirror,dm_log
[root@localhost ~]# 

This could be the starting point of investigating and finding out what is loaded and what is really needed, what is not needed and what might be a good addition in some cases.

modinfo
as you might not be checking your kernel modules on a daily basis you might not know which module is used for what purpose. In this case modinfo is coming to your reseque. If you want to know, for example, what the module snd_seq is used for you can check the details with modinfo as shown in the example below.

[root@localhost ~]# modinfo snd_seq
filename:       /lib/modules/4.1.12-61.1.28.el6uek.x86_64/kernel/sound/core/seq/snd-seq.ko
alias:          devname:snd/seq
alias:          char-major-116-1
license:        GPL
description:    Advanced Linux Sound Architecture sequencer.
author:         Frank van de Pol , Jaroslav Kysela 
srcversion:     88DDA62432337CC735684EE
depends:        snd,snd-seq-device,snd-timer
intree:         Y
vermagic:       4.1.12-61.1.28.el6uek.x86_64 SMP mod_unload modversions 
parm:           seq_client_load:The numbers of global (system) clients to load through kmod. (array of int)
parm:           seq_default_timer_class:The default timer class. (int)
parm:           seq_default_timer_sclass:The default timer slave class. (int)
parm:           seq_default_timer_card:The default timer card number. (int)
parm:           seq_default_timer_device:The default timer device number. (int)
parm:           seq_default_timer_subdevice:The default timer subdevice number. (int)
parm:           seq_default_timer_resolution:The default timer resolution in Hz. (int)
[root@localhost ~]#

As you can see in the example above the snd_seq module is the Advanced Linux Sound Architecture sequencer developed by Frank van de Pol and Jaroslav Kysela. Taking this as an example, you can argue. do I need the snd_seq module if I run a server where I have no need for any sound.

Unloading "stuff" you do not need will ensure you have a faster boot sequence timing of your system, less resource consumption and as every component carries a risk of having an issue.... with less components you have theoretically less possible bugs.

In conclusion
optimizing your system by checking which kernel models should be loaded and which could be left out on your Oracle Linux system. However, when you just use it for common tasks you might not want to spend to much time on it. However, if you are building your own image or investing time in building a fully automated way of deploying servers fast in a CI/CD manner you might want to spend time on making sure only the components you really need are in the system and nothing else.

Oracle Linux - Yum security plugin

Ensuring your Oracle Linux system is up to date with patches, and especially security patches can be a challenging task. Updating your system from a pure operating system point of view is not the main issue. A simple yum command will make sure that the latest versions are applied to your system.

The main challenge a lot of enterprises face is identifying which patches and updates are applicable and how they might affect applications running on the systems. For Oracle linux you will have an additional level of assurance that Oracle software will be working when applying updates from the official Oracle Linux repositories.

For software not developed by Oracle this assurance will not be that strict and you will face the same possible issues as you will have with other Linux distributions, like for example, RedHat.

A formal process of identifying what needs to be updated and after that ensuring the update will not break functionality should be in place. The first step in such a process is finding the candidates. A good way to find out which updates, security specific in our example, are available and could be applied is something that can be facilitated by yum itself

You can use the yum security plugin. Some of the options you can see mentioned below:

Plugin Options:
    --security          Include security relevant packages
    --bugfixes          Include bugfix relevant packages
    --cve=CVE           Include packages needed to fix the given CVE
    --bz=BZ             Include packages needed to fix the given BZ
    --sec-severity=SEVERITY
                        Include security relevant packages, of this severity
    --advisory=ADVISORY
                        Include packages needed to fix the given advisory

As an example you can use the below command which will show information on available updates.

[vagrant@localhost ~]$ yum updateinfo list
Loaded plugins: security
ELBA-2017-0891 bugfix         binutils-2.20.51.0.2-5.47.el6_9.1.x86_64
ELEA-2017-1432 enhancement    ca-certificates-2017.2.14-65.0.1.el6_9.noarch
ELSA-2017-0847 Moderate/Sec.  curl-7.19.7-53.el6_9.x86_64
ELBA-2017-2506 bugfix         dhclient-12:4.1.1-53.P1.0.1.el6_9.1.x86_64
ELBA-2017-2506 bugfix         dhcp-common-12:4.1.1-53.P1.0.1.el6_9.1.x86_64
ELBA-2017-1373 bugfix         initscripts-9.03.58-1.0.1.el6_9.1.x86_64
ELBA-2017-2852 bugfix         initscripts-9.03.58-1.0.1.el6_9.2.x86_64
ELSA-2017-0892 Important/Sec. kernel-2.6.32-696.1.1.el6.x86_64
ELSA-2017-1372 Moderate/Sec.  kernel-2.6.32-696.3.1.el6.x86_64
ELSA-2017-1486 Important/Sec. kernel-2.6.32-696.3.2.el6.x86_64
ELSA-2017-1723 Important/Sec. kernel-2.6.32-696.6.3.el6.x86_64
ELBA-2017-2504 bugfix         kernel-2.6.32-696.10.1.el6.x86_64
ELSA-2017-2681 Important/Sec. kernel-2.6.32-696.10.2.el6.x86_64
ELSA-2017-2795 Important/Sec. kernel-2.6.32-696.10.3.el6.x86_64

In case you want to see only the security related updates with a severity Moderate you can use the below command to generate this list:

[vagrant@localhost ~]$ yum updateinfo list --sec-severity=Moderate
Loaded plugins: security
ELSA-2017-0847 Moderate/Sec. curl-7.19.7-53.el6_9.x86_64
ELSA-2017-1372 Moderate/Sec. kernel-2.6.32-696.3.1.el6.x86_64
ELSA-2017-2863 Moderate/Sec. kernel-2.6.32-696.13.2.el6.x86_64
ELSA-2017-2863 Moderate/Sec. kernel-headers-2.6.32-696.13.2.el6.x86_64
ELSA-2017-0847 Moderate/Sec. libcurl-7.19.7-53.el6_9.x86_64
ELSA-2017-2563 Moderate/Sec. openssh-5.3p1-123.el6_9.x86_64
ELSA-2017-2563 Moderate/Sec. openssh-clients-5.3p1-123.el6_9.x86_64
ELSA-2017-2563 Moderate/Sec. openssh-server-5.3p1-123.el6_9.x86_64
ELSA-2017-1574 Moderate/Sec. sudo-1.8.6p3-29.el6_9.x86_64
updateinfo list done
[vagrant@localhost ~]$ 

To list the security errata by their Common Vulnerabilities and Exposures (CVE) IDs instead of their errata IDs, specify the keyword cves as an argument:

[vagrant@localhost ~]$ yum updateinfo list cves
Loaded plugins: security
 CVE-2017-2628    Moderate/Sec.  curl-7.19.7-53.el6_9.x86_64
 CVE-2017-2636    Important/Sec. kernel-2.6.32-696.1.1.el6.x86_64
 CVE-2016-7910    Important/Sec. kernel-2.6.32-696.1.1.el6.x86_64
 CVE-2017-6214    Moderate/Sec.  kernel-2.6.32-696.3.1.el6.x86_64
 CVE-2017-1000364 Important/Sec. kernel-2.6.32-696.3.2.el6.x86_64
 CVE-2017-7895    Important/Sec. kernel-2.6.32-696.6.3.el6.x86_64
 CVE-2017-1000251 Important/Sec. kernel-2.6.32-696.10.2.el6.x86_64
 CVE-2017-1000253 Important/Sec. kernel-2.6.32-696.10.3.el6.x86_64
 CVE-2017-7541    Moderate/Sec.  kernel-2.6.32-696.13.2.el6.x86_64

When checking (automated) what patches are applicable the question why is very reasonable. Meaning, you would like to have some more information on the background of patches. For this you can do a "yum updateinfo info" command or you can specifically query for a CVE ID. The CVE ID example is shown below in an example:

[vagrant@localhost ~]$ yum updateinfo info --cve CVE-2017-1000251
Loaded plugins: security

=====================================================
   kernel security and bug fix update
=====================================================
  Update ID : ELSA-2017-2681
    Release : Oracle Linux 6
       Type : security
     Status : final
     Issued : 2017-09-13
       CVEs : CVE-2017-1000251
Description : [2.6.32-696.10.2.OL6]
            : - Update genkey [bug 25599697]
            : 
            : [2.6.32-696.10.2]
            : - [net] l2cap: prevent stack overflow on incoming
            :   bluetooth packet (Neil Horman) [1490060 1490062]
            :   {CVE-2017-1000251}
   Severity : Important

=====================================================
   Unbreakable Enterprise kernel security update
=====================================================
  Update ID : ELSA-2017-3620
    Release : Oracle Linux 6
       Type : security
     Status : final
     Issued : 2017-09-19
       CVEs : CVE-2017-1000251
Description : kernel-uek
            : [4.1.12-103.3.8.1]
            : - Bluetooth: Properly check L2CAP config option
            :   output buffer length (Ben Seri)  [Orabug:
            :   26796363]  {CVE-2017-1000251}
   Severity : Important
updateinfo info done
[vagrant@localhost ~]$

By using the yum plugin in a correct way and automate against it you can leverage the power of this plugin and implement (an automated) process that will inform you about candidates for installation on your production systems.

Oracle Cloud - IOT Enterprise Connectivity

Within the Oracle Cloud portfolio you will find the Oracle Internet Of Things (IOT) Cloud service. The IOT cloud service from Oracle provides a starting point for developing a IOT strategy within your company. Or, as Oracle likes to state: Oracle Internet of Things (IoT) Cloud Service is a managed Platform as a Service (PaaS) offering that helps you make critical business decisions and strategies by allowing you to connect your devices to the cloud, analyze data and alert messages from those devices in real time, and integrate your data with enterprise applications, web services, or with other Oracle Cloud Services, such as Oracle Business Intelligence Cloud Service.

One of the main pillars within the Oracle IOT strategy, and a right one in my opinion, is that you will have to connect your IOT strategy to your Enterprise Solutions. Connecting them to your enterprise solutions can be for many reasons. For example, integrating it with preventive maintenance and/or customer satisfaction programs... just to name two options.

If you look at the above diagram you will notice that Enterprise Connectivity is placed as a central part of the Oracle IOT Cloud Service.

Oracle IoT Cloud Service provides a secure communication channel for pushing messages to your enterprise applications, and for your enterprise applications to push or pull messages from Oracle IoT Cloud Service. The Oracle IoT Cloud Service Client Software Enterprise Library and REST APIs enable your enterprise applications to send commands to your devices. You can further analyze the device data and alerts sent to Oracle IoT Cloud Service by integrating your IoT application to your enterprise applications, Oracle Business Intelligence Cloud Service, Oracle Mobile Cloud Service, or JD Edwards EnterpriseOne with Internet of Things Orchestrator instances. 

REST based API connections
The beauty of connecting an enterprise application with the Oracle IOT Cloud service is that this can be done fully based upon REST API's exchanging JSON based messages with each other. This means that you can leverage all the API best practices and could leverage all the microservice best practices. Communication will be based upon API's supported by workflows within the Oracle IOT cloud Service.

Using a combination of stream processing and REST based API's you can make sure that certain events you receive from connected devices result in a JSON message being send to your enterprise application (or for example, to a user his mobile device who has a mobile APP installed).

Communicating back to the IOT cloud works in the same way, you can have your applications interact with the Oracle IOT Cloud service and, for example, querying device data and metadata, or send commands to devices.

Building a new model
Having the option to connect from and to the Oracle IOT Cloud service in a loosely coupled way using REST API's makes that complete new models are possible. You will be able to read data coming from connected devices. However, you are also able to directly connect this to processes downstream as well and sending instructions back to devices from the backend systems.

Whenever you are working on a solution which will involve IOT components it might be worth it to have a good look at the Oracle IOT solution as this could potentially bring you a lot of value from day one. 

Oracle Cloud Access Security Broker

"A cloud access security broker (CASB) is a software tool or service that sits between an organization's on-premises infrastructure and a cloud provider's infrastructure. A CASB acts as a gatekeeper, allowing the organization to extend the reach of their security policies beyond their own infrastructure."

Oracle Cloud Access Security Broker is used for exactly that. The Oracle CASB Cloud Service is the only Cloud Access Security Broker (CASB) that gives you both visibility into your entire cloud stack and the security automation tool your IT team needs.

Read more the Capgemini view on Oracle CASB via this link or view the presentation below., an overview created by Adriaan van Zetten and Johan Louwers.

Capgemini Oracle Cloud Access Security Broker from Johan Louwers