View source for Oracle Cloud Infrastructure

{{Infobox company
| name             = Oracle Cloud Infrastructure
| logo             = [[File:OracleCloudInfra.png|200px]]
| caption          = 
| type             = 
| traded_as        = 
| genre            = <!-- Only used with media and publishing companies -->
| fate             = 
| predecessor      = 
| successor        = 
| foundation       = <!-- {{Start date|YYYY|MM|DD}} -->
| founder          = Larry Ellison<br />Bob Miner<br />Ed Oates
| defunct          = <!-- {{End date|YYYY|MM|DD}} -->
| location_city    = Redwood City, California
| location_country = United States
| location         = 
| locations        = 
| area_served      = Worldwide
| key_people       = Clay Magouyrk (EVP)
| industry         = Cloud computing, Web services
| products         = [[Infrastructure as a service|IaaS]], [[Platform as a service|PaaS]], [[Database as a service|DBaaS]], [[Desktop virtualization#Desktop as a service|DaaS]]
| services         = 
| revenue          = $35.3 billion (2023, Q4)<ref name="NovetOracle20">{{cite web |url=https://investor.oracle.com/investor-news/news-details/2023/Oracle-Announces-Fiscal-2023-Fourth-Quarter-and-Fiscal-Full-Year-Financial-Results/default.aspx |title=Oracle Announces Fiscal 2023 Fourth Quarter and Fiscal Full Year Financial Results |publisher=Oracle Corporation |date=12 June 2023 |accessdate=04 August 2023}}</ref>
| operating_income = 
| net_income       = 
| aum              = <!-- Only used with financial services companies -->
| assets           = 
| equity           = 
| owner            = 
| num_employees    = 
| parent           = 
| divisions        = 
| subsid           = 
| homepage         = {{URL|https://www.oracle.com/cloud/}}
| footnotes        = 
| intl             = 
}}

'''Oracle Cloud Infrastructure''' is a a collection of public, private, hybrid, and multicloud [[cloud computing]] services offered by Oracle Corporation, an American multinational information technology company. Oracle Cloud Infrastructure deploys to unknown number of data centers in 44 cloud regions in 23 countries around the world.<ref name="OracleCloudRegs">{{cite web |url=https://www.oracle.com/cloud/public-cloud-regions/ |title=Public Cloud Regions |publisher=Oracle |accessdate=04 August 2023}}</ref> More than 100 different products and services are associated with Oracle Cloud Infrastructure, representing elastic computing, networking, content delivery, data storage, database management, security management, enterprise management, [[data analysis]], and developer support.<ref name="OracleCloudRegs" />

==Provider research==
This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory|Choosing and Implementing a Cloud-based Service for Your Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.


1. '''What experience do you have working with laboratory customers in our specific industry?'''

Oracle has the [https://www.oracle.com/research/ Oracle for Research program], which helps researchers, scientists, and academic institutions "to simplify the research process, accelerate discovery, and address humanity’s most urgent needs."<ref name="OracleForResearch">{{cite web |url=https://www.oracle.com/oracle-for-research/ |title=Oracle for Research |publisher=Oracle |accessdate=04 August 2023}}</ref> Through this program, [[Laboratory|labs]] at Flinders University<ref name="MillerFrom20">{{cite web |url=https://blogs.oracle.com/research/post/from-viruses-to-environmental-issues-cloud-computing-is-accelerating-research-and-scientific-discovery |title=From Viruses to Environmental Issues, Cloud Computing is Accelerating Research and Scientific Discovery |author=Miller, A.D. |work=Oracle for Research Blog |date=04 August 2020 |accessdate=04 August 2023}}</ref>, Royal Holloway University of London<ref name="PaytonRoyal23">{{cite web |url=https://blogs.oracle.com/research/post/royal-holloway-oracle-refine-carbon-storage-to-fight-climate-change |title=Royal Holloway & Oracle refine carbon storage to fight climate change |author=Payton, R. |work=Oracle for Research Blog |date=30 January 2023 |accessdate=04 August 2023}}</ref>, University of Bristol<ref name="OracleUniv21">{{cite web |url=https://www.oracle.com/customers/university-of-bristol/ |title=University of Bristol makes COVID breakthrough with Oracle |publisher=Oracle Corporation |date=08 September 2021 |accessdate=04 August 2023}}</ref>, and University of Southern California<ref name="BarkerWhen21">{{cite web |url=https://blogs.oracle.com/research/post/when-bare-metal-gpus-and-cloud-come-together-usc-researchers-win |title=When bare metal GPUs and cloud come together, USC researchers win |author=Barker, B. |work=Oracle for Research Blog |date=14 July 2021 |accessdate=04 August 2023}}</ref> have used Oracle Cloud towards their objectives.


Laboratory informatics vendors that have turned to Oracle Cloud include [[AgiLab SAS]]<ref name="Munoz-WilleryAgilab17">{{cite web |url=https://www.paperlesslabacademy.com/2017/09/15/agilab-moves-to-oracle-cloud/ |title=Agilab LIMS Solutions moves to Oracle Cloud |author=Munoz-Willery, I. |work=Paperless Lab Academy |date=15 September 2017 |accessdate=04 August 2023}}</ref>, [[Al Faris National Company for Investment and Export PSC|OPTIMIZA]]<ref name="OPTIMIZAAcculab19">{{cite web |url=https://optimiza.me/acculab-oracle-cloud-marketplace/ |title=OPTIMIZA’s AccuLab: Powered By Oracle, Now Available in Oracle Cloud Marketplace |publisher=OPTIMIZA |date=15 July 2019 |accessdate=04 August 2023}}</ref>, and Triniti.<ref name="TrinitiLabDiag">{{cite web |url=https://www.triniti.com/lab-diagnostics-industry-solution-oracle-cloud |title=Lab Diagnostics Industry Solution for Oracle Cloud |publisher=Triniti |accessdate=04 August 2023}}</ref> An Oracle representative is likely to be able to supply more examples of laboratories and laboratory informatics developers that use or have used Oracle Cloud Infrastructure.


2. '''Can your solution readily integrate with our other systems and business processes, making it easier for our end users to perform their tasks?'''

It will ultimately be up to your organization to get an answer from Linode tailored to your systems and business processes. However, this much can be said about Oracle Cloud Infrastructure [https://www.oracle.com/integration/ integrations]. The Oracle Integration collection of h database, application, social, and productivity adapters "offers innovative methods for accelerating all types of application connection and process automation projects. They include out-of-the-box templates and adapters to connect virtually any data store, process, application, service, or API across modern and legacy sales, marketing, HCM, finance, and order-management systems."<ref name="OracleIntegrate20">{{cite web |url=https://www.oracle.com/a/ocom/docs/cloud-essentials-integration-3885458.pdf |format=PDF |title=Integrate and Automate Business Processes |publisher=Oracle |date=2020 |accessdate=04 August 2023}}</ref>


3. '''What is the average total historical downtime for the service(s) we're interested in?'''

Some public information is made available about historic outages and downtime. Oracle Cloud Infrastructure has a [https://ocistatus.oraclecloud.com/ systems status page] with status history (you have to click on the "Incident History" link at the bottom, then the date range arrows in the top right of the subsequent page). You should be able to read through the incident details for each issue, going back through a fair amount of history. This will give you a partial picture of the issues experienced in the past, as well as any scheduled maintenance and currently impacted services. A follow-up on this question with an Oracle Cloud Infrastructure representative may reveal more historical downtime history for the services you are interested in.


4. '''Do we receive comprehensive downtime support in the case of downtime?'''

Oracle Cloud Infrastructure does not make this answer clear. However, the answer is likely tied to what after-sales [https://www.oracle.com/support/ support plan] you choose. Confirm with Oracle what downtime support they provide based on the services your organization are interested in.


5. '''Where are your servers located, and how is data securely transferred to and from those servers?'''

Oracle Cloud Infrastructure is [https://www.oracle.com/cloud/public-cloud-regions/service-availability/ split up] into 42 regions, each with various availability domains and fault domains. As for data transfers, Oracle Cloud Infrastructure provides multiple ways to better ensure safer data transmission. In its disaster recovery documentation, Oracle discusses networking services such as virtual cloud networks, reserved public IP addresses, Load Balancing, and FastConnect. For example, FastConnect can be used in hybrid cloud data transfers between on-premises and Oracle cloud infrastructures "that enable you recover your cloud workloads quickly, reliably, and securely."<ref name="OracleLearn">{{cite web |url=https://docs.oracle.com/en/solutions/design-dr/index.html |title=Best practices for protecting your cloud topology against disasters |work=Oracle Help Center |publisher=Oracle |accessdate=04 August 2023}}</ref> As for the security of data in transit, Oracle Cloud Infrastructure addresses this with encryption mechanisms like TLS v1.2.<ref name="OracleUsingInTransit">{{cite web |url=https://docs.oracle.com/en-us/iaas/Content/File/Tasks/intransitencryption.htm |title=Using In-transit TLS Encryption |work=Oracle Cloud Infrastructure Documentation |publisher=Oracle |accessdate=04 August 2023}}</ref>


6. '''Who will have access to our data (including subcontractors), and what credentials, certifications, and compliance training do they have?'''

Oracle broadly describes [https://www.oracle.com/corporate/security-practices/corporate/physical-environmental.html physical security controls] at its facilities, but it doesn't discuss who is allowed into the heart of data centers and how access to those areas is controlled. It also doesn't describe any certifications or training that applies to the individuals who could access your data. This is a conversation to have with a Oracle Cloud Infrastructure representative.


7. '''Will our sensitive and regulated data be stored on a machine dedicated to complying with the necessary regulations?'''

Not all [https://www.oracle.com/cloud/public-cloud-regions/service-availability/ Oracle Cloud Infrastructure machines] have the same controls on them; it will depend on the region, product, and compliance requirements of your lab. That said, verify with a representative that the machine your data will land on meets all the necessary regulations affecting your data.


8. '''How segregated is our cloud data from another customer's, i.e., will lapses of security of another customer's cloud affect our cloud? (It typically won't, but asking the question will hopefully prompt the provider to better explain how your data is segregated.)'''

Similar to IBM, Oracle appears to allow for both physical (bare metal) separation and logical separation for some of its services. They note:<ref name="OracleSecurity">{{cite web |url=https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm |title=Security Overview |work=Oracle Cloud Infrastructure Documentation |publisher=Oracle |accessdate=04 August 2023}}</ref>:

<blockquote>Customer Isolation: Lets you deploy your application and data assets in an environment that is fully isolated from other tenants and from Oracle staff.</blockquote>

As for tenant isolation, the concept is addressed in Oracle's [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm security documentation], in reference to both bare metal and virtual machine instances, as well as within the scope of networking. For details beyond the documentation, consult a representative.


9. '''Do you have documented data security policies?'''

Oracle Cloud Infrastructure documents its security practices in several places:

* [https://www.oracle.com/security/cloud-security/ Cloud security portal]
* [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm Infrastructure security guide]
* [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_features.htm Security services and features]

Some security-related documents, like the SOC 2 report, may not be publicly available, requiring direct discussion with an Oracle Cloud Infrastructure representative to obtain them.


10. '''How do you test your platform's security?'''

Oracle has this to say about internal and customer [https://docs.oracle.com/en/cloud/get-started/subscriptions-cloud/mmocs/oracle-cloud-security-testing-policy.html cloud security testing]<ref name="OracleCloudSecTest">{{cite web |url=https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy.htm |title=Oracle Cloud Security Testing Policies |work=Oracle Cloud Infrastructure Documentation |publisher=Oracle |accessdate=04 August 2023}}</ref>:

<blockquote>Oracle regularly performs penetration and vulnerability testing and security assessments against the Oracle Cloud infrastructure, platforms, and applications. These tests are intended to validate and improve the overall security of Oracle Cloud services.

However, Oracle does not assess or test any components (including, non-Oracle applications, non-Oracle databases or other non-Oracle software, code or data, as may be applicable) that you manage through or introduce into – including introduction through your development in or creation in - the Oracle Cloud services (the “Customer Components”). This policy does not address or provide any right to conduct testing of any third-party materials included in the Customer Components.

Except as otherwise permitted or restricted in your Oracle Cloud services agreements, your service administrator who has system level access to your Oracle Cloud services may run penetration and vulnerability tests for the Customer Components included in certain of your Oracle Cloud services in accordance with the following rules and restrictions.</blockquote>

It also appears that Oracle may have a Red Team that handles its penetration and vulnerability testing.<ref name="CrossWhy20">{{cite web |url=https://blogs.oracle.com/cloudsecurity/post/why-red-teams-rule-the-cloud |title=Why Red Teams Rule the Cloud! |author=Cross, D.B. |work=Oracle Cloud Security Blog |date=07 January 2020 |accessdate=04 August 2023}}</ref> Discuss this with a representative to learn more.


11. '''What are your policies for security audits, intrusion detection, and intrusion reporting?'''

''Audits'': Customers are able to audit their security by using the built-in Audit service. "Using the Audit service, customers can achieve their own security and compliance goals by monitoring all user activity within their tenancy. Because all Console, SDK, and command line (CLI) calls go through our APIs, all activity from those sources is included."<ref name="OracleSecurity" /> As for internal security audits, Oracle notes in its 2020 SOC 3 report that "[a]t least annually, Oracle Cloud Infrastructure completes an internal audit of the system. The internal audit is conducted by qualified auditors and as per the requirements set out in Clause 9 of ISO/IEC 27001:2013."<ref name="OracleSystem20">{{cite web |url=https://www.oracle.com/a/ocom/docs/oci-soc-3-report.pdf |title=System and Organization Controls (SOC 3) Report |publisher=Oracle |date=2023 |accessdate=04 August 2023}}</ref>

''Intrusion detection and reporting'': Oracle Cloud Infrastructure has the following to say about its internal intrusion detection processes<ref name="OracleSecPrinc">{{cite web |url=https://www.oracle.com/corporate/security-practices/corporate/network-communications-security.html |title=Security Principles for Network Communications |publisher=Oracle |accessdate=04 August 2023}}</ref>:

<blockquote>Oracle employs intrusion-detection systems within the Oracle intranet to provide continuous surveillance for intercepting and responding to security events as they are identified. Oracle utilizes a network-based monitoring approach to detect attacks on open firewall ports within Oracle's intranet. Events are analyzed using signature detection, which is a pattern matching of environment settings and user activities against a database of known attacks. Oracle updates the signature database as soon as new releases become available for commercial distribution. Alerts are forwarded to Oracle's IT security for review and response to potential threats.</blockquote>

Customers also have intrusion detection and reporting mechanisms [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm at their disposal], including Cloud Guard and Vulnerability Scanning.


12. '''What data logging information is kept and acted upon in relation to our data?'''

In its Oracle Services Privacy Policy, Oracle uses the term "systems operations data" to "include log files, event files, and other trace and diagnostic files, as well as statistical and aggregated information that relates to the use and operation of our Services, and the systems and networks these Services run on."<ref name="OraclePrivacyPolicy">{{cite web |url=https://www.oracle.com/legal/privacy/services-privacy-policy.html |title=Privacy @ Oracle: Oracle Services Privacy Policy |publisher=Oracle |accessdate=04 August 2023}}</ref> Oracle Cloud Infrastructure may use system logs related to your data to keep their services secure, investigate and prevent potential fraud, to administrate backup and disaster recovery plans, confirm compliance, research and development activities, and to comply with applicable laws.<ref name="OraclePrivacyPolicy" /> Of course, customers can maintain and act upon their own data logs using tools like [https://www.oracle.com/manageability/logging-analytics/ Logging Analytics].


13. '''How thorough are those logs and can we audit them on-demand?'''

It's not clear how thorough the logs are, but Oracle does state: "To the extent provided under applicable laws, Users may request to access, correct, update or delete personal information contained in Systems Operations Data in certain cases, or otherwise exercise their choices with regard to their personal information by filling out an inquiry form."<ref name="OraclePrivacyPolicy" /> Consult with a representative to learn more.


14. '''For HIPAA-eligible data (e-PHI) we may have, will you sign a business associate agreement?'''

Yes, Oracle Cloud Infrastructure will sign a business associate agreement.<ref name="KarabulutOracle18">{{cite web |url=https://blogs.oracle.com/cloud-infrastructure/post/oracle-announces-hipaa-attestation-for-oracle-cloud-infrastructure |title=Oracle Announces HIPAA Attestation for Oracle Cloud Infrastructure |author=Karabulut, Y. |work=Oracle Cloud Infrastructure Blog |publisher=Oracle |date=30 May 2018 |accessdate=04 August 2023}}</ref> Consult their [https://blogs.oracle.com/cloud-infrastructure/post/oracle-announces-hipaa-attestation-for-oracle-cloud-infrastructure blog post] or a representative for more details on their approach to HIPAA compliance.


15. '''What happens to our data should the contract expire or be terminated?'''

From the Oracle Cloud Hosting and Delivery Policies<ref name="OracleCloudHost20">{{cite web |url=https://www.oracle.com/assets/ocloud-hosting-delivery-policies-3089853.pdf |format=PDF |title=Oracle Cloud Hosting and Delivery Policies |publisher=Oracle |date=June 2023 |accessdate=04 August 2023}}</ref>:

<blockquote>For a period of 60 days upon termination of the Oracle Cloud Services, Oracle will make available, via secure protocols and in a structured, machine-readable format, Your Content residing in the production Oracle Cloud Services, or keep the service system accessible, for the purpose of data retrieval by You. </blockquote>


16. '''What happens to our data should you go out of business or suffer a catastrophic event?'''

It's not publicly clear how Oracle Cloud Infrastructure would handle your data should they go out of business; consult with a representative about this topic. As for catastrophic events, Oracles uses "fault domains" for ensuring data availability and redundancy. Those regions with availability domains typically have three fault domains. "Fault domains enable you to distribute your resources so that they don't depend on the same physical hardware within a single availability domain. As a result, hardware failures or maintenance events that affect one fault domain do not affect the resources in other fault domains."<ref name="OracleLearn" /> It's highly unlikely that all three fault domains would be affected in a catastrophic event. However, if this is a concern, discuss further data redundancy with an Oracle Cloud Infrastructure representative.


17. '''Can we use your interface to extract our data when we want, and in what format will it be?'''

From question 15, we found that data can be extracted "via secure protocols and in a structured, machine-readable format." Verify with a representative the finer details, including when such extractions of files, database dumps, whole disks, backups, etc. may occur.


18. '''Are your support services native or outsourced/offshored?'''

It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an Oracle Cloud Infrastructure representative.

==Managed security services==
Oracle advertises managed security services, described as "a suite of services to help you strengthen the enterprise security posture of your IT environment," part of the Oracle Customer Success Services (CSS) portfolio of services. Oracles mentions the following services<ref name="OracleMSS">{{cite web |url=https://www.oracle.com/customer-success/run-and-operate/security-services/ |title=Oracle Managed Security Services |publisher=Oracle Corporation |accessdate=04 August 2023}}</ref>:

* vulnerability and threat prevention
* data security and protection
* identity and access management
* regulatory security governance and compliance services

==Additional information==

===Documentation and other media===
* [https://www.oracle.com/assets/ocloud-hosting-delivery-policies-3089853.pdf Cloud Hosting and Delivery Policies]
* [https://www.oracle.com/a/ocom/docs/cloud-essentials-integration-3885458.pdf Cloud integration guide]
* [https://www.oracle.com/security/cloud-security/ Cloud security services portal]
* [https://www.oracle.com/corporate/cloud-compliance/ Compliance offering descriptions]
* [https://www.oracle.com/a/ocom/docs/support/css-reinforce-your-cybersecurity.pdf Cybersecurity services brochure]
* [https://www.oracle.com/cloud/backup-and-disaster-recovery/what-is-disaster-recovery/ Disaster recovery documentation]
* [https://www.oracle.com/cloud/public-cloud-regions/data-regions/hipaa/ HIPAA Assessed Regions and Services]
* [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm Infrastructure security guide]

===External links===
* [https://www.oracle.com/customer-success/run-and-operate/ Oracle Customer Success Services]
* [https://www.oracle.com/cloud/public-cloud-regions/ Oracle Cloud Infrastructure architecture framework or description]
* [https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm#Shared_Security_Model Oracle Cloud Infrastructure shared responsibility model]
* [https://www.oracle.com/corporate/cloud-compliance/ Oracle Cloud Infrastructure trust center]

==References==
{{Reflist|colwidth=30em}}

<!---Place all category tags here-->
[[Category:Cloud computing services]]
[[Category:Managed security services]]