Deploying a website built using Oracle9iAS Portal

This paper is a case study of the deployment of a website built using the Portal component of Oracle9i Application Server (Oracle9iAS) in 2001. It has been submitted as the practical assignment for GSEC certification (Version 1.4b, Option 2). The paper describes the scenario and the product, Oracle9i AS (Standard Edition) Release 1 for Windows NT 4.0, before performing a high-level risk analysis of the website. The architecture implemented is discussed in terms of risk. The paper also identifies the security vulnerabilities discovered with Oracle9i AS during the six-month development period and the steps taken to harden an 'out-of-the-box' version.