/* Generated with Author-it 5.4.131.8883  4/29/2016 4:40:37 PM */
Page=new Array();Page[0]=new Array("Secure Configuration Guide","Oracle® Health Sciences Empirica Healthcare Analysis Release 1.0.2.1","","186298.htm");
Page[1]=new Array("This guide provides guidance and recommendations on securely installing, configuring, and managing the Empirica Healthcare Analysis software and its system components. This guide does not provide step-by-step procedures in performing a secure installation; rather, it is intended as a supplement to the instructions already provided in the Empirica Healthcare Analysis Installation Guide and user documentation.","Overview of this guide","192991.htm");
Page[2]=new Array("This guide is for database administrators, Empirica Healthcare Analysis site administrators, IT administrators, and others whose responsibility is to perform the following:","Install and configure the Empirica Healthcare Analysis software and its system components securely.","Create security policies and develop best practices to regulate and monitor safety data usage.","Create and manage user accounts, passwords, roles, and permissions.","Monitor user activity for inappropriate or unauthorized actions or data misuse.","This guide assumes that you have an understanding of operating system and database concepts, and have experience using the software tools described.","Audience","192992.htm");
Page[3]=new Array("The product documentation is available from the following locations:","My Oracle Support (https://support.oracle.com)&#8212;Release Notes and Known Issues.","Oracle Technology Network (http://www.oracle.com/technetwork/documentation/hsgbu-154445.html)&#8212;The most current documentation set, excluding the Release Notes and Known Issues.","If the software is available for download, the complete documentation set is available from the Oracle Software Delivery Cloud (https://edelivery.oracle.com).","All documents may not be updated for every Empirica Healthcare Analysis release. Therefore, the version numbers for the documents in a release may differ.","Empirica Healthcare Analysis 1.0.2.1 documentation","Document","Description","Last updated","Release Notes","The Release Notes document provides descriptions of enhancements and bug fixes as well as system requirements.","1.0.2.1","Known Issues","The Known Issues document provides detailed information about the known issues in this release, along with workarounds, if available.","1.0.2.1","User Guide","The User Guide describes how to use the Empirica Healthcare Analysis application to perform epidemiologic and statistical analyses of healthcare and administrative claims data.","1.0.1","Installation Guide","The Installation Guide document describes how to install the Empirica Healthcare Analysis software.","1.0.2.1","Secure Configuration Guide","The Secure Configuration Guide provides guidance and recommendations on securely installing, configuring, and managing the Empirica Healthcare Analysis software and its system components. ","1.0.2.1","Transferring Data from the Common Data Model","The Transferring Data from the Common Data Model document describes how to use the Empirica Healthcare Analysis ETL utility to transfer data in the OMOP Common Data Model (CDM) Version 4 from a source system to the Empirica Healthcare Analysis database.","1.0.2","Third Party Licenses and Notices","The Third Party Licenses and Notices document includes licenses and notices for third party technology that may be included with the Empirica Healthcare Analysis software.","1.0.2","Documentation","206019.htm");
Page[4]=new Array("For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&amp;id=docacc.","Documentation accessibility","173141.htm");
Page[5]=new Array("Access to Oracle Support","Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&amp;id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&amp;id=trs if you are hearing impaired.","If you need assistance","173140.htm");
Page[6]=new Array("The latest information about the Empirica Healthcare Analysis application is on the Oracle Support self-service website, My Oracle Support. Before you install and use the Empirica Healthcare Analysis application, check My Oracle Support for the latest information, including Release Notes and Known Issues, alerts, white papers, bulletins, and patches.","Finding Empirica Healthcare Analysis information and patches on My Oracle Support","188961.htm");
Page[7]=new Array("You must register at My Oracle Support to obtain a user name and password before you can enter the site.","Open a browser to https://support.oracle.com.","Click the Register link.","Follow the instructions on the registration page.","Creating a My Oracle Support account","188993.htm");
Page[8]=new Array("Sign in to My Oracle Support at https://support.oracle.com.","If you know the ID number of the article you need, enter the number in the text box at the top right of any page, and then click the magnifying glass icon or press Enter.","To search the knowledge base, click the Knowledge tab, and then use the options on the page to search by:","Product name or family.","Keywords or exact terms.","Finding information and articles","188995.htm");
Page[9]=new Array("You can search for patches by patch ID or number, product, or family.","Sign in to My Oracle Support at https://support.oracle.com.","Click the Patches &amp; Updates tab. ","Enter your search criteria and click Search.","Click the patch ID number.","The system displays details about the patch. You can view the Read Me file before downloading the patch.","Click Download, and then follow the instructions on the screen to download, save, and install the patch files.","Finding patches","188997.htm");
Page[10]=new Array("The Oracle website contains links to Oracle user and reference documentation. You can view or download a single document or an entire product library.","Finding Oracle documentation","188998.htm");
Page[11]=new Array("For Oracle Health Sciences applications, go to the Oracle Health Sciences Documentation page at http://www.oracle.com/technetwork/documentation/hsgbu-clinical-407519.html. ","Note: Always check the Oracle Health Sciences Documentation page to ensure you have the most up-to-date documentation.","Finding Oracle Health Sciences documentation","189001.htm");
Page[12]=new Array("Do one of the following:","Go to http://www.oracle.com/technology/documentation/index.html.","Go to http://www.oracle.com, point to the Support tab, and then click Product Documentation.","Scroll to the product you need, and click the link.","Finding other Oracle documentation","189000.htm");
Page[13]=new Array("The Empirica Healthcare Analysis software is a web application that provides a high-performance epidemiologic data analysis environment for exploring multiple sources of population-based data, such as:","Clinical data from electronic healthcare records.","Administrative data from insurance claims. ","The software allows industry and pharmacovigilance professionals at pharmaceutical sponsors, regulatory agencies, and health care organizations to explore and review the following types of activities:","Pharmacovigilance activities","Pharmacoepidemiological activities","Risk management activities","When your organization implements the Empirica Healthcare Analysis software, Oracle recommends that you install the software and its system components using secure installation methods to protect the integrity and confidentiality of your data. Additionally, Oracle recommends managing and monitoring your system after installation to make sure that your data is protected from unauthorized access and misuse.","This document provides guidelines for secure installation and configuration and describes the security features provided to help you manage and monitor your system.","Overview","185562.htm");
Page[14]=new Array("Require strong, complex application and database passwords.","Create a password policy to establish password requirements. For example, require a minimum password length and at least one of each of the following types of characters:","Alphabetic","Non-alphabetic","Numeric","Uppercase character","Lowercase character","Keep passwords secure.","When you create user accounts in the Empirica Healthcare Analysis software, send users their user names and initial passwords in separate email messages. Instruct users not to share or write down passwords, or to store passwords in files on their computers. Additionally, require users to change their passwords upon first use.","Keep software up to date.","Keep all software versions current by installing the latest patches for all components, including all critical security updates. ","Implement the principle of least privilege.","In implementing the principle of least privilege, you grant users the fewest number of permissions needed to perform their jobs. You should also review user permissions regularly to determine their relevance to users&#8217; current job responsibilities.","Monitor system activity.","Review user audit records regularly to determine the user activities that constitute normal use and the activities that might indicate unauthorized use or misuse. ","Promote policy awareness.","Ensure that your employees are aware of Acceptable Use policies, best practices, and standard operating procedures that are relevant to the Empirica Healthcare Analysis software.","General security principles","185563.htm");
Page[15]=new Array("The Empirica Healthcare Analysis Installation Instructions include procedures that install the software and system components in a secure state by default. The accounts that you create during the installation also have restrictive permissions by default. In addition to performing the standard installation procedures, you can perform the following steps to secure the Empirica Healthcare Analysis software:","Installing and configuring the Empirica Healthcare Analysis software","185565.htm");
Page[16]=new Array("When you are required to authenticate to your Oracle database during the Empirica Healthcare Analysis installation, do not provide database account passwords as arguments from the command prompt. The standard installation instructions provide examples of execution scripts.","Execute scripts without passwords on the command line","185566.htm");
Page[17]=new Array("The standard Empirica Healthcare Analysis installation requires you to make several files editable. After the installation completes, make sure that you set the files to read-only again unless explicitly instructed otherwise in the Installation Instructions.","Reset the Read Only attribute","185567.htm");
Page[18]=new Array("The Empirica Healthcare Analysis Installation Instructions include directions for encrypting the Empirica Healthcare Analysis database account password. To ensure a secure installation, Oracle recommends following the instructions.","Encrypt the Empirica Healthcare Analysis database account password","185568.htm");
Page[19]=new Array("Using the HttpOnly flag when generating a cookie helps mitigate the risk of a client-side script accessing the protected cookie. ","Perform these steps on the application server. ","To turn on the flags for session cookies:","Navigate to the following directory:","$INSTALL_DIR/Healthcare/WEB-INF","Open the weblogic.xml file, and scroll to the &lt;session-descriptor&gt; section.","If the section does not contain the following element, add the element:","&lt;cookie-secure&gt;true&lt;/cookie-secure&gt;","If the section does not contain the following element, add the element:","&lt;wls:cookie-http-only&gt;true&lt;/wls:cookie-http-only&gt;","Note: When the http-only flag is turned on, users must use Microsoft Internet Explorer 8 or later and Java 7 or later to view single-patient and multi-patient timelines as applets. Users running older releases should deselect the Display Patient Timelines as applets user preference. Alternatively, you can deselect the Enable User Preference to display Patient Timelines as applet site option, which turns off the applet viewing mode for all users. ","Turn on the HttpOnly and Secure flags for session cookies within WebLogic","206018.htm");
Page[20]=new Array("The Empirica Healthcare Analysis software provides the option to download table data to a Microsoft Excel spreadsheet or to other file types, such as PDF, text, or SAS files. Establish best practices for downloading data to ensure the data remains secure outside the Empirica Healthcare Analysis software.","Establish best practices for downloading data","185570.htm");
Page[21]=new Array("In the Empirica Healthcare Analysis software, provide secure email addresses for the Feedback Email and Error Email site options. Consider providing email addresses that are not routed over the Internet.","Route email to a secure address","185574.htm");
Page[22]=new Array("Oracle strongly recommends configuring WebLogic to use TLS and accessing the Empirica Healthcare Analysis software using only TLS connections. For more information, see the Installation Guide.","To ensure that your use of TLS is secure, perform the following steps:","Disable the use of vulnerable TLS protocols by adding the following JVM option to the JAVA_OPTIONS settings in the setDomainEnv.sh file, for example:","-Dweblogic.security.SSL.protocolVersion=TLS1","You can find the setDomainEnv.sh file in a location such as:","/u01/app/oracle/Middleware/user_projects/domains/empirica/bin/setDomainEnv.sh","Enable only strong ciphers in the WebLogic config.xml file by listing only strong ciphers in the SSL section of the file.","For more information, see the Open Web Application Security Project website:","http://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Cryptographic_Ciphers","Use of TLS","205857.htm");
Page[23]=new Array("If you install the Empirica Healthcare Analysis software and Oracle Database software on different servers, secure configuration requires encryption of the communication channel between the servers. For more information, see the section about configuring the thin JDBC client network in the Oracle Database Security Guide:","https://docs.oracle.com/database/121/DBSEG/asojbdc.htm#DBSEG030","Encrypt the database connection","205860.htm");
Page[24]=new Array("The following steps allow you to install the Oracle Database software securely.","For more information and additional guidelines for securely installing and managing the Oracle database, see the Oracle Database Security Guide:","For Oracle Database 11g Release 2:","http://docs.oracle.com/cd/E11882_01/network.112/e16543/toc.htm","For Oracle Database 12c Release 1:","http://docs.oracle.com/database/121/DBSEG/toc.htm","Installing the Oracle database","205858.htm");
Page[25]=new Array("Periodically check the security site on Oracle Technology Network for details about security alerts for Oracle products:","http://www.oracle.com/technetwork/topics/security/alerts-086861.html","Patch the database regularly, and apply security updates","185576.htm");
Page[26]=new Array("Oracle Database is installed with several default database user accounts, such as SYS and SYSTEM. After the database installs successfully, the Database Configuration Assistant automatically locks most built-in database user accounts and marks them as expired. After the accounts expire, you should configure strong and secure passwords for them.","Allow database passwords to expire, and change default passwords","185577.htm");
Page[27]=new Array("You can configure the Oracle Database and WebLogic Server used with the Empirica Healthcare Analysis application to use FIPS 140-2 approved and validated encryption modules. For more information, see the following link:","http://www.oracle.com/technetwork/topics/security/oracle-fips140-validations-100923.html","Configure components to use FIPS 140-2 compliant cryptographic implementations","204217.htm");
Page[28]=new Array("The Empirica Healthcare Analysis software provides the following security features to help you secure your system:","Authentication","You can select from flexible password options to establish a password policy for user accounts.","User Access Control","You can assign users to several built-in or custom roles. You can also assign permissions to restrict user access to only the features that are appropriate for their job responsibilities. The Empirica Healthcare Analysis software also provides publishing capabilities to restrict user access to objects.","Auditing","The Empirica Healthcare Analysis software automatically tracks user activity, including successful and failed logins, for local users. The tracked activities provide a comprehensive audit trail of actions performed.  ","Overview of security features","185585.htm");
Page[29]=new Array("The Empirica Healthcare Analysis software requires users to authenticate by logging in with a unique user name and password. You can use the following authentication methods:","Local&#8212;User information stored in Empirica Healthcare is used for authentication.","Single Sign-On (SSO)&#8212;User information stored in Oracle® Access Manager is used for authentication.","With local authentication, the Empirica Healthcare Analysis software captures successful and failed login attempts in the User Activity Audit Trail, described in Auditing. ","When a user exceeds the allowable number of login attempts that you set in your password requirements, the Empirica Healthcare Analysis software sends an email notification about the account lockout to the site administrator.","Authentication methods","185588.htm");
Page[30]=new Array("The Empirica Healthcare Analysis software provides password options that you can select to establish a password policy for the user accounts for your local users. Using the options, you can require specific password content, complexity, and expiration. The Empirica Healthcare Analysis software provides the following password options and default values. You can edit the default values to suit the requirements of your organization. ","Password requirements","Option","Default value","Expiration","90 days","Expiration Warning","15 days","Minimum Length","8 characters","Number of Attempts Allowed","3","Number of Passwords Retained","8","Minimum Alphabetic","1","Minimum Numeric","1","Minimum Non-alphanumeric","1","Minimum Lower case","1","Minimum Upper case","1","Password requirements","185589.htm");
Page[31]=new Array("When an employee leaves your organization, the Empirica Healthcare Analysis software allows you to disable the employee&#8217;s user account to prevent unauthorized system access.","Disabling user accounts","185590.htm");
Page[32]=new Array("The User Activity Audit Trail tracks user activity that occurs in the application, capturing detailed information for user actions and providing you with an easily accessible, historical account of user activity. Using the User Activity Audit Trail, you can better enforce your company's security policy and monitor your system for attempts at unauthorized actions or misuse. ","Audited user activity is retained indefinitely. You cannot modify or delete audit records through the Empirica Healthcare Analysis software. ","The Empirica Healthcare Analysis software auditing feature is a standard feature that cannot be disabled. ","Auditing","185591.htm");
Page[33]=new Array("For each connection to the Oracle Database, Empirica Healthcare Analysis sets the CLIENT_IDENTIFIER attribute to the ID value for the currently connected user.","Oracle Database Client Identifier","205859.htm");
Page[34]=new Array("The Empirica Healthcare Analysis software allows you to implement user access control. Using roles and permissions, you can restrict user access to only what is necessary for users to perform their job responsibilities. ","Before implementing user access control, establish an access control policy based on business and security requirements for each user. Review your access control policy periodically to determine if changes to roles and permissions are necessary.","User access control","185592.htm");
Page[35]=new Array("During installation, several built-in roles are created. The roles are designed for least privilege and separation of duties. You can modify the permissions assigned to the roles and create new roles, if needed.","Assigning roles","185593.htm");
Page[36]=new Array("The Empirica Healthcare Analysis software defines permissions that grant or restrict user access to different application features. When you assign a role to a user, the user receives all the permissions assigned to the role. Review the permissions assigned to roles to make sure users can perform only the tasks relevant to their job responsibilities.","If necessary, you can also assign permissions to individual users.","Granting permissions","185594.htm");
Page[37]=new Array("You can control user access to objects, such as analysis runs or report outputs, by publishing the objects to specific login groups. By default, the publication level of every newly created object is Private. ","Users without the Administer Users permission can publish only objects they have created. Users with the Administer Users permission can publish objects that they or any users in their login group created. Superusers can publish any object.","For more information on user access control, see the Empirica Healthcare Analysis User Guide.","Publishing objects","185595.htm");
Page[38]=new Array("Copyright © 2013, 2016, Oracle and/or its affiliates. All rights reserved.","This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.","The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.","If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:","U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are &quot;commercial computer software&quot; pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.","This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.","Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.","Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.","This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.","This documentation may include references to materials, offerings, or products that were previously offered by Phase Forward Inc. Certain materials, offerings, services, or products may no longer be offered or provided. Oracle and its affiliates cannot be held responsible for any such references should they appear in the text provided.","Legal notices","2016.htm");
var PageCount=39;

function search(SearchWord){
var Result="";
var NrRes=0;
Result='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">\n';
Result+="<html>\n";
Result+="<head>\n";
Result+="<meta http-equiv='Content-Type' content='text/html; charset=UTF-8'>\n";
Result+="<title>Search Results</title>\n";
Result+='<script language="javascript" type="text/javascript" charset="UTF-8" src="dhtml_search.js"></script>\n';
Result+='<link rel="stylesheet" type="text/css" href="stylesheet.css">\n';
Result+="<style type='text/css'>\n";
Result+=".searchDetails {font-family:verdana; font-size:8pt; font-weight:bold}\n";
Result+=".searchResults {font-family:verdana; font-size:8pt}\n";
Result+="</style>\n";
Result+="</head>\n";
Result+="<body onload='javascript:document.SearchForm.SearchText.focus()'>\n";
Result+='<table class="searchDetails" border="0" cellspacing="0" cellpadding="2" width="100%">\n';
Result+='<tr><td><!--Enter a keyword or phrase--></td></tr>';
Result+='<tr><td>';
Result+='<form name="SearchForm" action="javascript:search(document.SearchForm.SearchText.value)">';
if(SearchWord.length>=1){
   while(SearchWord.indexOf("<")>-1 || SearchWord.indexOf(">")>-1 || SearchWord.indexOf('"')>-1){
       SearchWord=SearchWord.replace("<","&lt;").replace(">","&gt;").replace('"',"&quot;");
   }
}
Result+='<label for="SearchText">Enter a keyword or phrase<br /><br /></label><input type="text" id="SearchText" name="SearchText" size="25" value="' + SearchWord + '" />';
Result+='&nbsp;<input type="submit" value="&nbsp;Go&nbsp;"/></form>';
Result+='</td></tr></table>\n';

if(SearchWord.length>=1){
   SearchWord=SearchWord.toLowerCase();
   this.status="Searching, please wait...";
   Result+="<table border='0' cellpadding='5' class='searchResults' width='100%'>";
   for(j=0;j<PageCount;j++){
       k=Page[j].length-1;
       for(i=0;i<k;i++){
           WordPos=Page[j][i].toLowerCase().indexOf(SearchWord);
           if(WordPos>-1){
               FoundWord=Page[j][i].substr(WordPos,SearchWord.length);
               NrRes++;
               Result+="<tr><td>";
               Result+="<a target='BODY' href='"+Page[j][k]+"'>"+Page[j][k-1].replace(FoundWord,FoundWord.bold())+"</a><br/>\n";

               if(i<k-1){
                   if(Page[j][i].length>350){
                       Result+="..."+Page[j][i].substr(WordPos-100,200+FoundWord.length).replace(FoundWord,FoundWord.bold())+"...\n";
                   }
                   else{
                       Result+=Page[j][i].replace(FoundWord,FoundWord.bold())+"\n";
                   }
               }
               Result+="</td></tr>";
               break;
           }
       }
   }
   Result+="</table>";
   Result+="<p class='searchDetails'>&nbsp;" + NrRes + " result(s) found.</p>";
}

Result+="</body></html>";
this.status="";
this.document.open();
this.document.write(Result);
this.document.close();
}