Security by Design: Lessons from Oracle Cloud Infrastructure

Security by Design: Lessons from Oracle Cloud Infrastructure

Speakers: Ariel Septon, Cloud Security Researcher, Stream Security

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=VmOp532f5p0

Overview

Ariel Septon, a software engineer leading Oracle efforts at Native (formerly Rock Steady) and researcher at Stream Security, presented a comparative analysis of Oracle Cloud Infrastructure (OCI) security design choices and the lessons they offer for securing any cloud environment. Rather than advocating for OCI adoption, Septon examined three specific architectural decisions—human-readable policy syntax, encryption-at-rest by default, and opt-in region subscriptions—to argue that OCI's "security by design" philosophy reveals assumptions and weaknesses in how AWS, Azure, and GCP approach the same problems. The talk provides actionable strategies for applying OCI's design principles to any cloud platform through SCPs, Azure Policies, and GCP Organization Policies, while honestly addressing OCI's own trade-offs including the absence of deny policies and limited conditional logic.

Background

▶ Watch: Introduces OCI's compartment model — a hybrid of AWS OUs/accounts and GCP pro... (2:00)

Most cloud security practitioners have their mental models shaped by AWS, Azure, and GCP—the platforms that dominate conference talks, open-source tooling, and industry certifications. Native's work building multi-cloud security solutions for complex enterprise environments brought them face-to-face with OCI as customers began migrating workloads, often attracted by cost advantages or Google-adjacent AI capabilities. The integration process forced Septon's team to question assumptions they "didn't even realize they were making" about how cloud IAM, encryption, and resource scoping should work. OCI's architecture is organized around a tenancy (the entire cloud boundary) containing compartments that function as a hybrid of AWS OUs/accounts and GCP projects/folders, nestable up to six levels deep. Policies in OCI attach directly to compartments or the tenancy itself and flow downward through the hierarchy.

Key Findings

▶ Watch: OCI's four unified verbs (inspect, read, use, manage) compared to AWS's hundr... (6:00)

Lesson 1: Human-Readable Policies. OCI's policy syntax follows a consistent natural-language structure: Allow [subject] to [verb] [resource type] in [location] where [conditions]. Compared to equivalent AWS IAM JSON policies that require multiple lines to express a single intent, OCI policies can be understood by anyone who reads English. OCI uses four unified verbs—inspect, read, use, and manage—that apply consistently across every service, eliminating the need to memorize hundreds of service-specific API actions. This results in faster policy reviews (seconds versus minutes), fewer misconfigurations (intent is unambiguous), and accessible security (non-security personnel can participate in reviews).

Lesson 2: Secure Defaults. OCI enforces encryption at rest on all resources with no option to disable it—buckets, volumes, databases are always encrypted. In contrast, AWS EBS volumes are not encrypted by default (requiring an explicit flag), and Azure requires careful per-resource configuration. The principle is that the secured path should be the only path, removing the possibility of human error.

Lesson 3: Attack Surface Management. OCI's opt-in region model gives new tenancies a single home region, requiring explicit subscription for each additional region. This contrasts with AWS (all pre-2019 regions enabled by default), Azure, and GCP (all regions accessible). Septon connected this to MITRE ATT&CK technique T1535 (unused regions), where attackers deploy cryptocurrency miners in unmonitored regions, with discovery only occurring at the month-end billing review. OCI extends this further with quota policies that can effectively disable services and regions by setting resource quotas to zero.

Technical Deep Dive

▶ Watch: OCI's mandatory encryption at rest — no option to store unencrypted data, con... (8:00)

The policy syntax comparison reveals concrete security implications. An AWS IAM policy granting read/write access to encrypted objects in a specific S3 bucket requires a multi-line JSON document with Effect, Action arrays, Resource ARNs, and Condition blocks. The equivalent OCI policy is a single sentence: Allow group DevOps to use objects in compartment production where target.bucket.name = 'my-bucket'. The four-tier verb system (inspect < read < use < manage) creates predictable permission boundaries across all services, meaning "read means read" universally, without the per-service ambiguity of AWS action-level permissions.

However, Septon was transparent about OCI's trade-offs. Policy inheritance means a single overly broad policy at the tenancy level affects the entire organization. Limited conditional logic prevents complex access patterns that AWS IAM conditions can express. Most critically, the fixed verb system lacks granular precision—when you need surgical control over specific operations, the broad verbs may grant too much.

The network separation example demonstrated the practical impact of OCI's missing deny policies (planned but not yet available). To restrict network management to only network admins when multiple groups have manage all-resources, administrators must add explicit exclusion conditions to every other group's policies, creating a maintenance burden that grows with each new network service. In AWS, a single deny SCP would accomplish the same goal. OCI's lack of deny policies forces creative workarounds and careful policy management.

For region management, OCI region subscriptions are permanent—once subscribed, you cannot unsubscribe. Quota policies offer a workaround by setting all resource quotas to zero in unwanted regions, effectively disabling them even though they remain technically subscribed. This same principle extends to unused services: setting quota to zero for services an organization doesn't use reduces the attack surface without requiring service-level disablement.

Demo / Proof of Concept

▶ Watch: OCI quota policies as a workaround for permanent region subscriptions — setti... (11:30)

No live demo was performed. Septon presented policy syntax comparisons and architectural diagrams throughout the talk to illustrate the design differences between OCI and other cloud providers.

Defensive Implications

▶ Watch: Network separation nightmare: OCI's missing deny policies force exclusion con... (14:00)

The lessons are immediately applicable to any cloud platform. In AWS, use SCPs to deny unencrypted EBS volumes and block unused regions. In Azure, deploy Azure Policies to enforce encryption and restrict region access. In GCP, use Organization Policies for equivalent controls. Across all clouds: make policies human-readable through clear naming conventions and permission tiers, remove insecure defaults by making the secure path the only path (rather than relying on engineers remembering flags), minimize attack surface by blocking unused regions and services, and structure organizational hierarchies so that parent units have broader access than children. The overarching principle is that if a policy requires a paragraph to explain, it's too complex—and complexity is where security vulnerabilities hide.

Key Takeaways

• Human-readable policies reduce misconfigurations: OCI's natural-language syntax with four unified verbs enables faster reviews and fewer mistakes compared to JSON-based IAM policies
• Secure defaults eliminate human error: OCI's mandatory encryption at rest removes the decision entirely—apply the same principle in other clouds via SCPs and Azure Policies
• Unused regions are attack surfaces: OCI's opt-in model is superior to the default-enabled approach of other providers; use SCPs/policies to block unused regions across all clouds
• Every design choice involves trade-offs: OCI's simplicity comes at the cost of limited conditional logic, no deny policies, and permanent region subscriptions
• Minimize attack surface for unused services: Use quota policies (OCI) or equivalent controls to disable services your organization doesn't actively use
• Security by design is platform-agnostic: The principles of clarity, secure defaults, and minimal attack surface apply regardless of which cloud provider you use

About the Speaker(s)

Ariel Septon is a software engineer and cloud security researcher who leads Oracle efforts at Native (formerly Rock Steady), a company building multi-cloud security solutions focused on preventive security features. She also works at Stream Security. Her team specializes in operationalizing cloud-native preventive controls like AWS SCPs, Azure Policies, and GCP Organization Policies for complex enterprise environments.