sid-203/enterprise-information-security-risk-assessment-oracle-e-business-suite-case-studyReal-world information security risk assessment based on the Oracle E-Business Suite zero-day (CVE-2025-61882). Analyses attacker methods, enterprise risks, and mitigation strategies using ISO 27001, NIST CSF, Cyber Essentials and COBIT.
A comprehensive security and privacy compliance framework for high-risk biometric surveillance systems (CCTV, Facial Recognition Technology, and centralised contact tracing), including comparative framework analysis (ISO 27001, Cyber Essentials, NIST CSF 2.0, COBIT) and a detailed incident response case study analyzing the 2025 Oracle E-Business Suite CVE-2025-61882 breach.
This assignment addresses critical challenges in deploying high-risk biometric surveillance systems while maintaining compliance with UK GDPR, implementing layered security controls, and establishing robust incident response capabilities.
Proposed Solution Components:
Key Challenges:
Data Protection by Design and Default must be treated as an engineering and governance requirement, not a "compliance afterthought". For systems combining CCTV, FRT, and centralised contact tracing, DPbD must be:
Privacy-Aware Secure Development Lifecycle (SDLC)
| Phase | DPbD Requirements | Controls | Evidence |
|---|---|---|---|
| Requirements | Define purposes, lawful basis, special category processing | Purpose statements, DPIA initiation | DPIA document, legal basis assessment |
| Design | Defaults enforce data minimisation, purpose limitation | Camera zoning/masking, restricted FRT triggers, separated data flows | Architecture diagrams, privacy test cases |
| Build & Test | Privacy/security as testable requirements | RBAC with least privilege, MFA, encryption, immutable logs | Test results, security configs |
| Operations | Continuous monitoring, vendor assurance, change control | Access reviews, retention enforcement, anti-function creep controls | Audit logs, governance KPIs |
1. By Design (Integrate throughout processing)
2. By Default (Only necessary data)
3. Data Minimisation
4. Purpose Limitation & Anti-Function Creep
5. Pseudonymisation & PETs
6. Transparency & User Control
7. Access Limitation (Least Privilege)
8. Integrity & Confidentiality
9. Storage Limitation
10. DPIA as Living Control
UK GDPR is principles-led, requiring organizations to demonstrate:
Security and governance frameworks help convert GDPR's high-level obligations into actionable controls, but they do not replace GDPR compliance.
| GDPR Principle | ISO/IEC 27001 | Cyber Essentials | NIST CSF 2.0 | COBIT 2019 |
|---|---|---|---|---|
| Lawfulness, fairness, transparency | Partial (governance, policies) | Limited | Partial ("Govern") | Partial (governance) |
| Purpose limitation | Partial (scope, change control) | Limited | Partial ("Govern/Identify") | Strong (prevents function creep) |
| Data minimisation | Partial (risk-based design) | Limited | Partial (inventory, risk controls) | Partial (enforces decisions) |
| Accuracy | Partial (quality management) | Limited | Partial (monitoring) | Partial (metrics, assurance) |
| Storage limitation | Strong (retention, deletion, audit) | Limited | Partial ("Protect/Recover") | Partial (KPIs, audits) |
| Integrity & confidentiality | Strong (security controls) | Strong (baseline) | Strong (Protect/Detect/Respond) | Strong (governance) |
| Accountability | Strong (ISMS, documentation) | Partial (evidence baseline) | Strong ("Govern" function) | Strong (decision rights, KPIs) |
ISO/IEC 27001
