Security, compliance, and resilience are the cornerstones of trust. In this episode, Lois Houston and Nikita Abraham continue their conversation with David Mills and Tijo Thomas, exploring how Oracle Cloud Infrastructure empowers organizations to protect data, stay compliant, and scale with confidence. Real-world examples from Zoom, KDDI, 8x8, and Uber highlight these capabilities. Cloud Business Jumpstart: https://mylearn.oracle.com/ou/course/cloud-business-jumpstart/152957 Oracle University Learning Community: https://education.oracle.com/ou-community LinkedIn: https://www.linkedin.com/showcase/oracle-university/ X: https://x.com/Oracle_Edu Special thanks to Arijit Ghosh, David Wright, Kris-Ann Nansen, Radhika Banka, and the OU Studio Team for helping us create this episode. ------------------------------------------------------------- Episode Transcript: 00:00 Welcome to the Oracle University Podcast, the first stop on your cloud journey. During this series of informative podcasts, we'll bring you foundational training on the most popular Oracle technologies. Let's get started! 00:26 Lois: Hello and welcome to the Oracle University Podcast! I'm Lois Houston, Director of Communications and Adoption with Customer Success Services, and with me is Nikita Abraham, Team Lead: Editorial Services with Oracle University. Nikita: Hi everyone! In our last episode, we started the conversation around the real business value of Oracle Cloud Infrastructure and how it helps organizations create impact at scale. Lois: Today, we're taking a closer look at what keeps the value strong — things like security, compliance, and the technology that helps businesses stay resilient. To walk us through it, we have our experts from Oracle University, David Mills, Senior Principal PaaS Instructor, and Tijo Thomas, Principal OCI Instructor. 01:12 Nikita: Hi David and Tijo! It's great to have you both here! Tijo, let's start with you. How does Oracle Cloud Infrastructure help organizations stay secure? Tijo: OCI uses a security first approach to protect customer workloads. This is done with implementing a Zero Trust Model. A Zero Trust security model use frequent user authentication and authorization to protect assets while continuously monitoring for potential breaches. This would assume that no users, no devices, no applications are universally trusted. Continuous verification is always required. Access is granted only based on the context of request, the level of trust, and the sensitivity of that asset. There are three strategic pillars that Oracle security first approach is built on. The first one is being automated. With automation, the business doesn't have to rely on any manual work to stay secure. Threat detection, patching, and compliance checks, all these happen automatically. And that reduces human errors and also saving time. Security in OCI is always turned on. Encryption is automatic. Identity checks are continuous. Security is not an afterthought in OCI. It is incorporated into every single layer. Now, while we talk about Oracle's security first approach, remember security is a shared responsibility, and what that means while Oracle handles the data center, the hardware, the infrastructure, software, consumers are responsible for securing their apps, configurations and the data. 03:06 Lois: Tijo, let's discuss this with an example. Imagine an online store called MuShop. They're a fast-growing business selling cat products. Can you walk us through how a business like this can enhance its end-to-end security and compliance with OCI? Tijo: First of all, focusing on securing web servers. These servers host the web portal where customers would browse, they log in, and place their orders. So these web servers are a prime target for attackers. To protect these entry points, MuShop deployed a service called OCI Web Application Firewall. On top of that, the MuShop business have also used OCI security list and network security groups that will control their traffic flow. As when the businesses grow, new users such as developers, operations, finance, staff would all need to be onboarded. OCI identity services is used to assign roles, for example, giving developers access to only the dev instances, and finance would access just the billing dashboards. MuShop also require MFA multi-factor authentication, and that use both password and a time-based authentication code to verify their identities. Talking about some of the critical customer data like emails, addresses, and the payment info, this data is stored in databases and storage. Using OCI Vault, the data is encrypted with customer managed keys. Oracle Data Safe is another service, and that is used to audit who has got access to sensitive tables, and also mask real customer data in non-production environments. 04:59 Nikita: Once those systems are in place, how can MuShop use OCI tools to detect and respond to threats quickly? Tijo: For that, MuShop used a service called OCI Cloud Guard. Think of it like a security operation center, and which is built right into OCI. It monitors the entire OCI environment continuously, and it can track identity activities, storage settings, network configurations and much more. If it finds something risky, like a publicly exposed object storage bucket, or maybe a user having a broad access to that environment, it raises a security finding. And better yet, it can automatically respond. So if someone creates a resource outside of their policy, OCI Cloud Guard can disable it. 05:48 Lois: And what about preventing misconfigurations? How does OCI make that easier while keeping operations secure? Tijo: OCI Security Zone is another service and that is used to enforce security postures in OCI. The goody zones help you to avoid any accidental misconfigurations. For example, in a security zone, you can choose users not to create a storage bucket that is publicly accessible. To stay ahead of vulnerabilities, MuShop runs OCI vulnerability scanning. They have scheduled to scan weekly to capture any outdated libraries or misconfigurations. OCI Security Advisor is another service that is used to flag any unused open ports and with recommending stronger access rules. MuShop needed more than just security. They also had to be compliant. OCI's compliance certifications have helped them to meet data privacy and security regulations across different regions and industries. There are additional services like OCI audit logs for traceability that help them pass internal and external audits. 07:11 Oracle University is proud to announce three brand new courses that will help your teams unlock the power of Redwood—the next generation design system. Redwood enhances the user experience, boosts efficiency, and ensures consistency across Oracle Fusion Cloud Applications. Whether you're a functional lead, configuration consultant, administrator, developer, or IT support analyst, these courses will introduce you to the Redwood philosophy and its business impact. They'll also teach you how to use Visual Builder Studio to personalize and extend your Fusion environment. Get started today by visiting mylearn.oracle.com. 07:52 Nikita: Welcome back! We know that OCI treats security as a continuous design principle: automated, always on, and built right into the platform. David, do you have a real-world example of a company that needed to scale rapidly and was able to do so successfully with OCI? David: In late 2019, Zoom averaged 10 million meeting participants a day. By April 2020, well that number surged to over 300 million as video conferencing became essential for schools, businesses, and families around the world due to the global pandemic. To meet that explosive demand, Zoom chose OCI not just for performance, but for the ability to scale fast. In just nine hours, OCI engineers helped Zoom move from deployment to live production, handling hundreds of thousands of concurrent meetings immediately. Within weeks, they were supporting millions. And Zoom didn't just scale, they sustained it. With OCI's next-gen architecture, Zoom avoided the performance bottlenecks common in legacy clouds. They used OCI functions and cloud native services to scale workloads flexibly and securely. Today, Zoom transfers more than seven petabytes of data per day through Oracle Cloud. That's enough bandwidth to stream HD video continuously for 93 years. And they do it while maintaining high availability, low latency, and enterprise grade security. As articulated by their CEO Erik Yuan, Zoom didn't just meet the moment, they redefined it with OCI behind the scenes. 09:45 Nikita: That's an incredible story about scale and agility. Do you have more examples of companies that turned to OCI to solve complex data or integration challenges? David: Telecom giant KDDI with over 64 million subscribers, faced a growing data dilemma. Data was everywhere. Survey results, system logs, behavioral analytics, but it was scattered across thousands of sources. Different tools for different tasks created silos, delays, and rising costs. KDDI needed a single platform to connect it all, and they chose Oracle. They replaced their legacy data systems with a modern data platform built on OCI and Autonomous Database. Now they can analyze behavior, improve service planning, and make faster, smarter decisions without the data chaos. But KDDI didn't stop there. They built a 300 terabyte data lake and connected all their systems-- custom on-prem apps, SaaS providers like Salesforce, and even multi-cloud infrastructure. Thanks to Oracle Integration and pre-built adapters, everything works together in real-time, even across clouds. AWS, Azure, and OCI now operate in harmony. The results? Reduced operational costs, faster development cycles, governance and API access improved across the board. KDDI can now analyze customer behavior to
