In today’s interconnected enterprise landscape, security and performance are inseparable priorities. During his INFOCUS 2025 session, Oracle JD Edwards Security & Performance Improvements, Pradip Pandey, Senior Director of Product Management at Oracle, explored the latest strategies to harden JD Edwards (JDE) against modern threats while driving better system efficiency. 

Why Security Matters More Than Ever 

With organizations extending operations across global networks, third-party integrations, and cloud deployments, the attack surface has expanded dramatically. Security vulnerabilities evolve quickly, from OpenSSL to XML parser exploits, requiring proactive monitoring and patching. 

Oracle applies a Software Security Assurance (SSA) program across its technology stack—Linux, Database, WebLogic, Java, and JDE. This process enforces secure coding practices, malware scanning, and rigorous testing before release. Still, vulnerabilities inevitably surface post-release, which is why Oracle issues Critical Patch Updates (CPUs) on a predictable quarterly cycle (January, April, July, and October). 

For JDE customers, this means: 

• Staying current with CPUs across the stack—OS, Database, WebLogic, and JDE applications. 
• Watching closely for dense patch cycles that align with JDE update releases (April and October). 
• Applying web runtime, AIS, Enterprise Server, and third-party library updates to prevent web-based exploits. 

Configurations to Reduce Risk 

Beyond patching, Pandey emphasized several configuration best practices: 

• TLS 1.2/1.3 Encryption: JDE now supports automated TLS negotiation between servers, ensuring secure communication without manual version control. 
• Email Security: JDE workflow and Orchestrator emails now leverage TLS 1.2 encryption, with OAuth 2.0 support planned for Microsoft 365 authentication. 
• Content Security Policy (CSP): Customers can define allowed domains and attributes for embedding JDE apps, mitigating iframe and script injection risks. 
• File Upload Controls: Default restrictions on file size and extension types help prevent malicious uploads. 
• Cookie Protections: New attributes (SameSite, Secure, HTTPOnly) harden JDE sessions against cross-site scripting and hijacking attempts. 

Future roadmap items include TLS 1.3 adoption, stronger AES-256 encryption, improved auditing, and expanded role-based security management. 

Driving Better Performance 

Security alone isn’t enough—systems must also perform under modern business loads. Pandey shared proven performance improvements based on real-world customer cases. 

Infrastructure Recommendations 

• Network Latency: Keep Enterprise, HTML, AIS, and Database servers co-located in the same data center or zone. Target <100 microseconds latency. 
• VM Sizing: Minimum of 2 CPUs and 30 GB RAM per JDE server component. Undersized infrastructure is a leading cause of performance complaints. 
• MTU Settings: Adjust Ethernet MTU from 9000 to 1500 bytes to avoid buffering delays. 

Database Optimizations 

• SQL Server: Enable Read Committed Snapshot Isolation (RCSI) to speed up queries; disable query retries for cleaner execution. 
• Oracle Autonomous Database: Use auto-scaling to handle spikes in query demand—real-world tests show up to 60% improvement in interactive apps and 90% in some batch jobs. 
• TCP No Delay & Fast Open: These settings minimize socket delays, improving fetch performance for Oracle and IBM DB2 databases. 

JDE Application-Level Tuning 

• Session Models: Use stateful sessions for orchestrations to avoid repeated session establishment overhead. 
• AIS Server Guardrails: Cap concurrent calls at two per swim lane to prevent request storms. 
• Fetch Size Adjustments: Increase default fetch size to reduce round trips and improve throughput. 

The Bottom Line 

Security and performance are continuous journeys, not one-time fixes. Pandey’s session underscored Oracle’s dual commitment to defending JDE from evolving threats while helping customers optimize for speed, scale, and stability. 

By staying current on quarterly patches, hardening configurations, and tuning infrastructure, JD Edwards users can achieve both a secure and high-performing environment. 

Want more?  

Explore more content and resources to help you get the most from your JD Edwards investment:  

• Be sure to check out the INFOCUS 2025 Event Hub (coming soon) for presentation slides – available exclusively to Quest members.  
• Explore the JD Edwards Orchestrator Strategic Content Center for more Quest-exclusive resources.  
• Visit the Quest Learn Library for blogs, how-to demos, and on-demand sessions.  
• Connect with peers in one of our Quest JD Edwards Community User Groups to swap stories, ask questions, and share tips with other users facing the same challenges.  

Not a Quest member yet? Join today and tap into the ultimate Oracle customer network.