Click here to receive your FREE subscription to Campus Technology
News
Oracle Databases Go Unpatched, Survey Finds
1/17/2008
Database administrators using Oracle Database products haven't been applying Critical Patch Updates, according to survey results described by Sentrigo Inc., which is in the business of providing database security software.
Oracle typically releases its Critical Patch Updates on a quarterly basis, but these patches apparently are too much of a hassle to apply.
Sentrigo has had informal discussions with IT personnel on the matter, apart from the survey, according to Rani Osnat, Sentrigo's vice president of marketing. The reluctance to patch may stem from all of the testing and downtime that needs to happen before applying Oracle Critical Patch Updates.
"In the case of smaller companies, the DBAs simply don't have time to do it," Osnat said. "In the larger companies, you may have thousands of databases and you literally need to cycle through them to schedule downtime for all of them."
Woburn, Mass.-based Sentrigo collected the responses of 305 Oracle Users Group members in a survey that was conducted from August 2007 to January 2008. Responses were gathered across the various cities where Oracle Users Group meetings were held.
The survey found that only 10 percent (31 people) of the total number of respondents said that they had installed the latest Oracle Critical Patch Updates.
Moreover, 67.5 percent of respondents had never applied any Oracle Critical Patch Updates, according to an announcement issued by Sentrigo.
Sentrigo offers a kind of stop-gap measure to this dilemma. The company's Hedgehog solution uses a technology that Osnat calls "virtual patching."
"The idea of virtual patching is that you have a security layer that monitors the database and all transactions and looks for activities that target vulnerabilities," Osnat explained. "It looks for exploits and issues an alert. The benefit is that it doesn't require any downtime."
Virtual patching is a warning system, and it doesn't solve the root problem. A patch is still needed, eventually.
"We don't recommend it as a substitute for real patching," Osnat said. "On the other hand, most people don't do patching, so this allows them to fill in the gaps in terms of security."
Oracle's last quarterly Critical Patch Update, dated January 2008, addressed 26 new fixes across Oracle Database products.
Osnat explained that many of the vulnerabilities that have been found in Oracle Database have typically allowed SQL injection attacks. It's a method of using the main door of the SQL engine to execute commands, and these commands are then used for privilege escalation. The less severe attacks allow one to gain DBA access privileges via a login and password, but the more severe ones let anyone gain those privileges, he said.
Sentrigo's dismal survey results have an explanation, according to Osnat.
"Database security is not a major priority among IT security folks," he said. "Mostly, we think it's because of their lack of knowledge about databases and what kind of risk database vulnerabilities pose. Most IT security people are more familiar with network security or operating systems -- not so much about databases."
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
