Q&A: Oracle exec says users get enough flaw info
The company's security unit chief defends limited disclosures, quarterly patching schedule
Computerworld - As senior director of security assurance at Oracle Corp., Duncan Harris is in charge of the company's vulnerability remediation processes. He also manages a team of "ethical hackers" at Oracle's Reading, England, software lab whose job is to find flaws in the vendor's products. Following Oracle's latest quarterly patch release this week (see "Oracle releases patches for 82 flaws"), Harris spoke with Computerworld about the company's patching policies and its relationship with the IT security community.
Oracle just announced patches for 82 vulnerabilities. Why so many? Oracle doesn't shy away from fixing flaws publicly through our Critical Patch Updates. We don't hide our internally discovered vulnerabilities. When we discover something internally, we still mention it in our Critical Patch Updates. Other vendors, as the security community knows, may be doing silent fixes. It is something we don't believe in. That is part of the explanation for the large number of vulnerabilities. Certainly, there is also much more attention being paid to Oracle for whatever reason.
Critics say Oracle doesn't share enough vulnerability information for users to make proper risk assessments. Why don't you disclose more details? As part of our exercise to work out with customers what the regular schedule for our patches should be, we talked to them about the level of information they required in order to understand sufficiently whether they were affected by a vulnerability and what the impact would be if the vulnerability was exploited. We listened very carefully to that, and we have come up with a system where we identify in risk matrices for every one of our product stacks the nature of each of the vulnerabilities that we fix within a quarterly patch update. We believe that it is sufficient information for our customers. Our advisories are for our customers' benefit. They are not for the benefit of the security community.
Are quarterly updates good enough for users? The comparison is quite clearly with Microsoft's monthly updates. You have to remember that Windows updates are clearly aimed at client machines. Oracle has client-side products, some of which are quite important, but our fundamental focus is on the server side. Comparing this to the monthly patching that Microsoft does is like comparing apples and oranges. It really is quite different to have a systems administrator patch a server-side system and a small client.
Why do you think the security community is so unhappy with Oracle? In terms of working with the security community, we work very well with those that are happy to abide by the security vulnerability
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts