Q&A: Oracle exec says users get enough flaw info
The company's security unit chief defends limited disclosures, quarterly patching schedule
Computerworld - As senior director of security assurance at Oracle Corp., Duncan Harris is in charge of the company's vulnerability remediation processes. He also manages a team of "ethical hackers" at Oracle's Reading, England, software lab whose job is to find flaws in the vendor's products. Following Oracle's latest quarterly patch release this week (see "Oracle releases patches for 82 flaws"), Harris spoke with Computerworld about the company's patching policies and its relationship with the IT security community.
Oracle just announced patches for 82 vulnerabilities. Why so many? Oracle doesn't shy away from fixing flaws publicly through our Critical Patch Updates. We don't hide our internally discovered vulnerabilities. When we discover something internally, we still mention it in our Critical Patch Updates. Other vendors, as the security community knows, may be doing silent fixes. It is something we don't believe in. That is part of the explanation for the large number of vulnerabilities. Certainly, there is also much more attention being paid to Oracle for whatever reason.
Critics say Oracle doesn't share enough vulnerability information for users to make proper risk assessments. Why don't you disclose more details? As part of our exercise to work out with customers what the regular schedule for our patches should be, we talked to them about the level of information they required in order to understand sufficiently whether they were affected by a vulnerability and what the impact would be if the vulnerability was exploited. We listened very carefully to that, and we have come up with a system where we identify in risk matrices for every one of our product stacks the nature of each of the vulnerabilities that we fix within a quarterly patch update. We believe that it is sufficient information for our customers. Our advisories are for our customers' benefit. They are not for the benefit of the security community.
Are quarterly updates good enough for users? The comparison is quite clearly with Microsoft's monthly updates. You have to remember that Windows updates are clearly aimed at client machines. Oracle has client-side products, some of which are quite important, but our fundamental focus is on the server side. Comparing this to the monthly patching that Microsoft does is like comparing apples and oranges. It really is quite different to have a systems administrator patch a server-side system and a small client.
Why do you think the security community is so unhappy with Oracle? In terms of working with the security community, we work very well with those that are happy to abide by the security vulnerability
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts