Oracle promises tighter security for SOAs
446418
(InfoWorld) - Oracle Corp. has always made bold claims about the security of its database and applications. Now the company has said it will make security a priority as it begins rolling out its next-generation software products for building service-oriented architectures (SOAs), Oracle Fusion, in the next several years. Speaking at an event in New York on Wednesday, Oracle President Charles Phillips outlined three areas of security that will be important to Oracle going forward -- access control, data privacy and compliance. Acquisitions and internal product development over the last 18 months have given Oracle a comprehensive portfolio in this area, allowing the company to think of security "holistically" across its product line, he said. "We take it pretty seriously," Phillips said. "We [are putting] security where it belongs, which is consistent across the architecture." Oracle has had its ups and downs when it comes to security. The company is infamous for a 2002 marketing campaign in which it called its database "unbreakable," a notion that was proven wrong by security researchers. While Oracle's database has not been the target of a widespread attack, security experts point out that it is also in a less vulnerable position than many commonly targeted programs. Oracle databases are embedded so deeply in a network's infrastructure that attacks aimed for it are thwarted by technologies closer to the surface, such as firewalls. The true test of Oracle's security will come when it begins opening up its products to allow for SOAs, which enable applications to communicate via Web services standards across disparate systems. "Adding Web services to an architecture makes everything often more insecure because you add an additional way into the database," said Alexander Kornbrust, chief executive officer of security consulting firm Red Database Security GmbH. "Web services should be designed and developed very carefully." Beginning in March 2005, Oracle began a string of purchases to bolster its security portfolio. In March the company purchased Oblix, which has access-management software. Then last November, Oracle acquired Thor Technologies for identity provisioning and compliance software and Octet String for identity virtualization software. The company is combining these acquired technologies with new software it developed internally: Database Vault, which prevents the database administrator from accessing sensitive information stored in an Oracle database, and Audit Vault, a data warehousing product to keep track of data stored in various places. The former is available now, while Audit Vault will be available in the next few months, said Thomas Kurian, senior vice president of server technology for Oracle. Together with existing products such as Oracle Identity Federation, the products help shore up a strong portfolio for protecting data across multiple applications and systems in the network, he said. Oracle has these products now, but they will become increasingly important as SOAs become more prevalent and Oracle rolls out its Fusion architecture over the next couple of years, Kurian said. "We'll be making sure at each level of the application, you have common policies that are enforced," he said. "No matter where you come in [on a network], you can still access security." Charles Kolodgy, an IDC security analyst, called Oracle's presentation on Wednesday "a little underwhelming," but said the message the company was trying to send is important. "Many of their customers are not aware that Oracle has security offerings to help customers manage identity, data protection and compliance," Kolodgy said. "They have been know for building security into their products, but not for building security products." However, despite the rosy picture Oracle paints about its past and future security strategy, it's something customers have traditionally been less than happy with, Kornbrust said. New products like Data Vault and Oracle Transparent Data Encryption -- which encrypts database data and stores the encryption keys in another location -- show the company is taking security more seriously, he said. But Oracle has a long way to go before it gets it right. "They are not doing enough helping customers to make their database secure," Kornbrust said. "The patches are still ugly ... Selling new -- and expensive -- high-end features is good but doesn't raise the bar for the normal Oracle security. Most databases I see are vulnerable in most cases." Still, said Kornbrust -- whose firm handles Oracle security exclusively -- those responsible for securing Oracle infrastructure "appreciate the direction Oracle is taking in the last month." However, it will take at least two to four years for most database administrators and developers to see results of the changes taking place now, he said.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
719069
(InfoWorld) - The latest version ofÂ Oracle's flagship database offers better security than earlier versions, but development errors have left vulnerabilities that attackers can use to steal data, an expert warned Monday. "Oracle made big progress with 11g, but some of the vulnerabilities I've found so far in 11g are stupid programming errors," said Alexander Kornbrust, managing director of Red Database Security GmbH, during an interview at the Hack In The Box (HITB) Security Conference 2007 in Kuala Lumpur, Malaysia. "Oracle must educate their own development team because they should normally avoid these simple security vulnerabilities," Kornbrust said. Oracle executives were not immediately available for comment. Kornbrust, who helps large companies audit the security of their Oracle databases, examined the software and found SQL injection vulnerabilities, which allow attackers to run malicious code. He also uncovered a way to circumvent the auditing capability in 11g and other versions of the database, which could undermine a company's compliance efforts. While Kornbrust plans to discuss some Oracle vulnerabilities at HITB, he has no plans to detail his method for bypassing the auditing capability until Oracle has fixed the problem. Some of the problems that Kornbrust uncovered reflect architectural problems with Oracle's database. In a talk scheduled for later this week, he plans to demonstrate how architectural problems allow attackers to "bypass and avoid" Oracle's latest security tools, including Oracle Database Vault and Oracle Audit Vault. The cost and time required to fix a vulnerability in Oracle's database can be staggering because of the critical role the software plays in the business of large companies, and the wide range of platforms that Oracle supports, Kornbrust said. Citing the example of one German company that has 8,000 Oracle databases, Kornbrust said rolling out a single patch can require 32,000 hours of labor, or four hours per database. That translates into 60 full-time database administrators and doesn't take into account the time and expense required for testing the patch on each database, he said. Moreover, for each vulnerability that gets patched, Oracle must develop a patch for every version of its database that's supported, with a version of each for every hardware platform and operating system the database runs on. That amounts to around 100 separate patches for every vulnerability, Kornbrust said. HITB runs through Sept. 6.
589249
With hotly contested nationwide elections just weeks away, several computer experts Thursday questioned the reliability and security of e-voting systems during a congressional committee hearing.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
686832
InfoWorld - IBM released SOA products&#160;for integrating software applications and improving business processes, and said more customers are starting to understand the SOA concept.
735565
(Source: Qualys)  To further enhance its IT system risk management capabilities, Oracle GIT has deployed an on-demand software vulnerability and compliance management solution that allows Oracle GIT to gain significant efficiencies and enhance the company's information security. In addition, Oracle GIT can now more efficiently manage the security of highly-sensitive vulnerability information throughout the deployment of its Security Operation Center.
533542
(InfoWorld) - While most of Oracle's recent purchases have focused on growing its applications business, the vendor's latest proposed purchase will beef up its growing identity management operation. Oracle announced Wednesday that it has agreed to buyÂ Bharosa, a provider of software to help detect online identity theft and fraud. The companies didn't reveal the financial details of the acquisition, which is expected to close next month. "The transaction will extend Oracle's Identity Management capabilities by adding proactive real time risk-analysis, strong authentication and fraud prevention," Hasan Rizvi, vice president, identity management and security products at Oracle, wrote in a letter to customers. Identity Management is part of Oracle's Fusion middleware. Bharosa has two main products -- Tracker, antifraud software that works by verifying a variety of factors to confirm identity, and Authenticator, a suite of secure authentication software, which works with Web browsers to protect a range of sensitive information such as passwords from malicious attacks. Once the purchase is completed, Oracle plans to add some of Bharosa's Tracker and Authenticator software to its existing online single sign-on (SSO) and Web-based authorization security products. The intention is to expand the use of Oracle's identity management software outside of an enterprise to safely encompass external users. At the same time, Oracle committed to continue to make Bharosa's software available on a stand-alone basis and to offer integrations with non-Oracle databases and applications as well as its own products. Bharosa has more than 30 customers for its real-time fraud detection and multifactor online authentication enterprise security software. Consumer Web sites using Bharosa's technologies include Wells Fargo & Co. and National City Corp. In total, the company estimates its software protects 27 million users. Other Bharosa customers are AudioTel, a supplier of software to banks, and I-flex solutions, an Indian financial services software vendor and an majority owned Oracle subsidiary. Founded in 2003, privately held Bharosa has its headquarters in Santa Clara, California. The company's name means "trust" in Hindi. Oracle was previously busy on the identity management front in 2005 buying up three companies -- Oblix, OctetString, and Thor -- for their technologies which the vendor then integrated into its security offerings. Â
435523
Deepening its commitment to help corporate users create SOAs (service-oriented architectures) through the use of Web services, IBM's Global Services unit on Thursday announced the formation of an SOA Management Practice.
703336
InfoWorld - IBM's global services organization is adding "health check" services to its repertoire of technical services for SOA deployments, looking to assist users dealing with issues resulting from poor planning or partnerships with inexperienced or so-called proprietary IT vendors.
729877
IBM&#39;s Global Services division has created a practice to help customers with Web services management tools scale to larger service-oriented architectures (SOA).
562711
While most of Oracle's recent purchases have focused on growing its applications business, the vendor's latest proposed purchase will beef up its growing identity management operation.
503580
Work hard for the money IBM today rolled out 23 updated product and 11 professional services offerings for service oriented architectures (SOAs). Some use technology from recent and recent-ish acquisitions, Webify, BuildForge and Bowstreet.â¦
477678
InfoWorld - HP is announcing on Monday SOA governance software and services aimed at helping companies accelerate SOA adoption while reducing risks.
402714
Oracle has released 26 fixes across its product line in its latest critical patch update, nine of which repair flaws that are remotely exploitable.In an advisory listing the problems, Oracle advised administrators to patch their machines as quickly as possible.Five of the six vulnerabilities in Oracle&#39;s Application Server can be exploited over a network without the need for a username or password, the company said.The same danger applies to three of seven vulnerabilities in the E-Business Suite and Applications and one of four problems in PeopleSoft Enterprise PeopleTools, Oracle said.In other products, the update includes one patch for Oracle&#39;s Collaboration Suite and eight for various Database products.Oracle fixed a total of 51 vulnerabilities in its last critical patch update in October.&#160;
314527
Hoping to develop a framework that can one day be turned over to a standards-setting body, Oracle is tackling the problem of how identity data can be safely shared across heterogenous applications.
537932
SEPTEMBER 03, 2004 (IDG NEWS SERVICE) - The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.
743075
(InfoWorld) - As part of a new market strategy aimed at growth markets, business software vendor Software AG will focus on SOA (service-oriented architecture) products and services, and plans acquisitions to broaden its product portfolio and market share, company executives announced at a news conference Wednesday. The Darmstadt, Germany, software maker, whichÂ used to tag itself The XML Company, sees its future in helping businesses migrate their legacy IT systems to more flexible, SOA-enabled infrastructures, said Peter KÃ¼rpick, the member of the Software AG executive board responsible for research and development, Software AG offers a suite of products, including its main Crossvision application, that provide companies with the necessary tools to build SOA-based services and the interfaces to link them to other applications, KÃ¼rpick said. KÃ¼rpick pointed to the company's new Active Governance Framework (AGF) featuring an SOA policy editor that allows developers to edit and enforce business and technical policies. One of AGF's features is the capability to send alerts to business users when an application conflicts with an established policy. With its focus on SOA products and services, Software AG aims to double its sales to â¬1 billion ($1.3 billion) within the next five years, said CEO Karl-Heinz Streibich. While Software AG intends to "remain a product company," a huge share of its business will come from consulting services, said company spokesman Norbert Eder. Acquisitions, particularly a larger company in the U.S., will help increase sales and thus market share, according to Eder. Software AG is also keen to acquire smaller software companies that can broaden its SOA portfolio or provide access to new markets in Europe, he said. The company has set aside â¬700 million for acquisitions. At the Cebit trade show in Hanover, Germany, next month, Software AG plans to provide more details about its SOA strategy, KÃ¼rpick said. The company is the initiator of the "SOA World" event to held at the trade show. The event will include a forum and exhibition by providers of SOA products and services.
492310
(InfoWorld) - Oracle is making a number of moves to improve access management and other security features for its users. The enterprise software maker said Wednesday that its Oracle Identity Management product is now certified to work with its E-Business Suite 12, JD Edwards EnterpriseOne 8.12, and Siebel 8 applications. Oracle also said certification on its PeopleSoft Enterprise 9 applications is expected by June. Oracle also said that its Database Vault security product has been certified to run on PeopleSoft Enterprise applications. Database Vault is designed to protect against "insider threats" to data security by restricting who can access what data, where, when, and how. It is particularly focused on helping companies meet governance and compliance requirements. Oracle also introduced Oracle Management Pack for Identity Management, which it said helps reduce the cost and complexity of managing identity and access management systems. The Identity Management product is an enhancement of Oracle's Enterprise Manager 10g product. Its identity and access management functions work across multiple software brands and operating systems.