Oracle develops standards for identity security
171428
Software maker Oracle Corp.   said on Wednesday that it is developing a group of standards  that businesses can use to help control and monitor the flow of  sensitive personal data within corporate computer systems.
407202
Oracle has issued an alert regarding multiple security vulnerabilities discovered across an unsettlingly wide range of its products.
139126
Oracle Database 11g has new security, testing and management features.
638915
The Trusted Computing Group has announced a draft specification to protect sensitive data on storage devices.
535666
Oracle Corp. today patched 45 vulnerabilities in its flagship database as well as its application server, collaboration suite, e-business line and PeopleSoft software.
17527
The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.
265642
InfoWorld - Oracle on Wednesday announced a new project to tackle one of the thorniest problems facing enterprises: the proliferation of sensitive identity information across enterprise networks.
735565
(Source: Qualys)  To further enhance its IT system risk management capabilities, Oracle GIT has deployed an on-demand software vulnerability and compliance management solution that allows Oracle GIT to gain significant efficiencies and enhance the company's information security. In addition, Oracle GIT can now more efficiently manage the security of highly-sensitive vulnerability information throughout the deployment of its Security Operation Center.
168165
OASIS standards group ratifies a tamper-proof method for handling electronic timestamps, postmarks or official corporate imprimaturs.
537932
SEPTEMBER 03, 2004 (IDG NEWS SERVICE) - The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.
563884
(InfoWorld) - Thereâs a common nightmare haunting CISOs (computer information security officers) that features a glance at the morning paper, and 72-point banner headlines with the name of their employer and the words âLOSTâ and âCUSTOMER DATA.â Thereâs no question about it: protecting customer and employee data is one of the thorniest problems facing enterprises today. Last week, Oracle took a swing at solving that problem, announcing the Identity Governance Framework, an initiative to develop specifications for sharing identity data across heterogeneous applications. The project has the support of identity and access management (IAM) vendors Ping Identity, Sun Microsystems, and Securent, as well as CA and Novell, according to Amit Jasuja, vice president of product development for Oracleâs security and identity management products. Problems such as lost data on laptops and identity theft point to the need for overarching standards that govern all the sensitive data squirreled away in data repositories across an enterprise, such as human resources, customer relationship management and custom-built internal applications, he said. IGF addresses that problem by establishing a governance model that allows organizations to create âcontractsâ between applications and repositories of identity data. The model would cover how data flows within an enterprise and outside the enterprise to supply chain or business partners, he said. Because the framework came together quickly, the real value of IGG will be determined in the coming weeks and months, as Oracle and its partners work to develop the specifications and transfer them to a standards group such as OASIS or the Liberty Alliance to manage, Bowen said. âItâs a good first step. It will get us closer to the goal line,â said Don Bowen, director of identity integration at Sun. âWill it get us into the end zone? I donât know.â
90381
On tap for the new database management system: improvements in high availability, performance, scalability, manageability and what Oracle dubs "diagnosability."
589654
Oracle has shipped the first major upgrade to the stand-alone enterprise search software itÂ debuted last yearÂ emphasizing new links to third-party data sources and identity management systems.
636232
(InfoWorld) - The Liberty Alliance Project has published a document outlining the legal issues enterprises should consider when networking their Web applications and identity systems with those of other businesses. The primer on creating circles of trust raises awareness around issues such as privacy, technical terminology, indemnification and dispute resolution, the organization said. The Liberty Alliance, composed of vendors such as Oracle, Sun Microsystems, and IBM, has worked on defining technical protocols used for federated identity and Web applications. It's now studying policy issues around theÂ use of federated identity technology. While vendors are now producing standards-based products that enable the secure sharing of information, the legal consequences of what happens if things go wrong aren't so well defined. Before linking their systems, two businesses have to create a contract, a process Liberty calls establishing aÂ "Circle of Trust." Since managing federation agreeements between businesses is still a new area "it's helpful to have a checklist," said Graham Titterington, principal analyst at Ovum in London. "It's a step forward." The document was written by Liberty's Public Policy Expert Group along with legal experts, the organization said.
134607
InfoWorld - Oracle is making a number of moves to improve access management and other security features for its users.
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
45590
(InfoWorld) - Oracle has released a technology and policy blueprint for how organizations can exchange sensitive identity information among applications. Oracle has given theÂ Identity Governance FrameworkÂ (IGF) to the Liberty Alliance, a consortium that develops standards for Web-services applications, said Brett McDowell, Liberty's executive director. It was developed with support from vendors such as CA, Hewlett-Packard, Sun Microsystems, and Novell. The IGF will be used to develop technical standards for how identity information is stored and shared across systems. Over the coming months, Liberty will gather more technical requirements from users, McDowell said. "In the big picture, this helps enterprises better manage the privacy of identity information," McDowell said. "The key is that this is one more layer in completing the overall framework for identity management." Around June, a Liberty technical group will test the specifications before the final phase,Â interoperability testing, he said. Oracle made the IGF available to Liberty royalty-free so it can be used without licensing barriers in a wider range of products, McDowell said. The IGF includes components such as: -- Client Attribute Requirement Markup Language (CARML) and schema: an XML-based contract defined by application developers that informs deployment managers and service providers about the usage requirements of an application. -- Attribute Authority Policy Markup Language (AAPML): a set of policy rules regarding the use of identity-related information that allow sources to specify constraints on use of data. -- CARML API: an application programming interface that makes it easier for developers to write applications that consume and use identity-related data in a way that conforms to policies.