Survey of Oracle Database Professionals Reveals Most Do Not Apply Security Patches


	Advertise with Sarbanes Oxley Compliance Journal

News

< Back

Sarbanes Oxley : Technology : Database

Survey of Oracle Database Professionals Reveals Most Do Not Apply Security Patches

Sentrigo survey shows just one in ten DBAs regularly applies Oracle Critical Patch Updates; two-thirds have never installed CPUs

Slavik Markovich
Chief Technology Officer
Sentrigo

Sentrigo, Inc., an innovator in database security software, has announced survey results indicating that most Oracle database administrators do not apply the Critical Patch Updates (CPUs) that Oracle issues on a quarterly basis. Oracle designed its CPU program to help customers protect databases and other products against recently discovered security vulnerabilities. However, security patching is largely neglected, which leaves databases open to exploits. Although there are genuine hurdles to CPU installation, including downtime and concerns about compatibility with applications, the results indicate that many enterprises have not internalized the high risk presented by not securing their databases with the latest patches.

Sentrigo has been conducting the rolling survey at Oracle Users Group (OUG) meetings across the country, beginning in August 2007 at the Capital Area OUG in Reston, Va., and continuing in cities such as Chicago, Portland, Salt Lake City, Charlottesville and Cincinnati. The company has collected responses from 305 professionals, mostly database administrators as well as consultants and developers.

Results highlight that most organizations are not taking advantage of Oracle CPUs in a timely manner, if at all. Findings include:

- When asked: “Have you installed the latest Oracle CPU?” – Just 31 people, or ten percent of the 305 respondents, reported that they applied the most recently issued Oracle CPU.

- When asked: “Have you ever installed an Oracle CPU?” – 206 out of 305 OUG attendees surveyed, or 67.5 percent of the respondents said they had never applied any Oracle CPU.

"This survey scares the heck out of me," said Mike Rothman, president and principal analyst, Security Incite. "The database is where most of an organization's critical and regulated data resides and if it's not patched in a timely fashion, organizations are asking for trouble."

Sentrigo created Hedgehog, a host-based database activity monitoring and protection software solution, to detect and prevent unauthorized database use by hackers and company insiders. Hedgehog’s unique virtual patching ability immediately protects databases against vulnerabilities that have been discovered, but not yet patched, as well as against zero-day exploits of certain types.

Slavik Markovich, CTO at Sentrigo said, “While we encourage all organizations to install the Oracle CPUs in a timely fashion, Hedgehog’s virtual patching appeals to businesses because it offers a security layer that doesn’t require database downtime and is transparent to applications accessing the database. Hedgehog gives organizations such as these a fast, unobtrusive way to virtually patch until they can take time to install the latest CPU. Additionally, many companies are running older, unsupported database versions and have no protection against new exploits – for them, virtual patching is pretty much the only way to address vulnerabilities.”

Sentrigo, Inc. is an innovator in database security software that monitors all database activity and protects sensitive information in real time in order to prevent both internal and external data breaches. Sentrigo’s Hedgehog software, including a free version, can be downloaded and easily installed to provide immediate protection against breaches, as well as virtual patching against recently discovered threats—with minimal impact on database performance. The product’s unparalleled level of protection, coupled with its ease of use, make it the instant standard for database security and regulatory compliance. Sentrigo was named in 2007 by Network World as one of the 10 IT security companies to watch. For additional information and to download Hedgehog, visit www.sentrigo.com.

About Us

Editorial