Oracle behind Microsoft on patch management, says database expert

Top Stories

Related

• Clues point to Jan. 13 release of Windows 7 beta
• Microsoft releases Vista SP2 beta
• Obama's DHS pick may find support for raising H-1B cap at confirmation hearing
• IBM wants info from Apple execs in Papermaster case
• License server glitch exposes SonicWall users to e-mail security threats
• Report: Former AOL chief exec tries to raise funds to buy Yahoo

• Moving to a start-up? Fasten your seatbelt
• SAP's Kagermann had concerns about TomorrowNow deal, filing shows
• 7 ways to cut your software costs during the economic downturn
• SAP confirms hiring of former Oracle exec, signals new on-demand push
• Global News Update: Tuesday, November 11, 2008

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 13, 2008 (Computerworld) Oracle Corp. needs to improve patch management, an area in which it is lagging five years behind Microsoft Corp., according to database expert Karel Miko at Prague-based consultancy DCIT AS.

"When Microsoft announced Trustworthy Computing, a lot of people laughed, but now you see a real difference," said Miko, who spoke at the European Computer Audit, Control and Security Conference in Stockholm.

"I don't like Microsoft, but Oracle definitely has something to learn," he said.

Microsoft offers central patch management tools that allow customers to see what patches are missing and so on, whereas Oracle doesn't, Miko said.

Oracle also doesn't make life easier for companies that want to keep their databases secure, according to Miko, making it complex to download and install patches.

In addition, the company has a strange approach to new vulnerabilities, he said.

"An independent consultant announces a vulnerability to Oracle. Three months go by, and nothing happens. Six months, a year, and still nothing. Oracle puts it in a queue and will solve it sometime, maybe," said Miko.

If customers put pressure on Oracle, it might be prompted to improve, but Miko isn't holding his breath.

"Customers are very dependent on Oracle -- its database is No. 1. If you have an application based on an Oracle's database there is no way to change, in maybe 90% of all cases," he said.

Databases are one of the hottest topics at the convention; no other product category has more sessions.

That's good, because database security is lagging behind, Miko said. Even though Oracle has been adding new security features, customers aren't taking advantage of them.

"To be honest, a lot of companies aren't even using the basic stuff that has been there since Version 8," said Miko.

In the end, he said, database security is all about people.

"In my experience, even some small enterprises have better administrators than large banks, and [they] do a better job," said Miko.