Infosecurity.US

Sécurité de MySQL

via DatabaseJournal contributor Rob Gravelle - a well crafted screed, in which, Oracle Corporation's (NasdaqGS: ORCL) MySQL is targeted and security advice, conveyed. Today's Recommended Reading matière.

㎖

Monitoring? We Don't Need No Stinkin' Monitoring...

Interesting commentary by Adrian Lane, Analyst and CTO of Securosis, writing at DarkReading, and targeting the truncated utilization of DAM, the acronym for Database Activity Monitoring. In this case, the widespread lack of proper deployment and implementation of the query blocking mechanisms inherent to nearly all DAM products.

Coupled with the apparent lack of core competency in the DAM arena, clients of the software manufacturers flogging theses products are probably also deficient in at least three other fundamental aspects of DBMS security activity monitoring products: [1] Education / Training within the scope of the products, [2] Scrutiny of the Monitoring Log Output, and [3] probably the key to everything - the ability to read SQL statements.

შ ℇ  ℍ

SQL Injection, The Litany

via the recently released Veracode State of Software Security Volume 5 Report, SQL Injection flaws are rampant on the interwebs [suprised?], which points to fundamental coding failures brought on by both incompetent development staff plus the oft mentioned cruft.

The entire scenario equates to simple leadership failure; this fail condition is indicated by the inability to enforce both secure development practices and a verifiable training regime.

While the company responsible for the report is in the business of software security scanning and code review, there is efficacy to the document's  underlying information...

⊛  ⊟  ⊠

Big Data Speaks

via the apropos insight of the Oracle Alchemist.

ŗ

 

Microsoft Research: Hidden Bias of Big Data

 

An erudite take on the notion of bias in big data, hidden bias, indeed. Today's Must See!

 

℔ ℛ ℘

NoDBA®

via the apropos insight of the Oracle Alchemist.

 

Oracle OEM Vulnerabilities Detailed

 

TeamShatter has reported six severe vulnerabilities resident within Oracle Corporation's (NasdaqGS: ORCL) Oracle Enterprise Manager DB Grid Control management facility.

Quite negative news indeed, for the all-encompassing server, daemon, code and database control  product, not to mention the huge numbers of deployed bits in both the public and private sectors. Recent Java exploits, piggybacked on these Oracle Enterprise Manager vulns, puts the database leviathan into a tenuous posture of insecure cruft deployment.

Whilst all of the enumerated vulns have been officially patched by the company, a vast ocean of deployments are not being updated, generally due to recalcitrant DBAs and their System Administrator colleagues (thereby displaying misguided rationale, as generally, they're fearful of patchsets targeting Oracle products, due to the severe impact of the crufty bits applied to extant Oracle instances, and the subsequent possibility of significant downtime). - mxh

 ℇ  ℈ ℊ ℋ  ℌ  ℑ

 

 

Availability, Human Reliability for DBAs

 

⚠ ☠

Closson, Modern Platform Topics for Modern DBAs

 

⚠ ☠

Tanel Poder Releases Latest Oracle Performance Tooling

  Meanwhile, in Oracle Database news, Tanel Poder, perhaps one of the most highly respected, yet quitely competent Oracle professionals has released version 4.2 of his well known [and heavily utilized by DBAs in-the-know] Snapper tool targeting Oracle Database performance metrics.

Whilst not necessarily security related his work is both highly rated, feature rich, yet lightweight in DBMS impact, oh, and did I mention available at no charge? If you are in any way related to Oracle DBMS products, you need Snapper 4.x. Keep a sharp eye out for Tanel's seminars, also highly rated.

≨, ∉, ∝

Battle.net Fallout

News, of successful internal network security attacks, targeting Blizzard Entertainment has percolated up through the detritus of the interweb. Bad news for Battle.net players.

π

Requiem in Pacem: Mark Townsend

via Oracle Corporation (NasdaqGS: ORCL) comes the sad news of the passing of Mark Townsend, the Redwood Shores, California database, applications and hardware leviathan's Vice President of Product Development for Oracle Database. His technical acumen was legendary, as such, he was known as the company's "Single Source of Truth"  for database products. Infosecurity.US extends our sincere condolences to the Townsend family, his friends and colleagues.

 ℺