<<< Date Index >>>     <<< Thread Index >>>

Oracle - the last word



A few people have asked me recently what it is I'm actually looking for from Oracle. I have a nice little laundry list of things, of course, but mostly all I've been waiting for is to hear Oracle to say, "We admit we have a problem with regards to security, but here's our strategy and we're going to make it better." In that simple admission would lie the cessation of my criticism of Oracle. But, let's face it, it's not a simple admission in reality. As a business, Oracle can't say, "Oops. We've been mistaken all these years - turns out our database isn't a secure as we actually thought." A company like Microsoft can, and indeed did, something just like that but their business was never built on what was supposed to be a reputation for and a foundation of security. It would be business suicide for Oracle to do this.



After much rumination, the obvious struck me: Oracle could make their product more secure (and improve the behind-the-scenes processes that enable them to deliver a secure product) and all the while admit to nothing. Whilst I've been throwing tantrums at their failure to admit to the truth, Oracle has been working on doing this. It almost passed me by. They're not there yet but they are getting closer. Let me put that in concrete terms: When Oracle 10g Release 1 was released you could spend a day looking for bugs and find thirty. When 10g Release 2 was released I had to spend two weeks looking to find the same number.



Soon, and I have no time frame in mind for "soon", Oracle will have "arrived" at a point where sitting down and finding a single bug will take a month - and not once would they have had to admit to having problems with security. They'll have solved it. Their tools will be tight and their processes slick. They'll almost be Unbreakable.



I'm sure the strategists at Oracle must have realized this - for an organization such as Oracle it's really the only reasonable option available. Okay, it's not the open strategy that I'd have preferred but, in the end, the journey of how they got/get there, to a secure robust product, is irrelevant.



Another thing that struck me was the amount of effort and time that it must have taken to get a lumbering stegosaurus of a beast like Oracle to turn around. I can only assume that, as CSO, Mary Ann must credited with that, and as such, I revise my position on her. Dare I say it, well done, Mary.



I realize now that this is how it's going to be - I'm not going to get my much sought after admission but at least we get a better, more secure product we can be more confident in. Besides, I weary of "Oracle bashing" and I've no doubt that I've wearied many here on these list over the years, too. NGS will, of course, continue to research and find Oracle security flaws, report them and help Oracle to fix them but, from now on, I'll leave the proselytizing to others. Oracle have moved sufficiently forward enough, and with enough momentum (now), that I believe they've passed the point of no return and can do nothing but eventually end up where we all want them to be.



Cheers,

David Litchfield

NGSSoftware Ltd

http://www.ngssoftware.com/

+44(0) 208 401 0070