Chairman and CEO Larry Ellison positioned his company's newest database product as the ultimate e-mail server during his keynote speech Monday night at Comdex and claimed that Oracle 9i is "unbreakable." Emphasizing the importance of e-mail for enterprise customers, Ellison said Oracle's database is fault-tolerant and that any application running on Oracle is therefore unbreakable. "The new version of the Oracle database is completely fault-tolerant," Ellison said. "If the server fails, if the software fails, if the site fails, your application keeps running. It will not go down. You can't break it." Ellison also said hackers and cybercriminals can't break into the database because of its enhanced security and stability. He said he was warned not to call Oracle 9i unbreakable because it would attract hackers eager to break into Oracle databases, but despite increased attacks recently, all attempts have failed so far, Ellison said.

"I'm Mary Ann Davidson. I'm the Director of Security Product Management for Oracle Corporation. Oracle is the second largest software company in the world, and we are a large provider of secure information management systems to both commercial and governmental customers. A number of our customers are involved in national defense or intelligence activities."

"Organizations must assess their security requirements and not deviate from them as part of system design. If security is not built into a product or system from the get-go, it is often impossible to retrofit it after-the-fact. Organizations also need to look at the total cost of securing a system, including assessing the lifecycle cost of security, such as how often they will have to patch their systems due to significant security vulnerabilities. While no product is bug-free, an ostensibly secure product, for which a vendor is constantly issuing security patches, is a sign that the vendor did not pay enough attention to security during design, and at some level does not get it, or care about security. More importantly, often the single easiest way hackers break into systems is through public vulnerabilities for which the patch has not been applied. A vendor issuing a patch per day or every other day for their product suite is, in effect, building insecure and unsecurable systems."

"Consumers of information technology have a requirement to make security a purchasing criteria. I'm sure you're familiar with the expression that if you don't vote, you lose the right to complain about the election afterwards. This is also true in security. If you do not make it a purchasing criteria, you lose the right to complain afterwards if you've been hacked."

"Vendors, of course, also have many requirements to provide better cyber security. One of them is to commit to a secure product life cycle; that means everything from building security into your engineering process because you can't add it after the fact, to being very aggressive in treating security vulnerabilities and notifying a customer base when there are problems in our product suites."

Ms. Davidson: "Well, I think it's important that security has to be part of a design process. And a vendor of a secure product has to make a commitment to a secure product lifecycle. For example, before you build a piece of software, you need to sit down and say what are the security threats I'm protecting against? What are the technical measures I'm going to implement?"

Ms. Davidson: "I don't think you can ever be 100 percent sure and there is no bullet proof security. But it basically gets back to, I talk to my customers about the questions you ought to be asking all of your vendors about security. And that is, how do you build security? Is it part of the design process? Is that one of the first things you think of? Do you have secure coding practices? do you have a small group of people? Because it's hard to get security right. You have a small group of people who are the experts to whom the rest of your company goes to make sure I'm building a piece of software, I need to make sure the security people; I talk to them, I use the code routines that are well formed and well delivered, I have testing to test the security mechanisms, I do security risk assessments or penetration tests, try to break into it."

Ms. Davidson: "We have a team of reputable hackers whose very good that's breaking into things before the product goes out the door."

However, Oracle's Chief Security Officer Mary Ann Davidson took exception with any characterisation that the company hasn't delivered on its promise to create "unbreakable" software. "We are doing a heck of a lot," she said. "I would much rather stand up and say we are going to make every product unbreakable than to say, 'you're right, it's impossible,' and give up." "Marketing campaigns come and go," said Oracle's Davidson, "but we are in security for the long haul."

LARRY ELLISON: Do you know how many people have hacked into an Oracle database in the last ten years?

SPENCER MICHELS: No.

LARRY ELLISON: That would be zero. That would be zero. It is not true that anyone can hack into any piece of software.

Our customers are among the most security-aware in the world; it is precisely because we market that we are secure that we take great pains to notify customers of security vulnerabilities when we - or others - find them. It's very simple; you do the right thing by customers. We run our own systems on Oracle, so the security golden rule of 'treating the customer as you would yourself' is especially applicable.

It's easy to criticize vendors for security vulnerabilities, but the target is all too easy to hit. A better approach might be to look at a vendor's track record: we have spent millions on information assurance - having someone other than Oracle vet our security claims - through 14 independent security evaluations, far more than any other vendor. We have a secure product development process which we continuously strive to improve. Unlike many vendors, we do not blame the researcher for finding security issues in our products; rather, we give attribution to them, and make every effort to address the issue for all customers, on all releases, as quickly as possible, a feat particularly challenging for us given the number of product releases and operating systems we support. We use "vulnerability lessons learned" to continuously improve our development processes, our default installation and/or our documentation.

Our long-standing commitment to secure product design, development and delivery and independent measures of assurance is what 'Unbreakable' is all about. Long after the marketing campaign is done, we will still be fanatical about providing the most secure mission-critical software in the business.

Ellison claimed it's been more than 10 years since someone has hacked into an Oracle database. Oracle invited the toughest hackers from China, Russia and all over the world to break into Oracle's system when it launched its "Unbreakable" advertising campaign last year, he said. Though hacking attempts on Oracle's Web site shot up to as many as 30,000 attacks per week during the campaign, no one managed to break into the system, Ellison said.

"Bill Gates said he would devote the month of February to security," said Ellison, referring to an initiative at Microsoft earlier this year to improve the security of its software. "February's a short month. We've devoted 25 years to security."

Just so there's no misunderstanding about who to look up should something go wrong, Davidson's job starts with software development, where the task is to create a hacker-proof design, and ends with security response -- containing the damage if any occurs.

Though Davidson didn't have a programming background, she compensated with big-picture, strategic thinking. When Oracle's marketing team and Ellison came up with the "unbreakable" slogan, she mobilized her staff to raise the security bar. That entailed closely examining many products and changing the way programming code was built and planned. Davidson often asks the thorny security questions that software developers prefer not to answer, such as: Who should get privileges to see data? How can a software product guarantee that only the right people get that access? And how should products be built to both preserve security and accommodate government demands to see information on an emergency or surveillance basis?

"For example, the estimated cost to deploy a patch for a recognized software flaw runs on average $900 per server and $700 per client. If an organization misses a patch and gets hit by a virus, the cost will be magnified." -- Mary Ann Davidson

The real problem with this is not that the flaws Alert 68 supposedly fixed are still exploitable, but rather the approach Oracle took in attempting to fix these issues. One would expect that, given the length of time they took to deliver, these security "fixes" would be well considered and robust; fixes that actually resolve the security holes. The truth of the matter though is that this is not the case.

Some of Oracle's "fixes" simply attempt to stop the example exploits I sent them for reprodcution purposes. In other words the actual flaw was not addressed and with a slight modification to the exploit it works again. This shows a slapdash approach with no real consideration for fixing the actual problem itself.

As an example of this, Alert 68 attempts to fix some security holes in some triggers; the flaws could allow a low privileged user to gain SYS privileges - in other words gain full control of the database server. The example exploit I sent to Oracle contained a space in it. Oracle's fix was to ignore the user's request if the input had a space. What Oracle somehow failed to see or grasp was that no space is needed in the exploit. This fix suggests no more than a few minutes of thought was given to the matter. Why did it take 8 months for this? Further, how on earth did this get through QA? More, why are we still waiting for a proper fix for this?

"I admit: We vendors need to do better in building secure software. We try. I try everything I possibly can. But I don’t buy the argument that it’s all the vendors’ fault for not building better software, in cases where researchers happily hand weapons of mass disruption to the hacking community."

"When you look at the amount of money spent fixing avoidable, preventable security faults, you realize that almost anything that can be done upfront to avoid making those mistakes pays for itself quickly. There is a strong cost-avoidance argument to building software right the first time."

"Oracle has a rather strong culture of security, partly because we started as a company nearly thirty years ago by building the first commercial relational database, under contract to a U.S. intelligence agency."

As chief security officer (CSO) at software vendor Oracle, Davidson is in charge of making sure that customers' data stays safe. Even if you're not one of Oracle's customers, who include critical infrastructure providers in the government, financial services, and telecommunications sectors, it's possible that some of your data is being stored in Oracle software.

IDGNS: What other advice do you have for customers on security?

Davidson: Push your vendor to tell you how they build their software and ask them if they train people on secure coding practices. Also, push industry analysts on which products are more secure. Analysts tend to not do direct product comparisons but I think they should do it on security products based on the total cost of ownership. For example, ask which product is going to cost more from a security standpoint, ask how many patches am I going to have to apply, and how many consultants am I going to have to hire to lock it down.

Speaking with eWEEK Magazine, Oracle CSO Mary Ann Davidson admitted that the company had a problem with one of 100 issues that it fixed in its most recent quarterly Critical Patch Update (CPU).

Davidson admitted that the company did not adequately check to make sure that the patch components were installed correctly on Oracle systems where the patch was applied.

I saw today that Mary Ann Davidson has announced that Fortify Software Inc's products will be used to check the database server software and middleware for potential security holes. I saw this is a post titled "Oracle Turns to Fortify to Secure Source Code". In this post Mary Ann says she has searched for years for a suitable tool to audit the Oracle software. There is a sting in the tail though as Fortify's software is not suitable for auditing large swathes of the Oracle product stack such as the application server, E-Business Suite, Peoplesoft and many more that are written in a variety of languages, presumably PL/SQL is one of these that are not supported. It sounds from this article that the C used for the server will be audited but PL/SQL not. As most of the recent SQL Injection issues and therefore security bugs are in PL/SQL packages this new tool is unlikely to make large inroads into the recent woes caused by these bugs.

Why Oracle changed its mind is a long story. But the straw that broke the camels back came in November. It came in the form of a report from security research Alexander Kornbrust, of Red-Database-Security GmbH, which stated that Kornbrust had found some 252 unpatched holes in Oracle Database 10g.

Oracle does have a lot of resources, but vetting 252 reported vulnerabilities isnt where its people want to devote them. As it is, the automated code assessment tools Oracle uses tend to turn up false positives, John Heimann, director of Oracles security program management, told eWEEK.

Last week, the business software maker issued its quarterly Critical Patch Update, addressing more than 30 flaws in its software. However, the update for Oracle 10g Release 2 does not plug a hole that allows published attack code to run, according to a message sent to the Full Disclosure security list on Wednesday by David Litchfield, a researcher at Next Generation Security Software.

Last year, Oracle's chief security officer Mary Ann Davidson claimed that Oracle's own researchers found 75 percent of the bugs in the company's products. Kornbrust used Davidson's figure to project that Oracle actually had 160 flaws it needed to fix.

"Let's do some math," wrote Kornbrust on Bugtraq. "According to Mary Ann Davidson 75 % of all security bugs are found by Oracle employees: If bugs are fixed independently by the reporter then: 25 % = 40 unfixed bugs ( found by Red-Database-Security) 75 % = 120 unfixed bugs (found by Oracle employees) ==> 160 security bugs are still unfixed."

"I don't hate protecting our customers, that's important, but what a waste of resources to try to band-aid after the fact something we should have caught earlier," she said.

As a result, Oracle has implemented numerous measures to produce better code. Oracle created a 200-page guide on coding standards. An in-house hacking team pokes products for holes in live hacking sessions. Developers up to senior vice presidents must participate in educational Web-based classes.

"We use our own dumb-ass mistakes as examples," Davidson said. "Because if you don't do that, developers think this is an academic argument."

The company uses new in-house tools to looks for buffer overflow vulnerabilities and SQL injection attacks. It also employs software from Fortify Software to scan for problems in Oracle's 30 million lines of code, she said.

"My goal is to be out of a job," Davidson said.

Chief security officer Mary Ann Davidson has hit out at an industry in which "most software people are not trained to think in terms of safety, security and reliability." Instead, they are wedded to a culture of "patch, patch, patch," at a cost to businesses of US$59 billion, she said.

There is often little upside to cooperating with companies that do not understand Oracle and who profit from publishing security vulnerabilities, according to Oracle Chief Security Officer Mary Ann Davidson.

"What I really want is a world where there can be fair and accurate criticisms," she said. "I'm all for dialogue, but you have to establish trust."

And Oracle no longer talks about its products as unbreakable. Earlier this week, Davidson said that the first time she heard the marketing slogan, she thought, "What idiot dreamed this up?"

Davidson believes that Oracle and Microsoft have very different pedigrees when it comes to security. She says that security has been built into the development of Oracle's products for years now, a by-product of its long history of government use. The U.S. Central Intelligence Agency was one of Oracle's first customers, she noted.

Oracle's security team doesn't simply fix bugs. When a new flaw is discovered, researchers make sure that what they've learned also translates into secure coding practices for the development team. "For at least 12 years we have built security into the formal development process," Davidson said.

"This leads me to the very last reason but really the first reason why we did what we did for Oracle Database XE: Oracle's name is on it, and security is part of everything we do." -- Mary Ann Davidson [Source]

"Oracle, for example, got into identity management when customers asked us to build a really scalable LDAP directory, and we have made several acquisitions in identity management for the purpose of offering a complete, integrated, and heterogeneous solution." -- Mary Ann Davidson

"One of our key database security product features is definitely Transparent Data Encryption, encryption that is just there and works, without requiring you to recode your application. (Encrypting data in an operational database transparently to an application is not all that easy, or we'd have done it a long time ago.) We can encrypt backups, too, by using Oracle Secure Backup, and given the amount of sensitive information stored off-site in backups, that's a great thing. Just ask any company whose unencrypted backup tapes of all their customer data have gone missing. We have also started tackling that perennial "other hard security problem" of the godlike-privileged DBA by enabling customers to separate database administration from data access in the administered database by using Oracle Database Vault. And, last but not least, with Oracle Secure Enterprise Search we provide the ability to harness the power of all your data in disparate places across your enterprise through a powerful search engine, while limiting (in some cases, for security reasons) people from even knowing that a document exists. I confess that, for someone who works at a tech company, I am a closet Luddite, but database security is definitely cool again.

I'm glad that a lot of great folks at Oracle are making data security just that simple. I think our customers, and their customers, will be glad too." -- Mary Ann Davidson

"Maybe you can't prove that this product is free of defects but at least prove to me that you use these [tools] in its development. You are going to have to have some kind of proof that you paid attention in development -- even to the level of training people and what kind of software lifecycle you have," said Davidson.

"Where does this leave us? With a speed bump that says, in effect, newer versions of products -- almost any vendor's products -- are probably, all other things being equal, "more secure." This seems obvious, but it is worth stating. Vendors -- most of us -- know more about secure development and secure coding than we did even three or four years ago. Newer products reflect that. Also, even if we can't fix every single security issue on old product versions, we certainly are going to fix it in new versions. Preferably, as soon as we can because it is just good business and common sense to do this." -- Mary Ann Davidson

"The main value of automated vulnerability assessment tools is finding and fixing problems during development, before products ship. Also, automated vulnerability assessment tools are just one component of a robust, comprehensive assurance program. Oracle uses multiple tools as part of its Software Security Assurance program." -- Mary Ann Davdison

"Oracle is celebrating its 30th anniversary this year. Some of us old-timers have been busy wallowing in nostalgia by cataloging remembrances of how Oracle has changed over these 30 years." -- Mary Ann Davidson

"Oracle has some homegrown tools we use to help find and root out common secure-coding errors. Some of these have been developed by Oracle's ethical hacking team, whose technical acumen is exceeded only by its sense of humor in naming the tools. (SQL*Splat is a tool for finding SQL injections, and Bit*Rotter is a protocol fuzzer.) The ethical hacking team uses these tools to automate its security assessments, and the quality assurance teams use them to keep ahead of the ethical hackers.

It took us a long time to find good tools, train people to use them, and roll them out. We have helped our vendors make their tools more robust (nobody could scan 50 million lines of code daily when we started looking at tools), which helps not only Oracle but also others in the industry." -- Mary Ann Davidson

"I don't know if it's my Midwestern upbringing or going to a university with a very strong honor code, but I am really big on disclosure.

Disclosure forces you to be honest with yourself as well as other people. If you have an axe to grind about something, you need to disclose who sharpens your axe if it is material to the discussion. And it often is." -- Mary Ann Davidson [Source]

"What also strikes me about the Oracle Database 11g launch: the option and product releases before the launch. Oracle has released a number of innovative database security options, products, and features over the last two years, including Oracle Database Vault and Oracle Audit Vault. These two offerings were so important that Oracle did not wait for the Oracle Database 11g release; instead, Oracle shipped them when they were ready for market." -- Mary Ann Davidson

"Inside the enterprise, search engines need to be smart and choosy: they must help people find what they need, without allowing them to snoop for what they aren't supposed to have. Oracle Secure Enterprise Search was built to be a "better mousetrap": an intelligent, security-aware search engine." -- Mary Ann Davidson

"An important objective of Oracle Software Security Assurance is that we provide information to customers that helps enable them to use our products securely. To this end, we have developed training materials titled "Defending Against SQL Injection Attacks." Available now, this training content is available online and can also be downloaded so that offline studying (while in the train for your morning commute) is possible. "Defending Against SQL Injection Attacks" highlights some of the coding practices required to eliminate SQL injection vulnerabilities when developing in an Oracle environment. Oracle recommends that anyone who develops Internet applications that access an Oracle database review these materials. Note that this tutorial will also be available through Oracle University as a lesson in the instructor-led course "Oracle Database 11g: Advanced PL/SQL", which is scheduled to be available in April 2008." -- Mary Ann Davidson

"Forthwith, here is my script for parsing through shill-meisters as quickly as possible:

5. "How can it be broken?" (Especially for a security product, knowing and being honest about how it can be broken is important. A claim of "zero false positives," for example, should cause anyone to run screaming in the opposite direction.) (like 'unbreakable'?)"

"As much as I have expressed concerns about every idiot with an opinion being able to express it on the Internet (as I am doing here!), the fact remains that in some cases, bloggers have spotted untruths, exaggerations and fabrications reported by the media (doctored pictures and doctored service records, to think of a couple of prominent examples). There is an important utility in keeping professional journalists and industry analysts honest and objective that is worth something to the millions of people who expect that from mainstream media. Score one for the blogosphere.

I talked in my presentation about what constitutes a good metric (objective, measurable, helps you answer basic questions like "are we doing better or worse," incents the right behavior, fosters additional questions, helps you identify positive or negative trends, and so on). I used as an example the various metrics we keep pertaining to the release of CPUs that I wanted to discuss as a group, because there is no single metric that you could use to answer "goodness questions" related to how we are doing. In fact, picking a single metric and focusing it to the absence of all others would lead to incorrect incentives." -- Mary Ann Davidson [Source]

"As such, I am keenly aware of the high costs to Oracle and to our customers of avoidable, preventable defects in our software." -- Mary Ann Davidson

"In the vendor community, there is a low rumble of discontent about our supply chain's current lack of a "secure development lifecycle." I'm not talking about other software suppliers (for example, vendors who supply toolkits or components we embed) though at Oracle, we do vet these suppliers' security practices before we incorporate their technologies into our code.

While I appreciate the University of X's CS department chairman getting back to me (and the fact that they had at least some material on secure coding practice), I see no reason to pay them to do work they should be doing, anyway.

Take my letter, modify it as you will, and start holding university CS programs' feet to the fire to improve." -- Mary Ann Davidson

"For example, for many years, Oracle has had its developers use standard cryptographic modules." -- Mary Ann Davidson

Oracle believes that most developers should be writing "Secure code," not "security code."

A second caution is to remember information security Rule No. 1: "Don't trust any information from the client."

"In the almost 20 years I have spent here, I have seen Oracle evolve from being a strong database company to one of the largest enterprise software companies in the world. We have always been security leaders, and not merely in security features and functions. We lead by broadly training our developers in secure coding practice. We lead by wide deployment of automated vulnerability detection tools (both third-party and homegrown). We've developed security-enforcing interfaces, such as input validation, without expecting every developer (or customer) to be a security expert." -- Mary Ann Davidson