Database Security, Audit, Privacy and Support Blog

LewisC's An Expert's Guide To Oracle Technology

I've been working with EnterpriseDB's cloud offering recently and started looking around at what other databases are doing in the cloud.

Amazon's SimpleDB

Amazon is the 500 pound gorilla. The market leader in cloud computing also offers a very simple database called, appropriately, <a href="http%3A%2F%2Fwww.amazon.com%

Hi all. This will be a short one. I'm on a plane on the way to New Jersey. I just recently started using Opera-mini and wanted to see if I could post. I couldn't with the default blackberry browser. It appears to be working. Now I can blog from anywhere! My wife will love that. ;-). She already hates it. She hates twitter too. Opera-mini is a nice little browser. Excellent support for most of the pages I frequent. Take care, LewisC

Forrester evaluated leading IT risk and compliance software vendors across 88 criteria through scripted product demonstrations and found that Agiliance, Archer Technologies, and Brabeion have established early IT risk and compliance leadership thanks to their workflow, risk, and compliance management capabilities and product strategy focus. Vendors CA, Modulo, Relational Security, and Symantec are Strong Performers but lack either key risk management capabilities or breakout product strategies. eIQnetworks still has work ahead but is successfully making the transition from an enterprise security management vendor to an IT risk and compliance vendor. Overall, Relational Security has the most balanced IT risk and compliance capabilities, Archer the strongest strategy, and Symantec the dominant market presence.

Feds: Companies need to report cybercrimes

World of Warcraft to get bank-like security

I added some code to my site quite a while ago that indicates the number of visitors on-line at the current moment in time. It was for a bit of fun partly and also so that I could guage the....[Read More]

Posted by Pete On 22/05/08 At 02:02 PM

I saw a post by Richard Foote a few days ago and made a comment on the blog entry and also made a note to chat about it here. Richards post is titled " Read-Only Table Before 11g (A Day....[Read More]

Posted by Pete On 21/05/08 At 03:45 PM

As I have been posting for a while, I believe that Identity Management will evolve, during the next few years, from a pure “control point and compliance”-based approach towards an approach that will increasingly factor in the management of Risk.

Decision makers (CIOs, CISOs, etc.) are shifting from a “compliance management” mentality to a “risk management” mentality, when making investment decisions on IT security solutions. Their investment decisions (including the ones on Identity Management) are going to be increasingly questioned, due to the shrinking of resources available. Hence the need to prioritise based on real business objectives and needs.

I am glad that Burton Group is now making some statements in the same direction, as it is possible to evince from this article:

“Identity management is evolving to include a closer recognition of risk and how to manage it rather than trying to eliminate it using technology, according to the head of the Burton Group consulting firm.

“Companies are looking at controls from a risk perspective instead of trying to control everything,” said Jamie Lewis, CEO of the Burton Group during the opening day of the firm’s annual Catalyst Conference. “It is about people managing risk and not about technology trying to make risk disappear.””

I believe there is a whole new set of research and commercial opportunities in this space (i.e. beyond compliance management and control points), whilst traditional Identity Management solutions are becoming more and more a commodity.

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

LewisC's An Expert's Guide To Oracle Technology

I was recently in Boston to sit on a panel to discuss cloud computing. There were two panels and several keynotes. Take a look <a href="http://www.xconomy.com/boston/2008/06/19/google-microsoft-akamai-join-powerhouse-speaker-lineup-for-xconomys-june-24-cloud-computing-forum

LewisC's An Expert's Guide To Oracle Technology

If you haven't listened yet, make sure to listen to Oracle RAC experts Philip Newlan and Scott Jesse talk about RAC and Grid. Some topics that you'll hear:

<h3 style="MARGIN: 14pt

Apparently not, at least based on a recent Ernst & Young report, whose outcomes have been summarised in this article written by Adrie van der Luijt :

 

“IT fraud and data privacy fail to sound the alarm for CIOs and internal audit chiefs, a survey shows. Sixty-five per cent internal audit chiefs do not recognise data privacy and IT fraud as a serious threat to their business.

 

A survey, released by Ernst & Young, found that internal audit chiefs ranked corporate breaches and data privacy regulation sixth in their top ten IT risks for the organisation, while for CIOs it barely made it onto the list at just ninth.

 

In addition just 14 per cent of internal audit chiefs said that their staff had been trained in fraud investigation. …”

 

I would be interested in having a look at this survey, if only I could find a copy online …  

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

Enterprise Subscription Agreements are typically for businesses with a need to standardize their Microsoft software and with a minimum of 250 PCs. What are the benefits? Some of the benefits include: savings for a 3-year agreement and included software assurance.

The drawbacks? Software available is limited to: Office Professional Plus, Office Enterprise, Windows Vista Business Upgrade, Core Client Access License, and Enterprise CAL Suite, which includes the Core CAL plus seven additional CALs: Office SharePoint Enterprise CAL, Office Communications Server Standard and Enterprise CALs, Exchange Enterprise CAL, Forefront™ Security Suite, Operations Manager Client OML, and Windows Rights Management Server CAL.

The Microsoft Enterprise Subscription Agreements are ideal for companies that are only looking to subscribe to software licenses versus acquiring them on their own.  And, the SA benefits are quite comprehensive. Obviously, not available to all business as there is a minimum PC requirement, subscription agreements make sense for those who only require basic Microsoft software applications and don’t plan to make significant changes over the course of three years.

If you fit the bill, it’s a smart move and a great way to keep software licensing compliance inline.

Contactless payments are reaching Europe — as shown by numerous trials in different countries and real rollouts in the UK and Austria. We asked online Europeans how interested they are in using contactless payments. We found that only 23% are interested in paying with contactless cards, and no more than 15% are interested in using mobile contactless payments. Interest is higher among people who live in London and Paris, where contactless ticketing is widespread. Product managers launching contactless payments must spark consumer interest by incentivizing early lead users and communicating about the benefits and security of contactless payments.

EU advisors: Secure ISPs, form "cyber-NATO"

Malware morphs to greater numbers

Instant messaging (IM) has become an increasingly useful business tool for modern corporations. Businesses are seeing improved productivity with the adoption of IM, which offers a more fluid communication model than both email and voice communication. For many organizations, however, IM security is still a nascent topic. Given the phenomenal increase in IM adoption and the business difficulty of limiting the usage strictly to internal use, organizations are beginning to explore security capabilities that support instant messaging and other real-time communication applications.

Companies still struggle to keep up with spam volume and attack tactics years after spam first became a serious problem, and many see a continued investment drain for spam management. To keep a step ahead of spammers, organizations should adopt a hybrid of filtering solutions, strengthen this connection to management technologies, and treat antispam as part of a wider email content security strategy that includes content protection and compliance.

Breach-notification laws not working?

Earlier this month, after Oracle announced its acquisition of insurance software maker Admin Server, I asked this question:

Is this Oracle’s big break into the insurance market?

At that point, it may have been hard to say. But this week, after Oracle made yet another acquisition announcement, many are saying it’s likely that the software giant is  ready to dominate the insurance market.

Oracle will acquire Skywire Software, an insurance software provider and maker of applications for insurance policy life cycle management, in a deal that’s expected to close in the second half of 2008.

Matthew Josefowicz, director Novarica’s insurance practice, was quoted in this Insurance and Technology article as saying:

“If the acquisition of AdminServer was Oracle’s planting the flag on the shore of the insurer software business, the subsequent acquisition of Skywire Software is a declaration of Manifest Destiny.”

In Oracle’s official press release, President Charles Phillips clearly suggests that the Skyware acquisition will not be the last of Oracle’s steps into the insurance software industry:

“Insurance is a strategic industry for Oracle with growth focused on integrated packaged applications,” he said. “Adding Skywire Software to our growing portfolio of insurance software products further accelerates our investment in and commitment to providing the most modern and complete software solutions for this industry.”

Now the next questions: Will other vendors follow Oracle’s lead with acquisitions? Will Oracle have to fight with Microsoft, IBM or SAP for the top spot in the insurance software industry?

Let’s take a look at these vendors’ current insurance offerings:

Microsoft: Microsoft’s latest insurance software addition is just one of many that use Microsoft’s own .NET Framework.  In this article, Celent analyst Donald Light says that he thinks Microsoft will continue to “stick to its guns to not buy outside software vendors.”

IBM: IBM continues to develop its own insurance solutions, such as these new SOA-powered applications. Light says that he thinks IBM will continue its partner-based (rather than acquisition-based) approach.

SAP: Light seems to think that SAP could go either way - - decide to stick with its “homegrown products” or make insurance software vendor acquisitions. SAP’s SOA-based insurance products have been gaining popularity recently in the industry.

So, while it seems like Oracle is the only one making the big acquisitions (anyone surprised?) at the moment in the insurance software industry, only time will tell if others will follow suit. What do you think?

The number of Oracle license is required is based on the usage and business environment.  Take for example, Oracle database EE during the testing, staging and production phase.  Depending on the type of license being used, their number of different Oracle licenses required.

If you’re licensing by processor, the number of Oracle licenses would be dependent on where the database is installed or running must be licensed.  So, you have 6 processors, you need 6 licenses.  If you have 20 processors installed, but only five of them are actually running, you still need 20 licenses. 

If you’re using the Named User Plus scenario, there is a formula that can be used to compute how many Oracle licenses are needed.  The formula would be Named User Plus — meaning 25 Named User Plus licenses per processor — multiplied by the number of actual users accessing the database.  Now, the actual users mean the number of users and developers.

The Information Card Foundation has been launched on Monday, as reported by this article published by news.com: 

“A group including Equifax, Google, Microsoft, Novell, Oracle, and PayPal, plus nine leaders in the technology community announced on Monday the creation of the Information Card Foundation (ICF) with the goal of increasing awareness of the use of electronic ID cards on the Internet, and encouraging interoperability in business around new standards. …”

 

The ICF foundation web site should be live on Tuesday i.e. today.

 I think this is a great opportunity for improving interoperability in the identity federation space, including interoperability with other initiatives, such as Liberty Alliance’s.  

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

 

Game Trojans outscore Storm worm

With the State of Connecticut reeling from a series of massive security breaches that have exposed the personal information of hundreds of thousands of state residents, Connecticut's Governor and General Assembly joined forces in mid-June to make Connecticut only the second state (after Michigan) to mandate that private employers publish a policy on the protection of employee Social Security numbers (SSNs). The new Connecticut law — entitled, "An Act Concerning the Confidentiality of Social Security Numbers" (the "Act"), and effective October 1, 2008 — also imposes on private employers a statutory duty to safeguard, and properly dispose of, personal information more broadly defined. Continue reading. . .

Today, Liberty Alliance has publicly announced the release of the  Identity Assurance Framework (IAF) and Identity Governance Framework (IGF) Specifications:

 

"Liberty Alliance, the global identity community working to build a more trust-worthy internet for consumers, governments and businesses worldwide, today announced an industry milestone in driving trust and privacy into enterprise and identity-enabled applications based on the release of the Liberty Identity Assurance Framework (IAF) and the Liberty Identity Governance Framework (IGF). Today’s news is the result of the collaborative development of standardized frameworks and technologies designed to meet cross-industry requirements for policy-based security and privacy systems, with a focus on streamlining the establishment and management of identity and trust across user-driven applications and networks."

 

I believe this is a first, important steps towards providing a more systemic approach to assurance and privacy management in complex organisational (and cross-organisational) contexts.

 

More details can be found in the Liberty Alliance’s announcement, here.

 

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

 

The IIA has taken the next step in providing high-quality learning opportunities with the announcement of real-time live Virtual Seminars.We've modified our traditional seminar courses into an online learning environment while still maintaining the same high quality and standard of excellence. Our Virtual Seminars cover the same concepts and materials while utilizing the curriculum and exercises as their traditional counterparts. Register Today For:Enterprise Risk Management: What's New? What's Next? (with COSO's ERM Framework)Financial Auditing for Internal AuditorsEvaluating Organizational EthicsValue-added Business Controls: The Right Way to Manage RiskAll Virtual Seminars are written and developed by practitioners, for practitioners. We provide the course, you provide the comfy chair. That's right! Study wherever it's the most convenient for you because you can attend any of our Virtual Seminars wherever an Internet connection is available. Visit www.theiia.org/e-learning to review course offering schedules and how to register.

Ruby project patches serious flaws

LewisC's An Expert's Guide To Oracle Technology

I'm going to be in Boston on Tuesday to sit on a panel about Cloud Computing. I don't have a lot of info to share right now but I plan to do so after the event. This is an exciting opportunity to speak about <a href="http://www.enterprisedb.com/about/news_events/press_relea

LewisC's An Expert's Guide To Oracle Technology

This is not a technical entry. This is a story about bad luck, bad drivers, bad traffic, and a head-on collision.

Bad Luck

My wife, my sons and I were preparing to leave New Orleans after the recent trip for the <a href="http://blogs.ittoolbox.com/oracle/guide/archives/the-road-to-odtug-v2