Secure your most important technology asset - Database http://sahaa.net/blog Get a good night sleep Wed, 14 May 2008 00:01:19 +0000 http://wordpress.org/?v=2.5 en TA08-100A: Adobe Flash updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-100a-adobe-flash-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-100a-adobe-flash-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://56c92948c06799e655667fe351e86eb3 http://sahaa.net/blog/2008/05/14/ta08-100a-adobe-flash-updates-for-multiple-vulnerabilities/feed/ TA08-099A: Microsoft Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-099a-microsoft-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-099a-microsoft-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://8db74259979c71a9871a522d41b58bc6 http://sahaa.net/blog/2008/05/14/ta08-099a-microsoft-updates-for-multiple-vulnerabilities/feed/ TA08-094A: Apple Quicktime Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-094a-apple-quicktime-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-094a-apple-quicktime-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://02cd9fcf044133cbef509d18a90f320c http://sahaa.net/blog/2008/05/14/ta08-094a-apple-quicktime-updates-for-multiple-vulnerabilities/feed/ TA08-066A: Sun Updates for Multiple Vulnerabilities in Java http://sahaa.net/blog/2008/05/14/ta08-066a-sun-updates-for-multiple-vulnerabilities-in-java/ http://sahaa.net/blog/2008/05/14/ta08-066a-sun-updates-for-multiple-vulnerabilities-in-java/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://35a8762b73f723692d06221da8932353 http://sahaa.net/blog/2008/05/14/ta08-066a-sun-updates-for-multiple-vulnerabilities-in-java/feed/ TA08-071A: Microsoft Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-071a-microsoft-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-071a-microsoft-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://6f8e83595890f7637d9b3fe5812eefe6 http://sahaa.net/blog/2008/05/14/ta08-071a-microsoft-updates-for-multiple-vulnerabilities/feed/ TA08-079B: MIT Kerberos Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-079b-mit-kerberos-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-079b-mit-kerberos-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://3f8cded4a14703f323ecc65bf7b19838 http://sahaa.net/blog/2008/05/14/ta08-079b-mit-kerberos-updates-for-multiple-vulnerabilities/feed/ TA08-079A: Apple Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-079a-apple-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-079a-apple-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://2b29df74462158c9c4bb6d33fc986e42 http://sahaa.net/blog/2008/05/14/ta08-079a-apple-updates-for-multiple-vulnerabilities/feed/ TA08-087B: Cisco Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-087b-cisco-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-087b-cisco-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://ae7e1b5bad3a2b38f3c4d17ebee7faec http://sahaa.net/blog/2008/05/14/ta08-087b-cisco-updates-for-multiple-vulnerabilities/feed/ TA08-087A: Mozilla Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-087a-mozilla-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-087a-mozilla-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:19 +0000 info@us-cert.gov tag:www.us-cert.gov://341532c7c4712e99b38c75af0f7ec4c1 http://sahaa.net/blog/2008/05/14/ta08-087a-mozilla-updates-for-multiple-vulnerabilities/feed/ TA08-134A: Microsoft Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/14/ta08-134a-microsoft-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/14/ta08-134a-microsoft-updates-for-multiple-vulnerabilities/#comments Wed, 14 May 2008 00:01:18 +0000 info@us-cert.gov tag:www.us-cert.gov://4636e7271f0ce8c4d28602a196915ef9 http://sahaa.net/blog/2008/05/14/ta08-134a-microsoft-updates-for-multiple-vulnerabilities/feed/ “IdM Risk Management” and “Identity Analytics”: Anything Else Apart From “Bottom-Up” Approaches? http://sahaa.net/blog/2008/05/13/%e2%80%9cidm-risk-management%e2%80%9d-and-%e2%80%9cidentity-analytics%e2%80%9d-anything-else-apart-from-%e2%80%9cbottom-up%e2%80%9d-approaches/ http://sahaa.net/blog/2008/05/13/%e2%80%9cidm-risk-management%e2%80%9d-and-%e2%80%9cidentity-analytics%e2%80%9d-anything-else-apart-from-%e2%80%9cbottom-up%e2%80%9d-approaches/#comments Tue, 13 May 2008 20:10:00 +0000 Research on Identity Management Blog http://h20325.www2.hp.com/blogs/mcm/archive/2008/05/13/6345.html I was wondering if anybody in this community could share references to relevant material/links/documents/research projects illustrating the current status of:

(1) Risk Analysis and Management in the space of Identity Management

(2) Identity Analytics

My current search and assessment of this space has identified various technologies, solutions and work coming from a “compliance management” perspective i.e. (a) assessing events and evidence (e.g. logs) against expected processes/policies and (b) providing results that indicate the level of compliance and risk exposure. This is what I call the “bottom-up” approach where the “risk assessment” is done against predefined policies and/or well defined situations.

So far I have not found good examples of “top-down” solutions that help decision makers (e.g. CIOs, CISOs, etc.) to explore trade-offs in the Identity Management space (e.g. making investments in education vs IT solutions vs outsourcing vs etc.) to understand the impact on factor of relevance for an organisation (e.g. costs, reputation, losses, trust, etc.), make compelling decisions and potentially help them to define suitable policies.

A specific example would be decision support solutions that help understanding the trade-offs between adopting (in an organisation) the usage of strong passwords, SSO, multi-factor authentication, etc. against involved costs, the value of the assets to be protected, the kind of involved users and the actual benefits in terms of security. More in general these solutions should provide insights about potential trade-offs between various possible choices in the IdM space (in terms of authentication, authorization, provisioning, federation/SSO, privacy, etc.) against complex organisational realities and their business objectives. Modelling and simulation might be required to cope with the involved complexity …

Is anybody aware of specific research/work/solutions in this space?

CIOs/CISOs are increasingly asked to justify the reasons behind their security investments and/or have to make investment choices that must “maximise” their “expected outcomes” based on ever-shrinking budgets. I see the opportunity for “top-down” decision support, modelling and simulation solutions that can effectively help these decision makers, specifically in the Identity Management space …

--- NOTE: use this mirror blog to post anonymous (un-authenticated) comments ---

]]> http://sahaa.net/blog/2008/05/13/%e2%80%9cidm-risk-management%e2%80%9d-and-%e2%80%9cidentity-analytics%e2%80%9d-anything-else-apart-from-%e2%80%9cbottom-up%e2%80%9d-approaches/feed/ TA08-043C: Microsoft Updates for Multiple Vulnerabilities http://sahaa.net/blog/2008/05/13/ta08-043c-microsoft-updates-for-multiple-vulnerabilities/ http://sahaa.net/blog/2008/05/13/ta08-043c-microsoft-updates-for-multiple-vulnerabilities/#comments Tue, 13 May 2008 18:28:12 +0000 info@us-cert.gov tag:www.us-cert.gov://fc4e29201979c57e2f24e48babbedacc http://sahaa.net/blog/2008/05/13/ta08-043c-microsoft-updates-for-multiple-vulnerabilities/feed/ License plate SQL Injection http://sahaa.net/blog/2008/05/13/license-plate-sql-injection/ http://sahaa.net/blog/2008/05/13/license-plate-sql-injection/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001169.htm Wow, its been a while since I posted, I have been travelling all over the world over the last month or so, teaching my Oracle security class and also speaking at conferences and performing Oracle security audits. It's been a....[Read More]

Posted by Pete On 13/05/08 At 07:38 PM

]]> http://sahaa.net/blog/2008/05/13/license-plate-sql-injection/feed/ Slides from OUG Scotland DBA SIG on Oracle Forensics available http://sahaa.net/blog/2008/05/13/slides-from-oug-scotland-dba-sig-on-oracle-forensics-available/ http://sahaa.net/blog/2008/05/13/slides-from-oug-scotland-dba-sig-on-oracle-forensics-available/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001168.htm I have posted the slides to my talk from yesterday at the OUG Scotland SIG to my Oracle Security white papers page . They are the first entries in the page. The talk was 45 minutes about Oracle Forensics. This....[Read More]

Posted by Pete On 01/05/08 At 02:23 PM

]]> http://sahaa.net/blog/2008/05/13/slides-from-oug-scotland-dba-sig-on-oracle-forensics-available/feed/ Conditionally firing triggers http://sahaa.net/blog/2008/05/13/conditionally-firing-triggers/ http://sahaa.net/blog/2008/05/13/conditionally-firing-triggers/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001167.htm I saw a post on the BAR Solutions blog today titled " Triggers… " that was very interesting as I have had the same issue in the past for different reasons. The blog post was around an issue where triggers....[Read More]

Posted by Pete On 01/05/08 At 01:22 PM

]]> http://sahaa.net/blog/2008/05/13/conditionally-firing-triggers/feed/ Lateral SQL Injection and Conferences and security training http://sahaa.net/blog/2008/05/13/lateral-sql-injection-and-conferences-and-security-training/ http://sahaa.net/blog/2008/05/13/lateral-sql-injection-and-conferences-and-security-training/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001166.htm I am writing this whilst sat on a train travelling at around 120mph between York and Darlington, this is probably my first blog entry written at speed! I saw that David had released his paper " Lateral SQL Injection: A....[Read More]

Posted by Pete On 30/04/08 At 08:26 AM

]]> http://sahaa.net/blog/2008/05/13/lateral-sql-injection-and-conferences-and-security-training/feed/ Slides from OUGN Norway and RISK 2008 Norway available http://sahaa.net/blog/2008/05/13/slides-from-ougn-norway-and-risk-2008-norway-available/ http://sahaa.net/blog/2008/05/13/slides-from-ougn-norway-and-risk-2008-norway-available/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001165.htm I was over in Norway this week and the Oracle User Group Norway (OUGN) asked me to speak at an evening user group meeting of theirs. This was a eally friendly group and it was a pleasure to speak there....[Read More]

Posted by Pete On 25/04/08 At 05:58 PM

]]> http://sahaa.net/blog/2008/05/13/slides-from-ougn-norway-and-risk-2008-norway-available/feed/ Two remotely exploitable without authentication bugs to be fixed http://sahaa.net/blog/2008/05/13/two-remotely-exploitable-without-authentication-bugs-to-be-fixed/ http://sahaa.net/blog/2008/05/13/two-remotely-exploitable-without-authentication-bugs-to-be-fixed/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001164.htm Oracle's pre-patch advisory note for the next Critical Patch Update (CPU) due this Tuesday (15th) states that there are 17 new security fixes for the database, two for Apex and two of which are remotely exploitable without authentication. The advisory....[Read More]

Posted by Pete On 14/04/08 At 10:17 AM

]]> http://sahaa.net/blog/2008/05/13/two-remotely-exploitable-without-authentication-bugs-to-be-fixed/feed/ Fine Grained network Access Control in 11g http://sahaa.net/blog/2008/05/13/fine-grained-network-access-control-in-11g/ http://sahaa.net/blog/2008/05/13/fine-grained-network-access-control-in-11g/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001163.htm I saw a post by Tim Hall on his blog recently that referenced a new article he had written about the new fine grained network access controls added in 11g. As this is an area I have also looked at....[Read More]

Posted by Pete On 08/04/08 At 10:25 AM

]]> http://sahaa.net/blog/2008/05/13/fine-grained-network-access-control-in-11g/feed/ C code API to encapsulate OCI http://sahaa.net/blog/2008/05/13/c-code-api-to-encapsulate-oci/ http://sahaa.net/blog/2008/05/13/c-code-api-to-encapsulate-oci/#comments Tue, 13 May 2008 17:39:32 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001162.htm If like me you code in C and use OCI instead of Pro*C then you will be interested in a library written by Vincent Rogier. I have looked at most C++ OCI libraries, and C libraries that encapsulate OCI in....[Read More]

Posted by Pete On 07/04/08 At 11:52 AM

]]> http://sahaa.net/blog/2008/05/13/c-code-api-to-encapsulate-oci/feed/ Semi-finalist in the 2008 Ernst & Young New Jersey entrepreneur http://sahaa.net/blog/2008/05/13/semi-finalist-in-the-2008-ernst-young-new-jersey-entrepreneur/ http://sahaa.net/blog/2008/05/13/semi-finalist-in-the-2008-ernst-young-new-jersey-entrepreneur/#comments Tue, 13 May 2008 15:00:53 +0000 ScottR http://www.miroconsulting.com/blog/?p=108 http://sahaa.net/blog/2008/05/13/semi-finalist-in-the-2008-ernst-young-new-jersey-entrepreneur/feed/ Learn Oracle: Triggers http://sahaa.net/blog/2008/05/13/learn-oracle-triggers/ http://sahaa.net/blog/2008/05/13/learn-oracle-triggers/#comments Tue, 13 May 2008 11:14:20 +0000 An Expert's Guide to Oracle Technology 24607@http://blogs.ittoolbox.com/oracle/guide LewisC's An Expert's Guide To Oracle Technology

Today I will be writing about triggers. One of the questions I get fairly often is "what is the difference between a function, a procedure and a trigger?" I already wrote about functions and procedures in <a href="http://blogs.ittoolbox.com/oracle/guide/archives/learn-plsql-procedures-and-functions-13

]]> http://sahaa.net/blog/2008/05/13/learn-oracle-triggers/feed/ PLING panel at WWW 2008 http://sahaa.net/blog/2008/05/13/pling-panel-at-www-2008/ http://sahaa.net/blog/2008/05/13/pling-panel-at-www-2008/#comments Tue, 13 May 2008 00:29:00 +0000 Research on Identity Management Blog http://h20325.www2.hp.com/blogs/mcm/archive/2008/05/13/6340.html A PLING panel has been held at the WWW 2008 conference (Beijing 23-25 April), discussing policies and Policy-aware Web.

The list of panellists includes: Renato Iannella (Moderator), Piero Bonatti, Llana Kagal, Thomas Roessler.

The slides presented in this panel are now available online.

--- NOTE: use this mirror blog to post anonymous (un-authenticated) comments ---

]]> http://sahaa.net/blog/2008/05/13/pling-panel-at-www-2008/feed/ Crisis or Opportunity: leading through a down economy http://sahaa.net/blog/2008/05/12/crisis-or-opportunity-leading-through-a-down-economy/ http://sahaa.net/blog/2008/05/12/crisis-or-opportunity-leading-through-a-down-economy/#comments Mon, 12 May 2008 15:00:52 +0000 ScottR http://www.miroconsulting.com/blog/?p=107 http://sahaa.net/blog/2008/05/12/crisis-or-opportunity-leading-through-a-down-economy/feed/ A Complete Newbie’s Guide to Choosing a Database http://sahaa.net/blog/2008/05/12/a-complete-newbies-guide-to-choosing-a-database/ http://sahaa.net/blog/2008/05/12/a-complete-newbies-guide-to-choosing-a-database/#comments Mon, 12 May 2008 13:19:05 +0000 An Expert's Guide to Oracle Technology 24574@http://blogs.ittoolbox.com/oracle/guide LewisC's An Expert's Guide To Oracle Technology

Welcome to newbie Monday. Today's topic is choosing your database. Choosing a database for your business has some commonalities with choosing a database as a new developer or DBA. There are also differences though. Here are a few guidelines to getting started. This is not a complete guide but it is meant as a starting place.

If you are already an Oracle shop, or DB2 shop, or w

]]> http://sahaa.net/blog/2008/05/12/a-complete-newbies-guide-to-choosing-a-database/feed/ Biometrics: State Of The Art And Future Implications http://sahaa.net/blog/2008/05/12/biometrics-state-of-the-art-and-future-implications/ http://sahaa.net/blog/2008/05/12/biometrics-state-of-the-art-and-future-implications/#comments Mon, 12 May 2008 04:00:00 +0000 Bill Nagel http://www.forrester.com/go?docid=45586&src=RSS_CustomFeed http://sahaa.net/blog/2008/05/12/biometrics-state-of-the-art-and-future-implications/feed/ A new version of the Oracle password cracker woraauthbf is available http://sahaa.net/blog/2008/05/10/a-new-version-of-the-oracle-password-cracker-woraauthbf-is-available/ http://sahaa.net/blog/2008/05/10/a-new-version-of-the-oracle-password-cracker-woraauthbf-is-available/#comments Sat, 10 May 2008 20:46:04 +0000 Pete Finnigan's Oracle security weblog http://www.petefinnigan.com/weblog/archives/00001161.htm The Oracle password cracker woraauthbf written by Laszlo Toth has been updated and released as a new version 0.21R2 (The R2) is the new part, so even if you are running version 0.21 then please download the new release. The....[Read More]

Posted by Pete On 31/03/08 At 10:33 AM

]]> http://sahaa.net/blog/2008/05/10/a-new-version-of-the-oracle-password-cracker-woraauthbf-is-available/feed/ Oracle Street Talk http://sahaa.net/blog/2008/05/10/oracle-street-talk/ http://sahaa.net/blog/2008/05/10/oracle-street-talk/#comments Sat, 10 May 2008 15:00:11 +0000 ScottR http://www.miroconsulting.com/blog/?p=106 http://sahaa.net/blog/2008/05/10/oracle-street-talk/feed/ In Licensing loopholes in Microsoft Windows XP http://sahaa.net/blog/2008/05/09/in-licensing-loopholes-in-microsoft-windows-xp/ http://sahaa.net/blog/2008/05/09/in-licensing-loopholes-in-microsoft-windows-xp/#comments Fri, 09 May 2008 15:00:10 +0000 ScottR http://www.miroconsulting.com/blog/?p=105 http://sahaa.net/blog/2008/05/09/in-licensing-loopholes-in-microsoft-windows-xp/feed/ Cloudy software licensing issues http://sahaa.net/blog/2008/05/08/cloudy-software-licensing-issues/ http://sahaa.net/blog/2008/05/08/cloudy-software-licensing-issues/#comments Thu, 08 May 2008 15:00:10 +0000 ScottR http://www.miroconsulting.com/blog/?p=104 http://sahaa.net/blog/2008/05/08/cloudy-software-licensing-issues/feed/