First - make sure to read and check-back with Oracle Secure Technology Center.This is basically one-stop place for all of our security information. Oracle covers everything from OS to applications. And this location covers that breadth with links to deeper-dives.

Second - our Chief Security Officer Mary Ann Davidson has been trying to get developer education ecosystem (e.g. CS programs and their cousins) to do a better job of teaching secure coding. I believe she articulated the problem very well in her post - "The Supply Chain Problem".

Third - read this book (Mary Ann Davidson recommends it in her Supply Chain Problem) - Foundations of Security: What Every Programmer Needs to Know.

Fourth - if you do anything with the database- David Knox's Effective Oracle Database 10g Security by Design is still the go-to resource. It's book #2 on my tech shelf- after my own (me being first is mostly a vanity thing :)).

As an addendum - if you are writing code in ADF you should check out the new tutorial based on the new demo application - "Fusion Order Demo" . Besides learning all of the cool things ADF/JDev bring to the table - Chapter 28 covers how to leverage the external security framework. I hope to be able to use this application to demonstrate more of our capabilities - in particular OVD/IGF but possibly others too. 

Crisis Begets accountability and transparency --  While not directly about software code it is an article that can be used as a "teachable moment" across many disciplines.  From a programming perspective, the lesson to be learned here is that accountability and transparency helps to make for a more secure environment. Additionally we will likely see more monitoring across different systems and changing of organizational structures. Thus we're going to need more code in more places that interoperate with each other to help security become a cohesive whole. Thus make sure you are taking steps to integrate secure auditing (such as Oracle Audit Vault), logging and of course enabling external fine grain access control leveraging standards like XACML.

ISC2 To Offer Certification For Software Lifecycle Security -- The organization that provides CISSP certification is launching a new certification for developers. It is a rather explicit industry acknowledgement that developer's are not taught security as a core competency. And thus it's not ingrained into training or expectations. It also (IMHO) acknowledges that CISSP is not about dealing with code-level security. They are two different types of disciplines and just because one is competent in one discipline does not necessarily mean you will be competent in another even though they maybe related.

Upcoming PHP 5.3 beefs up security -- If you are writing code in PHP - you will want to learn more about a couple of changes being made that likely will make your code more secure but may break some of your scripts.

On the good news side - the team knows they need "two-factor" authentication. A factor is normally based on the concept of something you know (aka a password or answer to a security question) or something you have (digital certificate, fingerprint).

However, apparently it's the cool thing to do for certain web-sites to have "dual-cookies". One is persistent to store simple profile information (like what page do you want to go to when you login) - nothing secure. The other is your session cookie. And the perception in this team (and maybe they learned it from some magazine/conference) is that this is a type of two-factor authentication. And in particular they thought this would help protect access from "new unknown machines".

Any security professional knows this is not the case. Session cookies are often used to enable Web-based SSO. The persistent cookie is really just used to help manage profile information that can't be stored elsewhere. And just because there are two-cookies it does not make it two-factor authentication.

However, the better way to solve this problem isn't two cookies. It's to use actual multi-factor authentication and knowledge-based authorization. And Oracle can provide this via Oracle Adaptive Access Manager (OAAM).

Here is how OAAM could help in this scenario as quoted by one of our PM's in the Access Management Suite team:

OAAM uses many contextual information to determine the risk factor of any users performing any an action, whether it be viewing a resource or performing an action or or initiating a transaction.  The contextual information covers things like IP address, geo-location, time of day, day of week, device fingerprinting (which can be done as a persistent object on the client machine), and even user behavior.

If I drill down on the use case a little bit, I believe you guys are looking for a way to raise risk factors when a user is coming in from a machine that the user has never used.  The raised risk factor will require the user to answer an additional challenge question before the system can trust them enough to allow access to some resource.

So how does OAM and OAAM help accomplish the above?  One example would be as follows:

The first time a user attempts access to a protected resource, OAM initiates an authentication scheme that really calls OAAM in the backend.  OAAM then determines if the device has ever been used before based on device fingerprinting and if the machine is never used, then username, password, and a knowledge based question must all be provided before the user gets access.  Subsequently, the user attempts access again with the persistent object (or device fingerprint) that OAAM accepts, then only username and password is necessary.  This provides the knowledge based question as an added security measure if the user is coming from a machine that is never seen before.  Of course, this solution assumes that the knowledge based questions and answers has already been set up for all users. 

I also pitched a couple of other options - in particular if OAAM adoption would be slow to update for budget or time constraints:

1 - On sensitive pages - simply prompt for the password again. This would at least help with preventing someone who got access because the original person left the room.

2 - On sensitive pages - not only ask for a password but perhaps require a different pin code for that page.

3 - You could also use other authentication types  -like digital certificates but that has its own set of headaches.

Also you can read more about OAAM.

Pete Finnigan - Oracle [database] security information -- A page with various utilities to help test your local Oracle password security and tools to help with auditing the database.

So for example:

alter user hr identified globally as 'cn=Mark Wilcox,cn=Users,dc=ovddemo,dc=com';

Should allow you to then login as Mark Wilcox using his uid value (e.g. mwilcox).

I'm sure I read that in Knox's book before but it didn't sink in until I was asked about this at OOW last week.

Passwords -- This blog post from the "Blown to Bits" blog talks about problems with passwords. On a personal level - you should have a random password. No words. Just mix of characters. From a developer perspective - do not write your own login code. Almost all frameworks now have their own login subsystem - leverage that. It will allow you to focus on code that is actually core to your business application. Or as I would think - I would not want my friend Quan writing my UI but he knows how to write awesome security code. I know my friend Josh knows how to make awesome looking UI - he shouldn't be writing my security code. And from an enterprise level - make sure you are adopting  comprehensive access products such as Oracle Access Manager suite.

"Using Yahoo! Login Mechanisms for Desktop Applications" -- If you want to use Yahoo! for user password management this might be useful to you.

Criminal probe of ex-Lottery employee Launched  -- Basically another data leak problem. Remember - when writing apps to make sure you allow for proper auditing. Also make sure to put in hooks that can allow for access controls to be written using a standard like XACML (such as provided by Oracle Entitlement Server). And if you are storing data in a database make sure the application can work with strong security measures like Oracle Database Vault and Transparent Data Encryption. And - if you managing/installing database - make sure you enable these features if your applications can support them.

Schneier On Security -- Bruce Scheier who is the expert on security - has released a new book. I believe it's a collection of his columns, so if you are a regular reader probably nothing new. However, if you are new to this field - you should get a copy. As well as his previous book Beyond Fear. Or if you are up to speed on these books - then be sure to read The Unthinkable: Who Survives When Disaster Strikes - and Why.

"For Your Browser Only" -- Reminds developer's that if you are writing cookies from your server code to remember to mark them "HTTP Only". This dramatically reduces the surface area for cross-site scripting attacks. I would also add that other techniques - such as using a standards-based framework for authentication/session management and risk-based access control like Oracle provides via Fusion Middleware and the Access Management Suite will add extra protection.

Security Researches Uncover Spring Framework Vulnerabilities  --  Some researchers have found vulnerabilities in the popular Spring framework.

What Californians Understand About Privacy Online -- A paper showing how big the gulf is between the average person's perception of how their privacy is protected and the reality . One could of course make a joke about what do you expect from people who elect "The Terminator" their governor  but it is a real problem.

SQL Injection issue in :limit and :offset parameter -- A two-fer this week - security issues in two of the most popular frameworks out there - Spring and now Rails. I give credit to the author for trying to help raise awareness and in general I think adopting frameworks (in particular standard - whether that's "Standard" like JSF or a "standard" like Spring/Rails) make you more productive - and yes, secure.

5 Features Your Login System Must Have -- An interesting article for those who are still "rolling their own system". Of course for an enterprise - I'm not sure of any valid use case where that would be a good idea - there's too many good products out there such as Oracle Access Management Suite that can do this for you without needing to become a SSO developer. If you are working on a consumer site - then at the very least, you should adopt something like OpenID or Infocards so that you are not managing passwords.