Thursday Feb 04, 2016

ISACA Webcast on Cloud Security Prediction, Feb 11, 2016

Please join me February 11, 2016 for the ISACA webcast, Prediction: Security Moves from Barrier to Main Benefit of Cloud Adoption where I will discuss some of the cloud security challenges facing organizations. I will also discuss how cloud vendors should be implementing security controls for their public clouds so that organizations have more confidence putting their sensitive systems and data there. And you'll receive a CPE for joining me.

Here's the abstract:

In a recent cloud predictions article, Oracle CIO, Mark Sunday predicts “Today, the #1 reason organizations are not moving to the cloud is security. However, tomorrow, security will be one of the most important drivers to move to the cloud.” A survey by Harvard Business Review Analytic Services (sponsored by Oracle) found that 62 percent of respondents thought security issues were by far the biggest barriers to expanding cloud adoption at their companies. But those very same concerns will soon drive organizations to the cloud. Join this Oracle and ISACA webcast to learn how established cloud vendors with a solid security track record have the expertise and resources to deploy layers of defense that many companies can’t hope to duplicate in-house. 

I hope to see you there.  

Wednesday Jan 13, 2016

Oracle at RSA Conference 2016

Announcing Oracle at RSA Conference 2016 – Where the World Talks Security!

Moscone Center, San Francisco
February 29 – March 4 


Fueled by a $288B black market for information, we are in the midst of a data breach epidemic; spending on technology has failed to reduce the risk. Effective modern security to mitigate a data breach requires an inside-out approach with a focus on data and internal controls. 

Join Oracle at RSA Conference 2016 February 29 – March 4, and glean insight into helping your organization build an inside-out security strategy.

Oracle Speaking Session (PDAC-FO3)

Friday, March 4, 2016 | 11:20 AM – 12:10 PM | West | Room 2005

Encryption without Enterprise Key Management – It’s Like Icing without Cake, Saikat Saha, Sr. Principal Product Manager, Oracle 

Deploying encryption systems without effective key management will not deliver on the promise of data security. Whilst the exciting part is the encryption technologies, loss of the keys will compromise any solution. In this session we’ll explore the value provided by the standardization of key management protocols as well as the critical part of a security solution it plays.

Meet the Experts

Visit the Oracle Security Solution Showcase (Booth #4704) to meet our security experts and see live product demonstrations. 

  • Monday, Feb 29th – 5 – 7 p.m. (Welcome reception)
  • Tuesday, Mar 1st – 10 a.m. – 6p.m.
  • Wednesday, Mar 2nd – 10 a.m. – 6 p.m.
  • Thursday, Mar 3rd – 10 a.m. – 3 p.m.


Register for a complimentary Exhibit Hall Pass using code XEORACLE16 (deadline Friday, February 26th) 

Thursday Jan 07, 2016

Cloud Prediction #2: Security as an Enabler

Check out Oracle's eleven critical predictions as we head into 2016 and you'll find security will move from a barrier to cloud adoption to one of its main benefits.

“Today, the #1 reason organizations are not moving to the cloud is security. However, tomorrow, security will be one of the most important drivers to move to the cloud,” said Oracle CIO Mark Sunday. 

Security should be an enabler for organizations to move to the cloud. A company like Oracle has both the logical and physical security resources and knowledge that many organizations cannot match. Oracle's cloud is a very secure cloud that provides our customers trust that their applications run securely so they can focus on innovation.  

Brakes on a car enable you to go faster. Without brakes, you must go slowly and you can’t drive down hills. It’s very limiting. The cloud is a business enabler and security must be necessary and sufficient so that organizations can move fast as well as safe. 

“Cloud vendors like Oracle that have a comprehensive and integrated defense of layered security controls are what can turn security from an inhibitor to an enabler of enterprise cloud deployments,” Sunday concludes.

Read his prediction and the ten others here.  

Thursday Sep 24, 2015

Encryption is the Easy Part; Managing those Keys is Difficult

Security threats and increased regulation of personally identifiable information, payment card data, healthcare records, and other sensitive information have expanded the use of encryption in the data center and cloud. As a result, management of encryption keys, certificates, wallets, and other secrets has become a vital part of an organization’s ecosystem, impacting both security and business continuity. Join this ISACA and Oracle webcast as we examine the challenges with encryption, on premise and in cloud, and how key management best practices can help facilitate the secure deployment of encryption across the enterprise. Challenges we’ll address include:
  •     Managing encryption keys, Oracle Wallets, Java Keystores and Credential files across the enterprise
  •     Securely sharing keys across authorized endpoints
  •     Auditing key access controls and key lifecycle changes
  •     Detailed management reports

ISACA Members Earn Free CPE

Special Guest

Note, we'll have special guest Saikat Saha who has specialized in the area of data encryption and key management. Saikat currently works as product manager in the Oracle Database security team. He also serves as co-chair of the OASIS KMIP (Key Management Interoperability Protocol) industry standard technical committee. He has launched multiple successful security products in the market related to data encryption, application encryption and key management over last decade. Saikat holds a B.E from National Institute of Technology, Durgapur, India and an MBA from Leavey School of Business, Santa Clara University.

When and Where?

Date:  Thursday, 8 October 2015
Time:  12PM (EDT) / 11AM (CDT) / 9:00 (PDT)

Register Now

Friday Sep 11, 2015

Secure the Crown Jewels

What's the secret to being the longest running Monarch in British history? I'd like to think keeping your crown jewels safe; they symbolize the power and continuity of the monarchy. However, as anything that represents worth, or power, there will always be attempts to steal it.

In 1671, Colonel Thomas Blood  attempted to steal the crown jewels from inside the Tower of London. Just like we have cyber criminals stealing privileged users' credentials in order to fly under the radar and steal from our governments and corporations, so did Mr. Blood. Over a period of time, he gained the trust--and eventually access to the jewels--from the Master of the Jewel House, Talbot Edwards. Blood and his fellow criminals then managed to subdue Edwards and steal the Crown Jewels, but only for a short time. Blood was ultimately caught and interestingly awarded for his crime

The new Crown Jewels are organization and government data. This data represents information that organized criminals can sell on the black market, or intellectual property that espionage hackers can use for political or monetary advantage, or worse, blackmail and secrets that political hacktivists can expose. Unfortunately, unlike the case of Blood's attempt on the Crown Jewels, many of these cyber criminals are never caught because they weave an intricate and hidden path to the data, and exfiltrate it without being caught.

Data breaches continue to make headlines, and they are not just about stolen credit card information anymore. Data breaches are now targeting different industries and different types of information. What’s going on, and what can organizations do to protect their corporate data?

Oracle Magazine sat down with Vipin Samar, vice president of Oracle Database security, to talk about the latest data breaches, how data breach threats are evolving, and how to work with the wide variety of data that needs protection in the enterprise.

Read more here

Thursday Sep 10, 2015

Database Security at OpenWorld, 2015 -- Security is Hot!

Cybersecurity is Hot! In fact, so is the weather here in California at this moment. I write this in sweltering 95 degree temperatures and wonder if October--coincidentally National Cyber Security Awareness month--will be as hot outside San Francisco's Moscone Halls (and surrounding buildings) as it will be inside. Join me at Oracle OpenWorld, October 25-27th to find out. 

We are very excited to offer our customers over 77 talks on security, including our latest database security innovations.

Plan your days accordingly to attend these hot database security focused sessions. 

 Monday, Oct 26

  • What’s New in Oracle Database Security [CON6819]
  • Oracle Audit Vault and Database Firewall—Detect Breaches and Prevent Attacks [CON8668]
  • Data Protection in an Oracle E-Business Suite Situation? Oracle Label Security Is the Answer [CON2075]

Tuesday, Oct 27

  • Oracle Database Maximum Security Architecture—Protecting Critical Data Assets [CON8803]
  • Mask and Subset Sensitive Data for Test/Dev Databases On Premises or in the Cloud [CON8625]
  • Database Security: Preventing and Detecting Privileged User Attacks [HOL10437]

Wednesday, Oct 28

  • Oracle Database Vault for Pluggable Databases [CON1922]
  • Encrypting Oracle E-Business Suite 12.1 on Oracle Exadata Using TDE Functionality [CON2975]
  • Oracle Database Vault—Shrinking the Attack Surface for Your Application [CON8624]
  • Oracle Advanced Security—Enterprise-Grade Encryption for Your Sensitive Data [CON8563]
  • Minimize Security Risks by Masking and Subsetting Sensitive Data in Test and Developmen [HOL10507]

Thursday, Oct 29

  • Minimize Security Risks by Masking and Subsetting Sensitive Data in Test and Developmen [HOL10507]
  • Managing Advanced Security Database Encryption Keys with Oracle Key Vault [CON8562]
  • Oracle Database Security Customer Panel: Strategies and Best Practices [CON8655].

Get the details here with our focus on Database Security. And you can focus on all Security as well.  

Thursday Aug 27, 2015

Ready to meet privacy, security issues that come with Big Data?

Securing the Big Data Life Cycle

Managing big data involves more than dealing with storage and retrieval challenges – it requires addressing a variety of privacy and security issues as well. If you fail to secure the life cycle of your big data environment, you can face regulatory consequences, and worse, significant brand damage that data breaches can cause.

Download the resources, to learn about the top threats to Big Data environments, including:
  • Unauthorized access
  • Data provenance
  • Do-it-yourself Hadoop
Read the joint MIT and Oracle resources and learn the security controls to protect the big data life cycle:

White Paper: Securing the Big Data Life Cycle Video: Securing the Big Data Life Cycle Infographic: Securing the Big Data Life Cycle

Bigger Data, Bigger Responsibility Diversity of Big Data Sources Creates Big Security Challenges Big Data, Big Security: Defense in Depth

Related Assets from Oracle:

Monday Aug 24, 2015

Watch the Security Learning Streams

I wanted to call everyone's attention to the latest Oracle Learning streams for database security. 

Oracle's product management team has put together these three 13- to 25-minute clips in order to help our customers understand the value and benefits of a few of our database security solutions. Check them out:

Wednesday Jul 29, 2015

Security Inside Out Newsletter, July Edition is Out

The July edition of the Security Inside newsletter is now available. Sign up here for the Security Inside Out newsletter where we highlight key Oracle Security news and provide information on the latest webcasts, events, training and more. 

This month in the news:

Inoculating the Cloud

Another day, another data breach. From the recent cyber attack on the Internal Revenue Service to news of a security bug called VENOM, it seems as if frequent cybersecurity incidents represent the new normal. What new methods can your security group deploy to augment traditional perimeter defenses? The key is to focus on your most valuable asset—data—and build a security strategy that protects data at its source. 

Now Available! Oracle Identity Management 11g Release 2 PS3

Read about the new business-friendly user interface that simplifies the tasks associated with provisioning and managing today’s robust, identity-driven environments. Also learn about the expansion of mobile device management capabilities and a consolidated policy management framework that enables simplified provisioning of devices, applications, and access.

Securing Data Where It Matters Most

Putting defense in depth database protection in place is the first step to a security inside out data strategy. Even if an organization’s perimeter is breached, organizations can reduce risks by placing security controls around sensitive data, detecting and preventing SQL injection attacks, monitoring database activity, encrypting data at rest and in transit, redacting sensitive application data, and masking nonproduction databases. Read insights from Oracle Vice President of Security and Identity Solutions, Europe, the Middle East, and Africa, Alan Hartwell.

Wednesday Jun 17, 2015

Database Administrators –the Undercover Security Superheroes

Over the past five years, while enterprise IT departments were focusing on the rise of cloud, mobile, and social technologies, a lucrative black market emerged around the acquisition and sale of information. Today, this includes personal data, intellectual property, financial details and almost any form of information with economic value. 

It suffices to say that when it comes to data security, businesses now find themselves under assault like never before, and are in dire need of leadership to help overcome this systemic problem. Step forward the database administrator; the person with the knowledge and power to help secure sensitive data on behalf of the organization and its employees.

Like most free markets, the information black market sets the value of its focal commodity – in this case data – and allows buyers and sellers to connect via a complex underground network. Just as the world is producing more data than at any other point in history, these organized groups are finding new ways of stealing and monetizing this information.

For their part, senior executives are only too painfully aware of what’s at stake for their businesses, but often don’t know how to approach the problem. In an era where information is arguably the most valuable asset a company has, they will look to database professionals to help the business take a stand and prepare itself to best protect this crucial asset.

However, the knowledge gap these individuals will be addressing is large. Two-fifths of businesses admit they are not fully aware of where all the sensitive data in their organizations is kept, according to respondents to a recent Independent Oracle Users Group survey. Those taking proactive measures to lock down data and render it useless to outsiders are still in the minority, and relatively few have any safeguards in place to counter accidental or intentional staff abuse that could lead to a breach. These safeguards should also extend to DBAs themselves, as ultimately everyone in the organization is in a position to commit a data breach, whether inadvertently or intentionally. 40 Percent Unaware of Where Sensitive Data Resides

That said, together with security professionals, database administrators do have a fighting chance to combat assaults on their organization’s data. Their background gives them a unique understanding of what the risks are to the organization, where to find them and how they can ultimately be addressed or, in the best case, pre-empted.

As the stewards of highly sensitive intellectual property and personal information, database administrators will need to step up and lead the battle against the villains of the black market. As Voltaire once said, “With great power comes great responsibility”, a credo that holds as true for comic book superheroes as it does for the security champions of the enterprise.

If database administrators can bring security concerns front-of-mind for employees across the business, and help drive protective measures at every level of the organization’s IT, they will be well placed to take a stand and fend off the security challenges of the coming years.

Check out the Security Super Hero Infographic here.

Thursday Jun 04, 2015

Inoculate the Cloud: Moving to the Cloud FOR Security

Forbes BrandVoice features a new article, Inoculating the Cloud, on how organizations will be moving to the cloud in order to be more secure.

No matter what survey you look at regarding challenges of moving to the cloud, you'll usually see "security" as one of, if not the top, concern. It makes sense that organizations worry about putting their sensitive customer and company data in the cloud because of data breach risks and compliance concerns. "Who can protect my data, better than myself," they question.

However, I would much rather trust my money to a bank than putting it under my mattress. I think the bank is better positioned to protect my money.  I believe this same rationale goes for securing sensitive data. I would argue that a cloud vendor like Oracle could protect sensitive data better than corporations can. They should be focused on their core business, not maintaining and securing IT infrastructure.

The Forbes BrandVoice article highlights this logic:

A recent study from Harvard Business Review Analytic Services (sponsored by Oracle) found that 62% of survey respondents thought security issues were by far the biggest barriers to expanded cloud adoption at their companies. Nearly half pointed out that data is more difficult to secure in the cloud.

But those very same concerns will soon make security a selling point for the cloud. Established cloud vendors have the internal expertise and resources to install and maintain multilayer security—a level of expertise that many companies cannot hope to duplicate in house.

“This is one factor steering many CIOs toward established vendors for cloud services—they have the resources to invest in state-of-the-art security—both physical and logical,” according to the HBR-AS study.

Then, too, big service providers can automate and simplify many security measures such as implementing security patches, access management, and regulatory compliance.

Learn more by reading the article here

Tuesday Jun 02, 2015

MIT Technology Review: Diversity of Big Data Sources Creates Big Security Challenges

According to Oracle’s Neil Mendelson, many companies today make a key mistake in setting up their big data environments.

“In an effort to gain insights and drive business growth, companies can too often overlook or underestimate the challenge of securing information in a new and unfamiliar environment,” says Mendelson, vice president for big data and advanced analytics at Oracle. That lack of attention to big data security requirements can, of course, leave the organization open to attacks from any number of unknown sources. 

Other evolving circumstances also contribute to a wide range of security-related risks, hurdles, and potential pitfalls associated with big data. As the Cloud Security Alliance, an industry group, notes: “Large-scale cloud infrastructures, diversity of data sources and formats, the streaming nature of data acquisition, and high-volume inter-cloud migration all create unique security vulnerabilities.”

Learn more here about factors that complicate big data implementations, and what is required for organizations to secure the big data life cycle. 

Tuesday May 26, 2015

Oracle Database 12c Real Application Security Administration Application - Now Available on OTN

The release of Oracle Database 12c and the new Real Application Security (RAS) technology further demonstrated Oracle's decades long commitment to delivering cutting edge security technology to our customers.  The release of RAS fundamentally changed the technology available to application developers and data security architects.

“The release of RAS with Oracle Database 12c was the most important database security enhancement for application developers since the release of Oracle's ground breaking row level security solution, Virtual Private Database in 1998,” said Paul Needham, Senior Director for Oracle Database Security Product Management.  

Over the past two decades nearly every application developed has had its own unique security model.   Application users, roles, and privileges are mostly stored in custom application tables that require very specific domain knowledge to maintain.   This complexity has made it difficult and costly to keep pace with ever changing privacy and compliance regulations and protect against hackers.

Integrated with Oracle Fusion Middleware and Oracle Application Express 5.0, Real Application Security enables developers to build the world’s most secure applications by centralizing security policies within the database.  Benefits of Oracle Database 12c Real Application Security include:

  • End-user session propagation to the database
  • Data security based on application roles and privileges
  • Simplified security administration

Today, the database security development team is pleased to announce the release of Real Application Security Administration Application (RASADM).   RASADM is the new Oracle APEX 5.0-based tool for managing Oracle Database 12c Real Application Security.   It complements the comprehensive RAS PL/SQL API available today and is designed for both developers and application security policy administrators.   RASADM is designed to accelerate adoption of the powerful Oracle Database 12c RAS technology.  

"The release of Real Application Security with Oracle Database 12c demonstrates Oracle's continuous innovation in the database security arena.  RASADM was one of the first requests from those building on RAS with Oracle Database 12c and we are pleased to be able to deliver this to our customers,” says Vipin Samar, Vice President, Oracle Database Security.

Security Inside Out Newsletter, May Edition

Get the latest Security Inside Out newsletter and hear about securing the big data life cycle, data security training, and more.

Also, subscribe to get the bi-monthly news in your own inbox . 

Tuesday May 19, 2015

Securing the Big Data Life Cycle: A New MIT Technology Review and Oracle Paper

The big data phenomenon is a direct consequence of the digitization and “datafication” of nearly every activity in personal, public, and commercial life. Consider, for instance, the growing impact of mobile phones. The global smartphone audience grew from 1 billion users in 2012 to 2 billion today, and is likely to double again, to 4 billion, by 2020, according to Benedict Evans, a partner with the venture capital firm Andreessen Horowitz. 

“Companies of all sizes and in virtually every industry are struggling to manage the exploding amounts of data,” says Neil Mendelson, vice president for big data and advanced analytics at Oracle. “But as both business and IT executives know all too well, managing big data involves far more than just dealing with storage and retrieval challenges—it requires addressing a variety of privacy and security issues as well.”

With big data, comes bigger responsibility. A new joint Oracle and MIT Technology Review paper drills into addressing these big data privacy and security issues.

Get the paper, Securing the Big Data Life Cycle and learn more here.


Who are we?

Follow us on

  • TwitterFacebookLinkedIn


« February 2016