Wednesday Mar 23, 2016
Tuesday Mar 01, 2016
By Troy Kitch-Oracle on Mar 01, 2016
There is an incredible transformation we are all experiencing with cloud computing. The cloud truly is changing everything. It’s changing how businesses run and people work; it’s creating new categories, disrupting existing categories, and it’s changing how we communicate and share. It’s changing the economics of business forever. It’s happening at a speed no one ever imagined and it means a new way of thinking for security practitioners.
The Extended Enterprise is about the always-on expectation from users, about a corporate environment that is no longer limited to the four walls of the enterprise. Essentially, the Internet has become the corporate network; a coffee shop has become the corporate office. Work is no longer a place…it’s wherever you get inspiration.
The growing use of social collaboration and sharing regardless of location; the rising adoption of cloud computing; the proliferation of mobile devices; these are creating a fundamental shift within the enterprise that are breaking down the traditional four walls that have constrained IT to the corporate network and private WAN. This begs the questions, “where did the perimeter go?"
The Perimeter has Evolved
We’re moving fast and it’s difficult to run a business with the expectation that we can prevent perimeter network penetration. The perimeter has evolved and we must assume the perimeter will be breached and deploy solutions that protect our assets, starting with the most valuable. Now, enterprises face a boundless future where the four walls of the enterprise are fluid. They extend to the cloud. And follow users from network to network, device to device. These need to be addressed within the context of rapid evolution in the threat landscape. This heightened risk comes at a time when users are increasingly leaving the safety of the corporate network, yet are still trying to access corporate assets – now from anywhere in the world as we embrace mobile and cloud.
Turning Security from an Inhibitor to an Enabler of Cloud
So, How Do We Do It?
To build a secure cloud, it starts with the underlying infrastructure—a secure cloud must be built on a foundation that is securely designed and developed from the outset.
Oracle starts with defensive layers of defense. This is how we’ve built our solutions to work together and be more secure through seamless integration and layers of security. Then we add a comprehensive set of security controls across these solutions in order to protect the entire environment, from physical to logical security controls.
Layered Security Defense
When looking at security, it’s important to provide layered security, also known as defense-in-depth, because no one control can mitigate all threats. Oracle is working to provide multiple layers of security in our cloud. So, whether on premise or cloud, these are the requirements for a secure IT environment.
Throughout many of our Oracle cloud services (Fusion Apps, PaaS, and IaaS) when a user registers, the account and credential information is stored in Oracle Internet Directory. When a user wants to authenticate and gain access to several services, the single sign-on is handled by Oracle Access Manager. When a user account is disabled, it can be disabled across multiple services. Each of these capabilities is enabled by Oracle Identity Management, and we’ve been providing these services for some time now.
Oracle has put a great deal of effort into developing powerful, robust security mechanisms within its products and within our cloud, and we want to make sure that customers are fully leveraging these security features.
Comprehensive Security Controls for the Cloud
As we drill down into each layer you can see security is baked into both physical and logical access.
Securing the Hybrid Cloud
You see, now you can maintain existing on premises deployments and connect to your public cloud. This provides comprehensive security for a hybrid deployment. This also provides flexibility and choice because we’ve integrated many of our technologies.
Tuesday Feb 16, 2016
By Troy Kitch-Oracle on Feb 16, 2016
"Organizations are losing a lot of these cyberbattles," said Ellison. "Our industry needs to rethink how we deliver technology, especially as vast amounts of data are moved to the cloud."
Wednesday Jul 29, 2015
Tuesday May 26, 2015
Monday Mar 09, 2015
By Troy Kitch-Oracle on Mar 09, 2015
"Let me begin with my vision of the FTC and its role in light of the emergence of big data. I grew up in a beach town in Southern California. To me, the FTC is like the lifeguard on a beach. Like a vigilant lifeguard, the FTC’s job is not to spoil anyone’s fun but to make sure that no one gets hurt. With big data, the FTC’s job is to get out of the way of innovation while making sure that consumer privacy is respected."
- Edith Ramirez, Chairwoman, Federal
Trade Commission Ms. Ramirez highlights the FTC's role in protecting consumers from what she refers to as "indiscriminate data collection" of personal information. Her main concern is that organizations can potentially use this information to ultimately implicate individual privacy. There are many instances highlighting the ability to take what was previously considered anonymous data, only to correlate with other publicly available information in order to increase the ability to implicate individuals.
Finding Out Truthful Data from "Anonymous" Information
Her concerns are not unfounded; the highly referenced paper Robust De-anonymization of Large Sparse Datasets, illustrates the sensitivity of supposedly anonymous information. The authors were able to identify the publicly available and "anonymous" dataset of 500,000 Netflix subscribers by cross referencing it with the Internet Movie Database. They were able to successfully identify records of users, revealing such sensitive data as the subscribers' political and religious preferences, for example. In a more recent instance of big data security concerns, the public release of a New York taxi cab data set was completely de-anonymized, ultimately unveiling cab driver annual income, and possibly more alarming, the weekly travel habits of their passengers.
Many large firms have found their big data projects shut down by compliance officers concerned about legal or regulatory violations. Chairwoman Hernandez highlights specific cases where the FTC has cracked down on firms they feel have violated customer privacy rights, including the United States vs. Google, Facebook, and Twitter. She feels that big data opens up additional security challenges that must be addressed.
"Companies are putting data together in new ways, comingling data sets that have never been comingled before," says Jeff Pollock, Oracle vice president for product management. "That’s precisely the value of big data environments. But these changes are also leading to interesting new security and compliance concerns."
The possible security and privacy pitfalls of big data center around three fundamental areas:
- Ubiquitous and indiscriminate collection from a wide range of devices
- Unexpected uses of collected data, especially without customer consent
- Unintended data breach risks with larger consequences
Organizations will find big data experimentation easier to initiate when the data involved is locked down. They need to be able to address regulatory and privacy concerns by demonstrating compliance. This means extending modern security practices like data masking and redaction to the full big data environment, in addition to the must-haves of access, authorization and auditing.
Securing the big data lifecycle requires:
- Authentication and authorization of users, applications and databases
- Privileged user access and administration
- Data encryption of data at rest and in motion
- Data redaction and masking for non production environments
- Separation of roles and responsibilities
- Implementing least privilege
- Transport security
- API security
- Monitoring, auditing, alerting and compliance reporting
With Oracle, organizations can achieve all the benefits that big data has to offer while providing a comprehensive data security approach that ensures the right people, internal and external, get access to the appropriate data at right time and place, within the right channel. The Oracle Big Data solution prevents and safeguards against malicious attacks and protects organizational information assets by securing data in-motion and at-rest. It enables organizations to separate roles and responsibilities and protect sensitive data without compromising privileged user access, such as database administrators. Furthermore, it provides monitoring, auditing and compliance reporting across big data systems as well as traditional data management systems.
Learn more about Oracle Security Solutions.
This article has been re-purposed from the Oracle Big Data blog.
Tuesday Feb 03, 2015
By Troy Kitch-Oracle on Feb 03, 2015
As you look at data, you will quickly realize that not all data is equal. What do I mean by that? Quite simply, some data simply does not require the same security controls as other data.
When explaining this to customers, we use a metals analogy to simplify the provisioning of controls. Bronze to represent the least sensitive data, up through to Platinum, the highest value and most sensitive data within an organization.
Thinking in this manner provides the ability to refine many configurations into a few pre-configured, pre-approved, reference architectures. Applying this methodology is especially important when it comes to the cloud. It comes down to consistency in applying security controls, based on the data itself.
Oracle’s preventive, detective, and administrative pillars can be applied to the various data categorizations. At this point in the conversation, customers begin to understand more pragmatically how this framework can be used to align security controls with the value, or sensitivity, of the data.
Security practitioners can then work with lines of business to assign the appropriate level of controls, both systematically and consistently across the organization.
So for example, at the bronze level, items such as application of patches, secure configuration scanning and the most basic auditing would be appropriate. Data deemed more sensitive, such as personally identifiable information, or personal health information, require additional security controls around the application data. This would include, for example, blocking default access by those designated as database administrators.
Then finally, at the highest data sensitivity level--Platinum level--should exhibit blocking database changes during production time frames, preventing SQL injection attacks and centralized enterprise-wide reporting and alerting for compliance and audit requirements.
To learn more about Oracle Security Solutions, download the ebook "Securing Oracle Database 12c: A Technical Primer" by Oracle security experts.
Tuesday Aug 26, 2014
By Troy Kitch-Oracle on Aug 26, 2014
Get the Oracle Information InDepth - Security Inside Out Newsletter
New Product Launch: Secure and Centralize Key Management with Oracle Key Vault
Security at Oracle OpenWorld 2014: Don't-Miss Sessions and More
Monday Jun 30, 2014
By Troy Kitch-Oracle on Jun 30, 2014
Get the latest edition of Oracle Security Inside Out Newsletter and subscribe to future editions. As a bi-monthly security newsletter, we cover all things security for both Oracle Database Security and Identity Management solutions, news, and events. Here are this month's database security articles:
Advanced persistent threats (APT) are a type of ongoing cyberattack from well-coordinated and funded cybercriminals who penetrate an organization slowly and methodically. Find out from Oracle experts what key lessons your organization can take away from the analysis of an APT attack.
In the new Countering Adversaries webcast series now available on demand, security experts explain how to identify the kinds of adversaries specific industries attract, understand the types of data they are after, and focus in on the tools that provide the most effective deterrence against these specific threats.
Wednesday Jun 04, 2014
By Troy Kitch-Oracle on Jun 04, 2014
Friday Feb 28, 2014
By Troy Kitch-Oracle on Feb 28, 2014
Get the latest edition of our bi-monthly (that's every other month) Security Inside Out newsletter featuring both database security and identity management news. This month's articles:
SANS Study Explores Maturity of Security Strategies Among Healthcare Organizations
A new report from the SANS Institute, a leading security education and research organization, surveys real-world organizations to discover how the healthcare industry is adapting to this new security landscape. Find out how organizations like yours are responding to the new challenges of more-stringent regulations and new mobile and cloud technologies.
New Report Puts Oracle Audit Vault and Database Firewall to the Test
A new report from leading security organization SANS Institute finds that Oracle Audit Vault and Database Firewall successfully achieves three key security objectives: audit collection, SQL traffic monitoring, and security event reporting.
Key Cloud Security Paradigms and Oracle’s Identity Management Roadmap
Find out the most common approaches to achieving security in the cloud and whether using a third-party identity management solution is a good strategy.
Tuesday Dec 17, 2013
By Troy Kitch-Oracle on Dec 17, 2013
- Where is all of my sensitive data?
- Who has access to that data?
As we look forward into 2014, the following trends highlight the importance of data security. Read More in the latest edition of the Security Inside Out Newsletter.
Tuesday Oct 29, 2013
By Troy Kitch-Oracle on Oct 29, 2013
The latest October edition of the Security Inside Out newsletter is now available and covers the following important security news:
Securing Oracle Database 12c: A Technical Primer
The new multitenant architecture of Oracle Database 12c calls for adopting an updated approach to database security. In response, Oracle security experts have written a new book that is expected to become a key resource for database administrators. Find out how to get a complimentary copy.
HIPAA Omnibus Rule Is in Effect: Are You Ready?
On September 23, 2013, the HIPAA Omnibus Rule went into full effect. To help Oracle’s healthcare customers ready their organizations for the new requirements, law firm Ballard Spahr LLP and the Oracle Security team hosted a webcast titled “Addressing the Final HIPAA Omnibus Rule and Securing Protected Health Information.” Find out three key changes affecting Oracle customers.
The Internet of Things: A New Identity Management Paradigm
By 2020, it’s predicted there will be 50 billion devices wirelessly connected to the internet, from consumer products to highly complex industrial and manufacturing equipment and processes. Find out the key challenges of protecting identity and data for the new paradigm called the Internet of Things.
Monday Sep 16, 2013
By Troy Kitch-Oracle on Sep 16, 2013
Pre-register For Your Copy Now
With the launch of Oracle Database 12c, securing your databases is more important than ever. For a limited time you can pre-register for a new complimentary eBook and learn about Oracle Database Security from the experts who brought you the #1 database in the world.
Are you an Oracle DBA who wants to protect your databases? The new ebook, Securing Oracle Database 12c: A Technical Primer, will be the book that database administrators will want to turn to for their database security questions.
For a limited time, Oracle Press will be offering this book free of charge, so pre-register for your copy now.
Tuesday Jun 25, 2013
By Troy Kitch-Oracle on Jun 25, 2013
The latest edition of Security Inside Out newsletter is now available. If you don't get this bi-monthly security newsletter in your inbox, then subscribe to get the latest database security news. This bi-monthly edition includes:
Q&A: Oracle CSO Mary Ann Davidson on Meeting Tomorrow's Security Threats
Oracle Chief Security Officer Mary Ann Davidson shares her thoughts on next-generation security threats. Read More
New Study: Increased Security Spending Still Not Protecting Right Assets
Despite widespread belief that database breaches represent the greatest security risk to their business, organizations continue to devote a far greater share of their security resources to network assets rather than database assets, according to a new report issued by CSO and sponsored by Oracle. Read More
Who are we?
Follow us on
- Wanted: Outstanding Oracle Security Experts to Speak @OpenWorld 2016
- New Paper Explains Oracle Public Cloud Security
- Oracle Magazine Highlights "Security at Every Level"
- Securing Oracle Public Clouds
- Larry Ellison, New Rules of Thumb for Next-Generation Data Security
- ISACA Webcast on Cloud Security Prediction, Feb 11, 2016
- Oracle at RSA Conference 2016
- Cloud Prediction #2: Security as an Enabler
- Encryption is the Easy Part; Managing those Keys is Difficult
- Secure the Crown Jewels