Report: Microsoft beats Oracle on security |
 |
By Bill Brenner, Senior News Writer
30 Nov 2006 | SearchSecurity.com |
|
|
David Litchfield is a well-known critic of Oracle Corp.'s patching process. So it should come as no surprise that he ranks the database giant's security proficiency well behind that of Microsoft in a new whitepaper.
Litchfield, managing director at UK-based Next Generation Security (NGS) Software, examined differences between the security of Microsoft's SQL
Server and Oracle's relational database management system (RDBMS); based on flaws reported by external security researchers and ultimately fixed by the vendor in question in the last six years. In that period, he said, Microsoft patched 59 flaws in its SQL Server 7, 2000 and 2005 databases while Oracle patched 233 security holes in its Oracle 8, 9 and 10g databases.
"It is immediately apparent … that Microsoft SQL Server has a stronger security posture than the Oracle RDBMS," he wrote. In addition to the flaws outlined in the report, he said NGS is now waiting for Oracle to fix 49 security flaws it has reported.
The flaw count for SQL Server has been very low since 2002, Litchfield said, because Microsoft uses a security development lifecycle (SDL) where, as he put it, "knowledge learnt after finding and fixing screw ups is not lost. Instead, it is ploughed back into the cycle." From what he can tell, Oracle doesn't have a SDL of its own, since it is "making the same basic mistakes" and some of its fixes "indicate that they don't understand the problems they're trying to fix."
He said the conclusion is clear: "If security robustness and a high degree of assurance are concerns when looking to purchase database server software, given these results one
should not be looking at Oracle as a serious contender."
For Oracle, criticism over its patching process is nothing new. The company's Critical Patch Updates (CPU) are usually followed by third-party warnings about flaws that either weren't addressed or weren't fixed properly. Litchfield has often led the charge.
In an interview with SearchSecurity.com in June, John Heimann, Oracle's director of security program management, and Darius Wiles, senior manager of security alerts, acknowledged that its patching process can be difficult to follow. They acknowledged that a vast array of platforms and mountains of source code can make for some patching mistakes and slow fixes.
In October, Oracle unveiled a new, easier-to-digest bulletin, providing summaries to vulnerabilities addressed in the CPU, adopting a vulnerability scoring system and identifying critical flaws that may be remotely exploitable without requiring authentication to a targeted system. The response from DBAs has been mixed.
Microsoft has also taken its share of criticism in recent years. But the software giant has moved aggressively to bake security into its products, most notably in Windows Vista.
As Litchfield took swipes at Oracle security during the Black Hat USA 2006 conference in Las Vegas last August, Microsoft representatives were down the hall touting Vista security and inviting the hacking community to pick it apart for potential security holes.
|
|
|
|
