Dan Kaminsky: An Astonishing Collaboration

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
An Astonishing Collaboration

>> Advertisement <<
Can you answer the ERP quiz?
These 10 questions determine if your Enterprise RP rollout gets an A+.
http://www.findtechinfo.com/as/acs?pl=781&ca=909

Don Parker: Bad-Code Blues

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Bad-Code Blues

Federico Biancuzzi: Firing Up Browser Security

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Firing Up Browser Security

Federico Biancuzzi: Racing Against Reversers

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Racing Against Reversers

>> Advertisement <<
Can you answer the ERP quiz?
These 10 questions determine if your Enterprise RP rollout gets an A+.
http://www.findtechinfo.com/as/acs?pl=781&ca=909

More rss feeds from SecurityFocus

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
News, Infocus, Columns, Vulnerabilities, Bugtraq ...

Infocus: A Guide to Different Kinds of Honeypots

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
A Guide to Different Kinds of Honeypots

Infocus: Integrating More Intelligence into Your IDS, Part 1

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Integrating More Intelligence into Your IDS, Part 1

Infocus: Integrating More Intelligence into Your IDS, Part 2

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Integrating More Intelligence into Your IDS, Part 2

>> Advertisement <<
Can you answer the ERP quiz?
These 10 questions determine if your Enterprise RP rollout gets an A+.
http://www.findtechinfo.com/as/acs?pl=781&ca=909

Infocus: Blocking Traffic by Country on Production Networks

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Blocking Traffic by Country on Production Networks

IOUG/Oracle Software Security Assurance Team joint survery

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

I promoted the IOUG/Oracle security survey a few weeks back in a post titled " An Oracle Security Survey by The IOUG and Oracle " and today i received an email from John at the IOUG to let me know....[Read More]

Posted by Pete On 24/07/08 At 08:47 AM

Kurt Van MeerBeeck (jDul, DUDE) has started a blog

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

I saw today that Kurt Van Meerbeeck who is famous for writing jDUL that became DUDE has started a blog. I have known Kurt for many years on email but only in the last couple of years have we met....[Read More]

Posted by Pete On 23/07/08 At 10:45 AM

Advisories for the July 2008 Critical Patch Update and exploit code

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

There has been a number of emails posted to the bugtraq and full-disclosure mailing lists in the last few days detaling some of the vulnerabilities fixed in the recent Oracle Critical Patch Update July 2008. It is worth detaling some....[Read More]

Posted by Pete On 22/07/08 At 09:29 PM

Lateral SQL Injection needs no database privileges

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

I wrote this last night but then my email connection failed (the ISP must have been doing maintenance) so could not send before i needed to sleep. I am teaching my two day class " How to perform an Oracle....[Read More]

Posted by Pete On 21/07/08 At 10:01 AM

July 2008 Critical Patch Update (CPU) is the first to use CVE-ID numbers

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

One thing I forgot to mention the other day in my post July 2008 Critical Patch Update is out - a remote un-authenticated exploit revealed is that one of the major changes you will notice with this CPU is that....[Read More]

Posted by Pete On 18/07/08 At 10:34 AM

Sentrigo release Hedgehog vPatch

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

Sentrigo have released a new version of Hedgehog called vPatch. Basically, it’s the same Hedgehog product but without the ability to create custom policies. After installation, without any configuration by the customer, Hedgehog vPatch will protect the database from known....[Read More]

Posted by Pete On 17/07/08 At 09:15 PM

July 2008 Critical Patch Update is out - a remote un-authenticated exploit revealed

Posted in General by Pete Finnigan's Oracle security weblog on July 24th, 2008 | No Comments

I covered the pre-release announcement for the July 2008 Critical Patch Update (CPU) here a few days ago in a post titled " Oracle Patch Tuesday Is Coming ". Nothing new and major this time from the perspective of the....[Read More]

Posted by Pete On 16/07/08 At 01:33 PM

Brief: Attackers’ behavior builds better blacklists

Posted in General by SecurityFocus News on July 24th, 2008 | No Comments
Attackers' behavior builds better blacklists

State of the Database 2008: Vertica, Part 1

Posted in Database Support, General, Oracle by An Expert's Guide to Oracle Technology on July 23rd, 2008 | No Comments

LewisC's An Expert's Guide To Oracle Technology

I've dropped off this topic for a while but I want to pick it back up before 2009 gets here. ;-) I'm changing my approach a bit. In an effort to be as fair and accurate as possible, I will be discussing the database and company (where that applies) with the company that produces the database. I'll revisit my earlier posts when I have a chance to talk

Quick Byte: Microsoft Licensing Tip # 7

Posted in Database Support, General by ScottR on July 23rd, 2008 | No Comments

Benchmark testing - although this may be something that seems like it should be done for your own benefit it’s important to know that Microsoft requires that you get their written approval before disclosing the results to a third party.

This does NOT apply to the following applications:

.NET Framework, Class Server, Live Communications Server, Systems Center Operations Manager, SharePoint Portal Server, System Center Data Protection Manager, System Center Essentials, Systems Management Server, Virtual Server, Windows Server, Microsoft Services for Netware, Windows Services for UNIX, Windows Small Business Server

However if your software contains one or more components of the .NET Framework you may conduct internal benchmark testing of those components. You may also disclose those results. You can find the complete terms here.

Archive and purge in a security context presentation slides available

Posted in General by Pete Finnigan's Oracle security weblog on July 23rd, 2008 | No Comments

I am on the train whizzing back to York at around 120mph after being down in sunny London all day at the UKOUG Archive and purge special event conference. I was presenting there on the subject of archive and purge....[Read More]

Posted by Pete On 15/07/08 At 06:12 PM

New Database Taglines

Posted in Database Support, General, Oracle by An Expert's Guide to Oracle Technology on July 23rd, 2008 | No Comments

LewisC's An Expert's Guide To Oracle Technology

Do you know what a tag line is? It's those nifty phrases that come after a product or brand to get your attention. Like "Quality is job 1" or "Have it your way". Some of those tag lines really become part of the universal meme. Here are a few tag lines I'd like to see.

Oracle - Expensive. Because we can be.

Oracle - If it's not part of

News: E-Gold pleads guilty to money laundering

Posted in General by SecurityFocus News on July 23rd, 2008 | No Comments
E-Gold pleads guilty to money laundering

Teleconference: Enterprise Adoption Of Green IT Practices

Posted in Database Security, General by Bill Nagel on July 23rd, 2008 | No Comments

A new improved version of the woraauthbf Oracle password cracker is available

Posted in General by Pete Finnigan's Oracle security weblog on July 22nd, 2008 | No Comments

Laszlo Toth has released a new version of his famous Oracle password cracker woraauthbf. This is version 0.22. The main page for the woraauthbf password cracker describes the tool and its use. The latest C source code can be downloaded....[Read More]

Posted by Pete On 14/07/08 At 02:14 PM

Quick Byte: Microsoft Licensing Tip # 6

Posted in Database Support, General by ScottR on July 22nd, 2008 | No Comments

When you buy a Microsoft product of any kind, it will come with a summary of technical limitations which will enable the software to work in specific ways - even though these limitations are no longer included in the Product Use Right documentation - they cannot be ignored.

Each product has its own set of capabilities as well as licensing guidelines for its use. There is a great table available here that should answer many of your questions as to what you can do with each product.

Details such as how many processors are being run on your Microsoft product will affect its licensing requirement and must be taken into account should the need arise to make any changes.

One more thing to be on the lookout for when preparing your software asset management plan.

Build Your Business’s Mobile Strategy Around Device Management And Security

Posted in Database Security, General by Bill Nagel on July 22nd, 2008 | No Comments
As businesses embrace mobility, IT operations professionals are facing new challenges. But gone are the days when stodgy IT departments fight this business imperative. Most organizations today are simply trying to get smarter about how to manage and secure their increasingly mobile population and distributed assets. Through the first half of 2008, Forrester has assisted 89 organizations with refining or defining their mobile strategy. We've learned that IT operations professionals face challenges like steadily increasing mobile operations expenses, too much device diversity, and a total lack of insight while assessing, planning and purchasing, building, and managing their mobile infrastructure and operations. What can you do? The key is to make mobile device management and security the foundation of your business's mobile strategy. By doing this, your business will be well-positioned for the next phase of mobility, which will be driven by line-of-business applications, mobility shifting down the corporate pyramid, and a phenomenon we call Tech Populism.

Brief: Kerfuffle erupts as DNS flaw described

Posted in General by SecurityFocus News on July 22nd, 2008 | No Comments
Kerfuffle erupts as DNS flaw described

Thank You Larry Ellison

Posted in Database Support, General, Oracle by An Expert's Guide to Oracle Technology on July 22nd, 2008 | No Comments

LewisC's An Expert's Guide To Oracle Technology

Larry Ellison is a technology leader. I think that's generally accepted. Some people might not like him, but you can't really deny what he has done with Oracle. Larry apparently has one giant weakness though. He's way ahead of his time. I ran across this <a href="http://sunsite.uakom.sk/sunworldonline/swol-

For Sale: Sold!

Posted in Database Support, General, Oracle by An Expert's Guide to Oracle Technology on July 21st, 2008 | No Comments

I'm a productive, tax paying citizen again!

LewisC's An Expert's Guide To Oracle Technology

As you might know, last week I published an entry saying that I was looking for a job. I have to say I got a great response, both here on the blog and direct emails. I got great

nCipher provides encryption key management for TDE in Oracle 11g

Posted in General by Pete Finnigan's Oracle security weblog on July 21st, 2008 | No Comments

I saw a news post the other day via google and made a note to mention it here as its a very interesting development. The post is titled " nCipher to Provide Encryption Key Management for Oracle Database 11g....[Read More]

Posted by Pete On 12/07/08 At 08:38 AM