DBA's not to blame for Oracle patch application failures?

Paul Vallee, CEO of The Pythian Group, has a problem with a story I did recently based on a survey from Sentrigo Inc., which showed that two-thirds of Oracle database administrators had never installed the company's quarterly Critical Patch Updates.

According to Vallee, whose company provides database management services to some pretty big organizations, the article makes it sound as if Oracle DBAs are mostly a lazy, irresponsible bunch who don’t care too much about security. He seemed especially nettled about a quote from Sentrigo CTO Slavik Markovich saying that some database administrators don’t even monitor for Oracle’s CPUs or know when they come out.

“It made my jaw drop. They are making it sound as if it’s the DBAs' fault that these patches are not being applied,” Vallee said. Nothing, headded, could be further from the truth. This idea that DBAs would be running scared of the effort involved in applying the fixes or are plain lazy is just ludicrous, Vallee said.

“The real story that needs to be told is that DBAs don’t have the leverage they need for security best practices to be followed,” when it comesto database patching, he said. According to Vallee, less than 10% of the customers that his company does work for have applied Oracle CPUs to their databases. “It’s not because we don’t advocate it. And it’s certainly not because we don’t know how to do it,” he claimed. Rather, it’s because no policies exist within these companies that requiretheir DBAs to installthe patch sets, he said.

“There is no standard of care. There’s never anything written that says they need to patch it,”Vallee said. In the absence of such leverage, it can be hard mustering the resources and the time needed to implement Oracle patches. So DBAs tend to do the obvious thing, which is to focus their attention on other more pressing projects, according to Vallee.

There are other reasons as well. Commenting on the story, a reader who identified himself as Markand said he has been an Oracle DBA for the past six years, admitted that he hadn’t been applying the patches either. But the reason was not because of a blatant disregard for safety, he said. Rather it was because his company was running an older version of Oracle that is no longer supported. “The other part of the equation is risk tolerance,” Markwrote. The fact is that for some companies, the risk of someone breaching a database outweighs the months “of testing, profiling, resource consumption for test environments, scheduled downtime and patch repercussions”that are involved in an Oracle patch install, he said. For others, it quite simply does not.

And then of course there’s the whole patch reliability issue that Windows administrators run into all the time. A reader who said he (or she) was from a university notedthat IT staffers there had become “gun shy” about installing Oracle patches because of problems they had with one previous patch set. Despite installing the CPU only after extensive testing, a problem manifested itself “under the load and usage profile of our production instance,” the readerwrote. “If Oracle cannot release these patches so they don't break things, who will want to take the risk of causing even more trouble than the patch is supposed to fix in the first place?”

OK, so maybe there are some perfectly valid reasons why DBAs should not be faulted for not patching their Oracle databases. But it doesn’t change the fact that despite all the data breaches of the past few years and requirements such as HIPAA and PCI, there still are an awfullarge number of pretty vulnerable databases out there that fewpeople are doing a thing to patch. One thing no one seems to be disputing a whole lot is Sentrigo’s results which showed that just one-third of all the DBA’s they polled have ever installed an Oracle patch.

Ifit isn't the DBA's responsibility, whose is it? And if it is indeed the DBA that the buck stops with, what needs to be done to ensure they can do the job in the mostefficient manner?

Related Article:

Update: Two-thirds of Oracle DBAs don't apply security patches