Help in handling Oracle vulnerabilities

If you run parts of your business on Oracle databases, and who doesn’t, then you better be prepared for Oracle’s trend of security announcements to continue for quite a while. No band-aid fixes are going to help and it will take time for their enhanced security engineering processes to take effect.

It is very common for large organizations to have hundreds of Oracle databases floating around the corporate network with varying amounts of confidential data and security demands. Time to be sure you have the management tools to discover instances of databases, and an Oracle application vulnerability scanning capability to regularly assess the security posture of your most sensitive applications. Those are the basics you should have in place so you can get the most out of your activity monitoring or security risk management tools.

These are the vendors I’d suggest you take a look at for monitoring the health of your Oracle databases:

Application Security is among the best of the Oracle vulnerability scanners out there. Furthermore, AppSec will actively scan your entire network to help you discover where all of your Oracle databases are. Additional products support database auditing and database encryption.

Imperva offers a top shelf database vulnerability scanner as part of its gateway product, and can alert you to all the discovered destinations of SQL traffic its passive appliance can see. Its activity auditing capability is excellent at tracing individual user transactions that otherwise might be cloaked by application servers.

IPlocksmarkets a database auditing product that will keep you up to date with the vulnerabilities that are exposed in your Oracle databases. IPlocks also features software that peers into the database for granular reports on privileged user activity including changes to schemas and stored procedure calls.

After your database assessment capability is in place, then you can monitor database transactions. Database auditing products, such as Embarcadero, Guardium, Lumigent, Symantec, and Tizor have discovery features and strong activity auditing capabilities to help you with detecting changes and automating compliance. Symantec’s entry is new to the market and has the best upside potential to integrate security into your datacenter management process.