Oracle to deliver security patches quarterly

In a move intended to be customer focused, Oracle Corp. will provide security patches for all of its products on a quarterly basis starting Jan. 18.

The patches will include fixes for significant security vulnerabilities and updates that are needed to prevent patch conflicts, Mary Ann Davidson, Oracle’s chief security officer, said in a recent conference call with reporters.

In the past, Redwood Shores, Calif.-based Oracle generally released patches when these were ready for all supported product releases and platforms. This meant users may have been caught off-guard and had to drop other work to patch their systems.

Oracle had been mulling a regular delivery model for patches for the last year or so, according to Davidson. In August the company appeared to have opted for a monthly release cycle, similar to the one used by Microsoft Corp.

“When we talked to customers, they said they did not want to patch their systems once a month,” Davidson said. “We felt quarterly seemed to be a schedule that customers could live with.”

The dates on the patching calendar were chosen to provide a schedule that works for most customers, Davidson said. It avoids periods when customers don’t want to patch their systems because they are, for example, closing their books, she said.

Unlike Microsoft, which gives premium customers a heads up on patch releases, Oracle will seek to offer a level playing field. “I will not provide either selective information to some customers and not others or heads up to some customers and not others,” she said. Too many companies run mission-critical apps on Oracle’s software for it to take this stance, she said.

Oracle’s quarterly cycle is not set in stone. The company will issue a patch early if there is an imminent threat of a serious security flaw being exploited, Davidson said. The threshold is that there is no work-around for the vulnerability and exploits exist, she said. “In that case we don’t want to make customers wait for three months and of course customers don’t want to wait for three months,” she said.

Mike Murray, director or vulnerability research at nCircle Network Security Inc., a provider of vulnerability management services based in San Francisco, is pleased with Oracle’s move to quarterly patching.

“It is excellent. It really puts the appropriate emphasis on the importance of the patch cycle for IT departments. Now that it is predictable, it allows you to more efficiently and effectively allocate security resources around your Oracle infrastructure,” Murray said. “In the past, the announcements would come out whenever Oracle was ready, so you would come in to work one day and all of a sudden you had to run around and patch your Oracle servers.”

“I think they should monitor it for about a year and see how it goes,” said Craig Read, the president of the Toronto Oracle User Group.

“Oracle, in general, is a pretty secure architecture so I think quarterly is about right.” Also, because the software is often running mission critical apps, a release more often would make it difficult to do proper testing, he said.

— with files from Chris Conrath