Oracle to deliver security patches on quarterly basis

Starting Jan. 18, Oracle Corp. will provide security patches for all of its products on a quarterly basis, a schedule it believes is most convenient for customers.

The patches will include fixes for significant security vulnerabilities and updates that are needed to prevent patch conflicts, Mary Ann Davidson, Oracle’s chief security officer, said in a conference call with reporters on Thursday.

In the past, Redwood Shores, Calif.-based Oracle generally released patches when they were ready for all supported product releases and platforms. This meant users often times were caught off-guard and had to drop other work to patch their systems.

Oracle had been mulling a regular delivery model for patches for the last year or so, according to Davidson. In August the company appeared to have opted for a monthly release cycle, similar to the one used by Microsoft Corp.

“When we talked to customers, they said they did not want to patch their systems once a month,” Davidson said. “We felt quarterly seemed to be a schedule that customers could live with.”

The dates on the patching calendar were chosen to provide a schedule that works for most customers, Davidson said. It avoids periods customers don’t want to patch their systems because they are, for example, closing their books, she said.

Oracle’s quarterly cycle is not set in stone. The company will issue a patch early if there is an imminent threat of a serious security flaw being exploited, Davidson said. “In that case we don’t want to make customers wait for three months and of course customers don’t want to wait for three months,” she said.

Mike Murray, director or vulnerability research at nCircle Network Security Inc., a provider of vulnerability management services based in San Francisco, is pleased with Oracle’s move to quarterly patching.

“It is excellent. It really puts the appropriate emphasis on the importance of the patch cycle for IT departments. Now that it is predictable, it allows you to more efficiently and effectively allocate security resources around your Oracle infrastructure,” Murray said.

“In the past, the announcements would come out whenever Oracle was ready, so you would come in to work one day and all of a sudden you had to run around and patch your Oracle servers,” Murray said.

Unlike Microsoft, Oracle will not give customers a heads up on what it will deliver in its quarterly patch release, Davidson said. Microsoft recently started publishing a list of products it will provide patches for three work days ahead of the actual patch release.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now