Oracle Users Struggle With Patch Management

Oracle issued 41 security patches for its products in January, and another 43 in April. As the database giant prepares another round of quarterly patches, here's a question: How many of these patches has your organization deployed this year?

If you answered "none," you're not alone. According to a study published in February by the Independent Oracle Users Group (IOUG), nearly half of all Oracle users are at least two or more patch cycles -- that's six to nine months -- behind in their database patching. Eight percent are four or more cycles (more than a year) behind, and 11 percent have never applied one of Oracle's Critical Patch Updates.

An informal study of Oracle users published earlier this year by Sentrigo, which offers a virtual patch management tool for Oracle environments, offered even more stark results. In a rolling poll that totaled 305 respondents, Sentrigo found that only 10 percent of Oracle users had installed the most recent Oracle patch update. More than two-thirds said they had never applied an Oracle patch update.

While some experts dispute the findings of these studies, most agree that many database administrators are slow to roll out new patches. Why? Many of them are concerned that the patches might slow performance or cause disconnects between business applications and the databases that serve them.

"The requirement for extensively testing patches across complex and large production environments [is] a primary difficulty [in] timely application of Critical Patch Updates," the IOUG study says. "While the application of the patches may take a few hours, the actual testing of the patches before their application in production systems may take months in some organizations."

Shortly after the IOUG presented its study findings to Oracle management, Oracle announced it would look for ways to further educate customers about the importance of security patching. One such effort took place last month, when Eric Maurice, director of Oracle's Software Security Assurance program, presented a webinar abouot simplifying the patch process.

In the webinar, Maurice offered a detailed look at My Oracle Support, a customized system that users can access to perform a "health check" on their applications. The system leverages data from the Oracle Configuration Manager agent software -- sometimes called the Oracle Collector -- which pulls data from Oracle implementations and alerts users to potential problems or vulnerabilities.

The Collector provides Oracle users with an overview of their Oracle home environments, including which patches have been installed, which platforms the user has deployed, and a summary of the content in their Oracle configuration files, Maurice explains. Once the data has been collected, the system also helps users to locate the missing patches and deploy them immediately, he says.

"The Collector is embedded in many of our products, but it needs to be enabled in your environment before it can work," Maurice observes. If the user does not enable the Collector, then the user will not be automatically notified of patches that might be missing from their applications, he states. The Collector can be enabled across multiple instances of Oracle databases or applications and managed centrally, so it can be used to monitor patches in large environments, Maurice says.

Yet while Maurice's presentation offers some simple steps toward identifying missing patches and deploying them swiftly, he did not address the issue of long testing periods that may delay users from patch deployment -- or the potential impact of new patches on database performance. The IOUG report says the company "will be looking at ways to bring further enhancements to the Critical Patch Update documentation in order to help customers determine which areas need to be tested in their environment prior to the deployment of Critical Patch Updates against production systems."

"The results of this survey seem to indicate that it is typical for Oracle systems and database administrators to be required to justify the deployment of security patches," the IOUG report says. "From a security perspective, it seems more appropriate that organizational policies require that the non-deployment of security patches be justified."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.