E-Business security - it's time to take software security seriously

According to initial assessments by analysts, damage from the SQL Slammer worm could reach between $750 million and $1 billion USD.

The frequency and effectiveness of such attacks underscore the increasing need for vigilance by software vendors and their customers. Vendors must be vigilant in preventing common programming errors from opening up huge vulnerabilities in their software, and customers must be vigilant in procuring software that is built securely from inception, and deploy it securely. There is no 'security product' that can protect against a vendor's failure to build their products securely, just as it is impossible to put a lock on a cheap plywood door and expect it to keep out intruders, who will merely kick a hole in the door and bypass the lock entirely.

The stakes have never been higher for information security, and especially information assurance, the degree of confidence that customers can have in the security claims of a vendor. The industry standard is ISO-15408, under which licensed third parties independently evaluate the security claims of products. During most of the last decade, the fallback position has been that more customers did not require independent security evaluations because not enough vendors did them, and not enough vendors did them because customers did not demand them.

Oracle's commitment to building Unbreakable software builds upon the strength of some 25 years of building systems for the most security-conscious customers in the world - including the intelligence community and the US Department of Defense - and the assurance afforded by 15 independent security evaluations. As we run our own company on Oracle software, we have a vested interest in delivering Unbreakable software for every product we build.

We laud the vendors who subscribe to 'built in, not bolted on' security as validated by independent evaluations and we urge all other vendors to do so. Information assurance is too important an issue to be the purview of only the few and committed. The security of cyberspace in part rests on every vendor taking the Unbreakable pledge - to build products secure from inception, to ship products secure on delivery, and to complete security evaluations as proof of a product's security-worthiness.

'Trust us, we are secure' is not good enough anymore.


Mary Ann Davidson
Chief Security Officer
Oracle Corporation