|
Sentrigo Intros Hedgehog vPatch to Avoid Database Vulnerabilities
 TMCnet Contributing Editor
Sentrigo, Inc. today launched the Hedgehog vPatch, a virtual patching software, that it says will protect databases against known vulnerabilities as soon as they are discovered.
The software is designed to protect corporate databases against recently discovered security issues, without requiring database downtime and affecting related applications, according to the company.
Database vendors study their software and receive input from communities and security experts, who identify vulnerabilities that can be patched with software updates. However, it may take months to patch a known vulnerability and the fixes can be difficult to apply. Also, it requires extensive application testing and then database downtime.
This results in business disruption or loss of support from software vendors that certify their applications only for particular database configurations, company officials say. Additionally, many widely used database versions are no longer supported by vendors and thus are never patched.
Eric Ogren, principal analyst at the Ogren Group, studies customer use of database management systems and database industry trends.
“Organizations, particularly those in highly regulated industries, fully appreciate the need for database protection, but struggle to keep their systems current when vulnerabilities are continuously being discovered,” Ogren said. “Sentrigo’s host-based vPatch software operates on the internal database structures to defend against exploits, but without altering the DBMS itself. Enterprises are better protected from the latest attacks without affecting application uptime or modifying existing compliant database configurations.”
According to Sentrigo’s data, gathered from 305 Oracle ( News - Alert) database administrators, consultants and developers, only 10 percent install Oracle Critical Patch Updates in a timely manner following that company’s quarterly releases. Even if organizations use Oracle CPU, they are at risk between patch installations, when vulnerabilities have been discovered but not addressed, company officials say.
“The risk window after an exploit has been published on the web is months or even years long,” said Slavik Markovich, Sentrigo’s chief technology officer. “Indeed, it’s more likely that a vulnerability will be exploited after a patch has been issued. With Hedgehog vPatch, we’re offering immediate protection against known database vulnerabilities with ongoing updates delivered automatically. RDBMS vendors have been investing significant efforts to patch their databases frequently, and Sentrigo encourages all companies to install vendor patches when they are made available. But when they can’t, or when installation is delayed because business systems can’t be taken down, Hedgehog vPatch protects databases and keeps them up to date.”
“Although there have been improvements in DBMS security options, organizations struggle to secure established DBMSs that were not designed with effective security controls,” wrote Jeffrey Wheatman in a report by Gartner ( News - Alert), Inc. titled “Take Six Steps to Secure Your Databases,” published October 24, 2007.
The report continues, “We have also seen an increased focus on data security resulting from regulatory pressures. You can take several actions to secure your databases/DBMSs. But even if you follow every recommendation, there are still potential risks to your data.” The report goes on to state that “Keeping up-to-date with patches and hot-fixes is difficult.”
The new software can prevent intrusions by terminating or quarantining user sessions, as well as to generate alerts. The product currently supports Oracle and Microsoft ( News - Alert) databases.
Arun Satapathy is a contributing editor for TMCnet. To read more of Arun’s articles, please visit his columnist page.
[ Back To TMCnet.com's Homepage ]
|
INDUSTRIES
Activate Email 
Find Solutions for Enterprises, SMBs & Service Providers at the INTERNET TELEPHONY Conference and EXPO East, January 20-22, 2010. Miami, FL.
