DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references;
        b=XiBUV32jDVlF1O3huvIwlsCkyF79us7pyO5mm1iDXsxBRPB+sHGr/NCoIujVX5uMK2vH+uFXi03ghdExF6rmPm2iDh3l7AfWL+73gRxcpJCVnX8KJNwBuns0aQrfbs5XsZgE+x0uS4TXAJIk1t1unJvmMDb3w3gHEa0ff3MNAt8=
Message-ID: <9b46ac490711260933k40f0f9fcsd911d933c7ba6502@mail.gmail.com>
Date: Mon, 26 Nov 2007 18:33:03 +0100
From: "Andre van Winssen" <dreveewee@gmail.com>
To: "Niall Litchfield" <niall.litchfield@gmail.com>
Subject: Re: Risk Calculator for Oracle Critical Patch Updates
Cc: oracle-l <oracle-l@freelists.org>
In-Reply-To: <7765c8970711260738l48a09dd2u1175fe7d9955384c@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_8363_13263049.1196098383932"
References: <9b46ac490711260352l71c61ccekf90fae9f0f03952e@mail.gmail.com>
	 <7765c8970711260738l48a09dd2u1175fe7d9955384c@mail.gmail.com>
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-to: dreveewee@gmail.com
------=_Part_8363_13263049.1196098383932
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Niall,

thanks for sharing. But what is a better way to come to agreement? In my
organisation it is difficult to get additional downtime for patching
something that hasn't led to (security) incidents yet. So what can we
database security focal points do, sit and wait until the security incidents
start happening or be optimistic and forget about cpu's altogether or until
regular maintenance cycle comes in?  CPU's are really hot potatoes in this
respect.

Indeed we have to agree first on *Environmental Score Metrics *and the *
thresholds* but once that is done it's pretty straightforward. What I want
to achieve is to get buy-in in advance from the businesses and dba managers
for when these tresholds are exceeded.

Skipping cpu's means that the score should go up as the nr of fixes missed
has increased. But how much..who knows?

If database security was only a nightmare I could forget about it after
waking up !

Regards,
Andre


2007/11/26, Niall Litchfield <niall.litchfield@gmail.com>:
>
> Well I'm one of those groups (dba and manager) and it seems to me that
> CVSS only really helps where the organisation doesn't have a basis for
> discussion already. In particular it's a little overstating the case to
> state that CVSS is objective given that it scores based on subjective
> judgements on a number of the core elements of the score (eg collateral
> damage potential). In addition it's difficult to see how to relate CVSS
> scores to dollar cost of implementing the fixes. Especially as the dollar
> cost may not be known - applying a cpu may require one or more application
> code updates and associated testing. So for example the Oct CPU score for my
> organisation I calculate as 5.9. Is that enough to delay a project
> promised before year end or not? That in the end can't be an objective
> decision. Suppose I decide it doesn't justify it, and go through a similar
> process with the next 2 CPUs (say they score 5.8 and 6.3). Does the fact
> of not having applied 2 previous CPUs affect how I use the score of 6.3 in
> 6 months time?
>
>
> --
> Niall Litchfield
> Oracle DBA
> http://www.orawin.info
>

------=_Part_8363_13263049.1196098383932
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<div>Niall,</div>
<div>&nbsp;</div>
<div>thanks for sharing. But what is a better way to come to agreement? In my organisation it is difficult to get additional downtime for patching something that hasn&#39;t led to (security) incidents yet. So what can we database security focal points do, sit and wait until the security incidents start happening or be optimistic and forget about cpu&#39;s altogether or until regular maintenance cycle comes in?&nbsp; CPU&#39;s are really hot potatoes in this respect.
</div>
<div>&nbsp;</div>
<div>Indeed we have to agree first on&nbsp;<strong>Environmental Score Metrics </strong>and the <strong>thresholds</strong> but once that is done it&#39;s pretty straightforward. What I want to achieve is to get buy-in in advance from the businesses and dba managers for when these tresholds are exceeded.
</div>
<div>&nbsp;</div>
<div>Skipping cpu&#39;s means that the score should go up as the nr of fixes missed has increased. But how much..who knows?</div>
<div>&nbsp;</div>
<div>If database security was only a nightmare I could forget about it after waking up !</div>
<div>&nbsp;</div>
<div>Regards,</div>
<div>Andre<br><br><br>&nbsp;</div>
<div><span class="gmail_quote">2007/11/26, Niall Litchfield &lt;<a href="mailto:niall.litchfield@gmail.com">niall.litchfield@gmail.com</a>&gt;:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div>Well I&#39;m one of those groups (dba and manager) and it seems to me that CVSS only really helps where the organisation doesn&#39;t have a basis for discussion already. In particular it&#39;s a little overstating the case to state that CVSS is objective given that it scores based on subjective judgements on a number of the core elements of the score (eg collateral damage potential). In addition it&#39;s difficult to see how to relate CVSS scores to dollar cost of implementing the fixes. Especially as the dollar cost may not be known - applying a cpu may require one or more application code updates and associated testing. So for example the Oct CPU score for my organisation I calculate as 
5.9. Is that enough to delay a project promised before year end or not? That in the end can&#39;t be an objective decision. Suppose I decide it doesn&#39;t justify it, and go through a similar process with the next 2 CPUs (say they score 
5.8 and 6.3). Does the fact of not having applied 2 previous CPUs affect how I use the score of 6.3 in 6 months time? </div><span class="sg">
<div>&nbsp;</div>
<div><br>-- <br>Niall Litchfield<br>Oracle DBA<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.orawin.info/" target="_blank">http://www.orawin.info</a> </div></span></blockquote></div><br>

------=_Part_8363_13263049.1196098383932--
--
http://www.freelists.org/webpage/oracle-l