Oracle: Automated security would have prevented Equifax breach

Larry Ellison reveals self-patching database, as Oracle steps into machine learning

Oracle founder Larry Ellison claimed yesterday that Equifax's huge data breach would never have happened had the company used Oracle's upcoming self-patching database.

Equifax's CEO, CIO and CSO all retired in the aftermath of the incident, which exposed 143 million US customers' data records, and the details of 400,000 UK customers, to hackers, though the company only revealed the July hack last month.

Advertisement - Article continues below

It emerged that Equifax had been hacked through an unpatched Apache Struts flaw, which the Apache Foundation had released a fix for back in March - Equifax had simply failed to apply it.

"The worst data thefts in history have occurred after a patch was available to prevent a theft," Ellison told approximately 60,000 delegates at Oracle OpenWorld in San Francisco.

"The database system has to be able to immediately patch itself, automatically patch itself, not wait for a human being to schedule downtime where there's an opportunity to implement a patch in a month or two - by the way which normally happens."

He suggested the Equifax breach was a result of unwillingness to bring the system offline to patch it efficiently.

"To apply a patch typically you have to bring your systems down - nobody likes to bring their systems down," Ellison said. "There's a lot of approvals up and down that need to occur. That doesn't work. Didn't work at Equifax, didn't work at the [US] Office of Personnel Management - doesn't work."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

While Oracle is still "moving to" a fully autonomous security system - which Ellison promised more details on come Tuesday - he did show off a fully automated database, Oracle 18c, coming in December, which he said includes the ability to automatically patch flaws.

On Oracle's security system, he explained it relies on machine learning to identify anomalies in patterns of behaviour, to allow companies to spot potential malicious behaviour before they are impacted.

"You have to know in the [hacker's] reconnaissance phase when someone's nosing around in your computer systems trying to steal a password, trying to steal an identity," he said. "You better detect that happening during the reconnaissance phase.

"After your database's been notified by your security system it has to be able to patch itself immediately while running," he explained. "No delay, no human intervention, it has to happen immediately."

The cost of getting it wrong is too high to pay, Ellison argued, not to consider the advantages of automated security.

Advertisement - Article continues below

"How many cents did it costs Equifax to not do an online patch? What if a human being just misses a patch, what's the cost of that?" he asked.

"There was a patch available for Equifax [but] somebody didn't apply it. It's a clean sweep; directors aren't safe, nobody's safe when something like that happens. People are going to get better at stealing data and we have to get a lot better at protecting it."

Picture: Larry Ellison

Advertisement

Recommended

Visit/security/hacking/355227/65-country-coronavirus-team-protects-the-technological-infrastructure-of
hacking

Cyber security experts form COVID-19 taskforce to combat ransomware attacks

3 Apr 2020
Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020

Most Popular

Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020
Visit/business-strategy/flexible-working/355186/why-were-lucky-covid-19-has-come-now
flexible working

Why we’re lucky COVID-19 has come now

3 Apr 2020