As a security professional, I find it hard to believe the questionnaire's respondents are responsible for truly mission-critical systems that, if hacked, could cause the organization's demise. On the other hand, I know that Oracle systems don't simply sit exposed on the Internet, though, sadly, exceptions probably exist. They'll be contained inside the corporate perimeter within the datacenter, and quite possibly within an even more tightly controlled network segment within the datacenter.
So, what's the significance of these numbers? Not much. That's because the survey doesn't provide any context as to why the companies are not patching. The IOUG's president said it's likely that admins don't patch their systems because they're more isolated, as I said above, but I'm still left wondering what the numbers really mean without having more questions answered, such as: Did the companies perform comprehensive risk assessments to determine whether to deploy Oracle patches?
What I do want to point out for you infosec pros and pen testers is a great resource on hacking Oracle servers. During the past few months, Chris Gates has put on his blog, Carnal0wnage, some awesome examples of using the Metasploit Framework's Oracle modules. If you have Oracle servers in your environment or perform pen testing for companies that use Oracle, take the time to walk through the examples and test out the modules. You never know when they might come in handy.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.