Oracle to deliver security patches on quarterly basis

Starting Jan. 18, Oracle will provide security patches for all of its products on a quarterly basis, a schedule it believes is most convenient for customers.

The patches will include fixes for significant security vulnerabilities and updates that are needed to prevent patch conflicts, Mary Ann Davidson, Oracle's chief security officer, said in a conference call with reporters on Thursday.

In the past, Redwood Shores, California-based Oracle generally released patches when they were ready for all supported product releases and platforms. This meant users often times were caught off-guard and had to drop other work to patch their systems.

Oracle had been mulling a regular delivery model for patches for the last year or so, according to Davidson. In August the company appeared to have opted for a monthly release cycle, similar to the one used by Microsoft.

"When we talked to customers, they said they did not want to patch their systems once a month," Davidson said. "We felt quarterly seemed to be a schedule that customers could live with."

The dates on the patching calendar were chosen to provide a schedule that works for most customers, Davidson said. It avoids periods customers don't want to patch their systems because they are, for example, closing their books, she said.

Oracle's quarterly cycle is not set in stone. The company will issue a patch early if there is an imminent threat of a serious security flaw being exploited, Davidson said. "In that case we don't want to make customers wait for three months and of course customers don't want to wait for three months," she said.

Mike Murray, director or vulnerability research at nCircle Network Security, a provider of vulnerability management services based in San Francisco, is pleased with Oracle's move to quarterly patching.

"It is excellent. It really puts the appropriate emphasis on the importance of the patch cycle for IT departments. Now that it is predictable, it allows you to more efficiently and effectively allocate security resources around your Oracle infrastructure," Murray said.

"In the past, the announcements would come out whenever Oracle was ready, so you would come in to work one day and all of a sudden you had to run around and patch your Oracle servers," Murray said.

Unlike Microsoft, Oracle will not give customers a heads up on what it will deliver in its quarterly patch release, Davidson said. Microsoft recently started publishing a list of products it will provide patches for three work days ahead of the actual patch release.