Oracle Press Release

Oracle Announces Oracle Privileged Account Manager

Advanced Administrative and Provisioning Capabilities Streamline Password Management for High Risk Accounts and Increase Security

Redwood Shores, Calif. – July 19, 2012

News Facts

Oracle today announced Oracle Privileged Account Manager to help customers efficiently comply with regulatory requirements, secure critical applications and sensitive data, and lower operational costs.

The latest addition to Oracle Identity Management 11g Release 2, a key component of Oracle Fusion Middleware 11g, Oracle Privileged Account Manager provides customers with the ability to easily and safely manage passwords for shared or administrative accounts associated with business applications, middleware, databases and operating systems.

Typically an enterprise data center can have hundreds of shared accounts, bringing an additional level of security concerns as shared accounts provide elevated system access often to highly sensitive information and can be accessed by multiple sources with little way to audit their usage back to any individual.

By combining advanced policy-based and automated password management capabilities with comprehensive auditing and reporting features, Oracle Privileged Account Manager delivers highly-secure and simplified password administration to shared accounts, while further streamlining identity compliance reporting.

As a part of Oracle Identity Governance and integrated into Oracle Identity Management 11g Release 2, Oracle Privileged Account Manager can also significantly reduce identity management costs, deployment times and audit deficiencies.

Integrated Best-in-Class Access Management

With Oracle Privileged Account Manager, administrators can easily manage and provision access to every layer of company information and data. Features in Oracle Privileged Account Manager include:

Policy-Based Password Check-Out/Check-In: A Web-based user interface allows administrators to request access to administrative accounts, eliminating the manual logging and tracking of passwords.

Integration with Oracle Identity Manager 11g: Streamlines password management by enabling Oracle Privileged Account Manager to use the same workflow approvals for account requests and automatically provision access with the same connectors.

Automatic Password Change: With Oracle Identity Manager 11g connectors available for Unix/Linux, Database and LDAP systems, Oracle Privileged Account Manager supports virtually any application -- improving security and reducing the risk of fraud by automatically changing passwords after administrator check-ins.

Comprehensive Auditing and Reporting: Tight integration with Oracle Identity Manager 11g and Oracle Identity Analytics 11g provides a common approach and simplifies compliance reporting.

Supporting Quote:

“With increasing complexity and the need for tight policy controls, managing passwords for shared and administrative accounts can be a very time consuming and expensive process,” said Amit Jasuja, vice president of development, Security and Identity Management at Oracle. “Oracle Privileged Account Manager reduces the administrative burden while enabling customers to benefit from simplified, highly-secure management of shared and administrative accounts. The combination can significantly reduce identity costs and improve security by protecting sensitive data from unauthorized parties.”

Supporting Resources

Oracle Privileged Account Manager

Oracle Identity Management 11g

Oracle Fusion Middleware 11g

Oracle Identity Manager 11g

Oracle Identity Analytics 11g

Join the Oracle Identity Management online communities: Blog, Facebook and Twitter

About Oracle

Oracle engineers hardware and software to work together in the cloud and in your data center. For more information about Oracle (NASDAQ:ORCL), visit www.oracle.com.

Oracle Press Release

Oracle Enterprise Single Sign-On Helps Videotron Improve its Security and Streamlines Password Management

Redwood Shores, Calif. – July 11, 2012

News Facts

To streamline its business processes and improve IT operational efficiency, Videotron, a Canadian integrated communications company, deployed Oracle Enterprise Single Sign-On Suite Plus across its entire enterprise including remote and mobile users.

Prior to using Oracle, Videotron’s help desk was consumed with at least 20 percent of its call volume related to forgotten passwords, which created significant employee downtime and heightened frustration for both the end user and the help desk administrators.

Using Oracle Enterprise Single Sign-On, a key component of Oracle Identity Management 11g, Videotron’s users gained access to all of their authorized applications through a single authentication event with an initial network login and were also provided self-service password management in the case they forgot that one password.

In just four months, Oracle Enterprise Single Sign-On was implemented across more than 75 applications for Videotron’s 6,000 users.

The deployment included all components of the Suite including Oracle Enterprise Single Sign-On Password Reset, Oracle Enterprise Single Sign-On Logon Manager and Oracle Enterprise Single Sign-On Kiosk Manager.

Within two months of completing its deployment, Videotron realized significant improvement with more than 29,000 passwords authenticated per day by Oracle Enterprise Single Sign-On instead of individual, manual entries.

Supporting Quote

“We were very concerned with the amount of passwords our employees had to manage and the impact on both our security and productivity,” said Alain Lavoie, Information Security Director at Videotron. “The ease of use of Oracle Enterprise Single Sign-On allowed us to see results almost immediately with increased end user productivity and decreased help desk costs.”

Supporting Resources

Oracle Enterprise Single Sign-On Suite Plus

Oracle Identity Management 11g

Oracle’s Strategy for Identity and Access Management

Gartner 2011 Magic Quadrant for User Administration/Provisioning

Gartner 2011 Magic Quadrant for Identity and Access Governance

About Oracle

Oracle engineers hardware and software to work together in the cloud and in your data center. For more information about Oracle (NASDAQ:ORCL), visit http://www.oracle.com.

Microsoft Security Intelligence Report Warns of Ongoing Conficker Threat and Clarifies Reality of Targeted Attacks

Microsoft Security Intelligence Report Warns of Ongoing Conficker Threat and Clarifies Reality of Targeted Attacks

April 25, 2012

Latest study analyzes data from more than 600 million systems worldwide, offers solutions for mitigating both targeted and broad-based attacks such as Conficker.

inShare2

REDMOND, Wash. — April 25, 2012 — Microsoft Corp. today released the Microsoft Security Intelligence Report volume 12 (.pdf file), which found that the Conficker worm was detected approximately 220 million times worldwide in the past two and a half years, making it one of the biggest ongoing threats to enterprises. The study also revealed the worm continues to spread because of weak or stolen passwords and vulnerabilities for which a security update exists.

According to the SIRv12, quarterly detections of the Conficker worm have increased by more than 225 percent since the beginning of 2009. In the fourth quarter of 2011 alone, Conficker was detected on 1.7 million systems worldwide. In examining the reasons behind Conficker’s prevalence in organizations, research showed that 92 percent of Conficker infections were a result of weak or stolen passwords, and 8 percent of infections exploited vulnerabilities for which a security update exists.

“Conficker is one of the biggest security problems we face, yet it is well within our power to defend against,” said Tim Rains, director of Microsoft Trustworthy Computing. “It is critically important that organizations focus on the security fundamentals to help protect against the most common threats.”

The SIRv12 also revealed that many of the threats often referred to as Advanced Persistent Threats (APTs) are no more advanced or sophisticated than other types of attacks. In most cases, these attacks leverage known vectors such as exploiting weak or stolen passwords and vulnerabilities for which security updates exist, but their success lies in the persistence and determination in trying different tactics to compromise the target. This is why Microsoft refers to these types of threats as Targeted Attacks performed by Determined Adversaries, rather than APTs.

“Labeling cyberthreats as ‘advanced’ is often times misleading and can divert organizations’ attention away from addressing basic security issues, which can prevent more common threats from infiltrating their systems,” Rains said. “Most attacks do not possess new, super-advanced techniques or technology as the APT label implies; in the majority of cases, they simply exploit weak or stolen passwords or vulnerabilities for which a security update exists and employ social engineering.”

Microsoft recommends that customers and businesses adhere to the following security fundamentals to help ensure they are protected:

• Use strong passwords and educate employees on their importance

• Keep systems up to date by regularly applying available updates for all products

• Use antivirus software from a trusted source

• Invest in newer products with a higher quality of software protection

• Consider the cloud as a business resource

“With organizations being presented with significant amounts of data and media reports on cyberthreats, the Microsoft Security Intelligence Report volume 12 gives us good perspective on recent trends in the global threat landscape,” said Bob Rodger, global head of IT Infrastructure Security at HSBC. “The report, in combination with other sources of intelligence, assists us to more accurately and effectively invest, prioritize and make informed decisions about our security infrastructure to ensure that our business continues to be optimally protected from threats.”

For businesses, as Scott Charney, corporate vice president of Microsoft Trustworthy Computing, outlined in his keynote presentation at RSA 2012, Microsoft recommends a more holistic approach to risk management to help protect against both broad-based and targeted attacks, including the following:

• Prevention. Employ security fundamentals and pay close attention to configuration management and timely security update deployment.

• Detection. Carefully monitor and perform advanced analysis to identify threats. Keep abreast of security events and leverage credible sources of security intelligence.

• Containment. If the targeted organization has configured its environment with targeted attacks by determined adversaries in mind, it is possible to contain the attacker’s activities and thereby buy time to detect, respond to and mitigate the attack. To contain an attack, consideration should be given to architecting domain administration models that limit the availability of administrator credentials and apply available technologies, such as IPsec-based network encryption, to restrict unnecessary interconnectivity on the network.

• Recovery. It is important to have a well-conceived recovery plan, supported by suitably skilled incident response capability. Maintain a “crisis committee” to set response priorities and engage in exercises to test the organization’s ability to recover from different attack scenarios.

Microsoft produces the SIR twice per year to keep the industry informed on the changing threat landscape and provide actionable guidance for customers in an effort to create safer more trusted computing experiences for everyone. The latest report, volume 12, provides insight into online threat data with new information for July 2011 through December 2011 and analysis of data from more than 100 countries and regions around the world. More information about SIRv12 is available at http://www.microsoft.com/sir.

Founded in 1975, Microsoft (Nasdaq “MSFT”) is the worldwide leader in software, services and solutions that help people and businesses realize their full potential.

Note to editors: For more information, news and perspectives from Microsoft, please visit the Microsoft News Center at http://www.microsoft.com/news. Web links, telephone numbers and titles were correct at time of publication, but may have changed. For additional assistance, journalists and analysts may contact Microsoft’s Rapid Response Team or other appropriate contacts listed at http://www.microsoft.com/news/contactpr.mspx.