Database Patch News — December 2020 (Issue 5)

Database Patch News — December 2020 (Issue 5)

Welcome to Database Patch News, Buda Consulting’s newsletter of current patch information for Oracle and Microsoft SQL Server. Here you’ll find information recently made available on patches—including security patches—and desupported versions.

Why should you care about patching vulnerabilities and bugs? Two big reasons:

  1. Unpatched systems are a top cyber attack target. Patch releases literally advertise vulnerabilities to the hacker community. The longer you wait to patch, the greater your security risk. 
  2. Along with running a supported database version, applying the latest patches ensures that you can get support from the vendor in case of an issue. Patching also helps eliminate downtime and lost productivity associated with bugs. 

Here are the latest patch updates for Oracle and SQL Server:

Oracle Patches:

October 20, 2020 Quarterly Patch Updates:

19c – Release Update 19.9 is available (31771877 & 31668882)

18c – Release Update 18.12 is available (31730250 & 31668892)

12cR2 – Release Update 201020 is available (31741641 & 31668898)

Regular support ends in Mar 2023 and extended support ends in Mar 2026.

12cR1 – Release Update 201020 is available (31550110 & 31668915)

Regular support ended in July 2019 and extended support ends in July 2021.

11gR4 – Patch Set Update 201020 is available (31720776)

Regular support ended in October 2018 and extended support ends in December 2020.

 

SQL Server Patches:

SQL Server 2019

Cumulative update 8 (Latest build) Released Oct 1, 2020

Mainstream support ends Jan 7, 2025

Extended support ends Jan 8, 2030

 

SQL Server 2017

Cumulative update 22 (Latest build) Released Sept 10, 2020

Mainstream support ends Oct 11, 2022

Extended support ends Oct 12, 2027

 

SQL Server 2016 Service Pack 2

Cumulative update 15 Release date: Sept 28, 2020

Mainstream support ends Jul 13, 2021

Extended support ends Jul 14, 2026

 

SQL Server 2014 Service Pack 3

Cumulative update 4 Release date: Feb 11, 2019

Mainstream support ended Jul 9, 2019

Extended support ends Jul 9, 2024

 

SQL Server 2012 Service Pack 4

Release date: Oct 5, 2017

Mainstream support ended Jul 11, 2017

Extended support ends Jul 12, 2022


Note: All other SQL Server versions not mentioned are no longer supported.

 

Is AI Going to Dumb Down the Internet?

Full disclosure, I am a layperson when it comes to search engine optimization (SEO). I have been doing some research to optimize the content on our budaconsulting.com website, and something caught my eye that concerns me. I wanted to mention it and see if readers have any thoughts about it. 

Implications of the new Mobile First Index

While researching the latest SEO topics, I came across this informative article on mobile-first indexing, appearing in Search Engine Journal.com, by Roger Montti.  

The article describes how Google’s new mobile-first index changes the way content relevance is derived. Most of that discussion is beyond the scope of this article, but it is all very interesting and worth a read. 

What interested me most was part 6, which talked about whether a user would understand your content.  This describes how machine learning is used to interpret click-through rates and viewport times (the amount of time content remains visible on a mobile screen or in a browser).

As with other signals used by the search engine’s algorithm, this is used to determine where in the search results, if at all,  your page shows up. The author references a Microsoft paper entitled “Predicting Interesting Things in Text.”

I won’t repeat the text here, but Roger Montti posits that one of his takeaways from this paper is, “It may be advantageous to appeal to the broadest array of people in a mobile-first index.” 

Dumbing down our content

I am not sure, but it sounds like that may mean that in order to get our pages to appear to the readers we want, we have to make it understandable (according to the AI) to the general public. 

When we write technical blogs, in order to make them understandable to everyone, we would have to leave out all manner of technical detail. We would also have to avoid going deep into the topic at a conceptual level.

 I am interested in the thoughts of SEO professionals about this. Do you think that we will start to see more shallow content on the internet in general in order to chase page ranking? It seems that the internet would lose much if its value pretty quickly if that becomes the only way to get page rankings.

 

Cloud Customers Need to Secure Their Own Data

In response to the recent Capital One data breach, where a hacker exploited a misconfigured open-source Web Application Firewall hosted within Amazon Web Services (AWS), the Amazon CTO reminded customers that they must secure their own data when housed on AWS infrastructure.

This seems obvious, but it is a very important point.

When you move your data into AWS or any cloud provider, because it is not in our your data centers, and because you often no longer employ full-time people to manage the server hardware and software that house that data, you might get the feeling that someone else is managing our data just as carefully as our own staff once did.

That may be true for some dimensions of data management. For example, the cloud provider is responsible for making sure that the hardware stays up and running. Likewise, when you use software as a service (SaaS) or platform as a service (PaaS), the service provider is responsible for making sure that the application software and/or operating system stays up and running. In the case of infrastructure as a service (IaaS) offerings, the customer is still responsible for the latter two functions.

But in all the above cases, the customer is ultimately responsible for the security of their own data. The AWS security documentation describes it this way:

    • Security of the cloud – AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the AWS Compliance Programs. To learn about the compliance programs that apply to Amazon EC2, see AWS Services in Scope by Compliance Program.
    • Security in the cloud – Your responsibility is determined by the AWS service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations.

The key takeaway is that if you have your data in any cloud service, you must be as rigorous in securing that data as if it were in your own data center—and in some cases even more so.

Following are some key things to think about when moving your data into the cloud. These are the same considerations you need to focus on when keeping your data in-house. Some of these concerns only apply to IaaS in the cloud, while others are relevant to all cloud service scenarios.

    • Is the underlying storage configured properly so that only the database software, application software and authorized users can access it?
    • Is the data encrypted both at rest and in transit?
    • Is proper authentication in place for the application or database, to ensure that only proper users can gain access to the system?
    • Is proper authorization in place for the application or database, such that data is exposed only to the proper users?
    • Is the network configured properly to reduce the surface area vulnerable to attack?

These considerations are not new. In fact, our Database Security Roadmap, initially created primarily with on-premises systems in mind, is still completely relevant with cloud technology.

Download the roadmap to make sure you have all the bases covered.

 

Communication Breakdown: Avoiding Conflict with Your Customers

When working with customers, we face many situations that might result in conflict. This is bad for obvious reasons. As service providers, conflict keeps us from providing outstanding value to our customers. It hurts our relationship and reduces the chance that they will continue to use our services.

Customers are at different technical levels and have different “personal styles.” Some are very technical and want to be part of designing the solution. Others won’t want to know any details and just want something that works at the end. Until we get to know the customer well, the potential for conflict is higher for reasons like these.

I have certainly not mastered the art of avoiding all conflict with every customer. But I continue to strive to improve. This post describes two kinds of situations where conflict is likely to occur if we don’t handle things well, along with some thoughts about how to avoid conflict in these and other instances.

The customer is always right!

Of course, we know that the customer is not literally always right. We also know (or had better know) that we are not always right, either.

But even though the customer is not always right, we must always respect them as if they are right. Why? Because it is the right way to treat people, and because they pay us. They are the reason we are in business.

We have all had times when a customer wanted us to do something that we felt was not in their best interest, was not efficient, or was just plain wrong.

So how do we handle it when we think our client is wrong? Below are some basic “rules of conduct” for reaching agreement. It’s good practice to follow these in order. Hopefully this will lead to building great relationships with our clients and avoiding conflicts.

    1. Listen completely to what the customers says, so we fully understand what they mean. This means not interrupting them before they have finished their thought. This takes patience. Often, if we let them talk through an issue long enough, they will come to the same conclusion we would have, and we have just avoided a conflict. Likewise, we may come to understand their position better and we will agree with them; and again, we have avoided a conflict.
    2. If after careful listening there is still not agreement, asking questions may help both parties see aspects of the issue that the other does not see. Try to use probing questions, not leading questions. Our frame of mind should be “How can they convince me that they are right?” Not “How can I convince them that I am right?” In other words, assume they are right, and help them prove it. I am not suggesting that you disregard your knowledge and expertise. But it’s important to acknowledge that you don’t know everything your customer knows. Challenge their position rigorously, but with an open mind.
    3. If there is still not agreement after they have expressed their entire thought and you have asked your questions and listened to the answers, try offering alternative approaches that may meet their objectives, but with methods that you think are more effective.
    4. If you and your customer still don’t agree after all that, then respectfully suggest that you table the issue and follow up via email with additional thoughts (in the same spirit of understanding that was described above).

If, after all your effort, you still think that what the customer is asking you to do is either not in their best interest or is ethically or legally wrong, then you may have to respectfully decline to provide the service they are asking for. I have done this and it’s not the end of the world.

Notice that nowhere did I recommend arguing with the client. Why? Because we never argue with the client. That is disrespectful. Oh, and they pay us.

This approach requires patience—but it’s worth it. Great communications allows us to add more value. Also they pay us, so they deserve it.

This approach might require that we answer the same question ten times. But that is also worth it, because great communications allows us to add more value, and because the client pays us.

This approach might also require that we ask the same question ten times or explain the same thing ten times. But it is worth it. Why? Because great communications allows us to add more value, and because they pay us.

The cranky customer

Right or wrong, the customer might get cranky with us from time to time. But it is worth it to endure this calmly and politely, because they pay us.

This does not mean accepting abuse. If a client is truly abusive, fire them. I’ve done that, and it’s not the end of the world. Service providers deserve and demand the same respect that they give to their customers.

But it does mean that we may have to accept expressions of frustration and even anger at times. When this happens, it is almost always due to problems with communication. And it is up to us to fix the communication problems. Why? Because they pay us.

Here are some simple steps to avoiding communication problems that lead to cranky customers:

    1. Over-communication: When giving an explanation, provide a littlemore information than you think is necessary, as long as that information is useful. If a customer tells you that you should provide less detail, then do so in future communications. It is better to be told you provide too much information than too little.
    2. Frequent communication: During the course of a project, particularly when a deliverable is expected soon, provide short, frequent status updates. The frequency depends on the length and urgency of the project. If the deliverable is due in one week and is urgent, then a daily email with a quick status can put a customer’s mind at ease. If it is a six-month project with ongoing deliverables, then a weekly recap may be enough.
    3. Set expectations with a communication rhythm: if you are in the middle of ongoing work with frequent deliverables, let the customer know that you will check Slack or email twice a day; for example, at 12 and 5. That way they won’t be disappointed or anxious if you don’t respond immediately to their 9:15 email asking for a status update. If you are on a longer-term project, let them know what days of the week you will provide status updates.
    4. Communicate problems or concerns immediately: If your project falls behind schedule, or runs into problems that are beyond your control, inform your customer immediately. This can be a difficult conversation to have, but the sooner they know about a blocking issue, the easier and less expensive it is to resolve it. And the moment you have the conversation, you will feel better!
    5. Be responsive: If your client asks you for something, either respond promptly with the answer, or acknowledge their request as soon as you see it and tell them when you will be able to get to it.

Here is the takeaway: the root of most conflict is misunderstanding, and the root of most misunderstanding is poor communication. As service providers, proper communications are our responsibility. It is part of our job.

We can build all the environments, databases and applications in the world. But if we don’t communicate well with our customers then we have not added the value that we should have.

To get maximum value from your Oracle database investments and clear communications from your service provider, contact Buda Consulting.

Lock the Safe—Secure the Database

You are going away on a much-needed vacation to Aruba. You will only be gone for a week. But you understand the importance of security, so you make sure you lock the windows and doors. You put the lights on a timer so would-be thieves think there is some activity in the house. You cancel the newspaper so they won’t be piling up outside and you ask your neighbor to watch the house in case he sees anything unusual.

Before you leave, you go to the bedroom where you keep the safe. All of your important papers are in there, and that watch that Dad left you, and your wife’s favorite earrings. Oh, and that brooch from Grandma. Not really your wife’s style but she would never part with it because Grandma was her favorite.

The Complacency

You grab some cash and the passports out of the safe, and you start to lock it up… But whenever you close it up, it is always such a pain to remember the combination, and you have to turn that knob so many times before you get it right. Besides, you locked all the doors and windows, and you have your neighbor watching the house. The perimeter is secure. So is there really any need to lock the safe?

The Dog

You have made arrangements for your nephew Tommy to walk your yellow lab Miles while you are gone. Tommy is such a fine young man and always willing to help.

The Double Trouble

Tommy hits a double down the first base line the day after you leave and breaks his ankle sliding into second. Tommy asks his friend Joey to walk Miles for him, because it’s hard to walk a dog on crutches.

He hasn’t mentioned it to Tommy, but Joey has been losing at the poker table lately. He borrowed a couple of thousand from that guy Rocco down the street, and took it to the tables thinking his luck would turn around. But now he’s just deeper in debt, and he doesn’t know how he will ever pay back that much money.

The Loss

When Joey opens your front door with Tommy’s key, he walks in and sees the beautiful furnishings in your home.  He walks upstairs and peeks in the bedroom. He sees the safe, walks over and tries the handle. He thinks “How lucky am I?” as the door swings open. Seeing all of the cash that you left in the safe, Joey thinks, “If this money was really important to them, they would have locked the safe.” After grabbing the cash, the brooch and the watch catch his eye and he can’t help himself. He grabs it all and closes the safe, not worrying for the moment what happens when you get home. At least he can get Rocco off his back.

The Lesson

Of course, you would never really do this!  You would be crazy to leave valuables in an open safe just because you locked your windows and doors. You know that securing the perimeter is not good enough. Right?

But this is exactly what many IT groups are doing every day. They spend lots of time and money securing their network’s perimeter. But they neglect the security of the safe holding all of their jewels—the database.

By strongly securing the database (locking the safe), you can protect your data assets from bad actors who get through the perimeter security. This may be hackers who break things for fun, criminals intent on gathering data they can sell or exploit, or disgruntled employees who didn’t even have to break through the perimeter in the first place.

The Action Plan

Don’t leave your safe open!  Your database has many vulnerabilities just waiting for a guy like Joey to find. Have a thorough security assessment performed today, take action, and make sure Joey goes home empty-handed.

Database Patch News — December 2020 (Issue 5)

Database Patch News — November 2019 (Issue 1)

Welcome to Database Patch News, Buda Consulting’s monthly newsletter of current patch information for Oracle and Microsoft SQL Server. Here you’ll find information on available patches—including security patches—and desupported versions made available during the past month.

Why should you care about patching vulnerabilities and bugs? Two big reasons:

  1. Unpatched systems are a top cyber attack target. Patch releases literally advertise vulnerabilities to the hacker community. The longer you wait to patch, the greater your security risk.
  2. Along with running a supported database version, applying the latest patches ensures that you can get support from the vendor in case of an issue. Patching also helps eliminate downtime and lost productivity associated with bugs.

Here are the latest patch updates for Oracle and SQL Server:

Oracle Patches:

Oct 15 2019 Quarterly Patch Updates:

19c – Release Update 19.5 available

18c – Release Update 18.8 available

12.2.0.1 – OCT 2019 RELEASE UPDATE 12.2.0.1.191015 available.
Regular support ends Mar 2023 and extended support ends Mar 2026.

12.1.0.2 – Currently in extended support.
The last freely available patch was July 2019 for 12.1.0.2. The Oct 15 2019 Patch Set Update (PSU) is available but may require extended support purchase to access it. Patches will be release until July 2021 for this version. PSU 12.1.0.2.191015 is available.

11.2.0.4 – Entered extended support in December 2017
The last free available patch was October 2018 for 11.2.0.4. PSU 11.2.0.4.191015 is available but may require clients purchase extended support to access it.

SQL Server Patches:
SQL Server 2017 incremental servicing model (ISM)
CU17 (Latest build)—Released October 08, 2019

SQL Server 2016 Service Pack 2
Release date: April 24, 2018

SQL Server 2014 Service Pack 3 Cumulative update 4
Release date: July 29, 2019

SQL Server 2014 Service Pack 2 Cumulative update 18
Release date: July 29, 2019