Bharosa to give Oracle users transaction security

By Mark Brunelli, News Editor 19 Jul 2007 | SearchOracle.com

Oracle tips, scripts, and expert advice Digg This!     StumbleUpon     Del.icio.us

That's where Oracle's acquisition of security software maker Bharosa Inc. comes in.

Bharosa, which is based in Santa Clara, Calif. and focuses on identity management and fraud prevention, excels at identifying suspicious transactions that occur on a network, and that strength will fill a key hole in Oracle's security lineup, according to experts.

"Bharosa is in the business of providing fraud detection for online transactions," said Andrew Jaquith, an IT security analyst with Boston-based Yankee Group. "The reason you authenticate the transaction is because merely authenticating the user isn't good enough in a lot of cases."

Oracle yesterday revealed plans to buy Bharosa for an undisclosed sum. The company boasts 25 million users and will become Oracle's 32nd acquisition in a multiyear buying spree that included the takeovers of CRM giants PeopleSoft Corp. and Siebel Systems Inc. The deal is expected to close sometime in August.

Bharosa is also the latest in a laundry list of acquisitions meant to shore up Oracle's identity management-related capabilities. Other identity management firms Oracle has purchased include Oblix Inc., Thor Technologies Inc. and OctetString Inc.

"What Oracle has wanted to do is two-fold," said Jaquith. "First, Oracle wants to provide a consistent set of identity frameworks for its own products, because it has a fairly diversified set of e-business products. Secondly, they would like to be a credible provider of identity solutions in their own right, with a full portfolio of offerings."

More on Oracle security: 45 Oracle security fixes released Security guru blasts Oracle's patching policies

The Bharosa deal was announced just one day after Oracle issued fixes for 45 security flaws across its product lines. Many of the flaws could be exploited by attackers without proper usernames and passwords, according to Oracle.

In addition to helping users authenticate the validity of transactions, Bharosa offers the ability to confirm the identity of users who enter networks through mobile devices. The company's list of customers includes several financial services firms such as Wells Fargo & Co., Sterling Financial Corp. and Sky Financial Group.

A competitive buy?

Oracle's Bharosa acquisition may at least in part be a response to IBM, storage giant EMC and other major software vendors who have built up their anti-fraud and identity management portfolios in recent years amid a torrent of high-profile incidents of identity theft.

Analysts say that one of Bharosa's key competitors is EMC's Cyota arm, a provider of online security and anti-fraud products. Cyota was purchased by RSA Security in 2005. Then EMC bought RSA about a year ago.

"[Bharosa] is essentially a competitive acquisition in the sense that you want to have identity plays that enable you to authenticate, but you also want to have a company in your portfolio of products that allows you to gauge the trustworthiness and the relative risk of particular transactions," Jaquith said.

Charles King, principal analyst with Hayward, Calif.-based Pund-IT Research, said recent consolidation in the field of identity management and fraud detection is symptomatic of a larger issue.

"Over the past couple of years there has been a growing recognition that identity management is really a base or a core technology that isn't simply something that you add on anymore," King said. "Larger vendors are really seeing identity management as a key part of many other business processes and applications that they're supporting."

Where Oracle could use an identity management boost

It's unclear where Oracle will focus its identity management efforts next, but Jaquith said he'd like to see the software goliath spend more time working with emerging Internet identity standards such as Windows CardSpace and OpenID.

"I think that's something that they'll probably need to spend a little more energy on," he said, "but whether or not they'll need to do an acquisition is hard to tell."

Tags: Oracle database security,  Oracle aquisitions,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Oracle database security How to enable remote Oracle OS authentication with OS_AUTHENT_PREFIX Oracle delivers database fixes in Critical Patch Update How to use DBMS_CRYPTO package for Oracle password encryption/hashing How to decrypt an Oracle password using John the Ripper and checkpwd How to use the CREATE SESSION command to track Oracle database logins How to troubleshoot Oracle critical patch updates using OPatch Can I automate Oracle patching when installing Oracle Standard Edition? Is it possible to automate Oracle CPUs for a DoD project? Three steps to help improve Oracle database security Tips for auditing and securing database backups in Oracle Oracle aquisitions Oracle reportedly offers EC a MySQL compromise in Oracle-Sun deal Timeline: Following the Oracle-European Commission trail Oracle and the European Commission state their cases Guide to Oracle's virtualization strategy Ellison and McNealy stage OpenWorld lovefest In the Oracle vs. SAP life sciences battle, Oracle gains a healthy lead Oracle-Sun deal faces more questions from the EU Oracle gets the green light from the DOJ for Sun acquisition Oracle's Primavera PPM software plans to be showcased at OpenWorld Oracle's Top 5 stories in 2009 (so far)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary