RE: DB2 has fairly large # of vulnerabilities in latest SQL 2014 brochure

Well they have a robust security lifecycle plan that's been in place for over a decade due to all the flak they got in years past (which people still refer to on this forum).

Search for "Microsoft Security Development Lifecycle" and you get a page here detailing the glory details microsoft goes through in their development process: http://www.microsoft.com/security/sdl/default.aspx

Now search for "IBM Security development lifecycle" in google and the first hit you get is "IBM Product Security Incident Response Process". Which I find hilarious. Apparently they respond to security incidents instead of putting security at the forefront of the development lifecycle :-)

-----Original Message-----
From: John McKee [mailto:jmmckee@xxxxxxxxxxxxxx]
Sent: Tuesday, August 06, 2013 9:29 AM
To: Midrange Systems Technical Discussion
Subject: Re: DB2 has fairly large # of vulnerabilities in latest SQL 2014 brochure

The link heads to Microsoft. Makes me doubt the datasheet immediately. How handy that Microsoft SQL was #1.

John McKee

On Tue, Aug 6, 2013 at 9:06 AM, Matt Olson <Matt.Olson@xxxxxxxx> wrote:

I was looking at the datasheet for SQL 2014 that will be coming out within the next year or so. What I found interesting is they ranked the major databases by vulnerabilities over a 5 year period. Microsoft SQL was #1 with the fewest vulnerabilities, Oracle and DB2 had by far the most vulnerabilities discovered.

http://download.microsoft.com/download/D/7/D/D7D64E12-C8E5-4A8C-A104-C
945C188FA99/SQL_Server_2014_Datasheet.pdf

I'm curious though, I can't seem to find their source of this information on the NIST vulnerability database to corroborate this news.

I'm suspecting that most of this is from DB2 on LUW and not the DB2 for i variety as the LUW version is a bit more mainstream.

Thoughts?

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.