User:Tqbf/Mary Ann Davidson

Mary Ann Davidson is the Chief Security Officer of Oracle Corporation, the second largest software company in the world. Her outspoken views regarding software security and role as security spokesperson for a leading database product have made hers an important voice among computer security practitioners. She has testified on Oracle's behalf before congress, and is routinely cited in industry and business publications.

Early life
Mary Ann Davidson was raised in a Naval tradition. Her father, a veteran of World War II and Korea, was the academic dean at the US Naval Academy. Davidson attended the Severn School, a preperatory high school for the Naval Academy, graduating in 1976. After obtaining a Bachelors in Mechanical Engineering from the University of Virginia, she was directly commissioned into the US Navy Civil Engineering Corps, eventually joining her sister Diane in a Reserve Naval Mobile Construction Battalion, an unusual assignment for a woman at the time. During her service she was awarded the Navy Achievement Medal.

Davidson left the US Navy to work at Oracle Corporation in 1988, and later obtained an MBA from the Wharton School at the University of Pennsylvania.

Security at Oracle
Davidson's public involvement in computer security dates to the mid-1990's, when she contributed to Usenet and the RISKS Digest as a manager in Oracle's Security Product Management business unit. By 2001, 13 years into her career at Oracle, she had been promoted to director in that business unit. Her function in these roles primarily involved advocacy for information security inside of Oracle and to customers.

Testimony before Congress
In November of 2001, Davidson was invited to appear before the US House Subcommittee on Commerce, Trade, and Consumer Protection, alongside executives from SAIC, Internet Security Systems, EDS, and Microsoft.

In her testimony, she argued that following September 11, information systems posed as an attractive target for terrorist attacks. She asserted that commercial enterprises were still "catching up" to the U.S. Government in security awareness, and that enterprises needed reliably third-party standards for security in order to make better purchasing decisions.

She entreated technology vendors to "think like hackers", and, in questioning, admitted that she didn't "think you can ever be 100 percent sure and there is no bullet proof security". Perhaps in contrast to statements she would make later in her career at Oracle, she lauded security researchers, claiming "98 percent of the people that we deal with are inquisitive, talented and [...] really want to test something".

Chief Security Officer
In December of 2001, in the wake of Oracle CEO Larry Ellison's infamous claim that the Oracle database was "Unbreakable", Davidson was named Chief Security Officer of Oracle Corporation, serving as Oracle's official security spokesperson and managing product security assessments and incident response.

Davidson immediately set about mitigating the brashness of Ellison's claim. She wrote in a white paper that "Unbreakable" stood for a process and not a guarantee. Later, she told the trade press that her first reaction to Oracle's marketing claim was, "What idiot dreamed this up?".

Regardless, Oracle's timing had been inopportune. In the midst of a rennaisance in vulnerability research (coinciding with the refinement of heap and integer overflows) and drastically increased attention to the security of enterprise technology, Oracle was targeted by security researchers. The subsequent discovery of numerous Oracle vulnerabilities led to the company being harshly criticized by security practitioners and pundits.

Davidson has since become an advocate for software security. This principle, pioneered by Microsoft with the Security Development Life Cycle (SDLC), argues that information security problems are best solved by improving the quality of vendor code, rather than by application of after-market security countermeasures. In particular, Davidson is a proponent of source code security scanners in general, and Fortify Software in particular; her public statements on Fortify's behalf constituted a notable early success for the source code scanning market.

Though not unusual for CSO's in the Fortune 500 at large, Davidson's lack of formal training in technology stands out among CSO's for major technology companies; her peers include former software developer John Stewart, CSO of Cisco Systems, computer forensics expert Howard Schmidt, former CSO of Microsoft, and famed cryptographer Whitfield Diffie, CSO of Sun Microsystems.

Controversy
Though her early career at Oracle seems marked by tolerance and appreciation for independent vulnerability research, her attitudes towards security research, and particularly full disclosure, seem to have hardened after her promotion to CSO. At conferences, she has sharply criticized latter-day security research practices, for instance referring to vulnerability markets as "morally reprehensible".

During her tenure, Oracle's has weathered a turbulent engagement with the security research community. Davidson was publically ridiculed by David Litchfield, a notable vulnerability researcher whose company, Next Generation Security, had business relationships both with Oracle and Microsoft's SQL Server product team. In a widely-cited Bugtraq posting, picked up by the mainstream trade press, Litchfield called on Oracle to replace Davidson, pointing to a series of delayed or ineffective security patches in Oracle's database server as evidence of "categorical failure".

Davidson and Oracle have since attempted to mend fences with the research community, an effort that may paid off; Litchfield has since written more positively about Oracle, even going so far as to congratulate Davidson for "turning around" Oracle's "lumbering stegosaurus".

Personal life
Davidson is an avid surfer and skiier. She divides her time between Ketchum, Idaho and San Francisco, California. She is a student of languages, including Hebrew, Classical Greek, and Hawaiian, and of military history (reporting on her blog that she consumes one book of military history every week).