NICC Sets new requirements for Customer Line Ident... » London: NICC, the UK’s technical forum for telecommunications, has published its updated specificati... First all-amputee team set record with English Cha... » Four Blesma Members have become the first all-amputee team to successfully swim the English Channel.... World of tanks to get race mode » Wargaming has announced the addition of Tank Rally mode to its free-to-play online action game World... Alert Logic launches UK Data Centre » London, UK: Alert Logic has completed its European Data Centre and now available for partners and cu... 20th Anniversary of VAWA: "...the decency of the A... » JB...advancing Bidenism with respect to womenfolks Watch the Video: www.youtube.com/embed/HpL-A6Z... Lord-Lieutenant of Hampshire presents Sonardyne wi... » Lord-Lieutenant of Hampshire presents Sonardyne with Queen’s Award for 6G Sonardyne International L... Rehousing TYphoon Aircraft of Number 1 (Fighter) ... » The Rt Hon Michael Fallon MP, UK Secretary of State for Defence The Typhoon aircraft of Number 1(Fi... Peplink signs distribution agreement with 4Gon » Wireless connectivity innovator and specialist wireless technology distributor form partnership UK:... Independent Scotland: Naked and Alone as UK Counte... » In the great debate on Scottish independence, little has been said by either side as to how a ‘yes’ ... Foundry in Nigeria: Investment Opportunities, Chal... » Introduction For the interest of the uninitiated and to further appreciate the subject, a definitio...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.