Network Utilities becomes first UK Pulse Secure NA... » UK: Pulse Secure  has announced Network Utilities (Systems) Ltd as the first Secure Premier partner ... SentinelOne Establishes $1 million cyber threat ... » PALO ALTO, CA: SentinelOne has announced a cyber threat protection guarantee to provide customers wi... New study reveals software pricing and licensing t... » Maidenhead, UK: The enterprise software marketplace is undergoing a massive transformation as the pr... 380 MOBOTIX Outdoor Cameras installed at ancient R... » Langmeil, Germany:  Pompeii is the world-famous ancient Roman city near modern Naples which may rece... LOCKEN extends frontiers of access control beyond ... » As the digital era continues to evolve businesses are increasingly looking to expand access control ... Liverpool to host Armed Forces Day 2017 » The ninth annual Armed Forces Day, honouring the work and dedication of our brave Servicemen and w... OF FOOLS OF THE MIDDLE BELT, ONE NORTH AND PASTORA... » PART FIVE A treatise on pastoral jihadism, islamism, arabism and cultural imperialism in Nigeria ... Dimension data helps police keep Tour de Yorkshi... » Tracking and data technology on police cars, motorcycles, and vans helped lead, surround, and follow... Al Murabit Security Services first Iraqi company... » Baghdad: Al Murabit Security Services (“AMS”) and its sister company Al Thaware Security Services (“... Optex Systems locks in $518,000 shipment to Brazil » RICHARDSON, TX: Optex Systems, Inc. has announced that it has completed its first shipments of its p...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.