Defence Driven by Understanding the Attacker’s M... » LONDON, UK: MWR InfoSecurity, has confirmed details of its latest service – Countercept, a complete ... Cheshire West & Chester Council use Becrypt tVol... » London, UK: Becrypt has announced that Cheshire West & Chester Council have chosen tVolution Mini to... Secunia and Blue Cube Security announce new partne... » Secunia has signed a Value Added Reseller agreement with specialist reseller Blue Cube Security. The... Ipswitch Network and Server Performance Monitoring... » Denmark: Ipswitch Inc. has announced that its WhatsUp Gold® network and server performance monitorin... LANDESK and WinMagic partner to provide enterpri... » LONDON: LANDESK has announced it has certified and is now reselling WinMagic's suite of SecureDoc pr... How Muhammadu Buhari is camouflaging as the silent... » In the 21st century Nigeria, naivety still pervades its politics: It is shocking and embarrassing t... Enterprises signing up for more than one new cl... » LONDON: European enterprises are adding new cloud services at a rapid rate, finds a new report from ... Police to hold major exercise in central London th... » A major exercise to test the emergency services and Government response to a terrorist attack will b... Most major financial hacks completely covered u... » London, UK: Despite devastating cyber attacks being reported daily in the media, a new survey from L... What Makes Close Protection Unique? » TB Close Protection Operatives have to deal with a wide range of threats that many others who uti...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.