Gartner names proofpoint a leader in 2014 Magic ... » London, UK: Proofpoint, Inc. has been positioned by Gartner, Inc. in the leaders quadrant of the 201... Tenable's Nessus v6 Eliminates cybersecurity blind... » COLUMBIA, Md./LONDON, UK: Tenable Network Security, Inc. has announced the release of Nessus® v6, re... New German heavy tanks bring serious firepower i... » Wargaming announced today the launch of the latest content update for its free-to-play console multi... Babcock to run Defence Support Group » The Ministry of Defence (MOD) has today announced the preferred bidder for the Defence Support Group... Free white paper explains how network access can... » London: According to the International Telecommunication Union (ITU), there are now as many mobile p... Kroll Ontrack published list of worst data disaste... » EPSOM: Kroll Ontrack announced its 12th annual list of the top 10 data disasters from 2014. For the ... UPnP Forum invites organizations to use UPnP+ Cert... » UPnP Forum has launched its UPnP+ Certification level for improved device and open source implementa... CNL Software to present PSIM at Teleste Video Su... » CNL Software will be participating in the Teleste Video Surveillance Summit in Dubai on December 7, ... ExtraHop integrates with FireEye to defend against... » LAS VEGAS, NV: ExtraHop has announced an integration of the ExtraHop wire data analytics platform wi... New technology helps financial institutions mana... » Pole Star launches PurpleTRAC risk management and sanctions compliance technology enabling global fi...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.