Data protection veteran is backup, recovered and... » LEEDS, UK: Data protection expert and industry veteran Simon Chappell has announced the launch of As... CNL Software expands Americas Operations » CNL Software has announced that it has expanded its U.S. operations with the opening of its new Regi... Mirantis & Openwave Mobility collaborate on Subs... » REDWOOD CITY, Calif: Openwave Mobility has announced a collaboration with Mirantis, the pure play Op... AV-TEST: Secucloud Mobile Security App named as ... » Hamburg, Germany: People now use their smartphone to access the internet more than any other device ... vCPE technology will create a “win-win” situatio... » LONDON: Enterprises demand is one of the key driving factors for cloud applications, but businesses ... BeyondTrust CEO, Kevin Hickey, elected to Arizona ... » PHOENIX: BeyondTrust has announced that its president and CEO, Kevin Hickey, has been elected to the... Digital brings fresh challenges for three quarte... » Distributed IT, shadow IT departments and data security risks are the big issues as businesses world... Greenwave Systems: “The Internet of Things is no... » London, UK: Learning from the past, taking security seriously and protecting the consumer must be at... First of the UK’s new nuclear deterrent subma... » Defence Secretary Michael Fallon  yesterday announced that, to mark Trafalgar Day, Her Majesty the Q... Pulse Secure launches promotion to simplify movi... » SAN JOSE, CALIF.: Pulse Secure has announced “Secure Access NOW” - a major new upgrade program to he...


Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:


Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.