ExtraHop accelerates into 2017 with new SVP of mar... » SEATTLE: ExtraHop has announced that Bryce Hein has joined the company as SVP of Marketing and will ... Opengear deal with Hardware Group extends European... » Piscataway, NJ: Opengear has announced a new distribution agreement with Hardware Group serving chan... Veracity delivers essential data paper at the San ... » Prestwick: Veracity takes a leading slot in delivering a Paper explaining the critical differences w... Veracity to showcase expanded portfolio at Inters... » Prestwick: Veracity reflects its significant growth in the Middle East by announcing an enlarged com... IPSecurityCenter to help protect citizens at the... » CNL Software has announced that its award-winning technology will be utilized as part of the multi-a... Pulse Secure certified for U.S. Department of Defe... » SAN JOSE, CALIF: Pulse Secure has announced that Pulse Connect Secure 8.2 and Pulse Policy Secure 5.... ExtraHop predicts 2017 trends in IT, security an... » UK: ExtraHop has announced its top predictions for enterprise IT in 2017. Based on insight from cust... VTech takeover: Snom stays Snom » Berlin: Now being part of VTech, leading manufacturer of professional business IP phones, Snom Techn... Secure I.T. Environments delivers challenging Da... » London UK: Secure I.T. Environments Ltd has announced the completion of a new internal data centre f... TDSi’s new GARDiS range grabbed visitors' attent... » Poole: Integrated security manufacturer TDSi’s new range of GARDiS software was the star attraction ...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.