NaviSite named SVC 2014 Cloud Company of the Yea... » NaviSite takes home the top prize for its work with PMGC Technology Group Ltd. to deliver enterprise... Zylpha adopts Adobe EchoSign as E-Signature Soluti... » Zylpha has adopted Adobe EchoSign, an e-signature solution, that will allow Zylpha customers to incr... €1bn CONTRACT TO DEVELOP CUTTING EDGE RADAR FOR ... » A €1bn (approximately £800m) contract for the development of a new electronic radar system for the E... Game-changing threat intelligence service combin... » London: Complete cybersecurity service provider, SecureData has today launched SecureData GI (Greate... New cellular certification adds to Opengear’s out-... » Sandy, UT: Opengear has announced the addition of the ACM5504-5-GS-I and the ACM5508-2-GS-I remote m... Zertificon's decade of success » Berlin: On its 10th anniversary, IT-Security specialist Zertificon looks back on a successful decade... KREA enhances network capabilities with Claviste... » KREA, Turkey’s largest e-mail marketing company, has enhanced its network capabilities following a d... Patch Tuesday: Adobe update » Yesterday Adobe published the second update (APSB14-26) of Adobe Flash this month, an out of band re... Templar Executives awarded CESG certification fo... » Cyber security specialist Templar Executives has become one of the first organisations to gain accre... NBCS supports calls for collaboration in fight aga... » “We couldn’t agree more with the recent comments made by Georgina Barnard, TP Crime Reduction & Part...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.