Met launches multi-agency operation to tackle rou... » The Metropolitan Police is today, 29 August, targeting begging and rough-sleeping hotspots across Lo... NaviSite launches two additional UK Cloud Nodes » LONDON: NaviSite Europe Limited, a Time Warner Cable has announced that they have launched two new N... Tech Trailblazers Awards announce "Firestarter" bu... » London, UK: Tech Trailblazers Awards has announced a new bursary for early stage non VC backed start... Varonis keeps Emerson Industrial Automation secu... » Varonis Systems, Inc. has explained how its product suite has helped Emerson Industrial Automation r... Lieberman Software hits the ground running in Euro... » Privilege management expert sees huge success in European market after only six months London, UK: ... Guardian24’s lone worker safety app released on ... » Guardian24, the UK’s lone worker supplier of the year, has announced the release of their lone worke... Free-of-charge white paper informs about the ris... » London: Wherever secure transactions or network access are required, the person requesting access fi... KAICIID joins call by the global community to end ... » In northern Iraq, brutal violence has led to the murder of thousands of innocent civilians. Many rel... Former Army Air Corps pilot helps limbless veteran... » The Gazelle Military Helicopter Trust has been set up to restore Gazelle helicopters that have been ... Best Use of Stop and Search scheme » The Metropolitan Police Service [MPS] welcomes today's further announcement by the Home Secretary re...

CLICK HERE TO

Viewpoints Header

In response to the news that Oracle has carried out an emergency security update on Java, Lamar Bailey, Director of Security Research and Development at nCircle has the following comments:

 

Here we go yet again. 2013 has seen a surge of critical vulnerabilities in IE, Java and Ruby on Rails. Attackers are targeting cross platform applications to try to obtain access to as many systems as possible using as few exploits as possible.

Oracle has taken a beating this year on Java. It is good to see they are fixing critical vulnerabilities in a code base they want to quit updating but it is past time for them to get serious and do a deep dive on Java to fix the security issues.

I have always thought Oracle did a good job of securing their products but I am losing some of my faith in them with the rash of Java vulnerabilities. I hope these security problems are not found in their other products. My advice to end users is to remove Java from your system and only install it when is needed to access a business critical application, then if possible run Java in a VM or an isolated environment. This is easier said than done as my Windows box had no less that 4 Java versions with various updates. I hope Oracle will assign a team of their best security engineers to Java to squash any of the remaining security issues. Until then many users will be updating Java as often as they update AV signatures.