During the recent kerfuffle over yet another Java zero-day vulnerability, I saw that Carnegie Mellon CERT advised...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
everyone to disable the Java browser plug-in. However, there are users at my company that need Java outside the browser setting. Will just disabling the browser plug-in ensure Java is secure otherwise? If we roll back to an old version of Java, would it be safe to keep the plug-in installed?
Ask the Expert!
SearchSecurity expert Nick Lewis is standing by to answer your questions about enterprise security threats. Submit your question via email. (All questions are anonymous.)
The Java Runtime Environment (JRE) has taken a beating over the last several years. The numerous security problems with Java have led some security-conscious organizations to weigh the risks of installing the JRE against the benefits, and even consider uninstalling Java altogether.
Enterprises without an extremely compelling reason to use Java should not install the Java plug-in or JRE, as they should not install any software that isn't required by the business. If only the JRE is required, but not the browser plug-in, the JRE should be disabled in all Web browsers on the system. If the JRE and browser plug-in are installed, they should be updated as quickly as possible if they aren't set to auto-update. If the JRE is required to run an enterprise application, the JRE and application could be remotely published to the desktop or set up in a virtual environment. This could allow an enterprise to not install Java on client systems, but still have the basic functionality.
Enterprises that require the JRE should follow CERT's advice on using a network device, like a Web proxy, to selectively allow Java applets. This will help protect client systems regardless of the Web browser settings. Enterprises that require Java applets could potentially configure systems to only run a Java applet when specifically executed on the local system, or could use NoScript to control Java applets. Enterprises could also use a virtual machine for Web browsing when requiring the JRE or a virtualized Web browser (software that runs a Web browser in a virtual machine or sandbox) to limit the risk from a malicious Java applet. However, the management overhead for all of these options should be carefully weighed against the risk posed by a compromised endpoint, given the ever-increasing cost of managing client systems.
Dig Deeper on Web application and API security best practices
Related Q&A from Nick Lewis
Vulnerabilities in Java and Python have opened them up to possible FTP injections. Expert Nick Lewis explains how enterprises can mitigate these ...continue reading
Researchers have developed an ASLR Cache side-channel attack that enables them to eliminate ASLR protections. Expert Nick Lewis explains how ...continue reading
The SQL Slammer worm has re-emerged to attack a vulnerability in Microsoft SQL Server 2000. Expert Nick Lewis explains what enterprises can do to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.