Q

How to avoid security problems with Java outside the browser

Another Java zero-day vulnerability has a security pro asking threats expert Nick Lewis how Java can safely be used with enterprise applications.

During the recent kerfuffle over yet another Java zero-day vulnerability, I saw that Carnegie Mellon CERT advised

everyone to disable the Java browser plug-in. However, there are users at my company that need Java outside the browser setting. Will just disabling the browser plug-in ensure Java is secure otherwise? If we roll back to an old version of Java, would it be safe to keep the plug-in installed?

Ask the Expert!

SearchSecurity expert Nick Lewis is standing by to answer your questions about enterprise security threats. Submit your question via email. (All questions are anonymous.)

The Java Runtime Environment (JRE) has taken a beating over the last several years. The numerous security problems with Java have led some security-conscious organizations to weigh the risks of installing the JRE against the benefits, and even consider uninstalling Java altogether.

Enterprises without an extremely compelling reason to use Java should not install the Java plug-in or JRE, as they should not install any software that isn't required by the business. If only the JRE is required, but not the browser plug-in, the JRE should be disabled in all Web browsers on the system. If the JRE and browser plug-in are installed, they should be updated as quickly as possible if they aren't set to auto-update. If the JRE is required to run an enterprise application, the JRE and application could be remotely published to the desktop or set up in a virtual environment. This could allow an enterprise to not install Java on client systems, but still have the basic functionality.

Enterprises that require the JRE should follow CERT's advice on using a network device, like a Web proxy, to selectively allow Java applets. This will help protect client systems regardless of the Web browser settings. Enterprises that require Java applets could potentially configure systems to only run a Java applet when specifically executed on the local system, or could use NoScript to control Java applets. Enterprises could also use a virtual machine for Web browsing when requiring the JRE or a virtualized Web browser (software that runs a Web browser in a virtual machine or sandbox) to limit the risk from a malicious Java applet. However, the management overhead for all of these options should be carefully weighed against the risk posed by a compromised endpoint, given the ever-increasing cost of managing client systems.

This was first published in July 2013

Dig deeper on Web Application and Web 2.0 Threats

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close