During the recent kerfuffle over yet another Java zero-day vulnerability, I saw that Carnegie Mellon CERT advised everyone to disable the Java browser plug-in. However, there are users at my company that need Java outside the browser setting. Will just disabling the browser plug-in ensure Java is secure otherwise? If we roll back to an old version of Java, would it be safe to keep the plug-in installed?
Ask the Expert!
SearchSecurity expert Nick Lewis is standing by to answer your questions about enterprise security threats. Submit your question via email. (All questions are anonymous.)
The Java Runtime Environment (JRE) has taken a beating over the last several years. The numerous security problems with Java have led some security-conscious organizations to weigh the risks of installing the JRE against the benefits, and even consider uninstalling Java altogether.
Enterprises without an extremely compelling reason to use Java should not install the Java plug-in or JRE, as they should not install any software that isn't required by the business. If only the JRE is required, but not the browser plug-in, the JRE should be disabled in all Web browsers on the system. If the JRE and browser plug-in are installed, they should be updated as quickly as possible if they aren't set to auto-update. If the JRE is required to run an enterprise application, the JRE and application could be remotely published to the desktop or set up in a virtual environment. This could allow an enterprise to not install Java on client systems, but still have the basic functionality.
Enterprises that require the JRE should follow CERT's advice on using a network device, like a Web proxy, to selectively allow Java applets. This will help protect client systems regardless of the Web browser settings. Enterprises that require Java applets could potentially configure systems to only run a Java applet when specifically executed on the local system, or could use NoScript to control Java applets. Enterprises could also use a virtual machine for Web browsing when requiring the JRE or a virtualized Web browser (software that runs a Web browser in a virtual machine or sandbox) to limit the risk from a malicious Java applet. However, the management overhead for all of these options should be carefully weighed against the risk posed by a compromised endpoint, given the ever-increasing cost of managing client systems.
This was first published in July 2013