What do you do to minimize the security risks created by Java?
In my experience, two of the greatest risks to system security are Flash and Java. Flash has a pretty central place in web design, as those of use who have used iPads, iPhones and Android 2.1 or earlier are well aware. Hopefully the widespread use of Java will fall off now that Adobe has killed support for development of flash for mobile platforms and HTML5 is on the rise. Java, on the other hand, doesn't seem to be going anywhere and remains a popular vehicle for exploits. What do you do at your company to minimize the risks that are created by using Java?
Answers
Java is a big issue, in my opinion. Browser plug-ins are one of the favorite avenues for cyberattacks, and have been for a long time. Fortunately, both Chrome and Firefox block out of date plug-ins, which definitely helps matters, at least with those two browsers. Of all plug-ins, Java is most often used for exploits, in my experience. Fortunately, there is a good way to minimize the risks of Java: remove Java completely. There is almost no need for it, and most users will never even miss it. If you use Chrome, you can use sandboxing to run Java in a secondary browser if you absolutely have to run it.
BTW, apparently we aren't the only ones concerned about the vulnerabilities created by Java. Mozilla is considering blocking the Java plug-in to help stop SSL attacks.It will be interesting to see if they follow through, and if so, whether there is a reaction from Firefox users.
- Share this answer
- Permalink
Related Questions
Apple's IOS-based devices (iPad, iPhone, and iPod Touch) can't read Adobe Flash, and we would like for our website to be available to...
Ok, so by now we all know Steve Jobs was right about Flash for mobile platforms, even though I didn't believe Adobe would give up on it...
We've seen the demise of Adobe's Flash format for mobile devices and questions about Miscrosoft's Silverlight, and it seems that HTML5...
Another day, another java exploit. A new browser based exploit apparently lets attackers execute arbitrary code on client systems, and...
The US Government's security warning about Java on computers has been widely reported at this point, but I can seem to find what that...
Ask a question
White Papers & Webcasts
White Paper
Bullet-Proof Your Enterprise Linux Environment
White Paper
How to Avoid the High Cost of Security Audits
White Paper
Business Assureance Technology Infographic
See more White Papers | Webcasts
I think it's a good idea to just get rid of both of them if you don't need them. I ranted about flash in a column a while back, and I still think it stinks.
Why Flash Sucks
http://jimlynch.com/en/2010/04/07/why-flash-sucks/
As far as Java goes, good riddance if you can just get rid of it. Neither of these things is really worth bothering with, given the security headaches (among other things).
So if you can remove them from your system(s) then more power to you. You're probably saving yourself a lot of aggravation in the long run.