Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start to update Java the software is causing problems and will not start but you need this software essentially so there is no way around this problem.

What can you do to leverage this lack of Java updates? Usually those machines tend to get infected by multiple malware based on Java (e.g. sopiuhdu243.class). All those files are located withn Java's Cache. What can I do now beside Java Update or not using Java at all which is not an option at the moment. I hope someone of you outside has more experience with problems like this.

share|improve this question
1  
Do you need Java in the browser? You can disable that if you don't. –  derobert Apr 24 '13 at 15:23
    
that is quite a good point. thank you! :-) –  vlad Apr 26 '13 at 6:25
add comment

3 Answers

up vote 5 down vote accepted

It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections.

See the JAVA documentation:

Very High: You are prompted to accept apps that are signed with a trusted certificate. All other apps are not allowed to run. If the JRE is below the security baseline, you are given an option to update.

share|improve this answer
    
true. thank you for this advice. i will try to figure out how to enable those security enhancements. –  vlad Apr 22 '13 at 21:14
add comment

This is an all too common scenario within the corporate world. I have to deal with exactly this problem and it isn't easy. The apps are business critical and cannot be replaced (last replacement implementation project came in at $15 million). There are firewalls and other layers of protection, but these are PCs used by staff who will also surf the web and could easily connect to a site with malicious java based applets.

All you can do is try to implement some controls to reduce the risk. As suggested, whitelists and java security policies can help. However, don't overlook education. Run an information campaign that informs your users about the security threats, how to spot them and what to do should they suspect they have possible been compromised. Ensure people feel OK about putting their hand up and saying "I think I may have made a mistake....". Use intrusion detection, log analysis and network monitoring techniques to alert you to problems sooner rather than later. Above all, assess your users and identify the risk profiles so that ou know where you are most exposed and where you need the stronger controls and review regularly.

finally, ignore any advice which talks in absolute terms, There are NO absolutes in IT security. You are not definitely screwed nor are you definitely protected. The threat differs depending on who and where you are and what value you represent. What you do to protect yourself should be a reflection of the threat exposure.

Of course, in my perfect world, the three amigos (Java, Flash and IE) just don't exist and all my users have perfect awareness!

share|improve this answer
    
Grea answer. I will try doing my best on this. But the simple: deactivate it in browser, would maybe help a lot. Thank you very much –  vlad Apr 27 '13 at 6:52
add comment

Are the machines internet facing? If it is, you are screwed.

If the machines are not internet facing, keeping them behind a firewall with very strict access conditions might reduce the possible attack surface enough.

There is no true alternative to simply patching or removing Java though.

share|improve this answer
    
they are not facing the internet. all behind restrictive firewalls. –  vlad Apr 22 '13 at 13:34
    
@vlad How are the machines getting infected? –  Terry Chia Apr 22 '13 at 13:38
    
I guess by simple surfing. there are so many websites hijacked which simply use exploits in old Java versions. –  vlad Apr 22 '13 at 14:06
    
@vlad Ah see, "have a bunch of computers which need Java for some important software..." and "simple surfing" just isn't matching up. You shouldn't be allowing people to surf the internet from unpatched machines running important software... –  Terry Chia Apr 22 '13 at 14:08
    
Well this is true but I am sure that this would lead to even more problems. Isn't there any other way around which just gives me a little bit time? –  vlad Apr 22 '13 at 14:11
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.