Skip to main content
Information Security

Return to Question

formatting
Source Link
Polynomial
Polynomial
  • 135.8k
  • 44
  • 309
  • 383

I'm not well versed in technology but have a problem that maybe you experts could answer. WeWe have a software application that supports our laboratory - obviously must be secure. WeWe want to be able to have outside parties interact with the application through a webmodule that we bought for the application. HoweverHowever our IT folks are concerned because the application currently needs Java 1.6 on the server - and they cite many security vulnerabilities. TheThe vendor indicates they haven't completed testing for any future versions of Java. This

This application is in use in many large hospital systems, so finding it hard to believe that vendor wouldn't have addressed this somehow. Its causing some contention and we users are stuck in the middle. Can

Can someone help me understand - in lay terms if possible - 1) Is this is a concern? 2) What questions do I ask of the vendor to determine our specific vulnerability - ie. if they keep our system updated with critical patches, etc? 3) Is the only recourse to insist that the vendor move to 1.8 before we create access into our network from outside entities? 4) Is it true that 1.6 is at end of life and therefore no more security patches are generated? Not:

  1. Is this is a concern?
  2. What questions do I ask of the vendor to determine our specific vulnerability - e.g. if they keep our system updated with critical patches, etc?
  3. Is the only recourse to insist that the vendor move to 1.8 before we create access into our network from outside entities?
  4. Is it true that 1.6 is at end of life and therefore no more security patches are generated?

Not sure where to begin or who to believe about this... Thank you!

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to have outside parties interact with the application through a webmodule that we bought for the application. However our IT folks are concerned because the application currently needs Java 1.6 on the server - and they cite many security vulnerabilities. The vendor indicates they haven't completed testing for any future versions of Java. This application is in use in many large hospital systems, so finding it hard to believe that vendor wouldn't have addressed this somehow. Its causing some contention and we users are stuck in the middle. Can someone help me understand - in lay terms if possible - 1) Is this is a concern? 2) What questions do I ask of the vendor to determine our specific vulnerability - ie. if they keep our system updated with critical patches, etc? 3) Is the only recourse to insist that the vendor move to 1.8 before we create access into our network from outside entities? 4) Is it true that 1.6 is at end of life and therefore no more security patches are generated? Not sure where to begin or who to believe about this... Thank you!

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to have outside parties interact with the application through a webmodule that we bought for the application. However our IT folks are concerned because the application currently needs Java 1.6 on the server - and they cite many security vulnerabilities. The vendor indicates they haven't completed testing for any future versions of Java.

This application is in use in many large hospital systems, so finding it hard to believe that vendor wouldn't have addressed this somehow. Its causing some contention and we users are stuck in the middle.

Can someone help me understand - in lay terms if possible:

  1. Is this is a concern?
  2. What questions do I ask of the vendor to determine our specific vulnerability - e.g. if they keep our system updated with critical patches, etc?
  3. Is the only recourse to insist that the vendor move to 1.8 before we create access into our network from outside entities?
  4. Is it true that 1.6 is at end of life and therefore no more security patches are generated?

Not sure where to begin or who to believe about this... Thank you!

Source Link
Bonnie Parker
Bonnie Parker
  • 31
  • 2

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to have outside parties interact with the application through a webmodule that we bought for the application. However our IT folks are concerned because the application currently needs Java 1.6 on the server - and they cite many security vulnerabilities. The vendor indicates they haven't completed testing for any future versions of Java. This application is in use in many large hospital systems, so finding it hard to believe that vendor wouldn't have addressed this somehow. Its causing some contention and we users are stuck in the middle. Can someone help me understand - in lay terms if possible - 1) Is this is a concern? 2) What questions do I ask of the vendor to determine our specific vulnerability - ie. if they keep our system updated with critical patches, etc? 3) Is the only recourse to insist that the vendor move to 1.8 before we create access into our network from outside entities? 4) Is it true that 1.6 is at end of life and therefore no more security patches are generated? Not sure where to begin or who to believe about this... Thank you!