Java 7 update 10 lets users restrict Java apps in browsers
Java users can now block Web-based Java content completely or enforce strict restrictions for it
IDG News Service - A recent Java 7 update allows users to completely prevent Java applications from running inside browsers or to restrict how Web-based Java content is handled by the Java Runtime Environment (JRE) client. These features will benefit security-conscious users, but companies still have to find methods of isolating older Java versions, security experts say.
Java 7 Update 10 (7u10), released on Dec. 11, does not address any security vulnerabilities, but provides several security enhancements. According to its release notes, the new version provides users with "the ability to disable any Java application from running in the browser." This can be done from the "Security" tab on the Java control panel by clearing the "enable Java content in the browser" checkbox.
Security experts have long advised users to remove the Java plug-in from their Web browsers in order to protect themselves from the increasingly prevalent Web-based attacks that exploit Java vulnerabilities to infect computers with malware. However, in order to follow this advice users had to remove the plug-in from all of their browsers one by one and were often forced to redo the process after installing new Java updates.
Java 7u10 seems to make things easier by providing users with a central and persistent option for controlling Web-based Java content regardless of how many browsers they use. In addition, the new Java version provides users who can't afford to completely block such content with a method of controlling how potentially dangerous applets are handled.
Starting with Java 7u10 users have to ability to set security levels from low to very high for Web-based Java content, with medium being the default option. The medium security level will allow unsigned Java apps to run, but only if the Java version is considered secure. "You will be prompted if an unsigned app requests to run on an old version of Java," Oracle said in the tech notes for the new control panel security options.
Setting the security level to very high will prompt the user for permission every time a Java app, signed or unsigned, attempts to run in the browser. If the Java version is deemed insecure, unsigned apps won't run at all, regardless of what the user decides.
"The Security Level setting affects unsigned plug-in applets, Java Web Start applications, embedded JavaFX applications, and access to the native deployment toolkit plugins," Oracle said.
In addition, Java 7u10 introduces new dialogs that warn users when the installed JRE version is insecure and needs to be updated.
These changes don't make Java more secure in itself, but will likely make it easier for users to make their PCs more secure because they allow users to manage certain restrictions, Thomas Kristensen, chief security officer at vulnerability research and management firm Secunia, said Tuesday via email. However, in order for the majority of users to be protected, Oracle needs to set the new options in a restrictive way by default, because most users won't understand or know about the new restrictions, he said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- The Critical Role of Support in Your Enterprise Mobility Management Strategy Most business leaders underestimate the importance of tech support when they choose an EMM solution. Here's what to put on your checklist.
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,...
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the... All Applications White Papers | Webcasts