Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

According to US CERT TA13-010A, all computer users are advised to disable Java 1.7 in their browser due to arbitrary code execution risks from a zero-day Java vulnerability; however, we rely on internal Java apps for our business-critical services.

How can we protect corporate network from external malicious threats, while still permitting our internal Java apps to function? Preferably, we would like to disable Java through our Cisco ASA firewall...

share|improve this question

1 Answer 1

up vote 1 down vote accepted

We decided to use the ASA's filter java command, which blocks all (non-SSL) java applications sent to our internal network block (10.0.0.0/8) on any port (1-65535).

filter java 1-65535 10.0.0.0 255.0.0.0 0.0.0.0 0.0.0.0

While we would love to block Java delivered via SSL, this measure seems to be the most reasonable tradeoff, since we can't afford to completely disable Java and tank our internal apps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.