Wargames - Java vulnerabilities and why you should care by Gerrit Grunwald

Security

Java vulnerabilities are widespread and often overlooked. Learn how to identify and mitigate them effectively.

Key takeaways
  • Java vulnerabilities are widespread and often go unnoticed.
  • Developers should automate the application packaging process using J-Link.
  • Java release cycle is important for security, with updates every 6 months.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use the latest secure version of Java and its components.
  • The JVM (Java Virtual Machine) has an API that can be used to attach a Java agent for security testing.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube, to identify vulnerabilities.
  • The software supply chain is a common target for attacks, and developers should prioritize security.
  • Developers should use a secure coding practice, such as jailing, to ensure the security of their code.
  • Developers should use a secure version of Java and its components.
  • Developers should use a vulnerability scanner, such as Snyk or SonarCube

More talks

Bootiful Spring Boot by Josh Long

Process Injection: Breaking All macOS Security Layers With a Single Vulnerability

Say Vulnerabilities One More Time - Ending Open Source Security Fatigue - Alyssa Miller

Open Q&A: Bring Your Challenge to Blockchain | Lucy Hedges | #LDNBlockchain23

Khronos APIs for Heterogeneous Compute and Safety: SYCL and SYCL SC - CppCon 2023

"Formally Verifying Everybody's Cryptography" by Mike Dodds, Joey Dodds (Strange Loop 2022)

The Hacker's Guide to JWT Security - Patrycja Wegrzynowicz

Frameworkless – The New Black? | Carsten Windler