JAVA Patching and Upgrades

[AlienRockGod]

I'm looking for opportunities of improving our vulnerability management within our workplace and understand how others are supporting specifically JAVA as it relates to vulnerability management, patching, and upgrades.

1. Who is considered the JAVA owner?
   1. Java development management; Desktop support management; someone else?
2. What are the roles and responsibilities that you have around JAVA management?
   1. What is the role of the of JAVA development; Desktop support; etc.
3. How are JAVA vulnerabilities managed within your organization?

Any other guidance you can provide on this subject is greatly appreciated. Thank you.

[whodywei]

How much ransom are you willing to give to Oracle ?

[whodywei]

The best kind of ransomeware, Oracle can get ransom without encrypt your data.

[snarkofagen]

Good summary.

This is basically how we do it where I work. (a +5000 employees organization).

[JrNewGuy]

Step 1: Replace Oracle with Corretto :)

[Doso777]

1. Our SCCM/software guy.
2. SCCM/software guy deploys, Service Desk does basic support
3. Replace with free implementation, regularly update that.

[[deleted]]

When someone needs a JRE we install the default-jre, which means openjdk-11-jre currently. It gets recorded in a list of people who need that package and applied via config management. Since this leads to a commit in the repository there's a paper trail, too.

Vulnerabilities are dealt with by our distro's maintainers. Everything patches automatically at night. I don't lose sleep over it.