How to mitigate Java Virtual Machine risks

Mitigation options
After you understand the level at which you’ve become dependent on the Microsoft VM, you have several options for mitigation. The first, and most commonly adopted solution, will be to move off the Microsoft VM and onto another company’s Java VM. Companies that are heavy adopters of Java and J2EE technologies have probably already chosen a non-Microsoft VM and used that VM in their production applications. But many companies that use both Microsoft and J2EE technologies may have chosen to stay with the Microsoft VM. They'll now need to look at mitigation strategies that may include the replacement of the Microsoft VM with another company’s VM. The other mitigation strategies involve removing the dependence on any version of the Java VM.

For client applications that rely on Java applets, you have two options for removing the Java dependency. First, rather than using Java applet technology, companies can use alternate technologies like DHTML, Macromedia Flash, or other client rendering technologies. Second, Microsoft has released the beta version of its J# browser controls (JBC), which allow companies to migrate existing applet code to J#.Net and run the client-side applications using the .Net Framework instead of the JVM. Of course, for either of these options, you’d have to have access to the Java source code to effectively migrate the client functionality.

If you don’t have access to the source code, you can at least mitigate some of the client security risks by using the security zones features of Internet Explorer. This feature will allow you to limit the use of the Microsoft VM to specific sites and keep general Internet sites from accessing, and potentially abusing, the Microsoft VM. If you anticipate using Java on the client for the long term, consider either migrating the code to another technology or replacing the Microsoft VM with another vendor’s JVM.

Most companies that have implemented J2EE and Java technologies on the server have already chosen to use the JVM recommended by their server tools vendor. If you have used the Microsoft VM in a server installation in your environment, you should either move the application to a different JVM or migrate the application from Java to .Net using Visual Studio, depending on your company's chosen technology direction.