Lame Review?

Russell Kay's review of our CD-ROM, "Java Security: Managing the Risks" (April Bits), accuses us of offering lame advice to Java users concerned about security. The review is a prime example of the sort of treatment that security experts can expect from Java bandwagoneers. Our bottom line is not, as the review implied, to turn Java off, but to manage your risks: Educate yourself about the dangers of executable content, determine what (if anything) you have to lose, and set up an appropriate security policy. Unfortunately, there's no magic solution to Java security. If you have nothing to lose, you can surf with impunity. But if information is the lifeblood of your business, you had better think twice about surfing to unknown sites with a Java-enabled browser on a mission-critical machine.

Security is rarely an all-or-nothing proposition. You must decide for yourself ho w much risk you're willing to live with.

Authors, "Java Security: Managing the Risks"

I commend the authors' attitude about managing risks; I've been waving that flag in various IS camps for years. But the problem, in my view, is that the solutions they propose aren't workable in the real world. To "think twice about surfing to unknown sites with a Java-enabled browser" is fine as a philosophical perspective, but you can't get much work done that way. When did you last use a Web browser for more than a minute or so and not visit an unknown Web site? To reap the advantages of Java, you have to understand and accept some security exposures, which the authors make clear. But what IS administrators need from security policy and security tools is more than an Off switch and a warning label. This isn't a bad CD-ROM publication. But I think there's a better one that could have been.--Russell Kay, technical editor