2 cissp ® Official Study Guide Eighth Edition

Java Applets Java
is a platform-independent programming language developed by Sun 
Microsystems (now owned by Oracle). Java is largely superseded by modern applications, 
and it is no longer supported directly in most browsers. However, you should still have 
a basic understand of Java as it may still be in use internally or supported in the specific 
browser implemented by your organization. While modern web design has moved away 
from Java, this does not mean Java has been scrubbed off the internet. Most programming 
languages use compilers that produce applications custom-tailored to run under a specific 
operating system. This requires the use of multiple compilers to produce different versions 
of a single application for each platform it must support. Java overcomes this limitation by 
inserting the 
Java Virtual Machine (JVM)
into the picture. Each system that runs Java code 
downloads the version of the JVM supported by its operating system. The JVM then takes 
the Java code and translates it into a format executable by that specific system. The great 
benefit of this arrangement is that code can be shared between operating systems without 
modification. Java applets are simply short Java programs transmitted over the internet to 
perform operations on a remote system.
Security was of paramount concern during the design of the Java platform, and Sun’s devel-
opment team created the “sandbox” concept to place privilege restrictions on Java code. 
The sandbox isolates Java code objects from the rest of the operating system and enforces 
strict rules about the resources those objects can access. For example, the sandbox would 
prohibit a Java applet from retrieving information from areas of memory not specifically 

---

344
Chapter 9 
■
Security Vulnerabilities, Threats, and Countermeasures
allocated to it, preventing the applet from stealing that information. Unfortunately, while 
sandboxing reduces the forms of malicious events that can be launched via Java, there are 
still plenty of other vulnerabilities that have been widely exploited.