Page 583 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

system that runs Java code downloads the version of the JVM
supported by its operating system. The JVM then takes the Java code

and translates it into a format executable by that specific system. The
great benefit of this arrangement is that code can be shared between
operating systems without modification. Java applets are simply short
Java programs transmitted over the internet to perform operations on
a remote system.

Security was of paramount concern during the design of the Java

platform, and Sun’s development team created the “sandbox” concept
to place privilege restrictions on Java code. The sandbox isolates Java
code objects from the rest of the operating system and enforces strict
rules about the resources those objects can access. For example, the
sandbox would prohibit a Java applet from retrieving information
from areas of memory not specifically allocated to it, preventing the
applet from stealing that information. Unfortunately, while
sandboxing reduces the forms of malicious events that can be

launched via Java, there are still plenty of other vulnerabilities that
have been widely exploited.

ActiveX Controls ActiveX controls were Microsoft’s answer to Sun’s
Java applets. They operate in a similar fashion, but they are
implemented using a variety of languages, including Visual Basic, C,
C++, and Java. There are two key distinctions between Java applets

and ActiveX controls. First, ActiveX controls use proprietary Microsoft
technology and, therefore, can execute only on systems running
Microsoft browsers. Second, ActiveX controls are not subject to the
sandbox restrictions placed on Java applets. They have full access to
the Windows operating environment and can perform a number of
privileged actions. Therefore, you must take special precautions when

deciding which ActiveX controls to download and execute. Some
security administrators have taken the somewhat harsh position of
prohibiting the download of any ActiveX content from all but a select
handful of trusted sites.

ActiveX is still supported by Internet Explorer 11, but Microsoft’s latest
browser, Edge, released with Windows 10, does not include support
for ActiveX. This signals that Microsoft is phasing out ActiveX.