Newcastle City Council mitigates security risks of unsupported Java

Newcastle City Council (NCC) said it has remediated more than 80 percent of its IT vulnerabilities caused by unsupported Java software by implementing Azul.

Azul Platform Core, an OpenJDK-based alternative to Oracle Java, addresses critical security vulnerabilities in Java-based applications. It said it has remediated more than 80 percent of the council’s IT vulnerabilities overall, with no disruption to its essential municipal services or impact on performance.

NCC provides services to more than 300,000 residents of Newcastle. Critical applications such as financial management, housing and benefits run on Java version 8.

But in 2019, Oracle changed how it licensed and priced licensing and support for Java 8 and, as a result, NCC lost access to free quarterly security patches. When NCC security audits began flagging the Java runtime (JDK) as a major concern, the council said it needed commercial support to access security patches for its older versions of Java. It also needed to be able to address the vulnerabilities without disrupting its essential Java-based business applications and systems used daily by approximately 1,100 employees.

Full support of Java application estate and critical patch updates

NCC explored several options to address the need for more secure Java applications, including migrating away from Java completely. However, this move would have launched a year-long, prohibitively expensive process, creating unacceptable downtime for the government body. It also looked at moving to a free distribution of OpenJDK, but it needed full support for its Java estate to ensure security and stability.

With Azul, NCC received a one-for-one equivalent to a commercial support subscription from Oracle, including Critical Patch Updates (CPUs) that allowed IT to immediately deploy security fixes in production.

With Azul, the council could continue to safely use its older versions of Java without needing to upgrade to newer releases. This transition also fortified the security of its Java environment across 5,000 desktops, and ensured that its systems remained robust, efficient and compliant with the UK’s Public Services Network (PSN) requirements.

“Through our strategic partnership with Azul, we significantly reduced our security risk level with our Java applications and Java-based infrastructure, which certainly helps me sleep better at night,” said Jenny Nelson, the council’s head of ICT & Digital. “In addition, the benefits of switching to Azul Platform Core as our JVM are clear. Our Java estate is now consistent, standardised, easier to maintain, and has brought a level of simplicity that’s a huge benefit to our organisation.”

“We are proud to support Newcastle City Council in its mission to secure critical municipal services by helping to eliminate over 80 percent of NCC’s IT security risks,” said James Johnston, VP of EMEA at Azul. “The council’s successful implementation of Azul Platform Core is a testament to our unwavering commitment to help customers maintain the integrity and performance of their critical Java applications, while advancing their overall security posture and without impacting service levels or performance.”