Summary
-------

Disable the TLS anon (anonymous) and NULL cipher suites by default by adding them to the `jdk.tls.disabledAlgorithms` security property. 

Problem
-------

The TLS anon and NULL cipher suites are used rarely and have security weaknesses. Anonymous suites are vulnerable to man-in-the-middle attacks. NULL suites do not provide confidentiality. RFC 7525 (Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)" says: "Implementations MUST NOT negotiate the cipher suites with NULL encryption." 

These suites are not enabled by default, so an application has to explicitly enable them using an API or the `jdk.tls.client.cipherSuites` or `jdk.tls.server.cipherSuites` system properties. However, adding them to the `jdk.tls.disabledAlgorithms` security property adds an extra layer of protection should they be used accidentally or maliciously.

Solution
--------

Add `anon` and `NULL` to the `jdk.tls.disabledAlgorithms` security property so that it will be disabled by default. In order to use one of these suites, an application has to explicitly enable it AND remove it from the `jdk.tls.disabledAlgorithms` security property.

Specification
-------------

In the `java.security` file, change the value of the `jdk.tls.disabledAlgorithms` security property:

```
jdk.tls.disabledAlgorithms= /* whatever was before */, anon, NULL
```