Java Security - Softcover

Oaks, Scott

Softcover

ISBN 10: 0596001576 ISBN 13: 9780596001575

Publisher: O'Reilly Media, 2001

Synopsis

One of Java's most striking claims is that it provides a secure programming environment. Yet despite endless discussion, few people understand precisely what Java's claims mean and how it backs up those claims. If you're a developer, network administrator or anyone else who must understand or work with Java's security mechanisms, Java Security is the in-depth exploration you need.Java Security, 2nd Edition, focuses on the basic platform features of Java that provide security--the class loader, the bytecode verifier, and the security manager--and recent additions to Java that enhance this security model: digital signatures, security providers, and the access controller. The book covers the security model of Java 2, Version 1.3, which is significantly different from that of Java 1.1. It has extensive coverage of the two new important security APIs: JAAS (Java Authentication and Authorization Service) and JSSE (Java Secure Sockets Extension). Java Security, 2nd Edition, will give you a clear understanding of the architecture of Java's security model and how to use that model in both programming and administration.The book is intended primarily for programmers who want to write secure Java applications. However, it is also an excellent resource for system and network administrators who are interested in Java security, particularly those who are interested in assessing the risk of using Java and need to understand how the security model works in order to assess whether or not Java meets their security needs.

About this title

Review

The second edition of Java Security is intended to help you build and deploy secure Java programs on private and public networks. It covers Java 1.1, Java 2, JCE 1.2.1, JSSE and JAAS (the last two absent from the first edition) and combines coverage of the core Java security features with the three optional security APIs. They will be combined in the next Java release--so you're ahead of the curve.

Security has different meanings depending on context. Java's core sandbox security model was originally intended to defeat viruses and trojans. Authentication, encryption and other security models were added to provide different kinds of security. The authors explain how Java components work so they can show how they might be subverted. Without knowing what the risks are you can't apply effective security measures.

The Java security features examined include class loaders, cryptography, certificates, key management, signatures, SSL, authentication and permissions. The authors explain where and how particular security features are best implemented and explain their limitations in the real world. For example, many people routinely grant signed Java applets permission to read and write files on their system believing a signed certificate somehow makes the application safe. In practice, as anyone can create and sign a Java applet or application it proves nothing of the kind and can still be setting you up for a fall.

Java security is non-trivial. Security is an arms race in which the two sides constantly leapfrog each other. Java Security is well written with many examples but it's a fairly technical read. If you're serious about Java application development, however, you need to read it. Because you can be sure the bad guys will. --Steve Patient

Review

"Overall, the book is a valuable reference for the Java 2 application programmer." -- Edward A. Feustel, IEEE Distributed Systems Online, Volume 3, Number 3, 2002

Anyone interested in taking an honest look at the risks of using Java to see whether it meets security needs should consider ‘Java Security' required reading. -- Ben Rothke, Security Management, March 2002

Overall, the book is a valuable reference for the Java 2 application programmer. -- Edward Feustel, IEEE Distributed Systems Online, April 2002

Scott Oaks' Java Security is a thorough reference that Java developers will want to add to their library. -- Steven Leathem, pantug.org. March 2002

While directed at Java programmers, the book has significant value for any programmer or system administrator... -- Ben Rothke, Security Management, Jan 2002

Edition details

• Publisher: O'Reilly Media
• Publication date: 2001
• ISBN 10: 0596001576
• ISBN 13: 9780596001575
• Binding: Paperback
• Language: English
• Edition number: 2
• Number of pages: 618