Slashdot Mirror
J2EE Security
The second section is "The Technology," and includes chapters three through seven. Chapter three is a discussion of cryptography with Java and would have been worth the price of the whole book for me if (I hadn't have gotten it for free as a review copy)! :-) Chapter four covers PKI (Public Key Infrastructure) with Java. Managing certificates is explained as well as the steps necessary to issue and revoke your own. Chapter five is a discussion of access control. Access control in Java is available based on the origin of the code (the applet effect), the signer of the code or the logged-in user. Chapter six concerns securing the wire. This is the use of encryption for the transmission channel, SSL in a web browser being the most obvious example, where everything served over HTTPS is encrypted. Chapter seven secures the message. This covers message encryption for those times in life where you have to use a non-encrypted transfer medium as well as techniques for authentication, so that the message you do send can be guaranteed to be authentic and provably from you.
The third section is "The Application." Chapter eight discusses the security aspects of RMI based applications, especially using the Java security managers. Chapter nine reviews web application security using both declarative and programmatic security, giving examples using Apache Tomcat.Chapter ten discusses EJB security, including JNDI-based client authentication, SSL and declarative access control. Chapter eleven talks about the security issues associated with web services using the Apache Axis tool to illustrate the points. Chapter twelve is a wrap up of the whole book.
What's To Like The book is logically divided into chapters on each of the main aspects of security that apply to J2EE. These chapters are then located within three sections: background, technology and application. This sequence worked nicely for me, each chapter getting more detailed. This way I knew how deep I was by how far into the book I'd gotten.The main thing that struck me about this book was that it was designed to be practical. Mr. Kumar not only explains his point and gives you example source code, but he has written a freely available security toolkit, to demonstrate each of the points he makes. The Java Security Tool Kit (JSTK) is a very nice addition to the book's text. Being able to try out the concept being explained really helps. This approach takes example code to another level and I hope other authors will take note.
What's To Consider There is almost nothing to nit-pick concerning the book, but I do have one complaint about the JSTK software. The supplied shell scripts in the bin directory all had MS-DOS end-of-lines. This prevented them running unmodified on my OS X iBook. I had to remove all of the ^M's. This may also be a problem under Linux, but I have not had an opportunity to test there yet. Once the end-of-line problem was fixed, the software worked like a charm. Summary A great combination of security primer and cookbook. If you're a serious crypto-freak then you probably don't need this book. If you're a regular Java programmer looking to move to the next level in your understanding and practice of security in your J2EE applications, then this is an excellent book to purchase and learn from. Table Of Contents1. A Security Primer
2. A Quick Tour of the Java Platform
3. Cryptography with Java
4. PKI with Java
5. Access Control
6. Securing the Wire
7. Securing the Message
8. RMI Security
9. Web Application Security
10. EJB Security
11. Web Service Security
12. Conclusions
Appendix A: Public Key Cryptography Standards
Appendix B: Standard Names - Java Cryptographic Services
Appendix C: JSTK Tools
Appendix D: Example Programs
Appendix E: Products Used For Examples Appendix F: Standardization Bodies
Simon P. Chappel would like Tim O'Reilly to call him to discuss the great Java book he's itching to write. You can purchase J2EE Security from bn.com. Slashdot welcomes readers' book reviews -- to submit a review for consideration, read the book review guidelines, then visit the submission page.
This one is a great addition to the book shelf, I know how to do certain things related to security n J2EE by using the docs and coming across them in my line of work, but this book clarifies nicely why you are actually doing it and provides better language specific ways of doing things that might now occur to you.
Also, it introduces nice security concepts in a clear and easy way which self taught coders might not have come considered before.
I got my copy from Barns & Noble which was a couple of dollars cheaper than amazon.
There is no god
i find it a little funny how this book only contains three chapters on actual J2EE security.
9. Web Application Security
10. EJB Security
11. Web Service Security
Seems more like this is Security book for all Java 2 folks with J2EE tagged on at end. Ohh let us not forget that J2EE is a big buzzword that will most likely increase sales an extra 10-15% versus naming the book "Java Security"
i'll take the karma hit to state my opinion. Name the book on what it is about not what will generate a large amount of sales.
>>but with power there is always complexity
I thought it was "with power comes great responsibility"? Applicable nonetheless.
Ryosen
One man's "Troll, +1" is another man's "Insightful, +1".
Actually, I think it's more like With EJB comes complexity.
but with power there is always complexity, and many of these tools, especially the security-oriented tools, are under-used because of this.
Security models and tools that are so complex as be underutilized are worthless. It only takes one unsecured app to ruin all the rest of your security. Ultimately security will have to come automagically from the framework, compiler, or language itself. It will be a fight because programmers will feel too constrained in such an environment (thinking they can do it better, which may be true). If only experts can write secure code, we will never have security. This business will always have amateurs working in it. If we have to depend on expertise, we will never have security.
Although the author did a great review, it's a shame he added in a CR/LF gripe.
/
For those who may be unfamiliar with file conversion issues, here's (only a few) ways to convert DOS text files.
For Linux, there's dos2unix.
For MacOSX, there's native2ascii (Haven't used it personally, but is reported to work)
Also dos2unix has been ported to MacOSX, see http://www.osxgnu.org/software/Fileutils/Unix2Dos
And I'm not including several dozen awk scripts, perl commands, shell scripts, etc. to do the same thing.
"with power there is always complexity"
---------------
Some of the most powerful concepts are also among the most simple. One of the principle weaknesses of the Java (and C#, and before that Win32 and MFC) API is that they fail to grasp that.
A deep unwavering belief is a sure sign you're missing something...
sed `s/^M$//`
perl -p -i -e 's/\cM//g' file
This chapter is for Web Services Security using XML Encryption and XML digital signatures.
iksrazal
...is "Hacking Exposed - J2EE and Java" from Osborne by Art Taylor, Brian Buege and Randy Layman. It's a really good overview of security in Java, from cryptography, code-signing, sealing jar files, byte code obfuscation etc. It runs the gambit from standalone code hacking, through the client-server tier and on to the J2EE and Web tiers. It has lots of good, reusable code samples too.
I highly reccomend it and it's a great "how to" companion to O'Reilly's Java Security by Scott Oaks.
Never by hatred has hatred been appeased, only by kindness - the Buddha
If I see one more book on server side Java that has example web.xml web app configuration files with plain text passwords, I'm going to go postal.
If you don't understand anything I post, please accept that I ate paste as a small boy...
Security is not just for the paranoid anymore.
Um. I think we figured this one out about two years ago on Sept 11th.
Not exactly the statement of a genius.
http://www.cgisecurity.com/development/java.shtml
From what I've seen, the typical J2EE shop
has a lot of H-1b/L-1 workers writing code that could be written by 1/3 as many people in 1/3 as many lines using a decent scripting language(Python, Perl, PHP). The risks associated with having an unmaintainable code base typical in Java shops are enormous--as are risks associated with tthe business practices of these organizations.
While it'd be nice to know these steps, I've personally never had to address them. This book seems to cover all of the programmer-oriented pieces of the security model while assuming the server environment is complete.
I would guess the reasoning for omitting these steps is due to this role seperation, or the fact that Application Servers and OSes tend to have vastly different configuration options and covering all of them (or even just a few major ones like WebLogic, JRun, WebSphere, etc.) could be a book in itself. I'd prefer to see those issues addressed by a seasoned server admin who would ideally have a book like this that would only cover the steps you feel were left out.
This red book has indepth converage of Java 2 security aspects including PKI, SSL and even classloaders. Though it doesn't deal with J2EE security details the foundation is lays is solid.
VeryGeekyBooks has more reviews for this book.