Cetus Links: 14,453 Links on Objects and Components / Java / Security

Object-Oriented Language: Java / Security

See also Java / General ... Java / APIs JavaBeans ... Java RMI Java / Databases Java / Tools
Intro
- When project green team heard about a Time-Warner RFP for a settop box operating system they quickly shifted focus from smart consumer electronics to the set-top box OS market. Fortuitously, Sun lost the bid, However around this time it was realized that the requirements for smart consumer electronics and settop box software (platform independent secure reliable code) were the same requirements for the nascent web. A prototype browser called WebRunner was written by Patrick Naughton after some additional work by Naughton and Jonathan Payne this browser became the well known HotJava.
- Now more than 90 percent of Web-based e-commerce applications use the Java platform as an integral part of their implementation; from basic online purchasing systems to international credit card systems, Java has proven itself as the solution for secure online systems.
- The two distinct aspects of JAVA's security -- System security and Information security
  - The Security Manager, and the Permissions API's provide system security, which allows the safe execution of untrusted and partially trusted code . In this case, the word safe refers to the fact that Java protects your system, the information on your system, and the resources available to your system from unauthorized access by the code being executed.
    Exmp: applets, channels, servlets, remote code, as well as applications
  - The Java Cryptography Architecture, a core part of the Java 2 platform, together with the Java Cryptography Extension (a standard extension), provide information security. That is, cryptographic techniques are available for protecting the privacy and integrity of information transmitted across public networks, and for verifying the identity of individuals communicating with a system.
    Exmp: Support for encryption, message digests, digital signatures, and key agreement
Contents
Other pages

Start here
- Fundamentals of Java Security By MageLang Institute
- Architecture in the JavaTM Development Kit 1.2 By Sunsoft
- Cryptography (Javasoft)
- Java's security architecture By Bill Venners
- The Evolution of Java Security IBM's initiatives in Java security
Examples
- A short description of how to use signed applets in JDK 1.1.x (javasoft)
- A short description of how to use signed applets in JDK 1.2, (javasoft)
- Building a bigger sandbox By Todd M. Greanie
- Encrypting and Decrypting Data JavaTM 2 Cryptography Extension
Central Sites
- Developer.com
- Javasoft
- JavaLobby
Related Sites
- http://www.cs.purdue.edu/homes/spaf/hotlists/csec-top.html
- http://www.cs.purdue.edu/coast/coast.html
- http://www.sware.com/
- http://www.telstra.com.au/info/security.html
- http://www.crpht.lu/CNS/html/PubServ/Security/security-home.html
- http://www.iss.net/sec_info/faq.html
- http://www.nsi.org/compsec.html
- http://www.sevenlocks.com/secinfo.htm
- http://cs-www.ncsl.nist.gov/
- http://seclab.cs.ucdavis.edu/
Glossaries
- Java Security
- Java Security Resources
- Java Security Problems
- Denial of service
- Netscape's main Security page
Tutorials
- Security in JDK 1.2
- Security in JDK 1.1
- Designing and Building Advanced Java Applications
FAQs
- A dialog with several network security experts
- JavaSoft's Java Applet Security FAQ(JS)
- Java Security FAQ.(princeton)
- Java Security Q & A Archive
  - Java Security Q & A Archive, Volume I , November 1996 - April 1997
  - Java Security Q & A Archive, Volume II , April 1997 - November 1997
  - Java Security Q & A Archive, Volume III , November 1997 - current
References
- Joe Bank's Java Security Paper(dated)
- Low Level Security in Java
- JavaSoft's Java Security white paper.
- Netscape's Signing Architecture
- What Price Security? (IBM)
Standards
- JDK 1.2 Security Documentation (Sunsoft April 1998)
- JDK 1.1 Security Documentation (Sunsoft 1997)
- Java Cryptographic Architecture (Sunsoft)
- Manifest File Specification (Sunsoft)
- A revised JavaTM Cryptography Extension (JCE) 1.2 API specification
- Security Reference Model for Java
General Newsgroups
- comp.lang.java.security
- comp.lang.java.security Resources (PHOAKS)
- comp.lang.java.softwaretools
- comp.lang.java.softwaretools Resources (PHOAKS)
Mailing Lists
- Java security with body =subscribe
- Best of Security List
- The Secure Socket Layer - Talk
- Security list FAQ
General Articles
- Understanding Java Stack Inspection.
  by Dan S. Wallach and Edward W. Felten.
- A Comparison between Java and ActiveX Security Compsec '97
- Java vs. ActiveX security comparison by princeton
- Java Security: Web Browsers and Beyond.
  by Drew Dean, Edward W. Felten, Dan S. Wallach, and Dirk Balfanz.
- Extensible Security Architectures for Java.
  by Dan S. Wallach, Dirk Balfanz, Drew Dean, and Edward W. Felten
- A Java Filter.
  by Dirk Balfanz and Edward W. Felten
- Java Security: Hostile Applets, Holes and Antidotes.
  by Gary McGraw and Edward Felten. John Wiley and Sons
- Java Security: From HotJava to Netscape and Beyond.
  by Drew Dean, Edward W. Felten, and Dan S. Wallach
- Application and Enterprise Security With the JavaTM2 Platform, (SUN)
- Twelve Rules for Developing More Secure Java Code,
  By Gary McGraw and Edward Felte
- Third-party Java Security Vendors: Solutions or Snake Oil? (JavaReporter)
- Signing Java with Microsoft's Authenticode (deleloper)
- Signing Code with JDK 1.2 (developer.com)
- Using the Netscape Object Signing Tool (developer.com)
- Privileged code in Java: Why the API changed from JDK1.2beta3 to JDK1.2beta4, (developer.com)
- JDK 1.2 May Breed Security Pitfalls, (InternetWorld)
- Hostile Applet Sparks Debate About Java Security Issues, (InternetWorld)
- Securing Java and ActiveX
- Smart cards, Java cards and security, (developer.com)
- Don't push me: the security implications of push, (developer.com)
- Java security snake oil?, (NetworkWorld)
- Java Not Secure, Experts Claim
- Sandboxes and signatures, Part 1: The future of executable content, (developer.com)
- Sandboxes and signatures, Part 2: How to sign code for Netscape Communicator (developer.com)
- Security is in the eye of the beholder, By William Blundon
- Security and the class loader architecture, By Bill Venners
- Understanding the keys to Java security: the sandbox and authentication,
  By Gary McGraw and Edward Felten
- A beginner's guide to designing a Web site for electronic commerce, (NetscapeWorld)
- Experts underwhelmed by new Java crypto , (developer.com)
- Java Security and Type Safety, (Byte Magazine)
- Slides from JavaOne by Li Gong
- Extensible Security Architectures for Java by Dan Wallach
- The Java Virtual Machine Specification. by Tim Lindholm and Frank Yellin.
- Trust-Based Security for Java (microsoft)
- Notes on Java Security from the University of Washington
- Escape the sandbox: Access native methods from an applet By Steve Small
- Java goes to the extreme By Jill Steinberg
- Building a bigger sandbox By Todd M. Greanie
- First bug bites Java 1.2 -- Mozilla stung By Kieron Murphy
- Get a jumpstart on the Java Card By Rinaldo Di Giorgio
- Closing the Hood By Bill Venners
- Java security: How to install the security manager and customize your security policy
  By Bill Venners
- Security and the class verifier By Bill Venners
- Java's security architecture By Bill Venners
- Is your browser a blabbermouth? Are your ports being scanned?
  By Gary McGraw
- Protecting your applet's intellectual property By Laurence Vanhelsuwe
- The trick to using Java networking applets behind firewalls By Thomas Wisniewski
- Write a custom security manager that gathers execution information By Mark Wutka
- A Security Model for Aglets (IBM)
- The Evolution of Java Security IBM's initiatives in Java security
- Flexible Control of Downloaded Executable Content (IBM)
- A Flexible Security Model for Using Internet Content (IBM)
- Internet Security, ActiveX, and Java (IBM)
- Tangled Web (IBM)
- Untrusted Applications Need Trusted Operating Systems (IBM)
- A New Approach to Mobile Code Security by Dan Seth Wallach(PhD thesis)
- Formal Aspects of Mobile Code Security by Richard Drews Dean (PhD thesis)
Bibliographies
- Javasoft
- Java Security Hotlist, ( RST Corp. )
- Javaworld
Books
- Cryptography and Security in Java by Joel Fan
- Securing Java: Getting Down to Business with Mobile Code
  by Gary McGraw and Edward Felten
- Internet Security in the Network Computing Framework (Java 1.2 Security Model) by Marco Pistoia,
- Java Network Security by Robert MacGreggo
- Java Security, Networking, and the Internet by CBT Systems
- Java Security by Gary McGraw & Edward Felten
- Java Security: Hostile Applets, Holes, and Antidotes by Gary McGraw & Edward Felten
- Java Security: Managing Risks
- JavaTutor: Implementing Java Security for JDK 1.2 L-5 Users by Sun Educational Services
- NCF Security Implications (Java 1.2 Security Model) by Marco Pistoia
- WWW.security: How to Build a Secure World Wide Web Connection Broad based primer on WWW Security. Practical examples including CGI and Java by Robert S. MacGregor
- Web Security & Commerce by Simson Garfinkel & Gene Spafford
Magazines
- Shake Communications
- JavaReporter
- Javaworld
- Infosecurity News
  Trade magazine dedicated to covering the world of information security
Projects
- Princeton
- The Kimera project
- NessusJ (AD8-1) A security scanner
People
- Edward W. Felten
Events
- March 1, 1999, Dulles, VA, First International Software Assurance Certification Conference, "Why Commercial-off-the-shelf (COTS) Software Increases Security Risks"
- February 3-5, 1999, San Diego, ISOC Symposium on Network and Distributed System Security, "Mobile Code Security and JAVA Architecture"
- December 8-10, 1998, New York, Java Business Expo
- November 7-12, Tuscon, ICSA Malicious Mobile Code Consortium
- November 11, University of Arizona, Java Security Architecture"
- Computer Security Conference and Exhibition, November 2-4, 1998, Chicago, IL; "New Issues in Java Security: From Smart Cards to JDK 1.2"
- SANS Network Security 98, October 25, 1998 (9am-12:15pm), Orlando, FL; "Towards Secure Executable Content: JAVA"
- SIGS Conference for Java Development '98, October 19-23, 1998, San Jose, CA.
- Mid-Atlantic Java Users Group, September 23rd, 1998, Bethesda, MD; "New Issues in Java Security: From Smart Cards to JDK 1.2"
- Internet Commerce Expo (ICE), September 22, 1998, Los Angeles, CA
- SD Expo East, August 17-21, 1998, Washington, D.C.
- Java Expo Europe, June 29-July 3, 1998, London.
- IEEE Symposium on Security and Privacy, May 3-6, 1998, Oakland, CA.
- Internet and Electronic Commerce (IEC) Conference and Exposition, Gartner Group, April 27-29, 1998, New York.
- Universite' Laval, Departement D'Informatique, April 14th, 1998, Quebec, Canada.
- EuroSec '98, 9th European Forum on IT Security and Quality, March 16-18, 1998, Paris.
- ISOC Symposium on Network and Distributed System Security, March 12th, 1998, San Diego, CA.
- USENIX Security Symposium Java Security Tutorial, January 26th, 1998 San Antonio, TX.
- CSI's 24th Annual Computer Security Conference and Exhibition, November 17-19, 1997, Washington, DC
- NCSA Network Security and Firewalls conference, SanJose, CA, October 27-28, 1997
- Triangle Area Java User's Group, October 20, 1997
- digitivity lecture tour: Chicago, Atlanta, NY, DC
- Hostile Applets at infoWARcon, September 10, 1997, Washington, DC
- Keynote at the HASE workshop in Washington, DC on August 11th, 1997
- Java Expo Europe in London on July 3rd, 1997
- Java Security tutorial at Compass '97, June 17th, 1997, Washington, DC
- Java Expo, New York on June 3rd, 1997
- Mid-Atlantic Java Users Group April 23rd, 1997, Reston, VA.
- NCSA Firewalls, Web & Internet Security April 14th, 1997
- DARPA, March 12th, 1997
Utilities / Tools
- Javakey Solaris and Windows
  Javakey is a utility for generating keys and certificates, and signing jar files
- Jar Solaris and Windows
  Jar is a utility for packaging files of any type into a single archive.
General Tools
- ftp://ciac.llnl.gov/pub/ciac/
- ftp://ftp.cert.org/pub/tools/
- ftp://ftp.win.tue.nl/pub/security/
- ftp://ftp.funet.fi/pub/unix/security/
- ftp://coast.cs.purdue.edu/
- ftp://ftp.nec.com/pub/security/
- ftp://net.tamu.edu/pub/security/
Other Resources
- RST Corp
- JavaTM Security (Javasoft)

Home Mirrors/Hosts
What´s New? Most Wanted About Cetus Cetus Team Legal
Download Suggest Moved/Broken Feedback URL-Minder Copy & Paste

Copyright © 1996-1999 by Manfred Schneider
Page maintained by Sridhar Muppidi
Last revision: March 27, 1999
Site visits: [Site visits]

[Site visits]

since May 1996