JAVA 2 Network Security (2nd Edition) [Paperback]

Marco Pistoia (Author), Pistoia (Author), Deepak Gupta (Author), Ashok Ramani (Author)

Book Description

Publication Date: August 4, 1999 | Series: Itso Networking Series

Learn how to use Java reliably, securely, and safely! Unlike other books, which focus on how Java can be broken, this one focuses on delivering practical help with Java security to everyone involved in building and deploying industrial-strength Java-based applications. Now that Java is "leaving the sandbox," you need stronger security than ever, and Java 2 Network Security, Second Edition shows you how to get it. One of the first books to cover the new Java 2 network security model that has been written in full cooperation with Sun's own developers, it compares the pros and cons of every leading approach to Java security. You'll review specific techniques for deploying or limiting Java across corporate firewalls; discover how to integrate Java and SSL; master Java's powerful Cryptography APIs; and learn how to architect your applications to improve their inherent security. The accompanying CD-ROM contains all programs included in the book, plus shareware designed to help readers develop more secure Java programs and more thoroughly understand the new Java 2 security model.

Editorial Reviews

From the Inside Flap

Preface

Java is fashionable, but is it reliable? Java is entertaining, but is it secure? Java is useful, but is it safe?

The purpose of this book is to answer those questions, from the point of view of people who want to use Java, but want to do so reliably, securely and safely. That makes this book different from much recent writing on Java, which focuses, perfectly legitimately, on how a Java system can be broken into and how to avoid those dangers. On the contrary, this book focuses on how Java can be made secure and how to exploit its strengths. The goal is to provide practical help to the various groups involved in making a Java-based application or Web site into an industrial-strength commercial proposition.

Various groups have different needs and different skills, which this book meets in its different parts.

The first part is aimed at the intelligent non-specialist who oversees system management or application development, or incorporates Java into the security policy. Only a basic understanding of computers and a limited exposure to Java is assumed, but all the themes of Java security are introduced in a context that stresses over and over again how Java security must be seen as an integral part of system security.

The second part goes into more detail on how Java security works, and is aimed more at system and network administrators and programmers, who need to know more of what is going on.

The third part looks at the broader context in which Java operates, including some extensions to Java security and some aspects of its future.

This book explains the evolution of the Java security model, and then focuses on the Java 2 security architecture and its revolutionary domains of protection. It offers a very large number of examples to give you a better understanding of the technology involved.The Team That Wrote This Redbook

This redbook was produced by a team of specialists from around the world working at the International Technical Support Organization Raleigh Center.The leader of this project was Marco Pistoia.

Marco Pistoia is a Network Security Specialist, working as a project leader at the International Technical Support Organization, Raleigh Center. He writes extensively and teaches IBM classes worldwide on all areas of the e-business Application Framework, WebSphere, Java and Internet security. Marco holds a degree with honors in Pure Mathematics from the University of Rome and a masters degree in Computer Science. Before joining the ITSO, he was a System Engineer in IBM Italy. He received an Outstanding Technical Achievement Award in 1996.

Duane F. Reller is a Senior Software Engineer in the System/390 Programming Laboratory in Endicott, New York, USA. He has 25 years of experience in System/390 Hardware and Software development. He has served in technical and management positions. He holds a Bachelor's degree in Electrical Technology and a Master of Science degree in Computer Science from the State University of New York at Binghamton. His areas of expertise include Hardware and Software System's Architecture and Management.

Deepak Gupta is a Senior Software Engineer in IBM, India. He has two and a half years of experience in Internet technologies. He holds a degree in Electronics and Communications from the University of Roorkee, India. His areas of expertise include Internet security and Electronic Commerce. Deepak was involved in IBM India's largest e-Commerce project and in India's first secured e-Commerce site allowing Rupee-based transactions, for which he was conferred the Employee of the Month Award. He has also given several talks on Internet security and e-Commerce.

Milind Nagnur is a Senior Associate in the Operations and Systems Risk Management (OSRM) group of Price Waterhouse Coopers in Mumbai, India. He has a couple of years of exposure in Internet technologies, with emphasis on security and control issues in real business applications. He holds a degree in Mechanical Engineering from the Indian Institute of Technology in Bombay, India, and an MBA from the Indian Institute of Management in Calcutta, India.Ashok K. Ramani is a Senior Software Engineer in IBM India. He has two and a half years of experience in Internet technologies. He holds a degree in MSc.(Tech.) Information Systems from the Birla Institute of Technology and Science, Pilani, India. His areas of expertise include Internet security and Electronic Commerce. Ashok was involved in IBM India's largest e-Commerce project and in India's first secure e-Commerce site allowing Rupee-based transactions for which he was conferred the Employee of the Month Award. He has won special recognition awards at IBM India for his contribution to e-Commerce projects. He has also presented several talks on Internet security and e-Commerce.Comments Welcome

Your comments are important to us!

We want our redbooks to be as helpful as possible. Please send us your comments about this or other redbooks in one of the following ways:

Fax the evaluation form found in "ITSO Redbook Evaluation" on page 713 to the fax number shown on the form.

Use the online evaluation form found at redbooks.ibm/

Send your comments in an internet note to [e-mail]

From the Back Cover

The complete insider's guide to securing Java 2 enterprise applications!

• Building secure enterprise applications with Java 2!
• Integrating Java 2 into your overall security strategy
• Detailed coverage for managers, developers, netadmins, and security specialists
• Comprehensive coverage of the new Java 2 security model
• Integrate Java 2 into your enterprise security strategies
• Master Java's powerful Cryptography APIs

Now that Java is "leaving the sandbox," you need stronger security than ever, and Java 2 Network Security, Second Edition shows you how to get it. Unlike other books, which focus on how Java can be broken, this one delivers practical help with Java 2 security to everyone involved in building and deploying industrial-strength Java-based applications.

Written in cooperation with Sun's own developers, Java 2 Network Security, Second Edition presents systematic coverage of the new Java 2 network security model for managers, network administrators, developers, and security professionals alike. You'll learn the real-world pros and cons of each leading Java security alternative; architectural techniques for maximizing security; and how to integrate Java security into your enterprise-wide security strategies.

You'll discover practical techniques for securing Web and intranet applications, deploying or limiting Java across corporate firewalls; integrating Java and SSL, leveraging Java's powerful Cryptography APIs, and much more. Java 2 Network Security, Second Edition is up-to-date, authoritative, and thorough-and if you're using Java in enterprise development, it's utterly essential.

Sharing Technical Expertise from Around the World This book and other IBM Redbooks are products of IBM's International Technical Support Organization, where worldwide specialists work alongside you to harness IBM technologies. IBM Redbooks make the answers to your most pressing technical questions easily and immediately accessible.

See all Editorial Reviews

Product Details

• Paperback: 250 pages
• Publisher: Prentice Hall PTR; 2 Pap/Dsk edition (August 4, 1999)
• Language: English
• ISBN-10: 0130155926
• ISBN-13: 978-0130155924
• Product Dimensions: 9 x 6.9 x 1.4 inches
• Shipping Weight: 2.5 pounds
• Average Customer Review: 4.6 out of 5 stars  See all reviews (9 customer reviews)
• Amazon Best Sellers Rank: #2,738,770 in Books (See Top 100 in Books)

Customer Reviews

Most Helpful Customer Reviews

7 of 7 people found the following review helpful:

4.0 out of 5 stars Just the begining..., February 8, 2000

By 

Ray Ye (Dallas, Tx) - See all my reviews
(REAL NAME)   

This review is from: JAVA 2 Network Security (2nd Edition) (Paperback)

Supplied essential Java security and cryptography information. Introduced how and where the potential attack may happen and several techniques to avoid attack. Detailed information how to use Java signing tools (for Netscape Signing Object and Microsoft Authenticate Code)and security APIs.

However, from the developer's point of view, some very important topics such as Public/Hybreed Encryption, SSL, EJB, Servlet topics are way too light. Almost no touch on CORBA and RMI. Some of the contents can be obtained directly from SUN's site and most of the examples in the book are not ture client/server, and also borrowed from SUN's tutorial.

The Author may not target the audience as developers but the architects of network security. However he spends a lot of chapters to explain the security features (i.e class loader, file verifier and security manager) coming with Java programming language and how to customize/modify them. Anyways, as a developer, I am disappointed with the examples given (no innovation from the author but basic copies from SUN and very trivial).

Since I am new to Java programming language let alone security issues, and there is very limited resources available both on the book market and net, I still obtained valuable information from the book, I gave it four stars. For real world security developer guru, the book only introduced basic java network security and cryptography APIs.

12 of 15 people found the following review helpful:

5.0 out of 5 stars The greatest computer book - for every reader!, March 2, 2000

By 

Michael Shorowski (Dallas, TX) - See all my reviews

This review is from: JAVA 2 Network Security (2nd Edition) (Paperback)

This is the greatest computer book I have ever read.

The first three chapters of the book are an introduction to Java security, and they are very helpful to people who are new to Java security, just like me. The same concepts are covered later in the book in greater detail, so it may appear that there are some repetitions, but in reality the author informs you many times that if you are an expert, you should probably go directly to Chapter 4, and read the advanced topics.

In fact, this is an advanced book. Nevertheless, you will not get lost even if you are a beginner. The author covers advanced topics with a very simple approach and even tells you how to perform the simplest operations. While this can be sometimes boring if you already know Java programming, I guess that basic information is always useful, especially if readers are not very familiar with the topic.

In this book you will find the architecture of Java security as well as advanced topics such as cryptography, SSL, Java and firewalls, Netscape and IE Java security, Java plug-in, and many other things. There are many examples and screen captures that help a lot. The final result is that, after reading this book, you will feel like a Java security expert.

There are some imperfections, but overall, this is a great book. If you are interested in Java security, buy this book. You satisfaction is guaranteed.

4 of 4 people found the following review helpful:

5.0 out of 5 stars Clearly written and packed with information, November 9, 1999

By A Customer

This review is from: JAVA 2 Network Security (2nd Edition) (Paperback)

This is an excellent book. I and everyone in my programming group at work are new to cryptology. Yet, after reading this book, I feel that we will be able to create a fully secure applet -- creating a trusted applet and making it work with encrypted communication between it and our server.

The technical information is delivered clearly and concisely. But I also enjoyed the first couple of chapters which describe Java Security for the "intelligent non-specialist who does not need all the details." These chapters will be extremely useful for me when I explain to my bosses why we should use Java Security. I highly recommend this book.

(No, I have no relationship to the author or the publisher. I am really just a satisfied reader).