Java security technology includes a large set of tools, APIs, protocols, and security mechanisms. They include cryptography, public key infrastructure, communication, authentication, and access control. There is so much depth that describing the use of each of them would make the article much longer.
Any fraud resulting in the loss of personal data (address, passwords, banking information, and others) is a serious application security problem.
Unauthorized access to personal information that is confidential and restricted to certain individuals is intended to harm or enrich one of the parties.
Discussing this subject is important to reflect on issues that we only become aware of when they are covered in the media (television and newspapers) and that we worry about after the fact has already happened.
Why do I need to worry about secure applications?
Some of the reasons to worry about Web application security:
• 75% of attacks happen at the application layer (Gartner)
• 90% of websites are vulnerable to attacks (Watchfire)
• 80% of organizations will experience a security incident (Gartner)
• Customer data, credit cards, and other information can be obtained in some attacks
• Identity theft
• Privacy violation
• Your company and your customer may suffer damaged reputation and high financial loss
Often, applications allow attacks due to a lack of knowledge and misuse of technology during software development. Even with a firewall in place, it is necessary for IT developers to care about security details to prevent this type of flaw.
Java Security and Web Application Vulnerabilities:
1. Cross-Site Scripting (XSS)
2. Injection Flaws
3. Insecure Direct Object References
4. Malicious File Execution
5. Cross-Site Request Forgery (CSRF)
6. Insecure Cryptographic Storage
7. Insecure Communication
8. Improper Error Handling
9. URL Access Restriction Failure.
It is not as uncommon as it seems to find applications with basic security flaws, such as storing passwords in a database without encryption. Even though it is common knowledge that no system is 100% secure, it is possible to minimize risks and increase the level of security in Java applications.
To the delight of developers working with Oracle’s language, there is a large number of tools and APIs, significantly reducing the number of attacks when used properly.
Tools and libraries can make it harder for a potential attacker to gain access
Functionality: Platform
Objective: Build security functionality into the language, compiler, and virtual machine (Strong data typing, automatic memory management, bytecode verification)
Benefit: Provides a reliable and secure platform to develop and run applications.
API/Tool: The Java Language Specification
Functionality: Cryptography
Objective: Support for standard algorithms including RSA, DSA, AES, Triple DES, SHA, PKCS#5, RC2, and RC4. PKCS#11 token support
Benefit: Algorithm-independent implementation
API/Tool: JCA and JCE
Functionality: Authentication and access control
Objective: Abstracts authentication APIs that can be incorporated into “login” mechanisms in a “pluggable” architecture. A policy and permissions API that allows developers to create and administrators to manage access to the application.
Benefit: Enables single sign-on authentication
API/Tool: Java Security Architecture, Java Authentication and Authorization Service (JAAS), Policy Implementation and Syntax, and Signature Timestamp Support
Authentication is the process of determining a user’s identity. In Java, we can perform this process by configuring the application server.
In Figure 1, we can observe the user password authentication process; however, just logging into the application is not sufficient for proper security.
Access to each page or URL of the application must have an associated profile, which may or may not be allowed to access it.
Another point: Always check whether the session initialized during application login remains valid. Setting a maximum timeout to invalidate the session is an important process, as the user might leave the application running without performing any operations. When this time, defined in the application configuration, is reached, the user should automatically be forced to log into the application again.
Invalidating the session at the moment of logging out of the application is mandatory, and it also benefits the application server by cleaning up objects that were stored in the user’s session.
Functionality: Communication security
Objective: APIs and implementations for the following security communication protocol standards: TLS, SSL, Kerberos, and SASL. Full support for HTTPS over SSL/TLS is also included.
Benefit: Authenticates endpoints over insecure networks and protects the integrity of transmitted data
API/Tool: JSSE, Java GSS-API, and Java SASL APIFunctionality: Public Key Infrastructure (PKI)
Objective: Tool for managing certificates and keys, with support for the following algorithms and formats: X.509 CRLs, PKIX, OCSP, PKCS#11, PKCS#12, LDAP, and java.util.Collection
Benefit: Simplifies PKI development complexity.
API/Tool: X.509, Java CertPath API, On-Line Certificate Status Protocol, and Java PKCS#11
Writing applications using security allows developers to implement more secure systems, as well as enabling administrators to manage them by restricting access and system authorizations.
Taking these aspects discussed in the article into consideration, the delivery and use of a safer application become inevitable.
Ask yourself:
- Which customer would want their banking information, tax ID (CPF), or address to be known by unauthorized persons?
- Does the website where you are making online purchases store your credit card information?
- Who guarantees that this information is not encrypted?
- Couldn’t a malicious company employee use your card to make a purchase?
To follow more content like this, subscribe to our newsletter:
