Home » Tag Archives: Security (page 10)

Tag Archives: Security

Database and Webapp Security

java-logo

Threat Model This is a discussions on database and webapp security loosely based on the quick reference page on my site. That page is becoming unwieldy and does not make it easy for readers to interact with me or others. Threat Model All security analysis must begin by examining the threat model. A threat model requires you to answer four ...

Read More »

Permissions in OSGi

osgi-alliance-logo

In a previous post, we looked at implementing a sandbox for Java applications in which we can securely run mobile code. This post looks at how to do the same in an OSGi environment. OSGi The OSGi specification defines a dynamic module system for Java. As such, it’s a perfect candidate for implementing the kind of plugin system that would ...

Read More »

Sandboxing Java Code

java-logo

In a previous post, we looked at securing mobile Java code. One of the options for doing so is to run the code in a cage or sandbox. This post explores how to set up such a sandbox for Java applications. Security Manager The security facility in Java that supports sandboxing is the java.lang.SecurityManager. By default, Java runs without a ...

Read More »

Signing Java Code

java-logo

In a previous post, we discussed how to secure mobile code. One of the measures mentioned was signing code. This post explores how that works for Java programs. Digital Signatures The basis for digital signatures is cryptography, specifically, public key cryptography. We use a set of cryptographic keys: a private and a public key. The private key is used to ...

Read More »

Building Both Security and Quality In

agile-logo

One of the important things in a Security Development Lifecycle (SDL) is to feed back information about vulnerabilities to developers. This post relates that practice to the Agile practice of No Bugs. The Security Incident Response Even though we work hard to ship our software without security vulnerabilities, we never succeed 100%. When an incident is reported (hopefully responsibly), we ...

Read More »

What is HMAC Authentication and why is it useful?

software-development-2-logo

To start with a little background, then I will outline the options for authentication of HTTP based server APIs with a focus on HMAC and lastly I will provide some tips for developers building and using HMAC based authentication. Recently I have been doing quite a bit of research and hacking in and around server APIs. Authentication for these type ...

Read More »

Fixing common Java security code violations in Sonar

sonar-logo

This article aims to show you how to quickly fix the most common java security code violations. It assumes that you are familiar with the concept of code rules and violations and how Sonar reports on them. However, if you haven’t heard these terms before then you might take a look at Sonar Concepts or the forthcoming book about Sonar ...

Read More »

How to Cheat at Application Security

software-development-2-logo

Developers need to know a lot in order to build secure applications. Some of this is good software engineering and defensive design and programming – using (safe) APIs properly, carefully checking for errors and exceptions, adding diagnostics and logging, and never trusting anything from outside of your code (including data and other people’s code). But there are also lots of ...

Read More »

Outbound Passwords

software-development-2-logo

Much has been written on how to securely store passwords. This sort of advice deals with the common situation where your users present their passwords to your application in order to gain access. But what if the roles are reversed, and your application is the one that needs to present a password to another application? For instance, your web application ...

Read More »

XACML In The Cloud

software-development-2-logo

The eXtensible Access Control Markup Language (XACML) is the de facto standard for authorization. The specification defines an architecture (see image on the right) that relates the different components that make up an XACML-based system. This post explores a variation on the standard architecture that is better suitable for use in the cloud. Authorization in the Cloud In cloud computing, ...

Read More »
Do you want to know how to develop your skillset and become a ...

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!
Get ready to Rock!
To download the books, please verify your email address by following the instructions found on the email we just sent you.

THANK YOU!

Close