An in-depth treatment of J2EE security architectural patterns and practices and how to apply them optimally to enterprise applications.

Ray Lai is Principal Engineer at Sun Microsystems.

"The problems that exist in the world todaycannot be solved by the level of thinking that created them."--Albert Einstein Security now has unprecedented importance in the information industry. It compels every business and organization to adopt proactive or reactive measures that protect data, processes, communication, and resources throughout the information lifecycle. In a continuous evolution, every day a new breed of business systems is finding its place and changes to existing systems are becoming common in the industry. These changes are designed to improve organizational efficiency and cost effectiveness and to increase consumer satisfaction. These improvements are often accompanied by newer security risks, to which businesses must respond with appropriate security strategies and processes. At the outset, securing an organization's information requires a thorough understanding of its security-related business challenges, potential threats, and best practices for mitigation of risks by means of appropriate safeguards and countermeasures. More importantly, it becomes essential that organizations adopt trusted proactive security approaches and enforce them at all levels--information processing, information transmittal, and information storage. What This Book Is About This book is meant to be a hands-on practitioner's guide to security. It captures a wealth of experience about using patterns-driven and best practices-based approaches to building trustworthy IT applications and services. The primary focus of the book is on the introduction of a security design methodology using a proven set of reusable patterns, best practices, reality checks, defensive strategies, and assessment checklists that can be applied to securing J2EE applications, Web Services, Identity Management, Service Provisioning, and Personal Identification. The book presents a catalog of 23 new security patterns and 101 best practices, identifying use case scenarios, architectural models, design strategies, applied technologies, and validation processes. The best practices and reality checks provide hints on real-world deployment and end-user experience of what works and what does not. The book also describes the architecture, mechanisms, standards, technologies, and implementation principles of applying security in J2EE applications, Web Services, Identity Management, Service Provisioning, and Personal Identification and explains the required fundamentals from the ground up. Starting with an overview of today's business challenges, including the identification of security threats and exploits and an analysis of the importance of information security, security compliance, basic security concepts, and technologies, the book focuses in depth on the following topics: Security mechanisms in J2SE, J2EE, J2ME, and Java Card platforms Web Services security standards and technologies Identity Management standards and technologies Security design methodology, patterns, best practices, and reality checks Security patterns and design strategies for J2EE applications Security patterns and design strategies for Web Services Security patterns and design strategies for Identity Management Security patterns and design strategies for Service Provisioning Building an end-to-end security architecture--case study Secure Personal Identification strategies for using Smart Cards and Biometrics The book emphasizes the use of the Java platform and stresses its importance in developing and deploying secure applications and services. What This Book Is Not While this book is heavily based on Java technologies, we do not describe the specific Java APIs intended for basic J2EE application development (e.g., JSPs, Servlets, and EJB). If you wish to learn the individual API