Enterprise Java Security: Building Secure J2EE Applications

Paperback (Print)
Used and New from Other Sellers
Used and New from Other Sellers
from $1.99
Usually ships in 1-2 business days
(Save 96%)
Other sellers (Paperback)
  • All (12) from $1.99   
  • New (7) from $46.74   
  • Used (5) from $1.99   
Close
Sort by
Page 1 of 1
Showing All
Note: Marketplace items are not eligible for any BN.com coupons and promotions
$46.74
Seller since 2008

Feedback rating:

(17721)

Condition:

New — never opened or used in original packaging.

Like New — packaging may have been opened. A "Like New" item is suitable to give as a gift.

Very Good — may have minor signs of wear on packaging but item works perfectly and has no damage.

Good — item is in good condition but packaging may have signs of shelf wear/aging or torn packaging. All specific defects should be noted in the Comments section associated with each item.

Acceptable — item is in working order but may show signs of wear such as scratches or torn packaging. All specific defects should be noted in the Comments section associated with each item.

Used — An item that has been opened and may show signs of wear. All specific defects should be noted in the Comments section associated with each item.

Refurbished — A used item that has been renewed or updated and verified to be in proper working condition. Not necessarily completed by the original manufacturer.

New
Brand New, Perfect Condition, Please allow 4-14 business days for delivery. 100% Money Back Guarantee, Over 1,000,000 customers served.

Ships from: Westminster, MD

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
$46.75
Seller since 2007

Feedback rating:

(23495)

Condition: New
BRAND NEW

Ships from: Avenel, NJ

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
$50.45
Seller since 2014

Feedback rating:

(0)

Condition: New
0321118898 Premium Publisher Direct Books are Like New or Brand New books direct from the publisher sometimes at a discount. Multiple copies are usually available. These books ... are not available for expedited shipping and may take up to 14 business days to receive. Read more Show Less

Ships from: Woodland Hills, CA

Usually ships in 1-2 business days

  • Standard, 48 States
  • Express, 48 States
$52.97
Seller since 2014

Feedback rating:

(31)

Condition: New
PAPERBACK New 0321118898 Premium Publisher Direct Books are Like New or Brand New books direct from the publisher sometimes at a discount. Multiple copies are usually ... available. These books are not available for expedited shipping and may take up to 14 business days to receive. Read more Show Less

Ships from: Tarzana, CA

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
  • Express, 48 States
  • Express (AK, HI)
$63.27
Seller since 2009

Feedback rating:

(10473)

Condition: New
New Book. Shipped from US within 4 to 14 business days. Established seller since 2000

Ships from: Secaucus, NJ

Usually ships in 1-2 business days

  • Standard, 48 States
  • Standard (AK, HI)
$77.35
Seller since 2014

Feedback rating:

(5)

Condition: New
New

Ships from: Idyllwild, CA

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
  • Express, 48 States
  • Express (AK, HI)
$81.69
Seller since 2010

Feedback rating:

(9)

Condition: New
2-17-04 other 1 BRAND NEW! ONLY Expedited orders are shipped with tracking number! *WE DO NOT SHIP TO PO BOX* Please allow up to 14 days delivery for order with standard ... shipping. SHIPPED FROM MULTIPLE LOCATIONS. Read more Show Less

Ships from: San Jose, CA

Usually ships in 1-2 business days

  • Canadian
  • Standard, 48 States
  • Standard (AK, HI)
  • Express, 48 States
  • Express (AK, HI)
Page 1 of 1
Showing All
Close
Sort by

Overview

Enterprise Java™ Security: Building Secure J2EE™ Applications provides application developers and programmers with the know-how they need to utilize the latest Java security technologies in building secure enterprise infrastructures. Written by the leading Java security experts at IBM, this comprehensive guide covers the current status of the Java™ 2 Platform, Enterprise Edition (J2EE), and Java™ 2 Platform, Standard Edition (J2SE™), security architectures and offers practical solutions and usage patterns to address the challenges of Java security.

To aid developers who need to build secure J2EE applications, Enterprise Java™ Security covers at length the J2EE security technologies, including the security aspects of servlets, JavaServer Pages(TM) (JSP™), and Enterprise JavaBeans™ (EJB™)—technologies that are at the core of the J2EE architecture. In addition, the book covers Web Services security.

Examples and sample code are provided throughout the book to give readers a solid understanding of the underlying technology.

The relationship between Java and cryptographic technologies is covered in great detail, including:

  • Java Cryptography Architecture (JCA)
  • Java Cryptography Extension (JCE)
  • Public-Key Cryptography Standards (PKCS)
  • Secure/Multipurpose Internet Mail Extensions (S/MIME)
  • Java Secure Socket Extension (JSSE)
Read More Show Less

Product Details

  • ISBN-13: 9780321118899
  • Publisher: Addison-Wesley
  • Publication date: 2/17/2004
  • Edition description: New Edition
  • Pages: 581
  • Product dimensions: 6.80 (w) x 8.90 (h) x 1.40 (d)

Meet the Author

Marco Pistoia is a Research Staff Member in the Java and Web Services Security department at the IBM T. J. Watson Research Center in Yorktown Heights, New York. He has written ten books and several conference papers and journal articles, and has also presented worldwide on all areas of Java and e-business security. Most recently, he was the lead author of the book Java 2 Network Security, Second Edition (Prentice Hall, 1999).

Nataraj Nagaratnam is a Senior Technical Staff Member and the lead security architect for IBM’s WebSphere software family in Raleigh, North Carolina. He has coauthored the Web Services security specifications and actively participates in the Java community process on the topics related to J2EE security. He was the lead author of one of the first books on Java networking, Java Networking and AWT API SuperBible (Waite Group Press, 1996).

Larry Koved is a Research Staff Member and the manager of the Java and Web Services Security department at the IBM T. J. Watson Research Center in Yorktown Heights, New York. He was actively involved in the design of JAAS and the EJB V1.1 security architecture, has published over twenty-five articles and technical reports, and has presented at conferences worldwide.

Anthony Nadalin is a Senior Technical Staff Member and IBM Software Group’s lead security architect for Java and Web Services in Austin, Texas. He is responsible for security infrastructure design and development across IBM, Tivoli, and Lotus. He has authored and coauthored over thirty technical journal and conference articles, as well as the book Java and Internet Security (iUniverse.com, 2000).

0321118898AB01122004

Read More Show Less

Read an Excerpt

The purpose of this book is to illustrate the applicability of Java 2 Platform, Enterprise Edition (J2EE), and Java 2 Platform, Standard Edition (J2SE), security technologies in building a secure enterprise infrastructure containing Java-based enterprise applications. With a pragmatic approach, the book explains why Java security is a key factor in an e-business environment and how application developers can use this technology in building secure enterprise applications.

The book introduces the J2EE and J2SE security architectures, showing how these architectures relate to each other and how they are augmented by Java Authentication and Authorization Service (JAAS) to provide authentication and authorization. Then, the book delves into the J2EE security technologies: The security aspects of servlets, JavaServer Pages (JSP), and Enterprise JavaBeans (EJB) are treated in detail because these technologies constitute the core of the J2EE architecture. To satisfy the needs of developers who need to build J2EE applications and want to do so securely and reliably, the book covers in great detail the relationship between J2EE and cryptographic technologies; Java Cryptography Architecture, Java Cryptography Extension, Public-Key Cryptography Standards, Secure/Multipurpose Internet Mail Extensions, and Java Secure Socket Extension are also described in detail. The book explains how to work with J2EE in practice and shows how the technologies presented work together and are integrated. The scenarios described are targeted to J2EE developers and deployers needing to build an integrated, secure, component-based system. Finally, Web Services security and other emerging technologies are discussed, along with a description of how the underlying middleware works. The book ends by summarizing the impact of J2EE security in today’s e-business environments.

Unlike other treatments of Java security, this book discusses the J2SE and J2EE security architectures, providing practical solutions and use patterns to address the challenges that lie ahead as these architectures evolve to address enterprise e-business needs. The goal is to give practical guidance to groups involved in making Java-based applications or Web sites into industrial-strength commercial propositions. Examples are provided to give the reader a clearer understanding of the underlying technology.

To achieve the goals of portability and reusability, J2EE security has been designed to be mainly declarative. Most of the authentication, authorization, integrity, confidentiality, and access-control decisions on a J2EE platform can be made through configuration files and deployment descriptors, which are external to the applications. This reduces the burden on the programmer and allows Java enterprise programs to be portable, reusable, and flexible. For this reason, Parts I and II focus on the declarative approach of Java security by showing examples of configuration files and deployment descriptors. Additionally, these parts of the book explain how to use the programmatic approach if declarative security alone is insufficient. (Sample programs can be found in Chapters 4 and 5.) The majority of the sample code of this book can be found in Parts III and IV.

This book has its roots in several articles we wrote for the IBM Systems Journal and IBM developerWorks, describing the origins of Java security and the security for enterprise applications using the J2EE programming model. Although we are geographically dispersed around the United States, we had gathered in Santa Clara, California, at the O’Reilly Conference on Java in March 2000 to present on a number of security topics. It was clear that developers and managers were not familiar with Java security features, J2EE security, and how to manage security in a J2EE environment. Inquiries on Java and J2EE security were being routed to us via e-mail and through our colleagues. We had already written a book on J2SE security, but a book on security for enterprise applications, including those written for server-based applications and Web Services, was needed.

This book draws and expands on material from multiple sources, including the J2SE security book and articles mentioned. Specifically, this book covers J2SE V1.4 and J2EE V1.4. The relevant specifications for J2EE covered in this book include the J2EE V1.4 specification, the Java Servlet V2.4 specification, the EJB V2.1 specification, and the Web Services specifications. The list of the sources used in this book can be found in Appendix D.

Read More Show Less

Table of Contents

Foreword.

Preface.

About the Authors.

I. ENTERPRISE SECURITY AND JAVA.

1. An Overview of Java Technology and Security.

Why Java Technology for Enterprise Applications?

Enterprise Java Technology.

Java Technology as Part of Security.

An Overview of Enterprise Security Integration.

Time to Market.

2. Enterprise Network Security and Java Technology.

Networked Architectures.

Network Security.

Server-Side Java Technology.

Java and Firewalls.

Summary.

II. ENTERPRISE JAVA COMPONENTS SECURITY.

3. Enterprise Java Security Fundamentals.

Enterprise Systems.

J2EE Applications.

Secure Interoperability between ORBs.

Connectors.

JMS.

Simple E-Business Request Flow.

J2EE Platform Roles.

J2EE Security Roles.

Declarative Security Policies.

Programmatic Security.

Secure Communication within a WAS Environment.

Secure E-Business Request Flow.

4. Servlet and JSP Security.

Introduction.

Advantages of Servlets.

Servlet Life Cycle.

The Deployment Descriptor of a Web Module.

Authentication.

Authorization.

Principal Delegation.

Programmatic Security.

Runtime Restrictions for Web Components.

Usage Patterns.

Partitioning Web Applications.

5. EJB Security.

Introduction.

EJB Roles and Security.

Authentication.

Authorization.

Delegation.

Security Considerations.

6. Enterprise Java Security Deployment Scenarios.

Planning a Secure-Component System.

Deployment Topologies.

Secure Communication Channel.

Security Considerations.

III. THE FOUNDATIONS OF JAVA 2 SECURITY.

7. J2SE Security Fundamentals.

Access to Classes, Interfaces, Fields, and Methods.

Class Loaders.

The Class File Verifier.

The Security Manager.

Interdependence of the Three Java Security Legs.

Summary.

8. The Java 2 Permission Model.

Overview of the Java 2 Access-Control Model.

Java Permissions.

Java Security Policy.

The Concept of CodeSource.

ProtectionDomains.

The Basic Java 2 Access-Control Model.

Privileged Java 2 Code.

ProtectionDomain Inheritance.

Performance Issues in the Java 2 Access-Control Model.

Summary.

9. Authentication and Authorization with JAAS.

Overview of JAAS and JAAS Terminology.

Authentication.

Authorization Overview.

JAAS and J2EE.

Additional Support for Pluggable Authentication.

IV. ENTERPRISE JAVA AND CRYPTOGRAPHY.

10. The Theory of Cryptography.

The Purpose of Cryptography.

Secret-Key Cryptography.

Public-Key Cryptography.

11. The Java 2 Platform and Cryptography.

The JCA and JCE Frameworks.

The JCA API.

The JCE API.

JCE in Practice.

Security Considerations.

12. PKCS and S/MIME in J2EE.

PKCS Overview.

S/MIME Overview.

Signing and Verifying Transactions with PKCS and S/MIME.

Encrypting Transactions with PKCS and S/MIME.

Security Considerations.

Future Directions.

13. The SSL and TLS Protocols in a J2EE Environment.

The SSL and TLS Protocols.

HTTPS.

Using the SSL Support Built into J2EE Products.

Using SSL from within J2EE Programs.

Examples.

Summary.

V. ADVANCED TOPICS.

14. Enterprise Security for Web Services.

XML.

SOAP

WSDL.

Security for Web Services: Motivations.

Security Technologies.

Web Services Security Model Principles.

Application Patterns.

Use Scenario.

Web Services Provider Security.

Security Considerations.

Futures.

15. Security Considerations for Container Providers.

Understanding the Environment.

Authentication.

Authorization.

Secure Communication.

Secure Association.

Access to System Resources.

Mapping Identities at Connector Boundaries.

16. Epilogue.

VI. APPENDIXES.

Appendix A. Security of Distributed Object Architectures.

Appendix B. X.509 Digital Certificates.

Appendix C. Technical Acronyms Used in This Book.

Appendix D. Sources Used in This Book.

Index.

Read More Show Less

Preface

The purpose of this book is to illustrate the applicability of Java 2 Platform, Enterprise Edition (J2EE), and Java 2 Platform, Standard Edition (J2SE), security technologies in building a secure enterprise infrastructure containing Java-based enterprise applications. With a pragmatic approach, the book explains why Java security is a key factor in an e-business environment and how application developers can use this technology in building secure enterprise applications.

The book introduces the J2EE and J2SE security architectures, showing how these architectures relate to each other and how they are augmented by Java Authentication and Authorization Service (JAAS) to provide authentication and authorization. Then, the book delves into the J2EE security technologies: The security aspects of servlets, JavaServer Pages (JSP), and Enterprise JavaBeans (EJB) are treated in detail because these technologies constitute the core of the J2EE architecture. To satisfy the needs of developers who need to build J2EE applications and want to do so securely and reliably, the book covers in great detail the relationship between J2EE and cryptographic technologies; Java Cryptography Architecture, Java Cryptography Extension, Public-Key Cryptography Standards, Secure/Multipurpose Internet Mail Extensions, and Java Secure Socket Extension are also described in detail. The book explains how to work with J2EE in practice and shows how the technologies presented work together and are integrated. The scenarios described are targeted to J2EE developers and deployers needing to build an integrated, secure, component-based system. Finally, Web Services security and other emerging technologies are discussed, along with a description of how the underlying middleware works. The book ends by summarizing the impact of J2EE security in today’s e-business environments.

Unlike other treatments of Java security, this book discusses the J2SE and J2EE security architectures, providing practical solutions and use patterns to address the challenges that lie ahead as these architectures evolve to address enterprise e-business needs. The goal is to give practical guidance to groups involved in making Java-based applications or Web sites into industrial-strength commercial propositions. Examples are provided to give the reader a clearer understanding of the underlying technology.

To achieve the goals of portability and reusability, J2EE security has been designed to be mainly declarative. Most of the authentication, authorization, integrity, confidentiality, and access-control decisions on a J2EE platform can be made through configuration files and deployment descriptors, which are external to the applications. This reduces the burden on the programmer and allows Java enterprise programs to be portable, reusable, and flexible. For this reason, Parts I and II focus on the declarative approach of Java security by showing examples of configuration files and deployment descriptors. Additionally, these parts of the book explain how to use the programmatic approach if declarative security alone is insufficient. (Sample programs can be found in Chapters 4 and 5.) The majority of the sample code of this book can be found in Parts III and IV.

This book has its roots in several articles we wrote for the IBM Systems Journal and IBM developerWorks, describing the origins of Java security and the security for enterprise applications using the J2EE programming model. Although we are geographically dispersed around the United States, we had gathered in Santa Clara, California, at the O’Reilly Conference on Java in March 2000 to present on a number of security topics. It was clear that developers and managers were not familiar with Java security features, J2EE security, and how to manage security in a J2EE environment. Inquiries on Java and J2EE security were being routed to us via e-mail and through our colleagues. We had already written a book on J2SE security, but a book on security for enterprise applications, including those written for server-based applications and Web Services, was needed.

This book draws and expands on material from multiple sources, including the J2SE security book and articles mentioned. Specifically, this book covers J2SE V1.4 and J2EE V1.4. The relevant specifications for J2EE covered in this book include the J2EE V1.4 specification, the Java Servlet V2.4 specification, the EJB V2.1 specification, and the Web Services specifications. The list of the sources used in this book can be found in Appendix D.

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star

(0)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)