Implementing Java Security

start > courses and registration > training feature sheet

code.

SL-303

length.

3 days

type.

Instructor-Led

partner.

Sun Microsystems

price.

$1,695 :: contact for GSA GOV.

Securely transferring vital data in the Internet world requires sophisticated technologies. The Java development language has several built-in mechanisms as well as a number of extensions that elegantly address security concerns. Recently updated for the Java 2 SDK, Standard Edition, Implementing Java Security provides students with a hands-on development experience using Java security technologies in both existing applications and new applications that they create. Practical work: This course provides students with plenty of lab time for practical experience implementing all of the major Java technology security features presented in the course.

There are currently no scheduled dates for this course. If you are interested in this course, request a course date with the links below.

who can benefit

Experienced programmers, application developers, and security architects who use the Java programming language and are interested in writing secure applications for Internet/intranet distribution, examining the security model used for Java technology programs or acquiring more accurate information on Java technology security can benefit from this course.

prerequisites

Use skills learned in SL-275: Java Programming Language or have a minimum of three months programming experience in the Java programming language, including:

	Implementing interfaces
	Handling exceptions
	Working with layout managers
	Handling events
	Working with threads
	Working with Java input/output classes
	Implementing socket communication

skills gained

	Identify and describe five good security practices and explain how the features of the Java platform address these practices
	Describe the security features provided by the Java virtual machine and the byte-code verifier Implement a security manager or class loader to control specific aspects of security
	Compare and contrast the Sandbox and the Java Protection Domains Security models
	Use the security classes in Java 2 SDK to create new Permission types and a security policy file
	Compare and contrast symmetric and asymmetric cryptography algorithms
	Write a program that uses a LoginModule implementation and a Java Authentication and Authorization (JAAS) policy file to control who runs the program
	Implement digital signatures, message digests, or access control lists to enhance the security provided with the Java programming language
	Use jarsigner and keytool utilities to create and manage public and private keys and certificates, as well as generate and verify signatures for Java archive (JAR) files
	Describe the main classes and interfaces of the Java Cryptography extension (JCE) and Java Secure Socket Extension (JSSE) API

course content details

	Module 1: Security Overview

	Describe abstraction and how it is used in object orientation
	Identify objects and non-objects from a problem domain
	Describe object encapsulation

	Module 2: Class loaders

	Class loader
	How a class loader works (what it controls)
	Applet class loader versus system class loader
	Class loader final methods
	Class loaders and signed classes, and JARs
	Class loader creation
	Class loader implementation
	Lab exercise

	Module 3: Security Managers

	Security managers
	What security managers do or control and how they are different from class loaders
	Security manager creation
	Implementing of a security manager
	Lab exercise

	Module 4: Extending the Sandbox Security Model

	What the original sandbox protects
	What the original sandbox does not protect
	Why an extended model is needed
	Java Protection Domains Security model
	A domain
	What protection domains provide
	What security problem a domain is designed to solve
	Rules for calculating permissions for domains
	Java technology security policy file and format (system and user file)
	Lab exercise

	Module 5: Java 2 SDK Security Classes

	New security classes and how to use them
	java.security.Permission and other Permission
	classesjava.security.AccessController
	java.security.SecureClass
	Loader
	java.security.GeneralSecurity
	Exception
	Lab exercise

	Module 6: Cryptography

	Definition
	Benefits of common encryptions and algorithms
	Java Cryptography Architecture
	Worldwide legal picture of encryption
	Lab Exercise

	Module 7: Message Digests

	What they are
	How to create them
	Classes and methods in the Java 2 SDK security package
	How to use them
	Lab exercise

	Module 8: Digital Signatures and Certificates

	Definition and characteristics of digital signatures
	How to create and manage digital signatures and certificates using keytool and jarsigner
	utilities
	How to use a JAR file
	Browsers and digitally signed files
	Definition of certificates
	X.509 certificates
	Certificate Authority (CAs)
	Browser authentication of certificates
	Lab exercise

	Module 9: Access Control Lists

	Definition of
	Access Control List (ACL) structure in the Java Security API
	How permissions are calculated and for whom
	Why and how to use ACLs in the Java programming language
	Classes in the Java 2 SDK security ACL package
	Lab exercise

	Module 10: Java Authentication and Authorization Service

	What JAAS is
	How JAAS fits into overall security
	JAAS policy and configuration files
	JAAS common classes
	JAAS authentication classes
	JAAS authorization classes
	Lab exercise

	Module 11: Encryption and SSL

	JCE and JCA contrasts
	Major classes and interfaces in JCE
	How and when to use JCE
	What JSSE is
	Secure communication protocols
	What the Secure Socket Layer is
	Secure communications
	Major classes and interfaces in JSSE