All 0 Likes
JEP 411: What it Means for Java’s Security Model and Why You Should Apply the Principle of Least Privilege
Java, like most platforms or languages has layers of security. This article intends to look at Java's Authorization layer, which is unlike in other languages. We will also distinguish between two different ways this layer is typically utilized and why one is effective while the other isn't. Furthermore, we investigate why JEP 411 only considers the least effective method and hopefully we will increase awareness of the Principle of Least Privilege as it is applied to Java Authorization, improve adoption and encourage people to take advantage of the improved security it provides. We hope to prolong its support and possibly even improve it in future.
The SecurityManager and associated infrastructure are the foundations upon which to build secure software, but by themselves are insufficient for limiting users and Java software to the principles of least privilege.
JEP 411 removes the SecurityManager and AccessController.
In doing so, your library code will be able to run with the full permissions of its Java process, which is the same as running with none of the permission checks that were used to harden Java’s API.
If an attacker breaks into your Java process via some other vulnerability, they will be able to load their own byte codes, and pretty much do whatever the process permissions permits them and possibly more if your system has other vulnerabilities.
If you want to know what I spoke about in @jcon_conference in Germany, here's an interview I did at the @foojayio podcast:
#Java #JCON #JakartaEE #AI #A2A
Our team loves to meet and talk with the Java community from around the world. If you want to learn more. You can find all OmniFish presentations at: https://speakerdeck.com/omnifish, including links to the source code of related demos. Or get in touch for a free consultation call.
Another happy customer :)
"Their expertise and flexible hands-on troubleshooting support accelerated resolution of several unexpected hurdles and ultimately got us to a successful upgrade outcome."
If you would like to discuss how we could help your company, get in touch.
All 4 Comments