Friends of OpenJDK Today
Foojay Podcast #7: Security in Java, what do we need to know and how to keep our applications secure?
November 21, 2022Author(s)
For this Foojay Podcast, we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.
How can you make and keep your systems safe?
That's what we want to find out...
Guests
- Steve Poole (Sonatype, @spool167)
- Brian Vermeer (Snyk, @BrianVerm, @[email protected])
- Anastasiia Voitova (Cossack Labs, @vixentael, @[email protected])
Host
- Erik Costlow (Azul, @costlow, @[email protected])
Content
- 00'00 Short intro and music
- 00'15 Introduction about the topic of this podcast
- 00'31 Introduction of the guests and host
- 02'40 Foojay article written by Brain about dependencies
- 05'02 XML parsers in Java
- 05'55 "The more the merrier" versus "The less the better"
- 06'30 Foojay article written by Brain about the role of Data Transfer Objects in security
- 09'10 Extending on DTOs: encryption in data provisioning
- 11'10 Database entities versus DTOs and serialization
- 12'25 Developers need to be trained more on security and take responsibility
- 13'50 Don't design your own security solution
- 16'58 Cryptograpic dad joke... 😉
- 17'40 What are CVEs (Common Vulnerabilities and Exposures)
- 20'40 Security in the layers of a Java environment
- 24'50 JAR signing
- 26'40 CWE with the W of Weaknesses and OWASP
- 29'40 How to evaluate vulnerability scores
- 31'23 CVEs as Pokemon, "You gotta catch them all" workshop
- 32'20 How to be able to fix vulnerabilities
- 33'57 About the recent critical SSL vulnerability
- 36'02 Libraries are linked (integrated) into a Java project
- 38'15 Security is an educational thing and understand your tools
- 39'90 Role of the different players in a team
- 46'32 Can the JVM itself be more secure
- 49'44 Make the JVM aware of vulnerable code
- 51'10 Security insights in IoT devices
- 1h01'30 Developers should learn about defending depth
- 1h02'10 Conclusion
-
How to Use Java DTOs to Stay Secure
How DTOs are used in modern Java applications, ways your application can benefit, and how Java DTOs can help you be more secure by preventing accidental data leaks.
Read More -
Best Practices for Managing Java Dependencies
Knowing how to select, update, and remove Java dependencies from our application is essential for security.
Read More -
Java Security: Log4J, the SecurityManager, and Funding
A demonstration of log4j exploits, which defenses people tried, and which worked. A look at open source funding models, subscriptions, and bug bounty programs to see why it’s sometimes hard to donate.
Read More
