Java™ Security

J. Steven Fritzinger, Marianne Mueller

Sun Microsystems, Inc.

INTRODUCTION months, the application lock of traditional operating systems

also forces the organization to support many different
Since its release in May of 1995, Java has swept across the
versions of the application. This administrative overhead
Internet. With its promise of truly network oriented
makes networked computing with traditional PCs a very
computing and a nearly universal system for distributing
expensive proposition.1
applications, Java is widely seen as the solution to many of
the most persistent problems in client/server computing and With their Write Once/Run Anywhere capability, Java
on the World Wide Web. However, this same ability to applications do not suffer from these problems. Developers
distribute executables automatically over the network raises working on a Sun Ultra computer running the Solaris
concerns about Java’s effect on network security. These operating system can produce an executable which also runs
concerns have been heightened by the discovery of several on Windows PCs, Macintosh and many other types of
security related bugs in existing Java implementations. computers without any porting. This frees up development
resources for other work and ensures that new applications
This paper discusses these concerns and how Java addresses
and new versions of old applications are simultaneously
them. It also describes several efforts underway to enhance
available for all platforms in an organization.
and extend the Java security model. It is divided into three
sections. The first section describes Java in general and
The Virtual Machine
discusses the security implications of Java. Readers who are
already familiar with Java may wish to proceed to the second Java provides its Write Once/Run Anywhere capability
section which discusses computer security in general, how through the Java Virtual Machine. The Virtual Machine is
s e c u r i t y a ff e c t s n e t w o r k e d s y s t e m s a n d s o m e implemented on top of a machine’s native operating system.
m i s c o n c e p t i o n s a b o u t s e c u r i t y. B e c a u s e t h e s e Java applications run on top of the virtual machine. The
misconceptions are very common and affect how people virtual machine insulates the application from differences
approach new technology, readers who are unfamiliar with between underlying operating systems and hardware and
general security issues are encouraged to read this section ensures cross platform compatibility among all
carefully. The third section discusses Java security in implementations of the Java platform (see fig. 1).
particular, looks at how the security model is implemented,
and describes upcoming extensions to the security model. Java Applications
JAVA
Java Virtual Machine
The Java Platform
Java is a revolutionary new application platform from Sun
Microsystems. Like other operating systems, the Java Solaris Windows MacOS JavaOS
platform provides developers with I/O, networking, windows
and graphics capabilities and other facilities needed to
develop and run sophisticated applications. The Java SPARC/Intel Intel/Others PowerPC Thin Clients
platform also provides an important capability not found in
traditional operating systems. This ability, called Write Fig. 1 The Java Virtual Machine sits between a native operating
Once/Run Anywhere executables, allows Java programs system and Java applications, allowing a single executable to
written on one type of hardware or operating system to run run on many different systems.
unmodified on almost any other type of computer.
The Java Virtual machine was first widely available in web
Applications written for traditional operating systems are browsers. Java-enabled browsers are currently available for
tied directly to that platform and cannot be easily moved to
another machine or operating system. This locks developers
to that particular, often proprietary, system. If the application 1 A recent report from Forrester Research estimates that, for
must be deployed on other platforms, the developers must companies aggressively managing their PC related costs, cost of
port the application to those platforms. These porting efforts ownership for the average PC ranges between $3,500 and
are often expensive and waste resources that could be used $5,000 per year. Other studies have shown that for companies
for new development. Because ports to the secondary which are not closely watching PC related costs, cost of owner-
platforms often lag behind the primary platform by several ship can be as high as $12,000 per year.

© Sun Microsystems, Inc., 1996 1

the major versions of the Unix operating system, Windows secure means of distributing executable code over the
3.1, 95, and NT, the MacOS and OS/2 Warp. The Java internet, it it perhaps the best known and most widely used.
Virtual Machine has also been licensed by every major
operating systems vendor, including Apple, HP, IBM, WHAT IS SECURITY?
Microsoft and SunSoft. These vendors will bundle the Java
Virtual Machine with their operating systems. As these The Security Process
implementations become available over the next several
months, Java will become a standard part of all important Effective security is an on-going process which must involve
operating systems, and an expected part of every desktop. every member of an organization and touch every aspect of
its operation. The strongest possible network and computer
Applets security does little to protect an organization which has not
Web Applets are one of the most exciting uses of the Java taken steps to ensure that its employees are trustworthy or to
Platform. Applets are small pieces of executable code which protect its physical assets from theft. Similarly, the best
may be included in Web pages and which run inside of the security mechanisms and procedures quickly fall into
user’s browser. While traditional web pages have been disrepair if they are not constantly reinforced by training and
limited to simple text and graphics, applets allow web periodically updated to account for new threats.
publishers to include sophisticated, interactive applications
in their pages. For example, a stock broker might want to Cost V. Security
publish the results of a financial analysis model. With Security is one means by which an organization can protect
applets, instead of publishing a simple graph showing the or extend a competitive advantage. By protecting valuable
results of the model, the broker could publish the model physical assets or proprietary intellectual property, security
itself, along with connections to live stock market data and policies and procedures allow an organization to exploit
the customer’s portfolio. those assets to the fullest. But there are costs associated with
all security procedures and these costs must be weighed
Security Implications against the value of the assets protected by those measures
While applets solve many of the important problems in and the potential harm which could be caused by the loss of
client/server and network-centric computing, they also raise that asset. A company which wished to advertise on the Web
new concerns about security. In traditional environments, may be satisfied with a simple firewall to discourage
companies could protect themselves by controlling physical electronic vandals. A large financial institute with billions of
and network access to their computers by establishing dollars at stake could justify much more elaborate security
policies for what kinds of software can be used on their measures, possibly including public key encryption,
machines. These steps include building a firewall between dedicated, private networks and regular security audits. In
the Internet and the company’s intranet, obtaining software extreme cases, public safety and national security may be at
only from known and trusted sources, and using anti-virus risk. For applications such as air traffic control and military
programs to check all new software. and intelligence systems, the risks of connecting these
systems to the Internet may so far out-weigh the benefits of
Use of applets potentially adds a new security vunerability. increased communication that the most sensitive of these
An employee searching an external Web site for information systems should never be connected (see fig. 2).
might inadvertently load and execute an applet without being
aware that the site contains executable code. This automatic
distribution of executables makes it very likely that software
will be obtained from untrusted third parties. Since the National
applet is imported into the user’s web browser and runs Security
Security

On-line commerce
locally, this software could potentially steal or damage
information stored in the user’s machine on a network file
server. Also, since this software is already behind the Web advertiser
company’s firewall, the applet could attack other unprotected
machines on a corporate intranet. These attacks would not be
stopped by traditional security measures. Cost
Java protects its users from these dangers by placing strict Fig. 2 Increasing security increases costs. Organizations
limits on applets. Applets cannot read from or write to the must choose the appropriate trade off.
local disk. Stand-alone windows created by applets are
clearly labeled as being owned by untrusted software. These
limits prevent malicious applets from stealing information, New Technology
spreading viruses, or acting as Trojan horses. Applets are
also prohibited from making network connections to other Since no security system can ever be 100% secure, it is not
computers on the corporate intranet. This prevents malicious meaningful to ask if a new technology or system is “secure”.
applets from exploiting security flaws that might exist Instead one should evaluate the new technology in light of
behind the firewall or in the underlying operating system. the existing cost/security tradeoffs. If the new technology
While Java is the not first or only platform that claims to be a makes it easier or cheaper to obtain the same level of
security, that technology would be very attractive. If, on the

© Sun Microsystems, Inc., 1996 2

o t h e r h a n d , t h e n ew s y s t e m o p e n s n ew s e c u r i t y risk from undetected viruses in commercial software,
vulnerabilities and makes it more costly to achieve an disgruntled employees and industrial espionage.
acceptable level of security, the organization must carefully
weigh the benefits offered by the technology and ask itself if While this company spends vast sums of money and
these benefits are worth either the added risk they bring or resources chasing the chimera of total security, its
the added expense required to manage these risks. competitors with more realistic security policies would be
concentrating on more practical matters such as exploiting
Usability new, “risky” technologies to better their competitive
position.
When calculating security costs, usability is an important,
and often hidden, factor. If security mechanisms are too Piecemeal Security
time-consuming or difficult to use, they can decrease
productivity by taking time and resources which should have The risk avoidance fallacy is very common among computer
been directed to the organization’s mission. Overly stringent users and managers. Fortunately, most security professionals
procedures can actually weaken security. Users who find the recognize that their goal is risk management, not risk
policies difficult to follow may ignore the policies or avoidance, and do not fall into this trap. Among these
implement them haphazardly. In extreme cases, where the professionals, piecemeal security is a more common
policies are seen as bureaucratic roadblocks, users may problem.
actively sabotage the policies in order to “get the job done” Piecemeal security is the tendency to look at small pieces of
(see fig. 3). a system or network in isolation from the system as a whole.
Because computer systems and especially computer
networks can be extremely complex, it is of little value to
examine individual aspects of the system. Informed security
decisions can only be made by examining the entire system
Security

and looking for the unanticipated side-effects of adding a

new type of software or network resource.
Piecemeal security often is the result of having several
departments responsible for different aspects of security. If
these departments do not work closely together, each can set
policies without regard for how those policies affect security
Cost as a whole. This can create vulnerabilities at the borders
between two departments and decrease the total security of
Fig. 3 Overly complicated and difficult to follow
procedures reduce overall security and increase cost. the organization. These gaps are particularly dangerous since
attackers may actively seek out areas in which several
departments share security responsibilities or in which there
In general, it is very difficult to design easy-to-use or is a gap between departments.
automatic security mechanisms which still effectively
Steel Doors And Grass Huts
protect an organization’s assets. Despite these difficulties,
Java is able to provide transparent security mechanisms, Piecemeal security can lead an organization to over-react to a
which do not require any knowledge or action on the part of perceived vulnerability. This is often the case when dealing
the end user. This is possible because Java’s security model with new technologies. A flaw found in the new technology
is intended to protect the end-user from hostile executables prompts the organization to expend great effort patching the
accidentally imported from untrusted sources. Limiting these vulnerability, without first checking to see if this same
so called “Trojan horses” is a much easier task than vulnerability exists, undetected, in existing systems. Like
providing general network and physical security. Since steel doors on a grass hut, these patches, produced at great
Java’s security model is intended to augment, not replace, expense, close one possible hole but do little to increase the
these traditional security mechanisms, Java can provide a security of the system as a whole.
simple, usable solution to this simpler, more manageable
problem. While the desire to build steel doors to protect against newly
perceived threats can waste resources and slow the adoption
Common Security Fallacies of new technology, previously constructed steel doors can
blind an organization to new or previously unnoticed threats.
Risk Avoidance
If the new found threat is not well-understood and is similar
The most common security fallacy is that the goal of security to the threat which motivated the construction of the steel
is to eliminate all risk and vulnerabilities from a system. As door, false confidence in the elaborately constructed door’s
discussed above, this is an unobtainable goal and little good ability to protect against the new threat can slow the
comes from pursuing it. A company with a “zero tolerance” adoption of more effective measures.
approach to security risks would be forced to disconnect
itself completely from the Internet and thus would not Keeping Current
benefit from the vast resources and near-universal One of the most important parts of the security process is
connectivity it provides. Such a company would still be at staying informed. New vulnerabilities in computer and

© Sun Microsystems, Inc., 1996 3

network systems, and new attacks which exploit those updated with samples of newly discovered viruses and must
vulnerabilities, are found regularly. Because of these new be installed on each machine. Also, many virus checkers can
attacks, even the most secure installation will quickly be turned off, either accidentally, as part of an installation
become vulnerable if its security is not actively maintained procedure, or to save time when handling “safe” diskettes. If
by a well-informed, up-to-date staff. the checker is accidentally left off, the machine and possibly
the entire organization are at risk.
The CERT2 Coordination Center (CERT/CC) maintains an
excellent set of on-line resources for security professionals. Java solves these problems, and the usability problem
The CERT/CC evolved from an Advanced Research Projects discussed above, by automatically confining applets to the
Agency (ARPA) computer emergency response team formed sandbox. End-users do not have to take any special action in
in 1988 following the Morris Internet Worm. The CERT/CC order to ensure the safety of the machine. Because the
collects and investigates reports of security attacks and new sandbox prevents the actions required to spread a virus or
found vulnerabilities. They distribute this information as steal information, instead of trying to identify a virus-
CERT Advisories, which document the vulnerabilities, list infected executable or potential attacker, the sandbox does
confirmed and rumored occurrences of attacks exploiting the not require periodic updates with new viruses.
vulnerabilities, and document patches and procedures to
close the vulnerabilities. Applets And Applications

Over the last several years the CERT/CC has documented Java programs can exist in two forms: as applets, which
approximately 10 to 20 new-found vulnerabilities and travel across the Internet or intranet as part of a web page
attacks each year. These vulnerabilities cover all aspects of and run inside of the end-user’s browser; or as traditional
computer security on systems ranging from mainframes to stand-alone applications. Only applets are subject to the
M i c r o s o f t Wi n d ow s . C E RT A d v i s o r i e s a n d o t h e r security restrictions described above.
information can be found on their web site at http:// Java applications are purchased and installed just like
www.cert.org. traditional commercial applications. They may be purchased
in “shrink-wrapped” boxes or imported over a network, and
JAVA SECURITY may be installed by users or system administrators
(according to standard practice within an organization.)
The Sandbox Since applications are not imported from outside the
Java’s security allows a user to import and run applets from organization, and are (in theory) only installed by trusted
the Web or an intranet without undue risk to the user’s individuals, Java applications add no new security concerns.
machine. The applet’s actions are restricted to its “sandbox”, Security comes from maintaining physical control over the
an area of the web browser dedicated to that applet. The systems, preventing end-users from downloading untrusted
applet may do anything it wants within its sandbox, but applications from the net, using virus checkers and other
cannot read or alter any data outside of its sandbox. The traditional security measures.
sandbox model is to run untrusted code in a trusted
environment so that if a user accidentally imports a hostile Building The Sandbox
applet, that applet cannot damage the local machine. The sandbox is made up of several different systems
operating together. These systems range from security
This approach is much different from that used in traditional
managers running inside of the application which imported
operating systems. Because most operating systems allow
the applet, to safety features built into the Java language and
applications broad access to the machine, especially in PCs
the virtual machine.
where very little protection is provided by the operating
system, the runtime environment cannot be trusted. To Class Loader
compensate for this lack, security policies often require a
level of trust to be established in the application before it is When an applet is to be imported from the network, the web
executed. For example, an organization might require that browser calls the applet class loader. The class loader is the
before an employee runs an application obtained from the first link in the security chain. In addition to fetching an
web, that application must be checked for viruses and its applet’s executable code from the network, the class loader
source code examined for malicious code. enforces the name space hierarchy. A name space controls
what other portions of the Java Virtual Machine an applet
There are two problems with this approach. First, the checks can access. By maintaining a separate name space for trusted
required to build trust in the application may be too complex code which was loaded from the local disk, the class loader
and time-consuming to be practical. Few employees will prevents untrusted applets from gaining access to more
take the time to read the source code of an application and privileged, trusted parts of the system.
compile it locally to ensure that it takes no hidden hostile
actions. Second, virus checkers require constant Applets downloaded from the net cannot create their own
maintenance in order to remain effective. They must be class loaders. Downloaded applets are also prevented from
invoking methods in the system’s class loader.
Verifier
2 CERT is a service mark of Carnegie Mellon University

© Sun Microsystems, Inc., 1996 4

Before running a newly imported applet, the class loader the system. This practice, known as security through
invokes the verifier. The verifier checks that the applet obscurity, assumed that if the system was presented as a
conforms to the Java language specification and that there black box then no one would expend the effort needed to
are no violations of the Java language rules or name space discover the hidden vulnerabilities. The existence of the
restrictions. The verifier also checks for common violations CERT/CC and a number of well publicized network attacks
of memory management, like stack underflows or overflows, in recent years demonstrate that this assumption is
and illegal data type casts, which could allow a hostile applet unfounded; the box is never black enough. This is especially
to corrupt part of the security mechanism or to replace part true for commercially successful systems. For such widely
of the system with its own code. used systems, too many people know the internal workings
of the system for the details to remain secret and the rewards
Security Manager for breaking into the system are too great.
The security manager enforces the boundaries around the Sun took the opposite approach, and published all the details
sandbox. Whenever an applet tries to perform an action of Java security model when Java was first released. This
which could corrupt the local machine or access information, included the design specifications for the language
the Java Virtual Machine first asks the security manager if mechanisms and the sandbox, and a full source
this action can be performed safely. If the security manager implementation. This approach, dubbed security through
approves the action — for example, a trusted applet from the openness, was intended to encourage security researchers to
local disk may be trying to read the disk, or an imported examine the Java model and to report any security flaws
untrusted applet may be trying to connect back to its home found; the flaws could be fixed before attacks based on those
server — the virtual machine will then perform the action. flaws could become endemic on the Web. Security through
Otherwise, the virtual machine raises a security exception openness also allows any organization to study the Java
and writes an error to the Java console. security model in detail and make an informed assessment of
the potential risks versus the benefits of the Java platform.
The security manager will not allow an untrusted applet to
read or write to a file, delete a file, get any information about
The Java Security FAQ
a file, execute operating system commands or native code,
load a library, or establish a network connection to any Keeping current is as important for Java security as it is for
machine other than the applet’s home server. This list is not general security. To facilitate this, Sun maintains a Java
exhaustive but does give a representative sample of the Security Frequently Asked Questions (FAQ) page on the
restrictions place on applets. Java web site. This FAQ can be found at http://
java.sun.com/sfaq. The FAQ contains more details
An application or a web browser can only have one security on known vulnerabilities, the status of these vulnerabilities
manager. This assures that all access checks are made by a and, when available, dates and release numbers of the
single security manager enforcing a single security policy. version of Java in which the vulnerabilities were fixed. More
The security manager is loaded at start-up and cannot be security related information can be found at http://
extended, overridden or replaced. For obvious reasons, java.sun.com/security.
applets can not create their own security managers.
Several other organizations are also tracking Java security.
Language Features The CERT/CC has released several advisories on Java
Security. These vulnerabilities have closely paralleled the
Java has several language features which protect the integrity
vulnerabilities listed above and in the Java Security FAQ.
of the security system and which prevent several common
Details are from the CERT/CC web site. Several other
attacks. For example, Java programs are not allowed to
organizations, including researchers at Princeton University,
define their own memory pointers or to access physical
have been investigating Java security. The Princeton findings
memory directly. This prevents an applet from accessing and
can be found at http://www.cs.princeton.edu/
modifying critical parts of the security system. The language
sip/.
tracks the type of newly created classes and objects so that
an applet cannot forge its own class loader or security
manager. The Java language also has several other checks for EXTENDING JAVA SECURITY
memory and pointer abuse which could weaken the security
system. Security Modeling
While many experts agree that the Java Security model is
In addition to making Java a more secure system, these basically sound, there is a concern that the model has not
language features also make Java programs safer and more been examined in enough detail to ensure that the sandbox is
reliable. Studies have shown that 40% to 50% of all bugs are as secure as is claimed. There is also the possibility that a
caused by errors in memory management. By automating particular implementation of the Java security model suffers
memory management, Java eliminates a large class of bugs; from bugs and other coding errors which could be exploited
this results in more stable and reliable code. by a malicious applet which wished to break out of the
sandbox. Finally, there could be unexpected interactions
Security Through Openness between Java applets and other parts of the network which
In the past, many computer and network systems tried to could be exploited. Problems which exploit all three of these
maintain security by hiding the inner works and policies of categories have been reported.

© Sun Microsystems, Inc., 1996 5

For these reasons, Sun has initiated an independent, third software which does not take any hostile actions against the
party security modeling effort. The first step, being user, then we can install the product with some degree of
conducted by security consultant Blackwatch Inc. (http:/ confidence.
/www.blackwatch.com), will produce a Security
Reference Model. The Reference Model will document “Signed applets” give us the same level of confidence in
Java’s security model in rigorous detail. network distributed software. To sign an applet, the producer
first bundles all the Java code and related files into a single
The second step will be to develop a more rigorous security file called a Java Archive, or JAR. The producer then creates
compatibility test suite based on the Reference Model. Since a string called a digital signature based on the contents of the
each Java licensee is free to re-implement portions of the JAR. The full details of digital signatures are beyond the
Java Virtual Machine, the new test suite will ensure that both scope of this white paper. More details can be found in
Sun and all licensees have correctly implemented the “Applied Cryptography,” by Bruce Schneier, as well as
Reference Model. This test suite will be an enhancement to numerous other cryptographic reference books.
t h e t e s t s u i t e a l r e a d y u s e d t o e n s u r e t h a t J a va
implementations comply with the Java standard. JAR files solve another problem. Currently, many Java
applets take a very long time to download and begin running.
The third step will be to commission independent, third party This can be annoying even for those users with a very high
assessments of Sun’s reference implementation of the Java speed link to the Internet. The problem is that current
standard. This assessment effort relies on having a formal Internet protocols move web pages across the Internet one
model specified so that the implementation can be assessed file at a time. Since there is some overhead associated with
in the context of the assertions of the security model. each request for a file, web pages and Java applets which are
composed of many small files might spend more time
This review is expected to be complete by the fall of 1996. requesting those files and waiting for replies than they spend
actually moving the information. Since a JAR file bundles all
New Security Facilities the information needed by the applet and its web page into a
The sandbox model described above protects the end-user’s single file, the entire page can be downloaded with a single
machine and networked computing resources from damage request. For many pages this will greatly reduce download
or theft by a malicious applet. Users can run untrusted code times.
obtained from the network without undue risk to their
JARs and digital signatures can also be used for Java
system.
applications. While Java applications are more trustworthy
The sandbox model does not address several other security than applets because they do not travel over the Internet and
and privacy issues. Authentication is needed, to guarantee are subject to an organizations traditional security policies,
that an applet comes from the place it claims to have come applications are subject to several types of attack. For
from. Digitally signed and authenticated applets can be example, viruses spread by modifying existing applications
promoted to the status of trusted applets, and then allowed to to include a copy of the virus. Since a virus would not be
run with fewer security restrictions. Encryption can ensure able to produce a valid signature for the altered program, the
the privacy of data passed between an applet client and a Java system could detect that a signed application has been
server on the Internet. Work is underway to extend Java’s tampered with, and refuse to run it. Since the JAR signature
security model into each of these areas. system will work with all types of information, not just Java
files, JAR signatures can also be used to protect data files and
Signed JAR files other information.
All networked systems are potentially vulnerable to the Signed JAR files will be included in Java release 1.1 and
“Man-in-the-Middle” attack. In this attack, a client contacts should be available by the end of 1996.
a legitimate server on the network and requests some action.
The attacker, or man in the middle, notices this request and Flexible Policies
waits for the server to respond. The attacker then intercepts
Since digital signatures allow us to assign to Java applets the
the response and supplies a bogus reply to the client. The
same level of trust which we assign to shrinkwrapped
client then acts on the bogus information, or possibly runs
applications, it may be useful to relax the Java security
the program supplied by the attacker, giving the attacker
restrictions for some applets. For example, it would be useful
access to the client machine. For example, an attacker might
if the home banking applet described above could establish
watch an Internet-based banking site. As clients visit the
its own directory on the user’s hard disk. It could store
page which provides bill paying services, the attacker diverts
account and credit card numbers, passwords, PINs, and other
the bank’s responses and provides a malicious applet which
frequently used information so the end-user would not have
mimics the bank’s service, but also steals a copy of the user’s
to constantly re-enter that information.
credit card and bank account numbers.
Signed applets can be used to create this environment. If the
This attack can be thwarted by applying “digital shrinkwrap”
end-user has previously told the Java system that a particular
to the applet. We trust physical software we have purchased
web publisher, say a bank or credit card company, is trusted
because its packaging shows who produced the software, and
and a signed applet from that publisher has arrived over the
the shrinkwrap shows that the product has not been tampered
Internet and been authenticated, then the Java Security
with. If the producer has a good reputation for providing

© Sun Microsystems, Inc., 1996 6

Manager could allow that applet out of the sandbox, and SUMMARY
treat it as an application. The Java platform supports Write Once/Run Anywhere
The Security Manger could also enforce different levels of applications. This, combined with the easy distribution
control based on how much a particular publisher is trusted, mechanisms provided by the World Wide Web and Web-like
or on how much the Internet as a whole is trusted. For systems called intranets, makes Java a powerful tool for
example, a very security-conscious user could configure the many network based systems. The mobile applications
system to allow signed applets to run only inside the which Java enables — applications that automatically
sandbox, and to prevent any unsigned applet from running at migrate over the network to where they are needed —solve
all. Another user might configure the system to allow the many persistent problems in application distribution and
banking applet to access only one particular directory on the systems management.
hard disk, while a net gaming applet could access another While mobile applications solve the software distribution
directory and all other applets are restricted to the sandbox. problem, they also make it more likely that end-users will
Auditing unintentionally import hostile applications into the corporate
network. Java addresses these concerns by running all
Auditing is another important security feature. Auditing untrusted applications in a protected area known as the
software maintains a record of everything which happens on sandbox. Applications running in the sandbox can only
the system. When something goes wrong, either through an access local and network resources through a limited set of
accident or a bug, or because of an attack, the audit trail trusted mechanisms. The sandbox model gives users the
allows systems administrators and security personnel to advantages of easy, ad-hoc application distribution while it
figure out what happened, and how to prevent a reoccurrence protects them from potentially malicious applications.
in the future. While auditing cannot prevent accidents and
attacks, once things go wrong, it is an important tool for Several efforts are underway to further enhance the sandbox
cleaning up the mess. model. Independent contractors are reviewing the design of
the sandbox to ensure that it provides adequate protection.
While some versions of the Java platform include limited Future releases of Java will provide applet signing, which
auditing features, there is no standard set of auditing acts as digital shrinkwrap. Support for flexible security
capabilities on which an administrator can rely, and those policies, encryption and other more advanced security
features that do exist do not record as much detail as is often features are also being added.
needed. Efforts are under way to define what standard
features need to be included in every Java implementation Any organization which is considering adding Java
and how these features should be implemented. applications or Java enabled software to its network should
carefully consider how Java will affect their current security
Encryption policies. While no set of security policies can ever eliminate
all risk from a networked environment, understanding how
While the sandbox and signed applets can protect against Java’s security model works and what sorts of attacks might
hostile applets and man-in-the-middle attacks, information be committed against it, keeping current with new
traveling between the applet and a server on the Internet is developments by both attackers and other security officers,
still vulnerable to theft. This is because the Internet itself is and evaluating Java in light of the organization’s overall
an insecure medium. An attacker attached to a central security policy can reduce risks to an acceptable level.
portion of the Internet can read all information which travels
through that portion of the Internet. The attacker could listen
to all traffic bound for a major bank or mail order company,
and simply read credit card numbers and other information
off the wire as it passed. To secure against this type of attack,
all information flowing between the applet and its server
must be rendered unreadable by encrypting it.
Several Java encryption facilities are being developed. These
facilities will allow applet developers to select the type of
encryption algorithm used, to negotiate with the server to
create the keys used in the encryption and to do the actual
encryption of the data.
While there are few technical challenges to implementing
the cryptographic functionality, the US government imposes
strict export controls on encryption technology. Since Java is
available world-wide, any proposed cryptographic system
must comply with these laws. Ensuring this compliance may
delay the release of the facilities.

© Sun Microsystems, Inc., 1996 7