Java Security Manager reloaded

It has become common practice to build programs by using libraries and make programs extendable by plugins. Applications deployed to application servers are also very popular nowadays. This means a serious issue for the security of the whole system. Luckily, Java has the solution - the Java Security Manager (JSM). Quick demo shows what to expect from evil applications and lazy programmers. The talk gives hints how to start with the JSM and how to write policy files. It also mentions which methods in your software should be protected by permission checks. The talk introduces a new Security Manager called ProGrade, which is backward compatible with the JSM and also allows the administrator to use ‘deny’ entries in policies. *Java Security is not a myth! The threat is out there. Be suspicious! Don’t trust your code and be paranoid when you use others’ code.*

Author:
Josef Cacek
Josef is a passionate Java developer, open-source contributor, decent runner and proud father. He joined JBoss team at Red Hat to help improve quality of security components in WildFly (JBoss AS formerly) and JBoss Enterprise Application Platform. Josef was few years involved in DirX Access project development at Atos.

[bluex]

I am a bit confused when researching - the SecurityManager is deprecated, and yet the OCAJP IZO-819 exam has questions centric to granting permissions via the policy file

[girishpathak]

Hi this was very helpful for me thanks a lot for such a good explanation . I have one query how can I go through with full application to generate policy file by using pro-grade library, I am having my war file with me which is deployed in wildfly 10 ?