Chapter 13: Securing your Enterprise

Overview

Few other topics in the domain of information computing create as much anxiety as that of security. No serious-minded systems analyst would dream of putting their mission-critical business logic and information assets into a production environment without being certain they could be protected from abuse and misuse. A few minutes perusing the CERT advisory board (http://www.cert.org) will leave you thinking twice about where your data has been. How many reports have we seen about viruses, worms, and other nasty vermin bringing down systems or stealing credit card numbers? How many times have you had to re-install Windows because a worm came in through e-mail and wiped out your file system? Who hasn't thought about having to stand in front of their boss having to explain why their web site got hacked?

Yet, if you're like most, the nuances and complexities of securing your systems will seem daunting and elusive. In some sense, this is good – it is often said that "just because you can't think of a way to break into your system, doesn't mean that someone won't find a way". If you're aware of this axiom, then you've already taken the first step towards justifying your paranoia. It is always worth investigating the security of your system. Understanding how the security system works will help you understand where its strengths and weaknesses lie and help you ensure your systems and information remain protected.

WebSphere, in conjunction with Java and the J2EE security model go a long way toward ensuring the protection of your system. Unlike other systems, security has not been added as an after-thought, but rather was architected right into Java and WebSphere from the start. WebSphere and Java are designed to be secure. But as always, you play a key role – whether you're an application developer, assembler, deployer, administrator, or business user, your actions can either undermine or reinforce the safeguards provided by WebSphere. This chapter will provide you with a basic understanding of how the security system in WebSphere works and will provide you some guidance on how to ensure the protection of your system.