SEC01-J. Be careful using doPrivileged
SEC02-J. Beware of standard APIs that may bypass Security Manager checks
SEC03-J. Beware of standard APIs that may use the immediate caller's class loader instance
SEC04-J. Beware of standard APIs that perform access checks against the immediate caller
SEC05-J. Digitally sign all artifacts before deployment (deprecated, incomplete)
SEC06-J. Assume that all Java clients can be reverse engineered, monitored, and modified
SEC07-J. Minimize accessibility
SEC08-J. Consider signing and sealing objects before transit
SEC09-J. Create and sign a SignedObject before creating a SealedObject
SEC10-J. Do not allow the unauthorized construction of sensitive classes
SEC11-J. Define custom security permissions where required
SEC12-J. Prefer using SSLSockets over Sockets
SEC30-J. Always use a Security Manager
SEC31-J. Never grant AllPermission to untrusted code
SEC32-J. Do not grant ReflectPermission with action suppressAccessChecks
SEC33-J. Define wrappers around native methods
SEC35-J. Ensure that the bytecode verifier is applied to all involved code upon any modification
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
SEC01-J |
medium |
probable |
high |
P4 |
L3 |
SEC02-J |
medium |
probable |
medium |
P8 |
L2 |
SEC03-J |
medium |
probable |
medium |
P8 |
L2 |
SEC04-J |
medium |
probable |
medium |
P8 |
L2 |
SEC05-J |
TODO |
TODO |
TODO |
TODO |
TODO |
SEC06-J |
medium |
likely |
medium |
P12 |
L1 |
SEC07-J |
medium |
likely |
medium |
P12 |
L1 |
SEC08-J |
TODO |
TODO |
TODO |
TODO |
TODO |
SEC09-J |
medium |
unlikely |
low |
P6 |
L2 |
SEC10-J |
high |
probable |
high |
P6 |
L2 |
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
SEC30-J |
high |
probable |
low |
P18 |
L1 |
SEC31-J |
high |
probable |
low |
P18 |
L1 |
SEC32-J |
high |
probable |
low |
P18 |
L1 |
SEC33-J |
medium |
probable |
high |
P4 |
L3 |
SEC35-J |
medium |
probable |
low |
P12 |
L1 |
The CERT Sun Microsystems Secure Coding Standard for Java The CERT Sun Microsystems Secure Coding Standard for Java SEC01-J. Be careful using doPrivileged