Software security protects applications and their data from misuse, disruption, unauthorized access, and related threats. Treat it as a nonfunctional requirement from the beginning, because neglected security can damage profitability and other systems. section 1.0
Security concerns can appear across multiple collaborating layers:
- Application data requires protections appropriate to its type and movement between locations. section 1.2
- Runtime memory can retain credentials or private keys long enough for a heap dump to expose them. section 1.2
- Virtual-machine compromise, intercepted communication, and missing application-level controls can enable data theft or user impersonation. section 1.2
- Small implementation mistakes, such as exposing sensitive data in logs or error messages, can cause significant harm. section 1.5
Layered protection
A system may still be vulnerable when an attacker reaches its virtual machine or intercepts communication between availability zones. Application-level security forms one layer, not a replacement for protections elsewhere. section 1.2
Figure 1.3 We implement security in a hierarchical manner, with each layer building on the foundation of the previous one. This book focuses on explaining how to use Spring Security, a framework that provides application-level security at the very top layer.
Use the layer diagram to distinguish application-level security, where Spring Security operates, from the lower layers that require other practices. section 1.2
