A security library is reusable software that implements security protocols and patterns for application controls such as authorization, transport security, and identity. It reduces the need to build these mechanisms from scratch, but it cannot replace secure design, coding, maintenance, or review. section 1.1.2
A practical Java choice
A Java web application might use Spring Security to authorize user access. Java Standard Libraries support TLS, while Spring Security supports OpenID Connect. These libraries become easier to configure when developers understand the standards and protocols underneath them. section 1.1.2
Use security libraries with these safeguards:
- Learn the underlying standards, protocols, and patterns instead of treating configuration as a black box. section 1.1.2
- Keep dependencies under review, use published APIs, and add automated vulnerability scanning to CI/CD pipelines. section 1.5
Figure 1.2 Layers at the top depend on the layers below them. All the layers are required to produce secure application. The standards, protocols, and patterns used to secure applications are the primary focus of this book; they are the foundation that you need to use security libraries in your application effectively.
Use the layered view to connect security libraries with the standards, protocols, patterns, and development practices they depend on. section 1.1.2
