Java/J2ee Security Best practices

Best practises of Java/J2EE application development
1. Stop Memory Leak errors in by (garbage collection of unused objects, stop dangling references).
e.g String immutable class can lead to memory leak while mutable versions like StringBuffer, StringBuilder can reduce memory leak.

2. NIO Packages can improve performance with features non-blocking Input/output API. NIO packages can by using buffers to hold data, memory mapping of files minimize acess to hard disk, operating system.
3.  Coding to Interface reduce coupling. Low coupling and high cohesion should be goal of applications.
4. Types of inheritance :
Implementation Inheritance: best practise subclasses should only depend on behaviour of super classes and not on actual implementation. As superclasses become tightly coupled with subclasses making design not flexible as to chang superclass all details of subclasses must be known to avoid breaking them.

Interface Inheritance: Program to Interface not implementation as coding to interface reduce coupling. Also inheritance cannot be changed at run time. Object composition requires functionality is acquired dynamically at runtime. Also promotes Open Close principle of OOAD.

5. Design by Contract: Use of Assertion Enforce Input compulsory contracts. message also capture detailed statement for AssertionError
http://docs.oracle.com/javase/7/docs/technotes/guides/language/assert.html

6. Use OOAD principles

  • Open Close Principle:  Open for Extension and Close for modifications Enforce minimum changes in existing code.
  • Dependency Inversion Principle: High level modules contain complex logic hence should not depend on low level module for implementation.
    Order: High level classes –> Abstraction Layer –> low level classes
  • Interface Segregation Principle: client should not implement interfaces not used.
  • Single Responsibility Principle: Every class should have single responsibility (reason to change) reducing complexity.
  • Liskov’s Substitution Principle: Derived Types should be substitutable to base types.

7. For multi threading application When atleast one thread adds or delete into collection use API external Synchronization.
Three Types of collection { Map, Tree, List}
Map mymap1= Collection.sychronizedMap(mymap1); // Lock for Entire Map.
8. Use zero length Collection as opposed to returning Null:
StringBufferOverflow Attack Can be caused due
9 Deep and Shallow copy of objects : To Be continued.
Read more details:
1. Design principle in Real World
https://sandyclassic.wordpress.com/2014/02/05/design-pattern-in-real-world/
2. generalize-problem-solving-through-design-pattern https://sandyclassic.wordpress.com/2013/10/24/generalize-problem-solving-through-design-pattern/

Enterprise Architecture TOGAF,ITIL,Zachman,eTom,NGOSS

A list of ALL ENTERPRISE FRAMEWORKS…

– Business Frameworks (e.g. BMM, Six Markets, Porters 5 Forces, McKinsey 7S, etc)
– Architecture Frameworks (e.g. PEAF, MODAF, TOGAF, TEAF, IAF, etc)
– Programming Frameworks (e.g. .NET, J2EE, etc)
– Project Management Frameworks (e.g. PRINCE2, MSP, etc)
– Service Management Frameworks (e.g. ITIL, etc)
– Industry Operations Frameworks (e.g. eTOM, Pragmatic Marketing, etc)
– Any other type of framework in any other domain so long as it is related to an ENTERPRISE.

There are various field of Architecture floating around in IT industry.Specially in indian IT industry where things are still taking shape.HR department is india in most forgotten department it still need to learn more about Labour laws and nothing more..Top institution in india for HR which was essentially focus on labour laws and nothing more.Other subjects are taught not with great emphassis..Problem that is  okay for manufacturing industry where management is dealing with unskilled uneducated manpower..but same is not true for Industry.Institutes still need to inculcate basic principle of psychological analysis , service industry and basic computer knowledge so people can visualize trends in skills needed to shape future of employee in company.

So For Industry still under trap of HR to define there own terminology for different job skills.In country outside india for which indian IT companies are executing project Position are well defined.Take a case Architect in software industry.

Architects can be classied into two category:

1)Enterprise Architects.

Architect working at enterprise level with various certification level like ITIL( process based for Service Management),TOGAF for Thne

Zackman for domain model, there are customised framework like NGOSS and e-TOM for Telecom industry

2) Domain specific Architects.

Domain Architect can be classied into four major types:

  1. Application or Language Architect (Java Architect,.NET Architect,PHP Architect, open source Architect, Integration Architect, Platform As Service Architect)  . These architects are primarily concerned with design patterns and application integration and language specific issues, options available like in integration web service is course grain integration but there are other option like CORBA,JNI web services is last option. So Java architect is SME for Java related design issues. same way .NET Architect, PHP Architect.Integration Architect are looking at how integrated different layer(ESB,Web services, COM,CORBA etc..).
  2. Database/Data Architect (Data Architect, ETL Architect, BI Architect, Performance Architect)
  •  Data Architect: concerned with logical data modelling (LDM) and Physical database  modelling (PDM), design of OLTP system and design normalized scehmas and table structure.
  • ETL Architect : Takes care of Data Integration layer (Extract Transform Load data from SQL server to Oracle from SAP populated tables into target datawarehouse. Designing or Star schema or extended star schema for Data warehouse.
  • BI Architect: Looks to create semantic Layer which helps user to convert dynamically dragged objects to there respective SQL equivalent.and reporting layouts ,data structure which support them,layout to of report on web on mobile or on portal.reports from tactical to strategic reporting to Exception reporting and business events.
  • Performance Architects are concerned performance to Web servers , data bases performance ,query response time, latency etc.

3. Network Architect (Storage Architect, Network Architect, System Architect,Virtualisation or Infrastructure As Service IAAS.

  • Storage Architect: Concerned with SAN storage and design of storage network its interface with network components. whether to go for SAN or NAS or DAS ,RAID levels, SCSI or Fiber channel , servers, vendors to go with (EMC Clarion,netapp,hitachi)  etc.analysts predict that enterprise storage will account for 75% of all computer hardware expenditures so storage is critical.
  • Network Architect: Network architecture have exploded in recent decade.Network architect needs to look into network Design, specification,Network security. Like Cisco defines 5 fields (1. Voice like VOIP, 2. Security, 3. Design, 4.Routing and Switching, 5.Wireless).Each one can have its own architects.person may not be specific to Cisco but can cut across to like juniper network junos firewall, or sonic firewall is in network security.
  • System Architect: concerned Types of servers used and Os Admin related activities.e,g Red hat admin subject matter expert with server datacenter know how, blade vs RACK, virtualisation layers,hypervisor (vmware ESXi, Microsoft hyperV, IBM AIX LPAR) etc.

4. Architect not defined above,

ERP Architects:

  • SAP Architect(since SAP has its own solution framework  like SAP Solution Manager  which help in maintaining and upkeep of solution and framework at solution or practice level, Also like SAP BI is domain specific architect who know out for 16 reporting tool flavor from WebI,Xcelsius,DesKI, live office, Quaas which one to use when).
  • Peoplesoft Architect: Looks into PS specific techno-functional issues customization , enhancement, or performance issue, installation and data migration, its integration with different web server app server.
  • , Oracle Apps Architect.: Oracle Application domain specific solution to use of Oracle BPEL, ESB, SOA suite, fusion middle ware vs old form report customization Vs used of OAF or ADF.