Secure Coding

The exam topics in this section are based on a documentation by Oracle of the same name.
Oracle's Secure Coding Guidelines

Java's Security Architecture and features are tools provided to help protect systems from hostile or misbehaving code, but like any tool if it is not used properly or not use it all, it falls short, and your application could be vulnerable. It also cannot prevent implementation bugs that occur in trusted code, so even your junior developers need to be knowledgeable of common flaws and prevention techniques. The stated purpose of this guide is to provide a more complete set of security specific coding guidelines for Java developers.
The document details many of the common pitfalls which the platform alone cannot entirely prevent. I will be summarizing this document as much as possible and I highly recommend a full read of the document.
The exam questions will most likely be a list of items that pertained to preventing a particular type of problem, and picking an item that doesn't belong, yeah because it applies to another type of problem, or it's worded slightly differently, altering its meaning from the text in the document.
These are the exam objectives:

The "Introduction" of Oracle's "Secure Coding Guidelines for Java SE" emphasizes the importance of secure coding practices to prevent security vulnerabilities in Java applications. While Java provides built-in security mechanisms, these alone are not sufficient to avoid security bugs. Developers must adhere to guidelines to minimize risks like data theft and misuse of system resources. The document targets all Java developers, including those handling security components or shared libraries, and highlights deprecated features like the Security Manager in Java 17.
More details: [Oracle Secure Coding Guide](https://www.oracle.com/java/technologies/javase/seccodeguide.html). Secure Coding in a Java SE Application

1. Preventing Denial of Service in Java applications
2. Securing confidential information in Java application
3. Implementing data integrity guidelines: 1) injections and 2) inclusion and input validation
4. Preventing external attack of the code by limiting Accessibility and extensibility, properly handling input validation, and mutability
5. Securing constructing sensitive objects
6. Securing Serialization and Deserialization

To prevent a Denial of Service (DoS) attack in a Java class, you can follow the below best practices:

1. Input Validation: Validate user input to ensure it is within expected bounds and reject any malicious or unexpected inputs.
2. Resource Limitation: Limit the resources that an application can consume, such as memory, CPU, and database connections, to prevent an attacker from overloading the system.
3. Exception Handling: Properly handle exceptions and ensure they don't reveal sensitive information that could be used in an attack.
4. Authentication and Authorization: Implement strong authentication and authorization mechanisms to prevent unauthorized access to sensitive resources.
5. Monitoring and Logging: Monitor the system for unusual activity and log any suspicious events to detect and respond to potential attacks.
6. Rate Limiting: Implement rate limiting to prevent an attacker from overloading the system by sending a high volume of requests.
7. Using Security Libraries: Use security libraries and frameworks, such as Apache Shiro or Spring Security, to handle security-related tasks, such as authentication and authorization.

By implementing these best practices, you can reduce the risk of DoS attacks and increase the security of your Java applications.