srinip

I will be speaking at AppSec USA 2011 Conference next month in Minneapolis. The title of my session is:

Messaging Security using GlassFish 3.1 and Open Message Queue

GlassFish application server version 3.1 and Open Message Queue container offer excellent messaging security features. My talk will include discussion on how to enable and configure security for various components in the messaging architecture. This includes Authentication and Authorization for controlling access to the message broker components as well as how to implement message level security using encryption techniques.

I will also discuss the monitoring aspect and how we can use JMX API to monitor and manage various messaging resources such as the Broker, Services, Connections, Destinations, Producers, Consumers and Messages. I will demonstrate all the security features using a sample Java EE application running on GlassFish 3.1 and Open MQ.

They also have a Charity 5K/10K Run being organized as part of the conference events which I will most probably participate.

If you are interested in attending, here is the link to register for the conference:
http://www.appsecusa.org/attend.html

I attended the NoSQL Now 2011 Conference in San Jose last week. It was a great experience to meet others who are currently working on or exploring the option of using a NoSQL database in their organizations.

Conference site (San Jose Convention Center) was a great location. The conference session snapshot on computer monitors to show what all sessions are scheduled at a specific time was very helpful. I could look at all the session summaries at the same time and decide which one to attend. The conference mobile app (Guidebook) was also very helpful in checking the conference session schedule, details and slide deck from anywhere at the conference. Attendees getting access to the presentations before hand is a great idea.

I gave a talk on NoSQL Security topic and it was a good discussion and well received by the attendees. NoSQL databases like MongoDB, Cassandra, and Neo4J (which are the NoSQL databases I covered in my session) have decent application security support (authentication, authorization, encryption) but there is still room for improvement in this area. For example, record/entry level data encryption, role based access control (RBAC) can be better than what's there right now.

Overall, NoSQL Now was a great learning event and an excellent forum to meet and network others who are working in the same space. Thanks to Tony, Nerrisa and his team from Wilshire Conferences group and Dan McCreary for organizing the conference. Can't wait for the next year's conference.

I will be speaking at NoSQL Now 2011 Conference next week. My title of my session is:

Security Considerations in NoSQL Data Access

The NoSQL DB's have been getting lot of attention lately and there hasn't been much discussion on the security of the applications accessing these non relational databases.

The main focus of my talk will be to give an overview of the current state of security support by the leading NoSQL DB vendors like MongoDB, Neo4J, Cassandra, and CouchDB. I will also discuss the emerging trends, tools and techniques, and best practices in the NoSQL Data Security space.

It's great to see an entire conference focusing on one of the emerging trends in software application development area such as the NoSQL Databases.

If you are interested in attending the conference, you can register for it at the following link:

http://nosql2011.wilshireconferences.com/reg.cfm

I am organizing a free training class in the Austin area on "Enterprise Java Development Using Spring and Hibernate Frameworks". If you live in the area and are interested in attending this class, here is the registration link:

http://enterprise-java-spring.eventbrite.com/

Training Class Details:

Title:
Training: Enterprise Java Application Development using Spring and Hibernate

Session Format: Tutorial
Date: March 12, 2011 (Saturday)
Time: 9 AM to 1 PM
Duration: 4 hours
Target Audience: Java/Java EE Developers and Solution Architects
Session Type: Introductory (Note: If you are already familiar with Spring and Hibernate frameworks, feel free to skip this class and sign-up for the next session where I will cover the advanced topics in Spring.)

Location: IASA Global Headquarters

Address:
11044 Research Blvd.
Suite B-400
Austin, TX 78759

Abstract:
Since its first release back in 2004, Spring Framework has become a popular choice for developing enterprise applications. At the core, Spring supports Dependency Injection (DI), Aspect-oriented Programming (AOP), and enterprise service abstraction. After a brief overview of design concepts like DI and AOP, this tutorial focuses on the last part - enterprise service abstraction that helps the Java developers to integrate their applications with many widely used technologies.

In this tutorial, we will build a web application based on the widely used application architecture layers (Database, Data Access, Domain, Service, Controller, and Presentation), add persistence (using JPA and Hibernate 3) in the DA layer and transaction management (using Spring Transaction Management) in the Service layer. We will add the application security (authentication & role based authorization) to the application using Spring Security.

Tutorial Outline (with estimated coverage time in minutes):
- Introduction (15)
- Example Web Application Setup Details (15)
- Spring Lightweight Container Architecture, including Inversion of Control (IoC) (15)
- Pragmatic AOP (15)
- Agile, domain-driven design techniques with Spring (15)
- Unit testing in isolation (15)
- System integration testing support (15)
- Persistence (using JDBC and JPA/Hibernate options) (30)
- Declarative transaction management (30)
- Validation (15)
- Spring Security (Authentication & Authorization) (15)

Key Takeaways:
You will leave with the practical knowledge of using Spring and Hibernate in developing enterprise Java web applications.

Pre-Requisites:
- Working knowledge of Java/JavaEE technologies
- Familiarity with development tools like Eclipse IDE, Maven, and JUnit.
- Bring your laptops to this tutorial as it will be a hands-on workshop and come ready to code.

I spoke at JavaOne 2010 conference yesterday on the topic of Application Security Enhancements in Java EE 6.

Java EE 6, released earlier this year, includes several significant enhancements especially in the areas of annotation based authentication and authorization in the web tier. So, if you are developing lightweight web applications where you don't want to use EJB components for the application security requirements, you now have a choice of implementing the authentication (declaratively or programmatically) and authorization aspects in the Controller classes (Servlets).

Session abstract:
Java EE 6 includes some interesting security enhancements in the areas of Web container security as well as authentication and authorization aspects in Web application development. This session will give an overview of these new security features and discuss the details of how to use them, with help of a sample Java application, in real-world enterprise Java applications. The discussion will include how developers can take advantage of programmatic and declarative (@ServletSecurity, @DeclareRoles) security features. It will also include a discussion on Java EE security technologies such as Java Authentication Service Provider Interface for Containers (JSR 196) and Java Authorization Contract for Containers (JSR 115).

I did couple of demo's on how to use the new security features. This is my first time attending JavaOne conference as a speaker and it's been a great experience so far.

I also wrote on InfoQ website about the new security features provided by Java EE 6 release.

If you have been using other security frameworks like Spring Security, Java EE 6 is definitely you should look at. While there are some differences in what Spring Security 3 framework offers in terms of role based access, EL based authorization etc, the new web-tier security features in Java EE 6 make it easier to implement the security aspects without coupling the security logic with application or business logic.