IBM WebSphere V5.0 Security - CGISecurity

A Web browser, for instance, must be capable of sending HTTP requests in a
secure fashion since this data may travel over an insecure connection to the
server, that is, a connection sensitive to eavesdropping or other interference. The
server, upon receiving a request, must be able to summon the appropriate
resources in order to respond without revealing information unnecessarily to
either the resource or a third party.
As a request passes from one component to another, the opportunities for the
interception and exposure of information increase and ultimately the overall
security of a system directly relates to the weakest, or least secure, point.
WebSphere, and indeed J2EE, do not implicitly provide a secure means of
communication but rather rely on an additional service, typically a transport-layer
digital encryption algorithm, called Secure Sockets Layer (SSL) and Transport
Layer Security (TLS). This section describes how to configure WebSphere to use
SSL to protect information as it is communicated from the client to the server and
back.
Security administration
The Security section is the focal point for the configuration of WebSphere
security. It is accessible from the Admin Console. After logging in, click the
Security link in the navigation pane.
WebSphere security can be enabled and disabled in its entirety by selecting a
single switch. This is the Global Security Enabled switch which is accessible from
the Administrative Console under Security -> Global Security.
236 IBM WebSphere V5.0 Security Handbook