IBM WebSphere V5.0 Security - CGISecurity

A Web browser, for instance, must be capable of sending HTTP requests in asecure fashion since this data may travel over an insecure connection to theserver, that is, a connection sensitive to eavesdropping or other interference. Theserver, upon receiving a request, must be able to summon the appropriateresources in order to respond without revealing information unnecessarily toeither the resource or a third party.As a request passes from one component to another, the opportunities for theinterception and exposure of information increase and ultimately the overallsecurity of a system directly relates to the weakest, or least secure, point.WebSphere, and indeed J2EE, do not implicitly provide a secure means ofcommunication but rather rely on an additional service, typically a transport-layerdigital encryption algorithm, called Secure Sockets Layer (SSL) and TransportLayer Security (TLS). This section describes how to configure WebSphere to useSSL to protect information as it is communicated from the client to the server andback.Security administrationThe Security section is the focal point for the configuration of WebSpheresecurity. It is accessible from the Admin Console. After logging in, click theSecurity link in the navigation pane.WebSphere security can be enabled and disabled in its entirety by selecting asingle switch. This is the Global Security Enabled switch which is accessible fromthe Administrative Console under Security -> Global Security.236 IBM WebSphere V5.0 Security Handbook