• Applications that store cryptographic keys in persistent and temporary data stores or memory are prone to attacks from unauthorized users
  • If an application does not securely guard the data store location, an attacker can use insecure keystore bugs to read data related to cryptographic keys and certificates
  • To protect keystore from this type of attack, developers should securely manage data in both temporary and persistent data stores
  • In the below insecure code, keystore files and registry keys are accessed due to insecurely managed permissions
  • Secure code solution for the above code is to give restricted or no permission to the folder java.home/lib/security that holds the storage facility for all keystore files and registry files