JavaOne Session: Twelve Java Technology Security Traps and How to Avoid Them
Brian Chess gave one of the best presentations at JavaOne on JavaOne on Twelve Java™ Technology Security Traps and How to Avoid Them.
The presentation was very well put together - sample code, then explanation of the security risk.
You can view the presentation here (you will need a user name: contentbuilder and password: doc789).
There's 92 (!) slides, you may find this summary of the security traps useful.
PJ Murray
CodeFutures Software