Here are some lessons we have learned as we have watched Java's approach to security change. Type safety alone is not security. Java security is much more than type safety, however. Think of type safety as the foundation of a complete Java security solution. The foundation is essential, but much needs to be built on top of the foundation to make a useful building.
Real security is more difficult than it sounds.
Do not let slick marketing convince you that building a secure system is easy. Java provides a powerful set of tools that can help you create a secure system, but simply using the tools is no guarantee of success. You must use the tools wisely and closely scrutinize your system from a security perspective. If ever there was a time to practice solid software engineering, design, and implementation of secure systems, it is now. It is impossible to separate implementation errors from design problems.