When developing a class that provides controlled access to resources, care must be taken to protect sensitive information and functions. For example, a file descriptor contains a handle that provides access to an operating system resource. Being able to forge a file descriptor would allow some forms of illegal access, since restoring state is done from a stream. Therefore, the serializing runtime must take the conservative approach and not trust the stream to contain only valid representations of objects. To avoid compromising a class, the sensitive state of an object must not be restored from the stream or it must be reverified by the class.
Several techniques are available to protect sensitive data in classes.
Transient and static fields are not serialized or deserialized. Simply marking the field will prevent the state from appearing in the stream and from being restored during deserialization. Particularly sensitive classes should not be serialized at all. To accomplish this, writeObject and readObject methods should be implemented to throw the NoAccessException . Throwing an exception will abort the entire serialization or deserialization process before any state from the class can be serialized or deserialized.