GET YOUR ENTERPRISE READY FOR GENERAL DATA PROTECTION REGULATION (GDPR)

September 26, 2017 | Regulations, Audit & Compliance | Corey OConnor

The General Data Protection Regulation (GDPR) is said to be one of the most important changes to data privacy regulations within the past two decades. The primary purpose of GDPR is to reinforce the personal data rights for all individuals’ residing within the European Union, and subsequently harmonizing the way member states enforce data protection across this geography. The fact of the matter is, most people today do not trust their personal data in the hands of businesses – and honestly, who can blame them?

Significant personal data breaches continue to dominate headlines. Most organizations are not taking security seriously enough with some even admitting they are well aware of existing security gaps but deliberately look the other way to keep business costs down and maintain a higher profitability. As we’ve seen over the past few months, the media has highlighted both the financial and reputational implications with being caught in non-compliance – and for good reason.

GDPR will affect organizations globally. If an organization is found to be negligent, they’ll face fines north of €20 million or 4 percent of total global turnover (whichever greater of the two). Moreover, there are equally as serious reputational risks such as significant brand damage and loss of both consumer trust and loyalty. Gartner predicts that by the end of 2018, more than 50 percent of companies affected by the GDPR will not be in full compliance with its requirements.1 This begs a very important question: is your enterprise really ready?

What to Know and Understand

Understand where personal data resides within your organization. Personal data is defined as any subject’s name, address, localization, online identifier, health information, income, cultural profile and more. Enterprises should map their data flows in a prioritized manner, starting from the top down with whatever is considered to be of high risk and with whatever business processes involve gathering, processing and protecting sensitive personal data. CyberArk solutions will help an enterprise lock down the access both human and non-human users have to critical systems and applications, but before you can do that, you really need to first identify where exactly the data resides within your organization. Additionally, any personal data that no longer serves a legitimate business purpose needs to be deleted. Backups and duplicate copies of personal data files might land you in the hot seat if you don’t manage your data subjects’ ‘right to erasure’ correctly.

Get a handle on your supply chain. One important change in GDPR that was absent from its mandated predecessor (the Data Protection Directive) is the new direct legal obligations for data processors. This change brings potential litigation and damage claims directly from data subjects, whereas before, data processors really only needed to concern themselves with existing contractual agreements they had in place with their data controllers. Once GDPR goes into enforcement, both controllers and processors will be required to prove they were not held responsible in the event of a breach. You might have the most comprehensive GDPR strategy in place with all the necessary tools and components to protect your personal data – but there still remains substantial risk residing within your third-party vendor supply chain. There needs to be a greater degree of transparency across the supply chain, with a shared responsibility for securing personal data.

Additional Considerations

Given that GDPR is a very complex and far-reaching regulation that cannot be solved overnight, it’s best to not boil the ocean. Take a pragmatic approach. One of the first and most critical steps for enterprise-level organizations is to partner with an advisory consultant. Most consultancies offer GDPR-specific workshops, detailed assessments, regular testing and actionable guidance. They’ll work with your team to put in place the necessary personnel, processes and technology that align with whatever is your most optimal strategy to maintain compliance with this regulation.

I previously discussed five ways CyberArk can help you address GDPR, highlighting some of the key articles within the regulation and how CyberArk can help mitigate risk against non-compliance.  It’s well understood that complying with GDPR cannot be achieved with a single security vendor – it’s a team effort. CyberArk customers also have access to our C3 Alliance Technology Program, which provides a wide range of integrations with security solution providers from around the world. These technology integrations enable an organization to realize a much more comprehensive GDPR solution, as well as bring more value to  existing security investments.

Take the first step and download the Security Checklist for Securing Personal Data to get your enterprise ready for GDPR. Visit the CyberArk GDPR solution web page for more information on how privileged account security plays a critical part in safeguarding sensitive personal data.

Don’t get caught in the crosshairs of GDPR non-compliance. Get your enterprise ready before time runs out.

1 Gartner Press Release: “Gartner Says Organizations Are Unprepared for the 2018 European Data Protection Regulation,” May, 3 2017. gartner.com/newsroom/id/3701117

SECURING YOUR CLOUD ENVIRONMENT: SIX CRITICAL USE CASES TO CONSIDER

September 5, 2017 | Security and Risk | Amy Burnis

Migration to the cloud continues to accelerate as organizations increasingly take advantage of its many benefits—from efficiency and flexibility to competitive advantage and strategic value. In fact, 74 percent of chief financial officers at technology companies say cloud computing will have the most measurable impact on their business this year.

Here are some industry stats and predictions around this movement:

• Cloud computing spending is growing at 4.5 times the rate of IT spending since 2009 and is expected to grow at better than 6 times the rate of IT spending from 2015 through 2020. (Source: IDC White Paper, sponsored by Salesforce, The Salesforce Economy: Enabling 1.9 Million New Jobs and $389 Billion in New Revenue Over the Next Five Years , September 2016)
• Worldwide public cloud services market will grow 18 percent in 2017 to $246.8B, up from $209.2B in 2016. (Source: Gartner1)
• By the end of next year, spending on IT-as-a-Service will be $547B. (Source: Deloitte)
• Platform-as-a-Service (PaaS) adoption is predicted to be the fastest-growing sector of cloud platforms, growing from 32 percent adoption in 2017 to 56 percent by 2020. (Source: KPMG )
• Microsoft Azure adoption increased from 26 percent in 2016 to 43 in 2017, while AWS adoption increased from 56 percent to 59 percent.(Source: RightScale)

The business benefits of the cloud are very real, but so are the vulnerabilities that exist within cloud workloads such as unprotected privileged accounts, credentials and secrets. That’s why security must play an integral role in any cloud strategy and be viewed as a shared responsibility between public cloud vendors and their customers. This is particularly important as more organizations leverage cloud to save on costs, access on-demand compute and turn to DevOps processes to increase their business agility.

While each organization’s cloud journey is different, there are a number of best practices that will likely need to be addressed to help ensure cloud workloads and infrastructures are secure. Our just-released eBook, 6 Key Use Cases for Securing Your Organization’s Cloud Workloads, outlines several important approaches organizations should take to secure their cloud workloads. The use cases are based upon our experiences of working with customers in the field.  Download it for free and visit cyberark.com/cloud for more information about how CyberArk can help your organization secure its cloud environments.

1 Gartner Press Release, Gartner Says Worldwide Public Cloud Services Market to Grow 18 Percent in 2017, February 2017, http://www.gartner.com/newsroom/id/3616417

THREE KEY STEPS FOR LOCKING DOWN CRITICAL PRIVILEGED ACCOUNTS

October 13, 2017 | Security and Risk | Chris Maroun

Let’s cut to the chase: Most IT professionals understand cyber attacks will happen, and it’s simply a matter of when. Every major breach has a common denominator: compromised privileged accounts. They are an essential element of the attack lifecycle and must be secured.

I recently presented a webcast on three key steps organizations can take to protect their most critical privileged accounts. Here’s an overview of each of these steps:

Take Control: Locking Down Credentials and Endpoints

Locking down credentials and endpoints is a crucial first step in an environment that does not have privileged credential security in place. The hardest part is figuring out where to start. You’ll need to identify and prioritize which accounts present the greatest risk and therefore need to be locked down first.

• Credential The first step is to figure out exactly where your account credentials actually “live” within your environment. Only then can you truly understand which ones need to be locked down immediately and which ones can be de-provisioned. For example, your organization may currently have 150 separate domain admin accounts that can feasibly be trimmed down to one or, at the minimum, just a handful.
• Endpoints. They continue to be attractive entry points for attackers. Identifying users with local administrator rights and removing those rights is a critical first step to securing your organization’s endpoints. From there, you can create policies against those endpoints. For example, you can dictate which applications can run in administrative mode and which ones cannot. Least privilege and application control are best practices to follow and a strong defensive combo.

Often, the discovery process is easier said than done. The average organization has 3X to 4X more privileged accounts than employees. Tools such as CyberArk DNA can help streamline the arduous process of discovering privileged accounts—on-premises or in the cloud, assessing privileged account security risks to help you prioritize actions and identify accounts with local admin rights. Using such a tool, you can also pinpoint embedded and hard-coded credentials stored within applications and uncover which machines are vulnerable to credential theft attacks, such as harvesting, Pass-the-Hash, Overpass-the-Hash and Golden Ticket. Discovery tools are particularly helpful in cloud environments. For example, in AWS or Azure, organizations can quickly find and identify AWSIM rules, users, Access Keys and EC2 Key pairs.

Once you identify where these credentials are, you can take ownership and action by placing them in a secure space or vault.

Isolate and Control Sessions

Once all of these critical accounts are located within a vault, it’s time to turn your attention to usage control. In today’s collaborative environment, many people need access to privileged accounts—from third-party contractors to temporary employees and more. Solutions such as CyberArk Privileged Session Manager can help manage and monitor privileged account sessions without impacting the end-user experience OR disrupting system administrators’ workflow. It allows users to connect to target systems within their environment via an agentless jump server. This isolates the user from the target systems’ passwords (ensuring credentials never reach endpoints) while enabling authorized access so s/he can perform necessary duties. Meanwhile, the secure vaultkeeps the passwords hidden and protected and rotates them (either each time they are used or on a set scheduled cycle). Monitoring and recording capabilities enable security teams to track user activity, pinpoint suspicious privileged sessions and immediately terminate them, as needed.

A key, added bonus is that organizations can continue to leverage native tools such as Putty, remote desktop connection manager, etc. CyberArk can configure these tools to be able to go through the CyberArk proxy channels to get to those target systems without introducing a lot of latency between the user and the job that they’re there to do.

Keep a Watchful Eye

The last step is keeping a watchful eye and making sure that you understand where anomalies are actually taking place in the day-to-day routine. For example, does John typically work from 8:00 to 5:00, but suddenly starts to check out passwords at 2:00 a.m.?  Was that really even John, or was it someone else?  Or, what if John normally checks out 10 to 15 passwords per day, then all of a sudden he starts checking significantly more?

But it’s not just user behavioral analytics—it’s also environmental. What happens if we can detect the very first time that someone is able to compromise the system by brute-forcing their way in as an administrator or another admin account?  Or creating a backdoor account and then logging into it at strange hours?

CyberArk Privileged Threat Analytics is a security intelligence system that allows organizations to detect, alert and respond to attacks targeting privileged accounts. It is designed to identify an attack in real-time and automatically respond to stop an attacker from moving laterally to advance the attack. Because in order to move laterally, the attacker needs to have the necessary credentials to escalate privileges. CyberArk individualizes every single password, and therefore, stops the lateral movement and shuts down the pathway. With CyberArk, organizations can set baselines and create thresholds for anomalies and get notifications immediately on true security events, which helps to lower the alert volume. Additionally, taking advantage of integrations—or tools that speak fluently with each other—helps to minimize alert fatigue.

For additional details on the attack lifecycle and how privileged accounts come into play, along with common hurdles to establishing the most effective protection, I invite you to view the on-demand presentation.

THINK LIKE AN ATTACKER AND IMPROVE YOUR DEFENSIVE STRATEGY

October 5, 2017 | Security and Risk, Uncategorized | Amy Burnis

The CyberArk Red Team is a highly qualified group of industry veterans who are trained to use “any means necessary” – just as an attacker would – to help security operations teams identify and measure which threats they can detect – and which ones they cannot.

In a recent post, we asked Shay Nahari, our Head of Red Team Services, about the process and goals of simulated attacks. In this exchange, we ask additional questions about an attack simulation and his team’s approach. Here are some highlights of our conversation:

Q: How do organizations test internal and external systems, so that the exercise successfully mimics real attacks?

A:  If you examine real-world breaches, you can see that adversaries are always thinking – and operating – in terms of goals, such as stealing intellectual property or financial records. With traditional penetration testing, you would have someone scan to pinpoint specific vulnerabilities, such an unpatched windows system, on the network. While this is certainly an important vulnerability to know about, advanced attackers simply don’t think like this. They are goal-driven and will try multiple times until they get into the network and on to the path that will lead them to the crown jewels. This is done by hunting for privileges that will allow them to move around on the network. Make no mistake – attackers will get in. Operating under the assumption that you’ve already been breached is the first step in improving your organization’s security posture.

Q: During Red Team adversarial simulation testing, are you asked to breach the perimeter or do begin the exercise on the inside?

A: While we’ve done both forms of testing, we preach to “assume breach,” so we most often start from within the network, on a VM or an internal user’s laptop, for example. There is always a way to get into the network either through exploiting an external facing device or through social engineering.

Q: In your attack simulation, you created a connection back to a C2 server to carry out the initial breach. What are some of the ways to gain network access?

A: We work to gain access in a variety of ways, such as deploying malicious codes in enterprise applications or abusing inherent trust both externally and internally to gain a foothold. Examples include phishing with an HTA file, link or macro embedded document to multiple people within the organization. All of these methods will lead to in-memory execution of our payloads. Once we’ve infiltrated the network, we’ll abuse trust, like credentials, misconfiguration or software vulnerability to escalate privileges locally. Attackers are lazy – they will usually choose the path of least resistance. Humans are always the easiest option to exploit.

Q: So, attackers will try to steal credentials from a compromised machine?

A: There are multiple credential locations within Windows – some of them are within windows credentials managers, user history, applications and even Outlook. Microsoft has done a lot of work to harden these locations (particularly from v8.1 on), but attackers continue to innovate, and they have found ways to circumvent these protections. If there is a privileged credential on a machine, it’s almost impossible to stop an attacker from stealing it and using it to help achieve his/her goal. That’s why it’s so important to ensure workstations don’t contain privileged accounts within the network.  

(Editor’s note: CyberArk Endpoint Privilege Manager helps organizations to block and contain attacks at the endpoint, reducing the risk of information being stolen or encrypted and held for ransom. A combination of privileged security and application control reduces the risk of malware infection. Unknown applications run in a restricted mode to contain threats and behavioral analysis blocks credential theft attempts. These critical protection technologies are deployed as a single agent to strengthen existing endpoint security. It also enables security teams to enforce granular least privilege policies for IT administrators, helping organizations to effectively segregate duties on Windows servers.)

Q: Is there a difference between an external or internal attack?

A: The concept of inside vs. outside is obsolete. We view internal resources as hostile territory. Organizations need to treat their internal network in the same way they treat their external network. Just like you would not put an RDP connection outside, connected to the internet with a weak password, you should not do it internally. At the end of the day, a compromised workstation or malicious insider will lead to the same result.

Q:  What is the biggest deterrent to you being able to move laterally throughout a network?

A: This is relevant to almost every threat actor out there – from script kiddies to nation states and everything in between: Lateral movement occurs after an attacker finds a user’s privileged accounts and begins impersonating that user by using those privileged accounts. In almost all of our engagements, we end up searching and querying Active Directory to figure out who is logging in and from where, in our hunt for privileges. As an attacker, if I cannot access your privileged accounts (passwords, SSH keys, tokens, etc.), my job becomes infinitely harder to do.

Interested in learning more about what our Red Team’s research? Check out our Threat Research blog, which features in-depth technical research from CyberArk Labs and Red Team security experts to help you think like an attacker by keeping you ahead of the latest threats.

WANNACRY RANSOMWARE: A BRIEF Q&A WITH A CYBERARK LABS RESEARCHER

August 7, 2017 | Security and Risk | Amy Burnis

In May, we offered a 30 minute webcast focused on deconstructing the WannaCry ransomware attack. Led by CyberArk Labs Researcher Shaked Reiner, the webcast delved into specifics of the attack, as well as proven methods organizations can implement to prevent WannaCry’s ability to spread through networks and encrypt system data. We’ve compiled some of the questions attendees asked Shaked during the session, and the highlights are shared here:

Q: Can you describe the propagation technique used by WannaCry?

A: The WannaCry ransomware’s technique is based upon code originally developed by the NSA and leaked by the hacker group known as Shadow Brokers. It uses a variant of the Shadow Brokers’ leaked exploit and utilizes strong encryption on files such as documents, images and videos. The ransomware was able to spread at an unprecedented rate via a sophisticated, built-in “worm” capability. Additionally, it specifically targets the MS17-010 SMB vulnerability in Microsoft systems that many people had left unpatched, and therefore, exposed.

Q: Which account does WannaCry use to install itself, and if the user does not have administrative privileges, shouldn’t it disallow WannaCry to install itself?

A: This specific strain of ransomware is special in that aspect. Administrative privileges are not required to execute the initial infection. However, in order to propagate throughout the organization’s network, it needs to escalate privileges through the Microsoft vulnerability described above. After successfully exploiting this vulnerability, the ransomware has access to the highest tier of privileged credentials, enabling it run code in SYSTEM user context. WannaCry is then able to operate in an offline environment, encrypting the user’s files with an RSA-2048 key pair. After the encryption process, the ransomware demands $300-$600 in Bitcoin to decrypt the files.

Q: Why can’t Bitcoin payments be tracked?

A:  Bitcoin is often described as an anonymous currency because it is possible to send and receive Bitcoins without sharing any personally identifying information. It works by leveraging digital wallets untethered to a central management or processing system. This allows each digital wallet to operate independently, and it makes tracking and identification of the wallet holder incredibly difficult.

Q: How is it possible to detect and block such an attack?

A: Our CyberArk Labs team conducts ransomware testing daily to help organizations better prepare for such attacks. Based upon tests of more than 600,000 ransomware samples (including WannaCry), the team has found that the combination of enforcing least privilege on endpoints and application greylisting control is 100 percent effective in preventing ransomware in general, and WannaCry specifically, from encrypting files.

CyberArk Endpoint Privilege Manager helps organizations remove common barriers to enforcing least privilege, such as user productivity loss and increased burden on IT teams. It also allows organizations to block and contain attacks at the endpoint, reducing the risk of information being stolen or encrypted and held for ransom. A combination of privilege security and application control reduces the risk of malware infection. Unknown applications can run in a restricted mode to contain threats while maintaining productivity, and behavioral analysis identifies and blocks credential theft attempts. These critical prevention and protection technologies are deployed as a single agent to strengthen existing endpoint security.

Q: How difficult is it to create malware such as WannaCry?

A. It’s important to separate the two components of this malware to answer this question. In the case of WannaCry, the ransomware component itself was very ordinary – there are a few open-source ransomwares widely available on the internet and one does not need advanced programming knowledge to figure out how to compile one. What makes WannaCry unique and viral in nature is the highly sophisticated worm component that allows it to spread as quickly as possible to as many machines as possible. It’s likely two malware authors were involved in the creation of WannaCry, as the infection component is so advanced, while the ransomware itself is not overly sophisticated.

Q: Are there any additional tools from the NSA leak that could lead to another attack of this magnitude and scale?

A: Yes. The Shadow Brokers group offer a monthly subscription program that promises more data will be released from the NSA leak. It’s important to note that the previous leak did not contain any exploits’ source code, so WannaCry was constructed by fully reverse-engineering the software that was released. This indicates that the attacker responsible for the WannaCry worm component was extremely sophisticated, as noted previously. The NSA leak most certainly contained more tools that savvy hackers may leverage to wreak additional, future havoc and harm.

To learn more about the WannaCry attack, we invite you to read our Labs Team’s full analysis, as well as five ways to mitigate ransomware risk.

FOUR CRITICAL STEPS FOR SECURING API KEYS IN YOUR ORGANIZATION’S CLOUD WORKLOADS

September 19, 2017 | Security and Risk | Chris Smith

Automation enables organizations to leverage the dynamic capabilities of the cloud. Today, enterprises are increasingly leveraging automation tools and DevOps initiatives to drive greater business agility, improve efficiency and optimize business processes. To achieve this agility securely, automation tools pass credentials through APIs to ensure that only authenticated automation tools, applications, etc. can access the organizations’ cloud resources, customer data, infrastructure and other applications. Each of the public cloud vendors uses secure credentials, generically referred to as “API keys” or “access keys,” which are unique to the organization’s cloud environment and are established during set up of the cloud environment.

For example, in Amazon Web Services (AWS) environments, scripts use AWS Access Keys for accessing data, auto-scaling and other functions. With Azure, Azure Application Keys play a similar role, as do API Keys for Google Cloud Platform. These API keys are very powerful, enabling, for example, a script or user to stop or start a virtual server, copy a database or even wipe out entire workloads. With API keys, a script or user can do pretty much anything they want within a given cloud environment. In the wrong hands, they represent a major vulnerability.

API keys essentially represent the “keys to the cloud kingdom,” but despite this far-reaching power, these keys are often relatively unprotected. For example, attackers use phishing to steal API keys by gaining access to unprotected endpoints. Keys are also often embedded within applications, automation scripts and orchestration tools. As a consequence, they are all frequently static and unchanged — they are effectively hard coded and available in any copy of the app code or script. Attackers also steal API keys from public repositories, like GitHub – in this case, from code that is inadvertently dropped into public repositories without removing the API keys. It can be an easy mistake for a developer to make, and attackers use bots to troll these repositories leaving little time for the developer to correct the error.

News reports underscore the dangers unsecured API keys present. Consider the OneLogin breach from May 2017, during which an attacker gained access to a set of API keys and used them to access the AWS API from an intermediate host with another, smaller service provider, creating havoc for the organization.

As a result, because API keys are such powerful credentials and so widely used in cloud workloads, securing them and applying the principle of least privilege is imperative.

Four Steps for Securing API Keys

To help secure the enterprises cloud workloads, enterprises should take the following four steps to prevent attackers from compromising the organizations API keys:

1. Discover and enumerate all keys: Leverage discovery tools that can scan your cloud environment to pinpoint where API keys and other secrets exists. Assess and prioritize the API key and infrastructure vulnerabilities and collect reliable and comprehensive audit information.
2. Remove embedded API keys: Securely remove API keys from scripts, applications and automation tools. Similarly, prevent human users from directly accessing the API keys.
3. Secure API keys: Proactively protect API keys by storing them in a secure, centralized vault that supports strong access controls—allowing only authorized users and applications to reach them. Additionally automatically rotate API keys and apply the principles of least privilege (including reducing redundant permissions from the account role that is assigned to the API key).
4. Automate securing credentials: Leverage API Key access to the digital vault and use integrations with automation tools and scripts to automate and ensure the secure use of the API keys. To ensure that only the correct application have access to the API keys use machine IDs and application authentication.

While moving workloads to the cloud can bring significant business benefits, it can also expand the attack surface by allowing unprotected API keys and other secrets and credentials to become damaging security vulnerabilities. In the hands of an external attacker or malicious insider, API keys could allow attackers to take full control of an organization’s cloud infrastructure, disable security controls, steal confidential information and disrupt operations.

However, while this post focuses on vulnerabilities that attackers can exploit, organizations that effectively manage their API keys, secrets and other credentials can minimize these vulnerabilities and secure their cloud workloads. In fact, with the right approach the cloud can be more secure than on-premises environments.

Learn more about protecting your cloud workloads in our new eBook “6 Key Use Cases for Securing Your Organization’s Cloud Workloads” or visit www.CyberArk.com/cloud.

Java - Inner classes

In this chapter, we will discuss inner classes of Java.

Nested Classes

In Java, just like methods, variables of a class too can have another class as its member. Writing a class within another is allowed in Java. The class written within is called the nested class, and the class that holds the inner class is called the outer class.
Syntax
Following is the syntax to write a nested class. Here, the class Outer_Demo is the outer class and the class Inner_Demo is the nested class.

class Outer_Demo {
   class Nested_Demo {
   }
}

Nested classes are divided into two types −

• Non-static nested classes − These are the non-static members of a class.
• Static nested classes − These are the static members of a class.

Inner Classes (Non-static Nested Classes)

Inner classes are a security mechanism in Java. We know a class cannot be associated with the access modifier private, but if we have the class as a member of other class, then the inner class can be made private. And this is also used to access the private members of a class.
Inner classes are of three types depending on how and where you define them. They are −

• Inner Class
• Method-local Inner Class
• Anonymous Inner Class

Inner Class

Creating an inner class is quite simple. You just need to write a class within a class. Unlike a class, an inner class can be private and once you declare an inner class private, it cannot be accessed from an object outside the class.
Following is the program to create an inner class and access it. In the given example, we make the inner class private and access the class through a method.
Example

class Outer_Demo {
   int num;
   
   // inner class
   private class Inner_Demo {
      public void print() {
         System.out.println("This is an inner class");
      }
   }
   
   // Accessing he inner class from the method within
   void display_Inner() {
      Inner_Demo inner = new Inner_Demo();
      inner.print();
   }
}
   
public class My_class {

   public static void main(String args[]) {
      // Instantiating the outer class 
      Outer_Demo outer = new Outer_Demo();
      
      // Accessing the display_Inner() method.
      outer.display_Inner();
   }
}

Here you can observe that Outer_Demo is the outer class, Inner_Demo is the inner class, display_Inner() is the method inside which we are instantiating the inner class, and this method is invoked from the main method.
If you compile and execute the above program, you will get the following result −
Output

This is an inner class.

Accessing the Private Members

As mentioned earlier, inner classes are also used to access the private members of a class. Suppose, a class is having private members to access them. Write an inner class in it, return the private members from a method within the inner class, say, getValue(), and finally from another class (from which you want to access the private members) call the getValue() method of the inner class.
To instantiate the inner class, initially you have to instantiate the outer class. Thereafter, using the object of the outer class, following is the way in which you can instantiate the inner class.

Outer_Demo outer = new Outer_Demo();
Outer_Demo.Inner_Demo inner = outer.new Inner_Demo();

The following program shows how to access the private members of a class using inner class.
Example

class Outer_Demo {
   // private variable of the outer class
   private int num = 175;  
   
   // inner class
   public class Inner_Demo {
      public int getNum() {
         System.out.println("This is the getnum method of the inner class");
         return num;
      }
   }
}

public class My_class2 {

   public static void main(String args[]) {
      // Instantiating the outer class
      Outer_Demo outer = new Outer_Demo();
      
      // Instantiating the inner class
      Outer_Demo.Inner_Demo inner = outer.new Inner_Demo();
      System.out.println(inner.getNum());
   }
}

If you compile and execute the above program, you will get the following result −
Output

The value of num in the class Test is: 175

Method-local Inner Class

In Java, we can write a class within a method and this will be a local type. Like local variables, the scope of the inner class is restricted within the method.
A method-local inner class can be instantiated only within the method where the inner class is defined. The following program shows how to use a method-local inner class.
Example

public class Outerclass {
   // instance method of the outer class 
   void my_Method() {
      int num = 23;

      // method-local inner class
      class MethodInner_Demo {
         public void print() {
            System.out.println("This is method inner class "+num);    
         }   
      } // end of inner class
    
      // Accessing the inner class
      MethodInner_Demo inner = new MethodInner_Demo();
      inner.print();
   }
   
   public static void main(String args[]) {
      Outerclass outer = new Outerclass();
      outer.my_Method();        
   }
}

If you compile and execute the above program, you will get the following result −
Output

This is method inner class 23

Anonymous Inner Class

An inner class declared without a class name is known as an anonymous inner class. In case of anonymous inner classes, we declare and instantiate them at the same time. Generally, they are used whenever you need to override the method of a class or an interface. The syntax of an anonymous inner class is as follows −
Syntax

AnonymousInner an_inner = new AnonymousInner() {
   public void my_method() {
      ........
      ........
   }   
};

The following program shows how to override the method of a class using anonymous inner class.
Example

abstract class AnonymousInner {
   public abstract void mymethod();
}

public class Outer_class {

   public static void main(String args[]) {
      AnonymousInner inner = new AnonymousInner() {
         public void mymethod() {
            System.out.println("This is an example of anonymous inner class");
         }
      };
      inner.mymethod(); 
   }
}

If you compile and execute the above program, you will get the following result −
Output

This is an example of anonymous inner class

In the same way, you can override the methods of the concrete class as well as the interface using an anonymous inner class.

Anonymous Inner Class as Argument

Generally, if a method accepts an object of an interface, an abstract class, or a concrete class, then we can implement the interface, extend the abstract class, and pass the object to the method. If it is a class, then we can directly pass it to the method.
But in all the three cases, you can pass an anonymous inner class to the method. Here is the syntax of passing an anonymous inner class as a method argument −

obj.my_Method(new My_Class() {
   public void Do() {
      .....
      .....
   }
});

The following program shows how to pass an anonymous inner class as a method argument.
Example

// interface
interface Message {
   String greet();
}

public class My_class {
   // method which accepts the object of interface Message
   public void displayMessage(Message m) {
      System.out.println(m.greet() +
         ", This is an example of anonymous inner class as an argument");  
   }

   public static void main(String args[]) {
      // Instantiating the class
      My_class obj = new My_class();

      // Passing an anonymous inner class as an argument
      obj.displayMessage(new Message() {
         public String greet() {
            return "Hello";
         }
      });
   }
}

If you compile and execute the above program, it gives you the following result −
Output

Hello This is an example of anonymous inner class as an argument

Static Nested Class

A static inner class is a nested class which is a static member of the outer class. It can be accessed without instantiating the outer class, using other static members. Just like static members, a static nested class does not have access to the instance variables and methods of the outer class. The syntax of static nested class is as follows −
Syntax

class MyOuter {
   static class Nested_Demo {
   }
}

Instantiating a static nested class is a bit different from instantiating an inner class. The following program shows how to use a static nested class.
Example

public class Outer {
   static class Nested_Demo {
      public void my_method() {
         System.out.println("This is my nested class");
      }
   }
   
   public static void main(String args[]) {
      Outer.Nested_Demo nested = new Outer.Nested_Demo();  
      nested.my_method();
   }
}

If you compile and execute the above program, you will get the following result −
Output

This is my nested class