JavaOne talk on security (pdf). I find the diagrams we created to be useful.