[link|http://java.sun.com/marketing/collateral/security.html|Here] is Sun white paper thingie.
The business end of the Java security model is conveniently described by using the metaphor of the Sandbox. The sandbox comprises a number of cooperating system components, ranging from security managers that execute as part of the application, to security measures designed into the Java Virtual Machine* (JVM) and the language itself. The sandbox ensures that an untrusted-and possibly malicious-application cannot gain access to system resources.