Twelve rules for developing more secure Java code-Rule 9

Rule 9: Make your classes nonserializeable

Serialization is dangerous because it allows adversaries to get their hands on the internal state of your objects. An adversary can serialize one of your objects into a byte array that can be read. This allows the adversary to inspect the full internal state of your object, including any fields you marked private, and including the internal state of any objects you reference.

To prevent this, you can make your object impossible to serialize. To achieve this goal, declare the writeObject method: 

private final void writeObject(ObjectOutputStream out)

throws java.io.IOException {

        throw new java.io.IOException("Object cannot be serialized");

}

 This method is declared final so that a subclass defined by the adversary cannot override it.