Web Services Risks — Understanding The Web Services Security Threat

With the increasing popularity of Web services, there is a crucial need to understand Web services risks, and the most prevalent Web services threats and best practices to mitigate these risks.

Register to download this white paper for free today.

Note: The items in BOLD are required fields. You must supply a valid email address to complete the registration.


First Name
Last Name
Company
Title
Job Category
Industry
Email
Telephone
Address 1
Address 2
City
Country
State/Prov
Postal Code

Abstract: Web Services Risks — The Risk, The Threats and What You Can Do About It

Even though Web Services standards are only a few years old, the rapid ratification by standards bodies and the committed support by major vendors are unprecedented. Companies and government agencies have been rushing in, with many projects already in production. The question of Web services security, however, continues to be the leading issue and the top investment area for companies enabling Web Services. Is there a reason for this? Can existing technologies plug these security holes created by Web Services? Are the risks the same for all services – across the user base: internal employees vs. external users? Are the Web services dangers and risks more or less than with existing technologies? The benefits and ease of use make the adoption of Web Services a foregone conclusion. The real question that enterprises must ask themselves when adopting Web Services is: what are the reasonable and cost effective steps to mitigate Web services risks to an acceptable level for our organization?

There are many methods for calculating Web services risks. Calculating risk around Web Services is difficult given that Web Services can be used for many different types of applications. Web Services can be used for simple enterprise application integration to complex B2B communication with partners and other third parties. We will examine one method by which to examine the security risk of Web Services.

The goal of Web Services is to expose standardized interfaces to new and existing applications. No technology in the past has created such potential exposures to critical business applications. Web Services are standardized interfaces and therefore can be attacked in consistent ways. Hackers can more easily gain access to a standardized interface than a proprietary interface because more is known about the interface.

In addition, the adoption of Web Services has been increasing rapidly. While it has not hit the mainstream yet, all analyst predictions point to massive adoption in the coming years. Support in the vendor community has been growing faster providing further impetus for rapid growth.

In assessing the basic security risk of using Web Services, one must examine a couple of key areas. There are many ways to analyze security risk. One simple way is to look at the following formula:

Annualized Loss Expectancy = Annualized Rate of Occurrence x Single Loss Exposure

Each organization has different ways of calculating these variables. To illustrate, we'll discuss each of these variables.

Annualized Rate of Occurrence (ARO)

One constant in the security realm is that companies and government agencies must expect to Web services attacks. Large organizations are attacked on a regular basis through ever new and creative means. In the recent 2004 Computer Security Institute and FBI survey, 100% of companies experienced attacks.

For externally facing Web Services, access to interfaces is simple. Because Web Services are designed to tunnel through existing network firewalls, hackers can quite easily get direct access to applications. In addition, because Web Services are self-describing, with WSDLs that describe how to interact with Web Services, hackers have more information than ever on how to interact with specific application interfaces.

Many Web Services projects are internally focused which might provide a false level of comfort to security professionals. In the CSI/FBI study, almost 50% of security breaches were from internal sources. Whether it's a recently fired employee or an unscrupulous trader or a compromised partner, there is significant risk from the inside. While there are varying statistics, internal attacks may be considered more harmful because the attacker typically has much more inside knowledge of the systems to cause the most damage while greatly reducing the chance of being detected.

Issues and Answers

This white paper covers a great deal of territory with respect to Web services security issues and answers. The contents include the following sections:

"Under the Radar"

Web Services are in the early stages now but in some surveys, over 60% of companies have Web Services already in production. Many of these implementations are grassroots efforts that escape the radar screens of the network operations and security staff – and therefore their policies: just one more source of Web services risk.

For More Information

Learn how to protect your network against Web services risks: read the free white paper, XML Web Services Security: Going Production