Progress / Actional/Resources/White Papers
XML Web Services Security
XML-based Web services is poised to revolutionize Information Technology, much the same way that client server and Web-based applications did in the past decade. Through the use of protocols such as XML, SOAP, WSDL and UDDI, applications can more easily communicate with each other over Internet protocols, enabling faster and cheaper enterprise application integration, supply chain integration, distributed development and Internet-based service distribution models. But in order to gain wide acceptance, service networks must be able to count on standards for XML Web services security.
Register to download this white paper for free today.
Background on Web Services, SOA, XML
XML Web services has had unprecedented support from many of the major vendors including SAP, Siebel, PeopleSoft, Oracle, Sun, IBM and Microsoft with their .NET framework.
Web services is also behind most service-oriented architecture (SOA) implementations today. In addition, the technology is easy to implement: a fact that drastically reduces Web service cost and development time, but at the same time dramatically increases the security risk.
SOAP allows applications to easily communicate with each other using XML, presenting a challenge for Web services security
XML Web services interfaces are XML-based and loosely coupled in practice. XML and SOAP allow any systems to communicate with each other, whether it be an Office XP desktop application or a mainframe system. Over time, as there is pressure to automate business functions, there will be a need to integrate additional diverse systems as part of a broader Web Service environment. This "ecosystem" has some or all of the following characteristics:
- Decentralized in architecture
- Decentralized in administration
- Heterogeneous in implementation technologies
- Connections across multiple departments
- Connections across multiple enterprises
- Peer-based architecture
- Open to the public Internet
Any of these characteristics presents challenges to the overall security of the system. How do you enforce a Web services security policy across an entire environment with multiple heterogeneous systems? How do you ensure that security policies are enforced particularly with "desktop administrators"? How do you work with an outside vendor that is weak in security? How do you Web enable a legacy application that was never designed to be exposed to the public Internet? How can you monitor and audit activity and administrate access across multiple heterogeneous systems? How do you protect an interface implemented using new technology that has much more functionality exposed?
XML Web Services Security: Ready for Production?
XML Web services is a set of protocols and technologies that many believe will change the IT landscape within the next few years. However, the mostly true perception that there are serious issues with Web services and security is preventing the widespread adoption of XML Web services. While there is no way that any system can be completely secure, a greater understanding of the issues, better policies and procedures, better standards and supporting technology can provide many enterprises with adequate protection today for certain deployments. While it's not going to happen overnight, many companies and standards bodies will soon solve these problems.
Security Risk Prevents Widespread Adoption
The number-one concern that prevents many enterprises from implementing Web services in a meaningful way is the lack of understanding of what the security risks are. Many IT managers are dabbling in Web services and have plans to implement in the fictitious "3-6 month timeframe" but are afraid to seriously commit resources until "somebody else has gone first."
Common questions are:
- Will standard firewalls and intrusion detection systems be sufficient?
- What are the details of Web services authentication and authorization?
- Web services encryption: Can I rely on SSL, VPNs and dedicated lines to protect my traffic?
- How do I avoid the most common Web services attacks
- Web services threats: Will hacker attacks be the same as the ones I expect on my own Web site?
- Vendor Support for Emerging Security Standards: Can I rely on vendors to provide adequate protection?
- Will there be a protocol developed that secures my network?
The quick answers to these questions are "no" – although current technologies can provide some level of protection in a controlled environment. While standard Web-based traffic involves HTML from browser to server, Web services traffic can involve application APIs sending data to each other over HTTP, HTTPS, SMTP, wireless and other mediums. Instead of a web server processing HTML, applications will be consumers and producers of SOAP wrapped messages. An application can be both a Web services consumer and a Web service provider. Each Web Service application interface may have hundreds of operations that can be accessed, providing hackers and other individuals (whether intentionally or unintentionally) with new and harder-to-detect ways of compromising systems.
Hindrances to Web Services Growth
Until IT managers are more confident of XML Web Services security standards – or of the availability of products to secure their services networks – Web services will be hindered in its complete adoption. One purpose of this tutorial is to set forth the security threats as they have been identified, and to outline methodologies for coping with these threats.
For More Information
Find out more about XML Web services security. Learn how Actional runtime governance secures your services: download the free webinar, SOA Governance: Where the Rubber Meets the Runtime
