SOA and Security - Twenty-Four Seven Security

« The Unique Security Challenges of SOA | Main | Scary New Class of Security Exploits »

October 15, 2007
SOA and Security

As per my blog from last Friday, The Unique Security Challenges of SOA, where I contend that, "security is the primary limiting factor inhibiting SOA's growth," I just came across Christopher Hoff's blog at Rational Security titled, Security is NOT the Primary Limiting Factor Inhibiting SOA's Growth.

And you know what, when you get down to the nuts and bolts of SOA, Hoff is right! Whereas security is definitely one of the limiting factors, would I say in even 90% of the cases it is the MOST limiting factors...No! My line is pretty much marketing copy, almost akin to someone saying, That's the coolest thing ever! Standing on the cutting edge of technology, it's easy to get sucked into using hyperbole.

But the inevitable point of my article is that security IS an issue with SOA, and whether it's the most, least, or middle issue, it is still an IMPORTANT issue, which still makes the webinar, Think Globally, Act Locally for SOA Security, relevant.

Hoff also takes me to task for saying I haven't seen much discussion in the blogosphere about SOA security when there's clearly been a few. But what I meant is I haven't seen much discussion on SOA compared to all the chatter re: spam or phishing or application security or the high-profile security breaches that keep making news.

There were also some very interesting comments after Hoff's blog. One comment in particular was: "Should security in SOA be improved? Sure. Did this ever stop any previous technology from being widely deployed? Nope. The dotcom boom was built on far weaker security architecture than what SOA has. The real problem with SOA security is that the security people need to learn more about how apps are built and the software people need to learn more about security."

I think that the reason that security came up so early in SOA's lifecycle is the changing nature of how people and corporations now view security. I'm from Detroit, and in the early days of the automobile, it was just enough to have a vehicle that would take you from A to B. Then people started noticing that when going fast enough from A to B, these autos have a tendency to flip over and burn, so people started asking: how safe is that?

And as more and more companies get up-to-speed on the info superhighway, people are starting to ask the same: how safe is that?