« Web Services Security - Web Application Threats | Main | Threat Protection for Web Services - Architecture Matters »

Much of the discussion around web services or SOA security tends to revolve around enabling SOAP messaging security in the form of WS-Security and other standards. Far less has been written about the notion of protecting your web services architecture from potential threats. When you consider securing this service oriented world we are intentionally engaged in from a technical perspective, we start to realize how challenging threat protection can be.

Threat protection of a distributed web services environment is exponentially more difficult than your traditional tightly bound, monolithic web app. You have to consider protecting web services architectures at three levels:

1. Architecture
2. Transactional
3. XML Content

Much of the discussion is relegated to (3) without consideration to (1) to the detriment of security. Let's examine how architecture plays a role in changing the rules of threat protection.

Posted by andreyee in web services security |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/346