SOA in Action Blog

Successful service oriented architecture means more than getting all your technology pieces in order -- even more crucial is lining up organizational support for the changes that SOA will bring.

That's the experience David Saul, senior VP and chief information security officer at State Street Bank, recently described in a new ebizQ Webcast which addressed the ROI of SOA. Saul was joined by IBM VP Sandy Carter and ebizQ's Beth Gold-Bernstein.

State Street Bank, which manages three major lines of business across 26 countries, turned to SOA in an effort to surface various applications and processes -- such as fund accounting daily pricing of mutual funds, and net asset value calculations -- as services across the organization.

Saul strongly emphasized the need to put the business out in front in SOA. "Your technology architecture is something that you need to get to after you’ve completed the business architecture," he said.

"One of the important things going into this is was we recognized that this couldn’t be purely a technology-related project and driven entirely by IT. so it was very important early on to get business partners who were willing to work with us and sponsor projects. I would say it was equal parts governance and technology, and we’re still working through that.... Having buy-in from a business is absolutely critical."

Saul also emphasized the need to plan out the direction and goals of an SOA and enterprise architecture program. "There's an ancient Chinese proverb that says, 'if you don’t know where you’re going, any road will get you there.' That applies to the governance of enterprise architecture and SOA. What does the business want to do? Where do we want to grow with our existing customers?"

It's not necessary to create new metrics and measurements from scratch to track SOA results, he said. "We’re not talking about inventing new measurements for SOA. If you do that, then you've missed the point. The business measurements that we have already, and the key performance indicators, those should be the ones we correlate against our SOA strategy."

Saul also observed that SOA is creating new types of jobs across the organization. "If you are creating a services environment, there are a whole new set of jobs, people who are able to understand what these services are, translate the business requirements into technology requirements. In a lot of cases, they’re very similar to an analyst role previously, but it’s probably at an even higher level than that was before. At both the architecture, development and implementation levels, we’re seeing whole new sets of jobs being created."

This shift in skills requirements adds additional stress to the cultural changes that SOA is bringing to the business, Saul added. "SOA is creating new types of jobs and new types of roles, so we need to think about how we’re going to migrate our existing workforce into this new way of doing business, where they’re dealing with services. As we all know, the cultural changes are very much more difficult to handle than technology."

Saul said State Street was also now making security a "a major emphasis in its SOA program" this year. "The business that we’re in -- the security of our customer’s assets is paramount to us. We have to deal with a large number of regulatory bodies and legistlation from around the world. So security has to be 100%. There can't be any slip-ups."

To address these acute security requirements, Saul's team needs to undertake a complex strategy, along the lines of a roles-based model for security. "There are a lot of pieces to that, and a lot of steps along the way," he explained. "We're going to have to develop federation identities. We’re going to have to provide for delegated authentication, and then fine-grained entitlements."

Moving from a complex legacy environment to a new service-oriented approach is a long-term task when it comes to re-orienting security, he says. "We’re coming from an environment where a lot of security was built into applications, or into packages that we where buying from vendors. You can imagine what its like if you have a CICS transaction that runs on the mainframe that expects to have a human being at the end of that authenticating a transaction, and now you want to turn that into a service that might be running remotely."

"We’re trying to move to a more generalized approach that will satisfy everybody going forward."

For a replay of the Webcast, click here.

___________________________________________________________________