SOA also allows companies to rejuvenate their legacy systems by abstracting certain business processes, services, or data points without having to rip out and replace these systems. Companies can leverage their existing investments in their legacy systems while building new systems that seamlessly integrate with them.

To the end users this is nirvana. To the folks in the security department, this is their worst nightmare!

Integration Side Effects

The benefits I mentioned above come with great risks in the area of security, privacy and compliance. For services to integrate easily with other services both behind and outside of the firewall, they must be discoverable and easy to translate. Many SOA implementations use Web services. Web services use WSDL (Web Service Description Language) which describes how to invoke the service. UDDI (Universal Description, Discovery, and Integration) is a standard that is commonly used with Web Services that allow services to be discovered and retrieved. Two other important standards frequently used in an SOA are XML (eXtensible Markup Language) and SOAP (Simple Object Access Protocol). XML is a self describing format that contains information about the messages in clear text while SOAP is a protocol for exchanging XML based messages and provides important information in the clear. While these standards make it easier for companies to integrate services, it also could give the keys to the kingdom away to hackers if the proper security is not in place.

Many legacy systems were never architected to be exposed to other systems, especially systems outside of the firewall. Now with SOA, hackers can get access to systems and data that they couldn't get to before, thanks to the discovery and self-describing nature of SOA.