SOA Security: Good Enough and Getting Better
Forrester Research SOA expert Randy Heffner discusses how to establish an iterative design process for evolving your SOA security architecture that considers your current and future security requirements, emerging industry specifications, overlaps in product functionality for SOA security, and possibilities for custom security integration.
Wed, August 19, 2009
CIO —
Security is not a reason to stay away from SOA. Although full SOA security maturity is yet to come, 30 percent of organizations now use SOA for external integration with customers and partners. For standard Web services using SOAP, WS-Security has achieved critical mass as a foundational standard. On the other hand, advanced SOA security — involving federation among partners, nonrepudiation, and propagation of user identities across multiple layers of service implementations — is in its early days. To navigate the path from what's practical today to the future of advanced SOA security, establish an iterative design process for evolving your SOA security architecture that considers your current and future security requirements, emerging industry specifications, overlaps in product functionality for SOA security, and possibilities for custom security integration.
As a baseline for designing SOA security, the simplest way to secure SOA requests and responses is to place them within a virtual private network (VPN). The most common method for external SOA security is two-way Secure Sockets Layer (SSL), which: 1) allows each of the communicating partners to authenticate the other, and 2) sets a high bar for security: Hackers cannot even connect to an SOA-based service unless they steal a certificate and key from a service consumer. Although VPNs are relatively easy to establish, VPN-based SOA security is coarse-grained and offers no ability to support advanced functions such as: propagation of user identity across multiple layers of service implementations; coordination and federation among multiple security domains; and strict nonrepudiation. Also ongoing management of certificates can be an administrative burden.
Other major alternatives for SOA security include leveraging existing SOA security features in Java or .NET application platforms and concentrating SOA security within an SOA specialty product such as an enterprise service bus, SOA and Web services management solution, SOA security server, or SOA appliance. Appliances provide the simplest and most focused "drop-in" solution for SOA security, but there are intricate trade-offs to consider among the SOA specialty products as you build your overall SOA platform.
Even with the emerging features of application servers and SOA specialty products, simple SOA security solutions can be compelling, Historically, organizations have been reticent to tackle the difficulties of implementing advanced application security requirements. As SOA security implementations mature — along with broader architectures for security federation — it will become easier to implement advanced security scenarios. Many user organizations will find that advanced SOA security becomes mandatory — especially with increasing data privacy and other regulations. Thus it is important, even if you start with a simple SOA security solution, to anticipate the need for and leave paths open to build additional, deeper security functionality as business requirements demand and SOA security maturity allows.
