Welcome!

Cloud Security Authors: Elizabeth White, Maria C. Horton, Liz McMillan, Ravi Rajamiyer, Pat Romanski

Related Topics: Cloud Security

RSS Feed Item

SOA Security Vision

This will be the last [at least for a while] post in the SOA Security Series, and I want to conclude by sharing my vision and some recommendations and best practices (most of them fairly common sense) that I have noticed, stole and otherwise accumulated while working in this field. But before we start, I would like to fill the gap that I left in my earlier postings by never providing a

Definition of Secure SOA

Secure SOA is an approach to implement SOA which by design ensures trust throughout the SOA ecosystem (including services, consumers, composite applications and infrastructure) by addressing some or all of the following security aspects: Definition of Security

  • Authentication
  • Authorization
  • Integrity
  • Confidentiality
  • Accountability (monitoring, logging, audit, non-repudiation)
  • Identity (federation, provisioning, trust brokering)
  • Security Policies

It is also worth mentioning that I firmly believe that Secure SOA is best viewed as a specific case of Governed SOA.

Common SOA Security Requirements

I have a dream that all SOA Security platforms, implementations and mechanisms will be:Bastet, the goddess of protection

  • Agile – able to change at business speeds
  • Policy-driven – giving all stakeholders freedom to change their mind
  • Not client- or service-bound – applicable outside the individual domains of control
  • Usage- and context-sensitive – allowing service providers and their agents the freedom to have different security for different circumstances
  • Granularly applicable – not forcing the adopters to deal with the all-or-nothing dilemma
  • Brownfield-friendly – can be retrofitted into existing environments without requiring heroic efforts or causing unnecessary disruptions
  • Centrally controlled
  • Ubiquitous – not limited to a single technology, platform, protocol, transport or product
  • Extendable – affording everyone the freedom to add
    • new mechanisms
    • new Aspects (censorship, throttling, privacy)
    • new providers
    • new kinds of relationships (federations, aggregations, delegation, trust, etc.)
    • support of new standards and specifications
    • defense against new threats
    • ... and utilize new capabilities (HSM, accelerators)

Recommendations for Building Secure SOA

  • Enterprise-grade SOA Security can not be bought – it has to be architected, implemented and maintained. Do not confuse Software Security with Security Software.
  • Do not address SOA Security in isolation as a point solution, but try to address it as one of the aspects of a comprehensive governance solution in conjunction with QoS, versioning, lease and other governance aspects.
  • Avoid redundancy and duplication – look for a solution that can delegate governance functionality to your existing infrastructure and governance solutions (e.g. security and identity packages).
  • Do not look for easy fixes (like applying security at the perimeter or relying on transport layer security) and magic bullet solutions real security takes work.
  • SOA ≠ Web Services so do not settle for a solution which artificially limits the scope of security and governance to that technology.
  • To ensure wide adoption of SOA across your enterprise, do not make service consumers and producers bear most of the compliance burden – your solution should be able to take care of most things.
  • Do not let your security solution undo the main benefit of SOA by re-coupling service consumers and producers to each other, policies, etc. Arms race
  • Vendors are involved in an arms race of standard compliance. Do not be fooled by a lengthy checklist of supported standards – it does not guarantee better interoperability or security. And standards will change. Look for a solution which gives you freedom to choose which standards to support and when to support them – seek a solution which gives you freedom to change your mind!
  • Do not delay implementing security until “phase 2”
  • Beware of those (clients, colleagues, partners, etc.) who believe they are secure
  • Do not assume it is someone else's job
  • Do not forget that SOA Security is still a kind of security, so all the regular principles apply:
    • Defense in depth
    • Threat analysis
    • Assumption vulnerabilities
    • Weakest point
    • All traditional threats still exist
  • And never forget that common sense!

Please bookmark with social media, your votes are noticed and appreciated:

Read the original blog entry...

IoT & Smart Cities Stories
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists examined how DevOps helps to meet the de...
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
While the focus and objectives of IoT initiatives are many and diverse, they all share a few common attributes, and one of those is the network. Commonly, that network includes the Internet, over which there isn't any real control for performance and availability. Or is there? The current state of the art for Big Data analytics, as applied to network telemetry, offers new opportunities for improving and assuring operational integrity. In his session at @ThingsExpo, Jim Frey, Vice President of S...
Rodrigo Coutinho is part of OutSystems' founders' team and currently the Head of Product Design. He provides a cross-functional role where he supports Product Management in defining the positioning and direction of the Agile Platform, while at the same time promoting model-based development and new techniques to deliver applications in the cloud.
@CloudEXPO and @ExpoDX, two of the most influential technology events in the world, have hosted hundreds of sponsors and exhibitors since our launch 10 years ago. @CloudEXPO and @ExpoDX New York and Silicon Valley provide a full year of face-to-face marketing opportunities for your company. Each sponsorship and exhibit package comes with pre and post-show marketing programs. By sponsoring and exhibiting in New York and Silicon Valley, you reach a full complement of decision makers and buyers in ...
There are many examples of disruption in consumer space – Uber disrupting the cab industry, Airbnb disrupting the hospitality industry and so on; but have you wondered who is disrupting support and operations? AISERA helps make businesses and customers successful by offering consumer-like user experience for support and operations. We have built the world’s first AI-driven IT / HR / Cloud / Customer Support and Operations solution.
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
LogRocket helps product teams develop better experiences for users by recording videos of user sessions with logs and network data. It identifies UX problems and reveals the root cause of every bug. LogRocket presents impactful errors on a website, and how to reproduce it. With LogRocket, users can replay problems.
Data Theorem is a leading provider of modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere. The Data Theorem Analyzer Engine continuously scans APIs and mobile applications in search of security flaws and data privacy gaps. Data Theorem products help organizations build safer applications that maximize data security and brand protection. The company has detected more than 300 million application eavesdropping incidents and currently secu...