Security of Web Application and Services and Service‐Oriented Architectures

Abstract

Abstract Service Oriented Architecture, or SOA, can help organizations integrate heterogeneous systems, provide for increased reuse of software assets, provide multichannel access to common components, and describe ways to build distributed systems, while reducing complexity and increasing interoperability. Seen as a natural outgrowth of previous software design paradigms, the key distinguishing characteristic it has is facilitating interoperability between distributed software components. As an architectural style for designing software SOA does not mandate one implementation choice over another. While there are many realizations of these principles the most pervasive implementation choice for SOA is Web services. This narrative will discuss the various technical specifications and standards that have been developed to help secure web services. It will also discuss security concerns and potential vulnerabilities associated with SOAs, including possible lack of information about what lies behind SOA interfaces, identity and authentication issues, federated trust management, end‐to‐end security needs, policy specification and policy enforcement issues, and interoperability related to security issues.