Home | Business News | Browse by Publication | X | XML Journal

XML in unexpected places: understanding the emergence of XML outside software systems.

Article Excerpt
It is a welcome sign of XML's success that it increasingly appears in unexpected places and concerns an ever-broadening set of people. Those of you who were involved with XML technology in the early days or who bravely pioneered XML in your organizations years ago may be bewildered by this, and wonder whether all of these "other" people really understand what XML is all about. The major change is that for the business people, the question has now irrevocably become "When XML?" not "XML?". Plugging our ears to keep out the din of marketing noise, let's take a quick tour of the unexpected places you'll find XML.

XML in Firewalls

It is quite natural to ask "Huh? What does XML have to do with firewalls?". XML is quickly becoming part of the network security infrastructure for three major reasons. First, XML Web services were designed to bypass the existing firewalls and intrusion detection systems. You may remember early articles about SOAP that promoted it as "firewall friendly RPC for Windows." The last thing any security professional wants, especially in the aftermath of MSBlaster, is "firewall friendly" anything for Windows. Detecting that a particular HTTP connection is actually carrying XML/SOAP and ensuring that the SOAP requests are valid requires an XML-aware firewall, leading a number of startup vendors to develop software and hardware products for the job.

Second, there is a larger trend of moving application-level security into network devices, motivated in part by the realization that most security threats today are at the application layer, and keeping up with the constant flow of application patches turns out to be very difficult in practice. By establishing a universal data encoding for application data and some basic security building blocks, XML makes the move to message-level security easier and more attractive. In addition to securing the enterprise perimeter or encrypting individual connections (using SSL...