Home | Business News | Browse by Publication | X | XML Journal

Malicious attack protection for XML Web services: communication behind a firewall isn''t always safe.

Article Excerpt
As the vast majority of Global 2000 organizations are transitioning pilot projects into production, the hype over XML Web services might finally be turning into reality. Web services usage has varied from simple data information sharing between two applications to corporate-wide, service-oriented architecture (SOA) initiatives.

**********

There are many reasons why Web services are gaining traction, including ease-of-use, their loosely coupled nature, and effectiveness in application integration with the lowest cost and least effort required. Yet the use of Web services is not without challenges. Security continues to be a top concern, and with good reason, as Web services interfaces are different than Web site pages and cannot rely on the same mechanisms to protect them.

Security as Top Priority

Security has taken a priority role in organizations as the threat of breached assets and downtime is compounded with regulatory requirements, including HIPAA and Gramm-Leach Bliley. Chief security officers (CSO) are now common-place and are charged with maintaining not only digital integrity, but physical security as well. As these C-level executives are pulled in two opposite directions, it is up to internal developers, QA staff, internal operations, and compliance officers to be aware of their company's security and auditing requirements.

With regards to XML security, Web services interfaces are generally much more complex, expose more functionality, and have a more sophisticated levcl of interactions than Web site pages. Though network firewalls do a good job of stopping network-level attacks, they do not provide the granularity or the proper rule sets to handle complex application attacks. Implementation of Secure Sockets Layer (SSL) and other existing technologies is useful but hinders value in scalability and interoperability costs.

The majority of early Web services projects have been conducted internally, behind...