CIO - The simplest and most common approach to security for service-oriented architecture (SOA) is to route service requests over a virtual private network (VPN). This provides adequate security for simple, coarse-grained requirements, it works with SOAP, REST, and non-Web services protocols, and it is adequate even for many external integration scenarios. Yet not all security scenarios are simple, and for more complex needs and fine-grained SOA security, architects must do considerably more planning and design. To craft a comprehensive strategy and architecture for SOA security, architects must consider a wide diversity of security requirements, business scenarios, and application infrastructure, weaving together multiple products, standards, and custom-built components into a flexible and robust SOA security solution.
[ For timely data center news and expert advice on data center strategy, see CIO.com's Data Center Drilldown section. ]
At least 10 product categories can play a part in SOA security architecture, and there are major areas of functional overlap among them. The building-block structure of SOA and Web services security specifications means architects must plan carefully for which specifications they will use and when to use them. Business scenarios with different security requirements may require different combinations of specifications and products. Adding even further to the complexity, the standards and specifications are still maturing, so there is little industry experience with best practices for many of the specifications. Architects may face additional challenges including divergent SOA infrastructure, multiple SOA messaging exchange patterns, the need to federate security across multiple environments, and the need to propagate identity across layers as one service calls another. This is not to mention common issues like organizational friction, cost, and difficulties with architecture governance.
Continue reading the complete article on CIO.com
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
