These challenges can be somewhat intimidating when it comes to transitioning to an SOA. However, it is important not to overlook the incredible cost savings and efficiency that come from an SOA in addition to the inevitability of this computing model. Those looking to implement an SOA should be encouraged that Web services security products, techniques, and standards are fast proving to be ready for prime time.

Example - Supply Chain Management
To illustrate the security problems inherent in SOAs, let's look at a typical supply chain management process that involves a manufacturer and three vendors. Figure 1 represents the traditional business-to-business security environment:

Though secure, this traditional setup is costly and complex to maintain:

If the manufacturer and its vendors decide to expose applications as Web services in an SOA, they benefit from greatly increased flexibility, but face security risks. Figure 2 shows what this SOA would look like. Applications developed in this environment have numerous potential functional advantages over the traditional model, including:

This is all accomplished without needing any proprietary software to create custom interfaces and remote procedure calls, without requiring a dedicated private network, and without even having to develop any code - it may already exist as a reusable Web service.

Unfortunately, however, the SOA shown in Figure 2 also contains a variety of security risks. Because the messages may travel across public networks, they can be "listened to" by others, they can be intercepted and changed, and they can be rerouted for the purpose of fraud or malicious mischief. In addition:

Building Security into Your SOA Through a Web Services Management Platform
To secure an SOA, it is best to identify, acquire, and implement a robust Web services management platform that will intercept SOAP messages and enforce security policies. Ideally, the platform selected will have the capability to connect with any existing security framework currently in use in the enterprise, even if stand-alone implementation is chosen in the first stage.

A suitable Web services management platform will tackle the most pressing security issues in an SOA. It should monitor the SOAP requests, authenticate users, establish authorization, encrypt, provide signatures and certificates, and assure contractually promised service responses. Figure 3 shows the standard Web service request and response transmitted in SOAP over HTTP. In Figure 4, the Web services management platform adds security to this process by authenticating the requesting user and encrypting both the request and the response using an SSL. The result is an SOA that operates in HTTP-S.

The following is a checklist of features that must be delivered in the Web services management platform that you select to secure your SOA:

Conclusion
Though it may seem as if there is a myriad of complex issues surrounding security in the SOA, the bottom line is that you can accomplish most if not all of your security goals with the more robust Web services management platforms on the market today. By managing a vendor-neutral, standards-based architecture in this manner you can take advantage of all the capabilities of existing security vendors (Netegrity, RSA, CA, etc.) in the context of a robust SOA framework. Then, if you work carefully to design security into the SOA from the outset, extending the same level of attention and concern for security that you have used in previous enterprise architecture efforts, you will find that your SOA will be able to operate smoothly and securely, even as it grows.