The Evolving Security Environment For Web Services

The Evolving Security Environment For Web Services Managing Risk Across SOA and Web 2.0

Agenda ,[object Object],[object Object]

An Understanding Of IT Risk Management ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Is a Continuum, Not a Binary State! Usability & Risk Confidence In Security Posture Cost & Complexity Window Of Opportunity

Enterprise Ready? Whose Enterprise? ,[object Object],[object Object],[object Object],[object Object]

Developer Communities ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Technology Transfer ,[object Object],[object Object],[object Object],[object Object]

Scalability & Commoditization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Scalability & Commoditization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Services Implementation Choices & Security Implications

SOAP, WSDL and UDDI ,[object Object],SOAP Client Payload SOAP Envelope Security Token Web Service Application A Application B WSDL (Web Services Description Language) UDDI Web Services Directory SSL Platform B Platform A Provided courtesy of Mark O’Neill, Vordel

REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Example of a REST Web Service ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Contrast with a SOAP weather service ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Contrast with a SOAP weather service POST /weatherforecast.asmx HTTP/1.1 <?xml version="1.0" encoding="UTF-8" standalone="no"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" > <SOAP-ENV:Body> <wns: getWeather xmlns:wns="urn:weather" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <zipCode xsi:type="xsd:string">02110</zipCode> </wns:getWeather> </SOAP-ENV:Body></SOAP-ENV:Envelope> ,[object Object],Provided courtesy of Mark O’Neill, Vordel

Reinventing protocols ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

More differences between SOAP and REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

What SOAP and REST have in common ,[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST in practice ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Another example: “Diane” Phone Service ,[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST’s popularity – a famous data point ,[object Object],Provided courtesy of Mark O’Neill, Vordel

Part 2 ,[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Applying security to REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

QueryStrings and Web Application Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Logging and audit trail ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon and Google Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

This time it’s REST “reinventing the wheel” ,[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST under the radar? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Developer awareness ,[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

When to use SOAP instead of REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

The problem with “Just filtering XML” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The Evolving Security Environment For Web Services

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (10)

Destacado

Destacado (9)

Similar a The Evolving Security Environment For Web Services

Similar a The Evolving Security Environment For Web Services (20)

Último

Último (20)

The Evolving Security Environment For Web Services