The Evolving Security Environment For Web Services

The Evolving Security Environment For Web Services Managing Risk Across SOA and Web 2.0

Agenda ,[object Object],[object Object]

An Understanding Of IT Risk Management ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Is a Continuum, Not a Binary State! Usability & Risk Confidence In Security Posture Cost & Complexity Window Of Opportunity

Enterprise Ready? Whose Enterprise? ,[object Object],[object Object],[object Object],[object Object]

Developer Communities ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Technology Transfer ,[object Object],[object Object],[object Object],[object Object]

Scalability & Commoditization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Scalability & Commoditization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Services Implementation Choices & Security Implications

SOAP, WSDL and UDDI ,[object Object],SOAP Client Payload SOAP Envelope Security Token Web Service Application A Application B WSDL (Web Services Description Language) UDDI Web Services Directory SSL Platform B Platform A Provided courtesy of Mark O’Neill, Vordel

REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Example of a REST Web Service ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Contrast with a SOAP weather service ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Contrast with a SOAP weather service POST /weatherforecast.asmx HTTP/1.1 <?xml version="1.0" encoding="UTF-8" standalone="no"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" > <SOAP-ENV:Body> <wns: getWeather xmlns:wns="urn:weather" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <zipCode xsi:type="xsd:string">02110</zipCode> </wns:getWeather> </SOAP-ENV:Body></SOAP-ENV:Envelope> ,[object Object],Provided courtesy of Mark O’Neill, Vordel

Reinventing protocols ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

More differences between SOAP and REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

What SOAP and REST have in common ,[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST in practice ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Another example: “Diane” Phone Service ,[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST’s popularity – a famous data point ,[object Object],Provided courtesy of Mark O’Neill, Vordel

Part 2 ,[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Applying security to REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

QueryStrings and Web Application Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Logging and audit trail ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon and Google Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Amazon Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

This time it’s REST “reinventing the wheel” ,[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

REST under the radar? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Developer awareness ,[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

When to use SOAP instead of REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

The problem with “Just filtering XML” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Provided courtesy of Mark O’Neill, Vordel

Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The Evolving Security Environment For Web Services

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (10)

Andere mochten auch

Andere mochten auch (9)

Ähnlich wie The Evolving Security Environment For Web Services

Ähnlich wie The Evolving Security Environment For Web Services (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

The Evolving Security Environment For Web Services