Understanding Soa Security Design And Implementation

Securing access to information is important to any business. Security becomes even more critical for implementations structured according to Service-Oriented Architecture (SOA) principles, due to loose coupling of services and applications, and their possible operations across trust boundaries. To enable a business so that its processes and applications are flexible, you must start by expecting changes – both to process and application logic, as well as to the policies associated with them. Merely securing the perimeter is not sufficient for a flexible on demand business.

In this IBM Redbooks publication, security is factored into the SOA life cycle reflecting the fact that security is a business requirement, and not just a technology attribute. We discuss an SOA security model that captures the essence of security services and securing services. These approaches to SOA security are discussed in the context of some scenarios, and observed patterns. We also discuss a reference model to address the requirements, patterns of deployment, and usage, and an approach to an integrated security management for SOA.

This book is a valuable resource to senior security officers, architects, and security administrators.

Table of Contents
Part 1. Business context and foundation
Chapter 1. Business context
Chapter 2. Architecture and technology foundation

Part 2. IBM SOA Foundation scenarios
Chapter 3. IBM SOA Foundation Service Creation scenario
Chapter 4. IBM SOA Foundation Service Connectivity scenario
Chapter 5. IBM SOA Foundation Service Aggregation scenario
Chapter 6. IBM SOA Foundation Business Process Management scenario

Part 3. Securing the Service Creation scenario
Chapter 7. Business scenario
Chapter 8. Solution design
Chapter 9. Technical implementation

Part 4. Securing the Service Connectivity scenario
Chapter 10. Business scenario
Chapter 11. Solution design
Chapter 12. Technical implementation

Appendix A. Introduction to service-oriented architecture
Appendix B. IBM SOA Foundation
Appendix C. Security terminology, standards, and technology
Appendix D. Additional material

About the Authors
Axel Buecker is a Certified Consulting Software IT Specialist at the International Technical Support Organization, Austin Center. He writes extensively and teaches IBM classes worldwide on areas of Software Security Architecture and Network Computing Technologies. He holds a degree in computer science from the University of Bremen, Germany. He has 21 years of experience in a variety of areas related to Workstation and Systems Management, Network Computing, and e-business Solutions. Before joining the ITSO in March 2000, Axel worked for IBM in Germany as a Senior IT Specialist in Software Security Architecture.

Paul Ashley is a Senior Certified IT Specialist and Lead Architect for the SOA Advanced Technologies A/NZ team, part of the IBM Software Group. The team specializes in new SOA engagements and technology. Paul has worked in the IT industry for 17 years, and holds degrees in Electronics Engineering and Computer Science, and a Ph.D. in Information Security. Before joining the SOA Advanced Technologies team, Paul worked as a Security Specialist for Tivoli Security in both the USA and Australia. He is based at the Australian Development Labs on the Gold Coast.

Martin Borrett is a senior security architect supporting IBM Tivoli Security brand across Europe. Martin has worked in the IT industry for 14 years, the last 12 of which have been with IBM. Martin is based at IBM Hursley in the UK and spends most of his time travelling across Europe advising clients about the business, technical, and architectural issues associated with security and assisting them in exploiting IBM Tivoli Security products. Over the last two years, Martin has worked increasingly with clients and IBM teams on SOA, in particular the security and management aspects and the technology that Tivoli can provide to help clients in this area. Martin is a Consulting IT Specialist, a certified member of the BCS and a chartered engineer (CEng) of the IET.

Ming Lu is a Senior Managing Consultant in the IBM Software Services for Tivoli (ISST) security practice team. He works on security architecture and solution design for projects based on the IBM Tivoli security product portfolio. Ming has over 12 years of experience in the field of information security, software engineering, and system integration. Before joining ISST in 2006, he worked in the IBM Tivoli Austin lab for seven years as a Senior Security Architect. He holds a Ph.D. degree in Computer Science from Tsinghua University, China.