Appliances vs. Agents for XML Web Services Security

The Secure Web Services Deployment System
Appliances vs. Agents for
XML Web Services Security
A Reactivity White Paper
ABSTRACTSecurity is one of the main issues when deploying Web services in the enterprise. The trade-offs between agent-oriented and appliance architectures lead most security and networking professionals to prefer hardened appliances to optimally secure XML Web services. This white paper discusses the advantages of an appliance over an agent-oriented architecture for Web services security, how cross platform interoperation is immediate with a hardened appliance, and why web services security is different from web server security.
Reactivity, Inc. © 2004, Reactivity, Inc.The Secure Web Services Deployment System
ContentsThe Advantages of a Security Appliance over Agent-oriented Architectures in Web Services Security .....3Only a Security Appliance Can Fully Protect a Web Service .........................................................4Packaged Protection in Hardware Protects the Entire Stack ........................................................5A Security Appliance is the Only Solution that Can Deliver Acceptable Performance ...........................5Security Appliances Provide Scalable Distribution of Web Services Security Load ...............................5An Appliance Maximizes the Reliability of the Web Service .........................................................6An Appliance Delivers a Significantly Lower Total Cost of Ownership ..............................................6Cross Platform Interoperation is Immediate with a Security Appliance ............................................7A Security Appliance Offers the Best Workflow Between Application Developers, Security Administrators, and Network Operations ...................................................................7Why Web Services Security is Different from Web Server Security .................................................8Why Web Services Management is Different from Security ..........................................................9Securing the Last Mile? ....................................................................................................9Contact Reactivity .............................................................................................................9
FiguresFigure 1: Advantages of a Security Appliance ............................................................................3Figure 2: Agent vs. Appliance Feature Comparison .....................................................................4Figure 3: A Summary of Enterprise Requirements for Web Services Security.....................................8
Reactivity, Inc. Appliances vs. Agents for XML Web Services Security 2The Secure Web Services Deployment System
The Advantages of a Security Appliance over Agent-oriented Architectures in Web Services SecurityWhile agent oriented architectures have been successful in areas such as application monitoring, there are many applications where an agent oriented approach does not provide a feasible or practical solution. A close comparison of the required features, performance and operational efficiency necessary for scalable Web services security quickly demonstrates that appliances are the lowest cost and lowest risk architecture to address the challenges facing enterprises.
There are many challenges that a security appliance can best solve in an enterprise deployment of Web services, including: . The heterogeneous nature of Web services platforms. Performance requirements for security processing. The costs and administration of ensuring version and update control. The conflicts between different organizational teams interacting with the application domain.
Ahardenedsecurityappliancecan LoadgeneratedbyWebservicessecuritysecurealllayersofthestack(network,1 features(schemachecking,cryptography)operatingsystems,application,etc.) 3 viaagentschokesserverperformance
Internet DMZ DataCenter
??????????????????????????HTTP/S ????????Browser J2EEApplicationServer
.NET .NETApplicationServer??????????? ??????????????????????????? ????????????????WebSphere MQSeries
SAPNetWeaver
Onlyasecuritygatewaycanprotect ApplicationServers,WebServers,Packaged2 properlyagainstcertainthreats 4 Applications,andMessagingPlatformscreate(XMLDenialofService,XMLViruses) anencumberingcoveragematrixforagents