Extending XML-based Services Beyond the Perimeter

Extending
XML-based Services
Beyond the Perimeter
Authored by Andrew Nash,
Chief Technology Officer, Reactivity
ABSTRACT
Across leading enterprises, architects have discovered that convincing a business owner to invest in Service Oriented Architectures and XML is most efficient when the architect identifies a clear revenue-producing or cost-reducing project that would be demonstrably accelerated by these technologies. The most compelling are often those projects that entail integration between the enterprise and its business partners, suppliers or even customers. The most significant challenge to those projects is assuring security. The vast majority of IT professionals and business people agree that security is the leading concern for SOA and XML messages and most quickly realize that SSL is limited by not providing content security, auditability or reliability.
Thought leaders from leading analyst firms and enterprises assert that addressing security concerns is both pragmatic and possible. In fact, many enterprises can and are extending their XML-based services beyond the perimeter with a more pragmatic and graduated approach than is required for comprehensive internal SOA.
This paper will discuss how to extend SOA beyond the perimeter through high performance:1. Service access controls2. Deep content inspection 3. Alignment of people and processes for sustainable growth
© 2006, Reactivity, Inc.WHITEPAPER
ContentsExpanding XML-based Services Beyond the Perimeter????????? 3 Threat Mitigation??????????????????????????????????????????????????????????????????????? 9
Case Study: Aeroplan???????????????????????????????????????????????????????????????????????????3 Protecting from XML-Based Denials of Service??????????????????????????9
Protecting the Enterprise when Exposing Services??????????????????4 Practice Safe SOA: Deep Message Inspection??????????????????????????10
SSL-Only Protection????????????????????????????????????????????????????????????????????4 Content Privacy and Compliance??????????????????????????????????????????? 11
Hard Coded Protection??????????????????????????????????????????????????????????????4 Aligning People and Processes for Sustainable Success?????? 12
Platform Protection?????????????????????????????????????????????????????????????????????4 Applying the Lessons of External Integration to Other Services Perimeters????????????????????????????????????????????????????????????????? 12Agent Protection??????????????????????????????????????????????????????????????????????????5 Types of Services and Associated Perimeters???????????????????????????12Gateway Protection?????????????????????????????????????????????????????????????????????5 Perimeter Protection Excellence - Reactivity XML Security Controlling Service Access ??????????????????????????????????????????????????????? 5 Gateways?????????????????????????????????????????????????????????????????????????????????? 13Message Transport Security???????????????????????????????????????????????????????????????5Service Level Security ?????????????????????????????????????????????????????????????????????????6Case Study: Carlson Marketing Group???????????????????????????????????????????8
© 2006, Reactivity, Inc. www.reactivity.com Extending XML-based Services Beyond the Perimeter | WHITEPAPER
XML services (XML, REST, Web Services, ebXML) continue to gain momentum as the Case Study: Aeroplan most efficient and flexible architecture for real-time system to system integration. The largest auto-manufacturers are finding that XML based services are a more Aeroplan, a highly profitable flexible and cost effective mechanism to connect dealer networks. Financial services subsidiary of ACE (ACE Aviation institutions are expanding their market reach by reducing the costs of integrating Holdings), whose first SOA their services with employers' portals - growing total revenues while improving initiative was to securely expose their margins. Loyalty companies are enabling real-time "points-based" ecommerce XML/MQ based services as Web to increase the value of loyalty programs and increase revenues. These are a few of services (SOAP/HTTPS) to third the many examples of pragmatic enterprises realizing significant business gains by party partners so that those extending XML-based services across the perimeter - often as th... [download for more]