Software security and SOA: danger, Will Robinson!

Severe SOA Security Threats on SOAP Web Services– A Critical Analysis

“…One of the major design issues of SOA is meeting its security requirements, since it affects interaction of services and applications in SOA environment [40]. Security must be unified with the software engineering process [41] and security engineering [42] should be implemented for SOA applications at design phase itself, instead of applying as an ad-hoc requirement.…”

Intelligent security and access control framework for service-oriented architecture

“…SOA has been introduced to industries and businesses in order to compensate for the weaknesses of distributed architectures, such as those with multi-tier client-servers [3]. Although SOA and distributed architectures contain a lot of similar aspects and share a significant amount of the same knowledge, SOA has distinct characteristics relating to its technology and underlying design principles.…”

“…SOA security is an overarching concern, as it affects every advertisement, discovery and interaction of services and applications in an SOA environment [3]. Furthermore, SOA also requires a flexible, sophisticated, and robust security framework in order to interact with the new generations of the Web, including Web 2.0 applications [4], which companies have required in order to manage the access to those applications [4].…”

The Road to Hell is Paved with Good Intentions: A Story of (In)secure Software Development

“…They recommend SOA as a way of achieving a common platform for the services within their responsibility [7]. However, SOA introduces some security concerns, as pointed out by Epstein et al [8] and the New Rowley Group [9], such as access to services from inside and outside the organisation. Therefore, developing secure SOA based systems is not trivial and, according to Knight [10], security "will only be part of your service oriented architecture (SOA) if you build it in yourself".…”