SOA Security Development Framework
September 25, 2013

SOA Security Development Framework Development frameworks are an important part of a Service Oriented Architecture. Developing Service Oriented Architecture applications from an enterprise architecture standpoint necessitates that all these development frameworks be documented and inserted in the reference guides delivered to each designer. With the traditional stovepipe application tactic, all of the applications are fabricated with their individually implanted security. Part of security for these applications is to necessitate the user to sign in to achieve access. Then the application would regulate what an authenticated user was certified to use by restricting the functionality through different apparatuses, including screen masks, database record locks, and distinct roles. Within a Service Oriented Architecture application development model, the required security has to be designed so that it can provide authentication services and authorization services to any of the Service Oriented Architecture components in the Service Oriented Architecture that requires them. According to the studies that are available it is projected that ninety percent of the external attacks on applications will be because of security vulnerabilities and misconfigured systems. Even though it is not possible to develop applications that will be one hundred percent secure there are useful approaches recommended for analyzing threats, susceptibilities, and risk (Achkoski, Trajkovik, & Dojchinovski, 2011). Then the security mechanisms for a Service Oriented Architecture based system can be implemented. Therefore to improve security throughout the entire system the security solutions should try to decrease the cost for incident response, application outage, fixing malfunctioning systems, and reputation damage (Achkoski, Trajkovik, & Dojchinovski, 2011). Originally the services in Service Oriented Architecture were related with a stack technology which encompassed SOAP, WSDL, and UDDI (O'neill, 2009). Then several of the grassroots developers started showing a fondness for lightweight Representational State Transfer (REST) services instead of the more heavyweight SOAP messages which resulted in REST being accepted as a part of Service Oriented Architecture (O'neill, 2009). The effect of all of this is that Service Oriented Architecture now includes the original SOAP/REST/UDDI stack, REST services, and the Cloud (O'neill, 2009). Meaning that, from a security professional’s perspective, all of these services will have to be secured. Service Oriented Architecture security framework will be required to provide particular capabilities. These capabilities are constituent authentication services, constituent role and service privileges identification services, service authorization services, service validation services, security pass-through services, and security detection and enforcement policy configuration services (Sweeney, 2010). On top of that the Service Oriented Architecture framework will also need to be supported by an Identity Management and Provisioning Framework that will provide the Service Oriented Architecture with the following capabilities, Constituency setup and configuration services, role creation and configuration services, constituent Service Oriented Architecture user profile setup and configuration services, legacy application security provisioning services, Legacy application security synchronization services, user provisioning services, Service Oriented Architecture user profile management services (Sweeney, 2010). There will be service components in the Service Oriented Architecture security framework that will operate in each of the layers of the Service Oriented Architecture framework. The Channel Layer security service is where user authentication and role identification will occur. The security framework at the channel layer will define all of the mechanisms and specifications that will be required to support authentication for all users across all channels (Sweeney, 2010). On top of this security framework will also stipulate the authentication criteria and devices for providing services through channel mediators and for using protected services from outside bodies. Different channels may require different authentication mechanisms for constituents in one channel that enter through another channel. In a typical organization there are five general categories for authentication scenarios from a Service Oriented Architecture perspective. That means that there should be at least five authentication frameworks defined for the channel layer (Sweeney, 2010). cation mechanisms for constituents f the mechanisms and specifications that will be required to authen The key is that no matter which channel that a constituent invokes the authentication in or which framework is used once the constituent has been authenticated the roles associated with that particular authenticated constituent in the Service Oriented Architecture security profile system will now be available for any component through that channel as long as the security framework session continues to be active (Sweeney, 2010). Then there is the Business Process and Business Service Authorization Services. Even though the User authentication and service privilege identification are modules and criteria that are quantified in relation to their design and use in the Channel layer of the SOA enterprise architecture framework. Service approvals are modules and criteria that are identified in relation to their strategy and use in the Business Process and Business Service layers of the SOA enterprise architecture framework. Under this methodology, each separate Business Process or Business Service supervises the approval of the service it executes, not the channel. There are three explanations why this method is required. The first is that if the service requests are hard-coded into the Channel layer then there will not be a way to certify whether the services are still certified for the role (Sweeney, 2010). The second reason is that there is the possibility that further prerequisite data that limit utilization of the service. An instance of this might be with a subscriber role being approved to add a family member, certain accounts might want to limit their staff from adding their family members through the account’s human resources system, which will send the updated data to the health insurer through one of the insurer’s account constituent channels (Sweeney, 2010). Integrating this reasoning at the Presentation layer of the channel will possibly have substantial performance repercussions. Then the third explanation why this method is required is because if it was performed at the channel layer it would be have to be performed every time a user authenticates. By invoking the authorization at the Process or Service layer, it will only be instituted when it is being used. Then there is the Integration Layer Security Services, there will be numerous occasions where the integration layer will be required to authenticate to the legacy system’s security on the back-end before it will be possible for the request or replies from the integration layer to be processed. The reason for this is because most if not all of these systems will have their own exclusive format and structure that will be required to authenticate the user. This could be group or individual specific authentication mechanisms. Quite possibly these credentials will be different from those used at the channel layer. However, enterprise SOA security framework can provide centralized services so that authentication can be provided at the legacy application on the back end. Simply put the enterprise SOA security framework will have to provide the capability of integrating back-end legacy security with the Enterprise SOA Provisioning Framework and leverage services from that framework to obtain the necessary credential data and processes (Sweeney, 2010). When it comes to trends in Service Oriented Architecture security framework it has to be mentioned that a fundamental challenge for Service Oriented Architecture applications is guaranteeing security of those applications through numerous computers which are typically connecting using unsecured networks. This Means that several of the features that make Service Oriented Architecture an attractive standard like web service configuration, communications transmitted as clear text and comparative independence of common web services clash with customary security models (Cotfas, Palaghita, & Vintila, 2010). If communications among web services are transmitted lacking the use of an encryption mechanism, all data together with the defining meta-data can be captured by an invader. Security of service oriented architecture applications is still a concern and numerous criteria are presently being established: WS-Authorization, WS-Privacy, WS-Trust, WS-Federation, WS-Policy, and WS- SecureConversation (Cotfas, Palaghita, & Vintila, 2010). When it comes to Security for a Service Oriented Architecture it does not matter what environment an organization is using the leading step in the analysis of that security has to be defining the set of requirements. On top of defining those requirements, the organization must have a set of cost versus threat parameters for the organization. Otherwise, they will not have the capability of implementing security in a Service Oriented Architecture (Hinton, Hondo, & Hutchison, 2005). The more an organization can define the threats to its organization, the better it will be capable to evaluate the advantage of countermeasures to safeguard itself. To do this organizations will need to answer these questions. “Who needs to have access to what information? How is access to data provided? Is it direct or brokered? Is there a need for data to be available to external partners as well as internal consumers? Are there different requirements on data in transit? In process? At rest” (Hinton, Hondo, & Hutchison, 2005)? Because a lot of software developers consider of security as a process that happens during the following phase a lot of business applications hit obstructions at deployment. Therefore, the next question that an organization should be asking themselves is what piece security logic will provide them with the best return on investment (Hinton, Hondo, & Hutchison, 2005). The same way that Service Oriented Architecture is about the transformation of business. The security for Service Oriented Architecture is about the transformation of security. What this means is that the specific security will need to be integrated into the complete business service decomposition. Therefore, application developers and business analysts will be obligated to team up with each other when it comes to the necessities in perspective of the business applications. Since each business application will have to describe the scope of the security service, developers and business analyst will need to work together to decide when so they can decide when the agility the require is provided by the common security services (Hinton, Hondo, & Hutchison, 2005). The implementation of Service Oriented Architecture now exists in almost every industry. The problem is that developers do not always secure the Service Oriented Architecture services and architectures. When you combine that with protocols that are allowed through the firewall like SOAP over port 80 which is common in web service environments then Service Oriented Architecture can become a security disaster waiting to happen (National Security Agency, n.d.). This means that particular attention should be paid to the security framework involved with Service Oriented Architecture in order to prevent the security disaster waiting when security gets overlooked by developers. The Knowledge that Service Oriented Architecture and Web Services do not combine well because the implementation of security in a Service Oriented Architecture environment is a intricate and error-prone undertaking for designers, security has to be in the forethought of Service Oriented Architecture development. The reason implementation of security is so intricate, and error-prone is because designers have to work with the enormous amount of WS*, WS-I, SAML and XACML standards for web service security (Layer 7 Technologies, 2013). There are also integration issues that exist among their services and a number of current enterprise security infrastructures that they have the desire to leverage. These include security infrastructure like SAML tokens, virus scanners, HSM's, Kerberos, SSO cookies, LDAP, CA authorities, and SSL termination devices (Layer 7 Technologies, 2013). Not to mention having to handle lifespan concerns through test and production. XML firewalls on the other hand make security definition and implementation in Service Oriented Architecture easy by giving designers and architects the capability to outline and administer security strategy across an easy graphical policy language (Layer 7 Technologies, 2013). Outlining policies for validation, fine-grained authorization, identity federation, data encryption, data signing, data redaction, data validation, API protection, and throttling amid additional Service Oriented Architecture security operations can all be made from an individual policy supervision console and then imposed reliably through distributed services and if so preferred the client applications that request them (Layer 7 Technologies, 2013). With that being said the way that so many organizations are embracing Service Oriented Architecture because it increases application elasticity, makes integration more controllable, lowers development costs, and enhanced alignment of technology systems to business processes. What they are doing is creating issues that need to be worked out dealing with security. The fact is the very thing that makes Service Oriented Architecture so popular is the very thing that increases the security risk. One of the methods for handling this problem in the new infrastructures environment that has been applied in an organizations Service Oriented Architecture is to look at it from the attacker’s perspective, then model the expanse an occurrence could spread from a compromised server (Clark, 2010). Once that has been figured out plan an alleviation strategy to control and halt the spread (Clark, 2010). Engineering elastic schemes such as Service Oriented Architecture is a physical security challenge, although it is not an unmanageable task as long as you take the right steps from the beginning (Clark, 2010). After the Service Oriented Architecture environment has been built and the security protocols have been instituted the security aspect will need to be tested. Because of this and the fact that so many security specification factors have evolved and will continue evolving in the future the obvious requirement would be to identify a test tool strategy (Naidu & Vussainsagar, 2009). For this purpose, there are several commercial and open source products available. In the commercial realm for testing, there are Green Hat Tester, Mercury products, Parasoft SOAtest, AdventNet QEngine, Borland SilkPerformer SOA edition LISA WS – Testing (Naidu & Vussainsagar, 2009). In the open source realm for testing, there is SOAP UI, Push To Test TESTMAKER and WS-I tools. All of these tools provide outstanding support for functional, interoperability, regression and performance testing some of them will even support the testing of WS-Security including X509, SAML, Username security tokens, XML Signature and Encryption (Naidu & Vussainsagar, 2009). The problem is that there are not many tools out there that will support testing past the WSSecurity. In order to test past the WSSecurity a non-normative approach will need to be used to test the security aspect because if they were tested individually they would register as working fine. The approach to use is divided into three different steps. The first step is the test assertion documents, which means the security specifications used by the web service in the Service Oriented Architecture needs to be thoroughly analyzed. Then a table should be prepared identifying essential, elective and suggested components that the specification has defined (Naidu & Vussainsagar, 2009). Along with the test assertion XMl document using the defined table should be prepared. The second step is to capture SOAP messages which is accomplished by identifying or developing a simple SOAP monitor tool, then initiate the request, along with capturing the SOAP messages with the SOAP monitoring tool (Naidu & Vussainsagar, 2009). The third and final step is to generate a test result report which will compare the TAD with the Captured SOAP request, response, and generate a result report (Naidu & Vussainsagar, 2009). An example company that is working in the area of Service Oriented Architecture security framework is Raythoen. They are working with open frameworks and their security that deliver approaches for scheme development and incorporation in which systems bundle functionality as interoperable services for customers like the Department of Defense (Raytheon, 2009).

References
Achkoski, J., Trajkovik, V., & Dojchinovski, M. (2011). An Intelligence Information System Based on Service-Oriented Architecture: A Survey of Security Issues. Information & Security, 27(1), 91-110. Retrieved from http://search.proquest.com/docview/1017670790?accountid=8289
Clark, C. (2010, January 19). Why traditional security doesn't work for SOA. Retrieved from Techworld: http://www.techworld.com.au/article/331125/why_traditional_security_doesn_t_work_soa/
Cotfas, L., Palaghita, D., & Vintila, B. (2010). Audit techniques for service oriented architecture applications. Informatica Economica, 14(1), 128-136. Retrieved from http://search.proquest.com/docview/1433237130?accountid=8289
Hinton, H., Hondo, M., & Hutchison, B. (2005, November). Security Patterns within a Service-Oriented Architecture. Retrieved from http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CEcQFjAB&url=http%3A%2F%2Fwww.ii.uib.no%2Ftrac%2FeSysBio_Master%2Fexport%2F196%2Fm2%2Fdoc%2FSOA%2FSecuritySOA_%282%29.pdf&ei=uB5HUpinFcnk4APqq4HIDg&usg=AFQjCNHZd3lILssE2hcaJcQpgANnMwN5hg&
Layer 7 Technologies. (2013). SOA Security. Retrieved from Layer 7 Technologies: http://www.layer7tech.com/solutions/service-security
Naidu, J., & Vussainsagar, U. K. (2009, October 28). Service Oriented Architecture Testing: An Approach for Testing Security Aspects of SOA Based Application. Retrieved from slideshare: http://www.slideshare.net/jaipalnaidu/soa-testing-an-approach-for-testing-security-aspects-of-soa-based-application
National Security Agency. (n.d.). Service Oriented Architecture Security Vulnerabilities-Web Services. Retrieved from National Security Agency/Central Security Service: http://www.nsa.gov/ia/_files/factsheets/soa_security_vulnerabilities_web.pdf
Raytheon company; raytheon to provide service-oriented architecture-compatible, cross-domain security solution. (2009). Defense & Aerospace Week, 70. Retrieved from http://search.proquest.com/docview/199636926?accountid=8289
Sweeney, R. (2010). SOA Security Development Framework. In R. Sweeney, Service Oriented Architecture Applying an Enterprise Architecture Approach (pp. 331-341). Hoboken: John Wiley & Sons.
O'neill, M. (2009, March 12). SOA Security: The Basics. Retrieved from NetworkWorld: http://www.networkworld.com/news/2009/031209-soa-security-the.html