＋设为首页 ＋添加到收藏夹
concerns about security are cited as the single largest barrier to rapid web services adoption. yet most web services today are fairly straightforward point-to-point integrations that can be securely implemented using only digital certificates and the secure sockets layer (ssl) protocol.
regardless of security strategy, enterprises are well advised to monitor their web services to ensure security has not been compromised. taken together, widely available standard security technologies and active monitoring provide a sensible approach to the majority of todays web service security challenges. this article describes how to use these technologies to secure the most common deployments of web services quickly and easily. ill close with a brief introduction of ws-security and how this emerging standard relates to what you do and do not get with ssl.
web services security in perspective
when considering what will be needed to enable a ubiquitous service-oriented architecture (soa) in the next 3-5 years, the security challenge looks daunting. the ws-security standards that specify security infrastructure that will allow the safe delegation of trust and identity are still evolving. the maturing of these standards is a necessary step toward the realization of a true service-oriented architecture. however, if we step back and focus on how web services are really being utilized today, we find that practical, secure deployments are possible now. in contrast to the fully distributed applications of the future soa "nirvana," most of todays web services are simple point-to-point integrations.as the name suggests, web services can be seen as a logical evolution of the previous generation of distributed computing - the world wide web. it should thus come as no surprise that much of the security infrastructure developed for the browserbased web is directly applicable to the realm of server-to-server web services. indeed, the combination of well-known internet security technologies and best practices for monitoring security compliance are the primary requirements for securing todays initial web service deployments.
web-enabled business-to-consumer (b2c) commerce provided much of the impetus for the development of the ssl protocol and digital certificates. b2c commerce required confidentiality and integrity for th... 下一页