Security for service oriented architectures

Select an Action

Place Hold(s)
Add to My Lists
Email
Print

Title:

Personal Author:

Williams, Walter, author

Publication Information:

Boca Raton : CRC Press, 2014

Physical Description:

xii, 329 pages ; 24 cm.

ISBN:

9781466584020

Abstract:

"Providing a comprehensive guide to security for web services and SOA, this book covers in detail all recent standards that address web service security, including XML Encryption, XML Signature, WS-Security, and WS-SecureConversation. It also reviews recent research on access control for simple and conversation-based web services, advanced digital identity management techniques, and access control for web-based workflows. With illustrative examples and analyses of critical issues, the book is a solid reference on web service standards, a practical overview for researchers looking for innovative new directions,and a suitable textbook on advanced topics in computer and system security"--provided by publisher

Subject Term:

Service-oriented architecture (Computer science)

Computer networks -- Security measures

Computer security

Available:*

Library	Item Barcode	Call Number	Material Type	Item Category 1	Status
Searching... PSZ JB	30000010340802	TK5105.5828 W55 2014	Open Access Book	Book	Searching... Unknown

On Order

Summary

Although integrating security into the design of applications has proven to deliver resilient products, there are few books available that provide guidance on how to incorporate security into the design of an application. Filling this need, Security for Service Oriented Architectures examines both application and security architectures and illustrates the relationship between the two.

Supplying authoritative guidance on how to design distributed and resilient applications, the book provides an overview of the various standards that service oriented and distributed applications leverage, including SOAP, HTML 5, SAML, XML Encryption, XML Signature, WS-Security, and WS-SecureConversation. It examines emerging issues of privacy and discusses how to design applications within a secure context to facilitate the understanding of these technologies you need to make intelligent decisions regarding their design.

This complete guide to security for web services and SOA considers the malicious user story of the abuses and attacks against applications as examples of how design flaws and oversights have subverted the goals of providing resilient business functionality. It reviews recent research on access control for simple and conversation-based web services, advanced digital identity management techniques, and access control for web-based workflows.

Filled with illustrative examples and analyses of critical issues, this book provides both security and software architects with a bridge between software and service-oriented architectures and security architectures, with the goal of providing a means to develop software architectures that leverage security architectures.

It is also a reliable source of reference on Web services standards. Coverage includes the four types of architectures, implementing and securing SOA, Web 2.0, other SOA platforms, auditing SOAs, and defending and detecting attacks.

Author Notes

Walt Williams, CISSP®, SSCP®, CEH, CPT has served as an infrastructure and security architect at firms as diverse as GTE Internetworking, State Street Corp, Teradyne, The Commerce Group, and EMC. He has since moved to security management, where he now manages security at Lattice Engines. He is an outspoken proponent of design before build, an advocate of frameworks and standards, and has spoken at Security B-Sides on risk management as the cornerstone of a security architecture.

Mr. Williams' articles on security and service oriented architecture have appeared in the Information Security Management Handbook . He sits on the board of directors for the New England ISSA chapter and is a member of the program committee for Metricon. He has a master's degree in anthropology from Hunter College.

Preface	p. ix
In Gratitude	p. xi
Chapter 1 Introduction	p. 1
Chapter 2 Four Kinds of Architectures	p. 3
2.1 Architecture	p. 3
2.2 Infrastructure	p. 4
2.3 Software Architectures	p. 9
2.3.1 Key Principles	p. 10
2.3.2 Presentation Layer	p. 13
2.3.3 Business Layer	p. 15
2.3.4 Data Layer	p. 16
2.3.5 Workflow	p. 19
2.3.6 Communications and Messaging	p. 20
2.3.7 Service Layer	p. 21
2.4 Service-Oriented Architecture	p. 22
2.4.1 Distributed Computing and Services	p. 23
2.4.2 Process-Oriented SOA	p. 25
2.4.3 Web Services or an Externally Focused SOA	p. 27
2.4.4 Enterprise Service Bus	p. 30
2.5 Security Architecture	p. 30
2.5.1 Construction of a Security Architecture	p. 33
2.5.2 Risk Management	p. 34
2.5.3 Organization and Management	p. 36
2.5.4 Third Parties	p. 37
2.5.5 Asset Management	p. 38
2.5.6 Information Classification	p. 39
2.5.7 Identity Management	p. 41
2.5.8 Security Awareness and Training	p. 44
2.5.9 Physical Security	p. 44
2.5.10 Communications and Operations Management	p. 45
2.5.11 Perimeters and Partitioning	p. 46
2.5.12 Access Control	p. 48
2.5.13 Authentication	p. 48
2.5.14 Authorization	p. 50
2.5.15 Separation of Duties	p. 51
2.5.16 Principles of Least Privilege and Least Authority	p. 51
2.5.17 Systems Acquisition, Development, and Maintenance	p. 52
2.5.18 Confidentiality Models	p. 52
2.5.18.1 Lattice Models	p. 52
2.5.19 Nonrepudiation	p. 53
2.5.20 Integrity Models	p. 53
2.5.21 Service Clark-Wilson Integrity Model	p. 54
2.5.22 Security Assessments and Audits	p. 58
2.5.23 Incident Management	p. 58
2.5.24 Business Continuity	p. 59
2.5.25 Compliance	p. 60
2.6 Data Architectures	p. 61
Chapter 3 Implementing and Securing Soa	p. 65
3.1 Web Services	p. 65
3.2 Extensible Markup Language	p. 66
3.2.1 Signing XML	p. 68
3.2.1.1 XML Digital Signature	p. 68
3.2.2 XML Encryption	p. 74
3.2.3 Key Management	p. 79
3.2.3.1 Key Information	p. 79
3.2.3.2 Location	p. 79
3.2.3.3 Validation	p. 80
3.2.3.4 Binding	p. 80
3.2.3.5 Key Registration	p. 80
3.2.4 XML and Databases	p. 82
3.2.4.1 A Database Query Language for XML	p. 82
3.2.4.2 XML Databases	p. 83
3.2.5 UDDI	p. 83
3.2.6 WSDL	p. 84
3.3 SOAP	p. 87
3.3.1 SOAP Roles and Nodes	p. 89
3.3.2 SOAP Header Blocks	p. 90
3.3.3 SOAP Fault	p. 90
3.3.4 SOAP Data Model	p. 91
3.3.5 SOAP Encoding	p. 91
3.3.6 Bindings	p. 92
3.3.7 Documents and RPC	p. 93
3.3.8 Messaging	p. 95
3.4 WS-Security	p. 99
3.4.1 WS-Trust	p. 107
3.4.2 WS-Policy	p. 116
3.4.3 WS-SecureConversation	p. 129
3.4.4 WS-Privacy and the P3P Framework	p. 133
3.4.4.1 POLICIES	p. 135
3.4.5 WS-Federation	p. 144
3.4.5.1 Pseudonyms	p. 153
3.4.5.2 Authorization	p. 162
3.4.6 Authorization without WS-Federation	p. 173
3.4.7 WS-Addressing	p. 178
3.4.8 WS-Reliable Messaging	p. 183
3.4.9 WS-Coordination	p. 191
3.4.10 WS-Transaction	p. 193
3.5 SAML	p. 195
3.5.1 Assertions	p. 197
3.5.2 Protocol	p. 205
3.5.2.1 Assertion Query and Request Protocol	p. 207
3.5.2.2 Authentication Request Protocol	p. 209
3.5.2.3 Artifact Resolution Protocol	p. 212
3.5.2.4 Name Identifier Management Protocol	p. 212
3.5.2.5 Single-Logout Protocol	p. 213
3.5.2.6 Name Identifier Mapping Protocol	p. 214
3.5.3 Authentication Context	p. 214
3.5.4 Bindings	p. 218
3.5.5 Profiles	p. 226
3.5.6 Metadata	p. 229
3.5.7 Versions	p. 240
3.5.8 Security and Privacy Considerations	p. 241
3.6 Kerberos	p. 244
3.7 x509v3 Certificates	p. 246
3.8 OpenID	p. 246
Chapter 4 Web 2.0	p. 249
4.1 HTTP	p. 249
4.2 REST	p. 250
4.3 WebSockets	p. 251
Chapter 5 Other Soa Platforms	p. 253
5.1 DCOM	p. 253
5.2 CORBA	p. 253
5.3 DDS	p. 254
5.4 WCF	p. 255
5.5 .Net Passport, Windows LiveID	p. 256
5.6 WS-BPEL	p. 257
Chapter 6 Auditing Service-Oriented Architectures	p. 271
6.1 Penetration Testing	p. 272
6.1.1 Reconnaissance	p. 272
6.1.2 Injection Attacks	p. 277
6.1.3 Attacking Authentication	p. 278
6.1.4 Attacking Authorization	p. 284
6.1.5 Denial-of-Service Attacks	p. 286
6.1.6 Data Integrity	p. 286
6.1.7 Malicious Use of Service or Logic Attacks	p. 288
6.1.8 Poisoning XML Schemas	p. 289
Chapter 7 Defending and Detecting Attacks	p. 291
7.1 SSL/TLS	p. 291
7.2 Firewalls, IDS, and IPS	p. 294
Chapter 8 Architecture	p. 297
8.1 Example 1	p. 297
8.2 Example 2	p. 300
8.3 Example 3	p. 305
8.4 Example 4	p. 307
Bibliography	p. 317
Index	p. 323

Available:*

On Order

Summary

Summary

Author Notes

Table of Contents