In an article for CIO, Randy Heffner from Forrester Research presents four scenario solutions to service-orientated architecture (SOA). Heffner states that the most common approach for security in SOA is to route service requests over a virtual private network (VPN). Because some environments are more complex than others, additional effort in security planning and design is required. According to Heffner, “architects must consider a wide diversity of security requirements, business scenarios, and application infrastructure, weaving together multiple products, standards, and custom-built components into a flexible and robust SOA security solution.”
Heffner also highlights additional complexities that complicate the environment, including the fact that planning must take into consideration which specifications will be used and when they will be used. Further complexities are added when different scenarios with particular security requirements require a certain combination of specifications and products. Because standards and specifications are still maturing Heffner concludes that there is “little industry experience with best practices for many of the specifications.”
The four scenarios that Heffner provides include:
1. Simple VPN provides a basic solution in a short time:
-SOA requests and secured using transport level security.
2. Application-Server Based fulfills audit and compliance requirements
- Facilitates implementation of advanced authorization strategies
3. Single intermediary consolidates security processing.
-Simplification of SOA security providing a single solution for security across any and all SOA services
4. Brokered, layered, federated provides comprehensive SOA security.
-Uses multiple standards, integrates multiple products, and custom-built integration to pull all the pieces together.
.gif)
