7

C H A P T E R

Security

V

IRTUALLY

 every enterprise application exposed through a Web service has a

need for security at some level. An enterprise's data is an important asset to every

business, and a good security system is necessary to ensure its safety and integrity.

Businesses need to safeguard their systems and their data resources from malicious

use by unauthorized intruders, both internal and external to the business, and from

inadvertent or unintended mischief. Businesses also must keep message exchanges

with other entities secure.

Security for Web services is two fold: It encompasses both the security

requirements of a typical enterprise as well as the particular security needs of the

Web services themselves. An enterprise's business security requirements are well

known, and it is just as important to identify the security needs of a service. For

example, the developer of a Web service, after assessing its business needs, might

only want to let a certain set of users access particular resources. 

Setting up security also involves some usability issues. In particular, because

Web services have a high degree of interaction with varied clients, it is important

to keep security measures from being overly intrusive and thus maintain the ease

of use of a service. A service needs to promote its interoperability and make its

security requirements and policy known to clients. Often, a service needs to keep

a record of transactions or a log of access made to particular resources. The

service must not only guarantee privacy, but it must also keep these records in

case a claim is made at some later date about a transaction occurrence. 

291