Enterprise Web Services Security (Book/CD-Rom)

Learn to Protect Your Assets and Prevent Attacks!Teaches developers, application architects, and security professionals how to build security policies and strategies in a Web Services environmentCovers the underlying protocols and technologies that form the Internet (TCP/IP, HTTP) and Web Services (XML, SOAP, WSDL, UDDI), and the major XML and Web Services standards that are the basis of implementing security in a Web Services environmentExplains how to implement security policies and mechanisms in both J2EE and .NETIncludes a companion CD-ROM with and all of the source code, references, and figures from the bookThe use of Web Services for Business-to-Business (B2B) and Business-to-Consumer (B2C) transactions has created risks that expose critical assets to increasingly greater threats. Enterprise Web Services Security provides the information developers, application architects, and security professionals need to build security policies and strategies from the ground up in a Web Services environment. Most security books focus on computer or network security in isolation, relegating the other areas to overview chapters or appendices. A single-system view of security, however, is not adequate to describe a distributed Web Services-based environment as it causes the developer to have to piece together material from several resources in order to create secure Web sites and services. This book takes a holistic approach that mirrors the perspective developers need to take regardless of whether they are planning and implementing the security mechanisms for a Web Service, a Web site, or an enterprise. It details how to secure critical components such as workstations, servers, and networks, the goals behind an enterprises security policies, the policies an organization should have in place, and how to communicate those policies using WS-Policy Framework and WS-Security Policy. Various threats and attacks are also covered, as well as the identity management, authentication, authorization, access control, confidentiality, and integrity mechanisms needed to protect messages and transactions. Enterprise Web Services Security is the one book developers need to make all their security mechanisms work successfully to thwart attacks and protect assets. KEY FEATURESTeaches developers, application architects, and security professionals how to build security policies and select appropriate security mechanisms and strategies in a Web Services environmentCovers the underlying protocols and technologies that form the Internet (TCP/IP, HTTP) and Web Services (XML, SOAP, WSDL, UDDI), and the major XML and Web Services standards that are the basis of implementing security in a Web Services environment Teaches how to implement and communicate security mechanisms using WSSecurity, XML Encryption, XML Signature, SAML, and XACML Explores the importance of auditing at both the server and network level and how to create trust relationships and domains Explains how to implement security policies and mechanisms in both J2EE and .NET Includes a companion CD-ROM with all of the references, source code, and figures from the bookON THE CDCode Samples: Contains all of the XML listings from the book References: Provides hyperlinks for all the reference materials used in the book Work sheet: Includes a work sheet for deploying a Web Services system as described in the book Figures: Includes all of the fi gures from the book by chapterAbout the AuthorsRickland Hollar (McLean, VA) is a Senior Applications Architect with the Central Intelligence Agency (CIA) and has over 30 years experience in the industry. Prior to joining the CIA, he was president of a Virginia-based software development fi rm. He has written articles for various publications, including Web Services Journal.Rick Murphy (Annandale, VA) is a Senior Principal INFOSEC Scientist at Mitretek Systems, a public interest research and development firm. He has over 25 years of experience in the information security field and is an adjunct professor in the University of Virginias Information Security Management program. Recent publications include papers on open systems security, network firewall configuration, and access control systems.