Basic Enterprise Web Service Security Concepts

In the (near) past, security was handled by the user interface.  The user interface acted as the sole entry point to the application, and therefore all application security was oriented around user permissions.

Added web services is like having great locks on your front door but opening all the windows in your house.  Lots of entry points, each of which needs security.

There’s a few basic enterprise web service security concepts that need to be understood to understand web service security.

Web service security may operate from a user context, an application context, or both.

User Context: Application 1 includes in the (web) service request to application 2 information about the user who performed an action causing the request. Application 2 then decides if the service is permitted based on the user requesting it in application 1.

This requires applications 1 and 2 to have a common user security framework (application 2 has to recognize application 1’s user and be able to check if that user is authorized to request the service operation being requested.)

User Validation – How can application 2 know that the user sent by application 1 has been validated by application 1? One answer would be to send through the user’s password, but application 1 rarely has access to the password (as it may be under the control of an external security system such as Microsoft Active Directory), and sending a password in a message has it’s own security risks.

A solution frequently select is Single Sign On software. This is integrated into both applications 1 and 2, and when the user logs in gives the application a “user token” instead of user information. This user token can then be passed in the message, and application 2 can simply ask the Single Sign On utility if the user token is valid and active (is the user still logged in).

If applications 1 and 2 have no common user context, no shared user base or shared security source, then user context security can’t be used.  Rather, the best that can be done is application 1 can pass along the name or ID of the user who performed a function resulting in the web service request, and application 2 can store it (for logging or auditing purposes), but can’t check any sort of permissions (as the user is unknown to application 2).

Application Context: Is application 1 allowed to activate a particular service in application 2? Is application 1’s test environment allowed to activate that service in application 2’s production environment? (probably not.)

Application context is about whether the source of the request (the source from a program / code / environment perspective) is allowed to request the action being asked from the destination (program and environment).

Enforcement: Some ESB’s (Enterprise Service Buses) have internal features to enforce some of this type of security. (Some require add on modules.) However, even if the ESB is enforcing this type of security, the end points of the requests (the service providing systems) must also be protected and have service security enforcement. Otherwise, what is to stop a developer (or hacker that gets into the internal network) from directly accessing a product business web service from a workstation or laptop? (Nothing.) Further, services are intentionally designed to be easy to use and understand (therefore security through obscurity may no longer help.)

Complete enforcement is best done using SOA security tools. These will either include an agent on each end point or route all services through security enforcement gateways (with the end points only accepting requests via the gateways).  It is possible to create your own security enforcement function in front of services (such as with IBM Websphere where a “handler” can be inserted in the Web Service engine), but is generally not recommended (as you would have to recreate it for each technology exposing services – which the vendor’s provide.)

Agent Based Security Model

 

Gateway Based Service Security Model

A Code Weapon

 

Stuxnet: Anatomy of a Computer Virus

Early Signs of SOA Success

I’ve been working with a client for an extended period of time.  This large IT department has had a variety of SOA tools and technologies available and has been doing major systems integration for 10 years.  Yet while their SOA tools have allowed them to integrate quicker than manual development, their integration methodology (essentially none) has given them 0% reuse.

Reuse is a fine objective, but it may not actually be valuable depending on the business and IT organization goals.  In this client’s case we did an extensive evaluation of IT current state, IT future state plans and goals, and business goals.  That may sound like a lot of overhead to determine future state integration and SOA approaches, but in the current economic climate architecture for architecture’s sake is simply not acceptable (if it ever was).

Or to put it another way, when IT is aligned with and demonstrating direct business value then IT is valued by the business.  And this attitude has to filter down to enterprise architecture, integration and SOA.

This is not to justify SOA (service oriented architecture).  Rather, SOA must justify it’s overhead by demonstrating how it’s going to provide value in meeting the IT and business goals.

At this client we identified 3 primary business and IT drivers for integration:

1. Business and IT systems agility.  This client is in a dynamic business environment and is frequently reinventing parts of their business, leading to an unusually high volume of major application replacement and feature revamping.

2. Reliability.  As the complexity of the interconnections between systems and applications had been increasing, reliability was suffering, sometimes with real dollar measurable business impact of downtime or data loss.  (Correspondingly more and better people were needed for support as more time was spend on more complicated problems.)

3. Integration Cost Reduction.  Integration (and integration support) were taking higher and higher percentages of project budgets and the trend continues to grow.

As I noted at the beginning of the article, I’ve been working with this client for some time.  Meeting this client’s goals is mostly about IT process changing and IT thinking change (though some solutions can be met with select tools for certain parts of the problem), for which we’ve been planning and preparing and planting the seeds as we’re reviewing projects in progress before the new processes are complete.

This week I saw in the organization the first signs of real SOA success.  I was sitting with an integration architect who was describing how he just saved 75% of the integration of 3 projects because we designed the services used by the first project in a reusable pattern. 

And that’s how it starts.

The goal is not reuse, the goal is aligning IT to meet the business goals.  Reuse is a method.  And seeing my client beginning to have success with the method and start meeting their goals…that’s exciting!

(Now we have to quickly put in place the KPI’s [key performance indicators] to measure the success and report it to all levels of IT management.  That’s the way to reinforce the positive people pattern and get the integration people positive recognition.)