Addressing Security in SOA Based Systems Throughout the Development Lifecycle CS 575 – Drexel University – Fall 2007 Alan Black, Daniel Moyer, Emily Reider

Some Aspects of Security Authentication Authorization Integrity Confidentiality Reliability Non-repudiation Privacy Some Aspects of Security

Why do we need security? Firewalls are not enough Independent security management Highly networked environments True security is about enabling functionality, not disabling it Why do we need security?

But what about? Complacency Cost New threats "We are not a target" "Our vendors will handle security" "We'll just encrypt our traffic" Cost New threats But what about?

Security Throughout the Lifecycle As Early As Possible Re-engineering may be difficult or impossible Maintenance Phase Encryption techniques for storage Vendors “How can you demonstrate to us that this product is secure?” Testing Security Throughout the Lifecycle

Conclusion Firewalls Early Design True Security - Enabling Manage Risks Maintenance Phase – Storage Vendors Conclusion