Enterprise SOA

How will security between companies function and evolve in an ESA environment?

It's absolutely critical that intercorporate security function well, at all levels—from trust functions down to message-level encryption. Otherwise, companies will run the risk of disaster. It's especially important to understand that security cannot be implemented at the service level alone. Potential gaps or blind spots in business process logic make it imperative to create checks that monitor the entire process. For instance, say an office supply buyer at an airline is allowed to buy pencils from an online supplier and is channeled to that supplier's web services, which also link to Boeing's order system. If services in this case only check to see that someone from an airline is doing the ordering, that buyer might inadvertently have permission to buy a 747 in addition to pencils. Once a composite application is accessed—either by a human user or by a service call—it may find itself in the midst of process orchestration distributed across a variety of other composites, or perhaps in an environment in which one service will be executed in an entirely different security environment (another company, for example). A lot is at stake in ensuring that entire processes are protected, not just enterprise services.

It's also important to note that when it comes to processes that cross company borders or security domains, issues of trust cannot be resolved by software alone. The willingness of one company to ...