Improving Web Application Security: Threats and - CGISecurity

12Building Secure Web ServicesIn This Chapter●●●●OverviewWeb service threats and countermeasuresStrategies for Web service input validationConfidentiality and integrity for Web service messagesWeb Services Enhancements 1.0 for Microsoft .NET (WSE)Web services are used by an increasing number of companies as they expose productsand services to customers and business partners through the Internet and corporateextranets. The security requirements for these service providers are of paramountimportance. In some cases, primarily intranet or extranet scenarios where you have adegree of control over both endpoints, the platform-based security services providedby the operating system and Internet Information Services (IIS) can be used toprovide point-to-point security solutions. However, the message based architectureof Web services and the heterogeneous environments that span trust boundaries inwhich they are increasingly being used pose new challenges. These scenarios requiresecurity to be addressed at the message level to support cross-platforminteroperability and routing through multiple intermediary nodes.Web Services Security (WS-Security) is the emerging security standard designed toaddress these issues. Microsoft has released Web Services Enhancements 1.0 forMicrosoft .NET (WSE), which supports WS-Security and a related family of emergingstandards. WSE allows you to implement message level security solutions includingauthentication, encryption and digital signatures.