WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

12.4 Planning checklist for security
Table 12-2 provides a summary of items to consider as you plan, and additional
resources that can help you.
Table 12-2 Planning checklist for Web services
Planning item
Determine when and how you will enable WebSphere Application Security.
Create a strategy for administrative security.
Plan for auditing.
Determine if multiple security domains will be used.
Determine the type of user registry you will use and procure the appropriate products
and licenses. If you do not want to use a federated repository, delay turning on
administrative security until after installation. Populate the user registry with the
appropriate user IDs and groups for initial security.
Determine the authentication mechanism (LTPA is strongly suggested).
Determine the authorization method (default or JACC). If using JACC, plan for the
implementation of the JACC provider.
Plan where you will implement SSL in your network.
Plan for certificate management.
Plan for single sign-on.
Create a strategy for securing applications using Java EE security. Choose either
declarative or programmatic. If selecting declarative, then should annotations be used
or not? Application security requires close cooperation between application developers,
security specialists, and administrators. Plan for coordinating role definitions with
development and assigning users to roles during the application installation. Determine
individual application components that have special security requirements.
Review and incorporate security strategies for Web services.
Review and incorporate security strategies for the service integration bus.
Chapter 12. Security 405