NIST issues guidelines on securing Web services
- By William Jackson
- Aug 30, 2007
The National Institute of Standards and Technology has released a 128-page guide to help organizations understand the security challenges of Web services in service-oriented architecture.
NIST Special Publication 800-95
, 'Guide to Secure Web Services,' provides practical guidance on current and emerging standards applicable to Web services in addition to background information on the most common security threats to SOAs based on Web services. The guidelines are hardware and software independent and do not address perimeter security devices such as firewalls or access control tools.
Web services based on the Extensible Markup Language, Simple Object Access Protocol and related open standards that are deployed in SOAs allow data and applications to interact without human intervention through dynamic and ad hoc connections.
Unfortunately, 'the security challenges presented by the Web services approach are formidable and unavoidable,' the publication states. 'Many of the features that make Web services attractive, including greater accessibility of data, dynamic application-to-application connections and relative autonomy (lack of human intervention) are at odds with traditional security models and controls.'
Issues addressed in the publication include:
- Confidentiality and integrity of data transmitted via Web services protocols.
- Functional integrity of the Web services requiring the establishment of trust between services.
- Availability in the face of denial-of-service attacks that exploit vulnerabilities unique to Web service technologies.
Perimeter network security technologies, such as firewalls, are inadequate to protect SOAs because they are dynamic and usually are not fully contained within the boundaries of a single network. SOAP also is transmitted over HTTP, which usually is allowed through firewalls without restriction. Transport Layer Security, which is used to authenticate and encrypt Web-based messages, is inadequate for SOAP messages because it is designed to operate between only two endpoints and cannot handle Web services' ability to forward messages to multiple Web services simultaneously.
The Web service processing model requires the ability to secure SOAP messages and XML documents as they are forwarded on long and complex chains of consumer, provider, and intermediary services. These problems make the services subject to unique attacks in addition to variations on familiar attacks targeting Web servers.
William Jackson is a Maryland-based freelance writer.