Customer Reviews

SOA Security

5 star:		(6)
4 star:		(2)
3 star:		(3)
2 star:		(1)
1 star:		(1)

 

 

One of the detailed expositions on this subject that I have seen. While it is written to help the architects, designers and developers of services to plan and implement better security, it also gives an excellent overview of the key concepts and challenges.

The book tries to address two key audience groups. One segment is the one with an interest in the broad policy and governance issues related to Security as applied to SOA and service. The other audience segment is from the IT architecture and implementation teams that want to see examples of security as applied to services in the new SOA world. Application and process security issues are explained and illustrated with extensive code samples with detailed walk-throughs of several scenarios.

It is NOT a generic textbook on basics of security or SOA or BPM but is focused on practical issues in architecting and implementing security within SOA and BPM solutions.

There are specific examples of various security models and implementations, including appropriate use of PKI in messages and services, SAML, etc. The authors have provided extensive examples at the publishers website and one of the co-authors has posted some useful links to external reviews and interviews. This was one of the few published books that I have seen discuss Cisco's AON solution.

If you are looking for broader security issues such as intrusion detection, network security, etc. then this is the wrong book. The focus is on Security when implementing a Service Oriented Architecture in an enterprise environment.

The book is physically HEAVY and a very detailed but easy read. I do not recommend reading all the chapters and even the authors seem to agree. It is best to read the initial chapters to cover the concepts and then dive into specific chapters of interest.

If you are really serious about building security to your SOA stack of applications, then this book would offer only a hello world to security. All you find is a full-blownup security chapter for XML Web services beyond that nothing more. More importantly this book is completely disorganized...all I saw is the basic XML Web services security using out-of-box Axis examples. To the most disappointment, there is no chapter to show how to put-to-gether all these APIs in a real world SOA (as they claim in the title). Why should I read the book if it is repeating the API examples from Axis. This book is nothing but a theoretical junk with no proof. After browsing all the pages, I don't find anything which show how to build a SOA security architecture. The word security is abused and does'nt make sense for this title.

Great book for starters.

However it misses the latest Standards in Security such as PKI, SAML, XACML, WS-Federation, WS-Trust and how it pertains to SOA based solution architecture. So much for a book titled "SOA Security". Also it totally ignores to explain how to ensure security at all integration tiers.

Not for security experts, more for people who are starters and do not have time to "Google" either.

Does not do detailed coverage only basic topics related to Web services security around SOAP and WSDL standards with Apache Axis sample APIs (which are out of box and can be googled easily) are discussed. It is a bit difficult to relate the examples to the meat on the book.

Also missing is the information on how to use the abused Apache API examples to compose/build a Secure SOA service base architecture or how to secure BPM workflows, SOA governance, Identity management using federation, entitlement issues with BPM portals,... the list goes on.

This book contains very repetitive content. The only good portion I found was the chapter on XML Web services. The authors should refer Information Security Management Handbook, Sixth Edition (Isc2 Press) and Core Security Patterns: Best Practices and Strategies for J2EE(TM), Web Services, and Identity Management (Sun Core Series) before the next version comes out.

Security is indespensable for web services, but difficult to understand and use. There are too many standatds relevant to security, W3C standards and OASIS. I think to understand whole structure need much time. It seems architecture or principle is required to consistent understanding. This book is good to grasp security standard structure. It is regrettable that this book seems written before 2007, the rush of new standards. I hope this book is maintained to the latest standards. Nonetheless it is good for readers to understand security standards structure.

I bought this book with lot of expectations but this book FALLS SHORT on providing design and implementation guidance. I likes the introductory coverages and to me it is more like reading Web services security around SOAP and WSDL standards. All I found is about using few Apache Axis samples. It is disappointing to note that this book fully ignored to use standards and technologies such as PKI, SAML and XACML (and its interoperability Profiles), WS-Federation, WS-Trust and related WS-* standards and it's role in SOA based solution archiecture. The authors completely forgot to discuss the core SOA security complexities involved with composing Secure SOA services, securing BPM Workflows, Web services based collaborations, single sign-on and entitlement issues with BPM portals and federated services.

I do agree the introductory part of the book (Chapter 1-2) is a good read beyond that I noticed the book suffers with poorly edited content and it contains highly repetitive content.

This is by far the best SOA/SCA Security reference I have come across. It is both a treatise on Architecture and Solutions Architecture. It takes the reader, novice or experienced on a structured journey thru the current and proposed standards landscape, outlines the intent of the standards, strengths and weakness's then proposes theoretical models that apply each with outlines and examples. If the book moves too slow for you, you can skip ahead to Part #3 and the Appendices, extracting what you need. The appendices and Part #3 also, refer back to prior examples of implementation and code to assist the reader to better understand the topics, concepts and applications. In our matrix'd teams, this is the absolute GO TO document to :...call the ball..." on the how. It is also relevant when working thru vendor sales presentations to separate the wheat from the chaf. It is by far the best Technical Book Dollar I have spent this year.

This book is great for beginners to SOA security. The examples are mostly in Axis from Apache. My background is with a commercial middleware and it took some imagination to translate the examples. Also, commercial security appliances like the Alcatel-Lucent web services gateway were left out completely.
After reading this book, I might think that calling a service for security would suffice. The common thinking today is to abstract the security into a central location run by security experts. Most SOA developers don't have the time or the depth of knowledge about certificates, user-centric policies, or even XML threat management to re-invent common security patterns.
Still the examples are solid and the concepts are important to know.

SOA and security, two terms very present and important in the enterprise development.
Due to this and its title, this book sounds very promising. However, the authors reduce immediately the scope of the book in the introduction.

Indeed, the book is not to explain the SOA architecture and concepts, neither all the security notions.
The book is about the intersection of the two subjects and so a minimal knowledge of these is necessary. The book is aimed at an initiated public, but not an expert one.

However, the book is well put together and interesting. It is composed of three parts.

The first is a reminder of the basics of SOA and WebService security : SOAP Header SOAP, WS-Security.

The second part presents the concepts of security: authentication, authorization, encryption, ... This section is particularly interesting. It introduces various practices (user / password, Kerberos, PKI), while describing their advantages and disadvantages.

The last part is a little more complex and deals with real security-oriented service. Again, the different implementations of a security service are shown together with the technologies used for this purpose (SAML, WS-Trust, ...)

At the end of the reading, we have learnt lots of information, however there is still a feeling of weakness on the subject. But once again, it's voluntary. Given the complexity of the issues, only the fundamentals are presented, but many links are provided for those who wish to deepen a specific topic.

In terms of examples, an implementation based on Axis is provided at the end of the chapter. This is probably the only regret I have : Axis is a little old. However, the examples are explicit enough to be easily adapted with any other framework.

This book is more than interesting, even if the title "Introduction to SOA Security" would have been more representative.

This is an extremely well written book. The topic is very technical but the book is easy to read and follow and does a great job of explaining the nuts and bolts of SOA Security. I also think the author did a great job of using relevant examples.

The main goal of this book (as stated in introduction section) is to give a reader good background knowledge on security in order to facilitate the implementation of security in SOA-based systems. This book is not for security experts, it is more for people who have to deal with security without having previous experience. It helps to answer the questions like how to secure collaborating Web services, what are the common practices.
Nevertheless, the book does not cover all the topics, however, mostly the basic ones. I found this book helpful to understand the fundamental instruments used in SOA security and continued with my own more specific and advanced solutions.