Six Tips for Moving Web Services from the Lab into Action
Flexibility, security, and manageability are the watchwords
Aug. 3, 2004 12:00 AM
It's relatively easy to build custom Web services. Customers are finding that it's much more difficult, however, to successfully secure and scale them in production. Six tips from Canada's largest loyalty reward program provider, a global financial services company, and Reactivity, Inc. can help you simplify Web services deployment.
They're Popping Up Everywhere
For one or two XML Web services, why worry about systematizing deployment? The answer is so you don't have to worry about them - or the potential security and availability lapses they can create - later. Here are three indications that your enterprise needs a robust, secure XML Web services deployment system:
- You're spending longer deploying XML and Web services than it took to create them.
- You're going back to modify services to accommodate new standards, meet security requirements, and fix interoperability problems.
- Stealth Web services are popping up around the company and you have no way to efficiently monitor them, consistently enforce security, or even ensure their availability.
If your XML Web services are designed to improve enterprise revenue or processes, you must seriously consider how they are deployed and maintained. Here are six lessons learned by one of the world's largest financial services firms and Aeroplan, Canada's largest loyalty reward program provider.
Lesson 1 - Minimize Web Services Interoperability Issues from the Beginning
Even the most specific Web services standards are subject to implementation interpretation and variability. For example, almost every implementation of Web Services Description Language (WSDL) is unique. This means that associated WSDLs must be easily importable by any client and, once deployed, they must be able to mediate between heterogeneous services without requiring business partners to alter their systems.
In Aeroplan's case, it chose to leverage existing XML services over an MQ Series communication channel that was already integrated with its mainframe. However, rewards partners would not communicate with them using XML over MQ. In fact, Aeroplan's first partner communicated using SOAP over secure HTTP (HTTPS), based on Visual Basic 6.0. Aeroplan needed an infrastructure that could proxy for its mainframe, create a secure connection, ensure transaction security, and translate from SOAP/HTTPS to XML/MQ and back again (see Figure 1).
As Aeroplan added partners, it encountered different flavors of SOAP and various security standards running on platforms ranging from VB and .NET, to WebSphere, to Axis (see Figure 2).
Aeroplan's new deployment infrastructure insulates it from this variability and greatly improves the IT team's productivity when setting up new connections. Plan to accommodate a variety of platforms, standards selections and implementations, and transports; and look for a deployment infrastructure that performs comprehensive mediation as part of its primary purpose - rather than building each XML or Web service to mediate the wide range of standards and transports you'll encounter.
Lesson 2 - Realize that Standards Are Not Enough for Security
Web services can be reliable, secure, and cost-effective. However, it's important to realize that standards-only based Web services security measures are not enough.
Lesson 3 - Implement Scalable Security and XML Threat Defense from the Start
- Evaluate relevance: Support the security standards that are most reliable and that deliver the biggest benefits to you, your partners, and customers. For example, ensure that your applications efficiently support one-way and two-way Secure Sockets Layer (SSL) and that support tools minimize opportunities for operator error. Be ready to support WS-Security, because it is the foundation of many high-utility upcoming standards. It's smart to support XML Encryption and XML Digital Signature so that your infrastructure can accommodate partners who just use XML as opposed to SOAP. Finally, consider Security Assertions Markup Language (SAML). Many enterprises are finding many uses for sharing security and authentication information between applications, and your infrastructure should support the current SAML standard and have a roadmap to support the standard in development.
- Look beyond SSL: While SSL secures information in transit and is highly interoperable, it requires considerable private key/certificate management that the Web service must handle. There are no guarantees of message confidentiality or integrity, no auditable records of the message, and session security can't be enforced. In addition, security threats in the XML payload remain invisible until they are decoded - potentially within the targeted application server where they could wreak havoc.
- Consider new standards: Consider XML digital signatures and field-level XML encryption with WS-Security - newer standards that provide a better way to keep messages confidential and assure their integrity.
- Dedicate a deployment infrastructure: Be sure to include centralized security policy control and distributed enforcement for securing Web services transactions.
- Test, test, test: Rigorously and regularly test standards for interoperability. They continue to evolve and their implementations vary from solution to solution.
Plan your defense against XML threats before an attack. Web services can create new vulnerabilities and new threats continue to emerge. Ensure that your architecture minimizes the chances of an attack reaching your services by intercepting and eliminating questionable messages at the network edge. The main Web services threats fall into three categories, and to beat them, you'll need a deployment infrastructure that is flexible and can scale quickly (see Table 1).
Lesson 4 - Provide Visibility into Transaction Traffic
- Trust infrastructure integration: Leverage existing security infrastructure, such as directories, PKI, and Identity Management solutions, to ensure consistent trust relationships and to speed Web services deployment.
- Centralized integration: Evaluate your centralized integration options to see if they actually simplify the task. A simple test is to time the amount of effort required to provision a new partner with a two-way SSL connection, including private key operations and storage. A good solution will enable you to provision a simple connection in minutes.
- Built-in scalability: It's possible to successfully provide basic security for a single Web service and write all the code necessary to apply standards using development toolkits. However, when the Web service is connected to a heterogeneous environment, integrates with other standards and policy requirements, and must evolve to meet new threats, it can be overwhelmed by all the security processing overhead required.
With visibility into traffic, application behavior, and potential issues, you can quickly uncover root causes of potential problems and defuse them before they disrupt business processes. Look for a secure deployment solution that:
Lesson 5 - Make Web Services Easy to Manage and Operate
- Is purpose-driven: Make sure it is designed to capture traffic information as part of its primary purpose
- Delivers in-depth information: Delivers detailed data about events and actual messages in the form of searchable detailed, configurable, and secure logs. This will allow you to easily debug connections, identify potential issues, audit messages, and resolve problems.
- Allows sharing: Information should be sharable between users, developers, and partners to expedite issue resolution.
Successful Web services involve people from business units, developers, and members of the deployment team - as well as technical operations staff. As business needs change, the operations staff must be able to easily and cost-effectively manage them. Here's what a deployment system should provide how:
Lesson 6 - Be Ready to Accommodate and Facilitate Change
- Linear scalability: "Rack-and-stack" appliances simplify adding systems without additional management overhead, deployment costs, or personnel.
- Good interface: A good user interface will walk operators through processes and prevent them from making costly errors without requiring them to know XML programming languages on open multiple interfaces, such as shells and text logs
- Intuitive role- and function-based access: Make sure the interface presents only policies and data that the user can use. Ideally, seek a solution that coordinates the efforts of your distributed SOA/Web services team.
- Assured usability: By architects, developers, and administrators. Remember that other users, such as business unit managers, administrators, security staff, and developers must be able to contribute to Web services without taking them offline, disrupting processes, or turning operations staff into data input clerks.
Establish a process for change management so you can balance the needs of the business unit requesters with those of the individuals responsible for security, technology infrastructure, systems management, application and network operations, and auditing/record-keeping. For example, a deployment workflow system can make it easier for a broad community of users to provision, review, and approve policies without lengthy meetings. If each user has appropriate delegated authority, operators can deploy partial policies without stopping workflow. Being able to easily coordinate the efforts of everyone involved with XML Web services deployment will benefit your organization through more efficient rollouts and higher service availability.
The Results of Lessons Learned
The global financial services firm initially built its own infrastructure and found that successful deployments took three to four months and required senior architectural staff to program and debug connections. After implementing several services this way, the firm elected instead to purchase a deployment system. That system reduced deployment time to just a few days and required involvement of only operational staff.
Because of its strategic commitment to XML Web services as a business enabler, Aeroplan chose to immediately implement a robust deployment environment. This was a requirement from deployment of its first service because of its customers' security, interoperability, and productivity requirements. When competitive advantage, consistent security, and return on Web service investment are your goals, it's never too early to consider a secure deployment process and system.
Look for one that:
The Payoff Is Here Now
- Offers flexibility: A solution that enables coarse- and fine-grained security policies allows users in different groups to consistently enforce and intelligently coordinate policies
- Offers manageability: One that can manage policy lifecycles, rationalize policy conflicts, and visually track policy changes greatly reduces management overhead. Since security policy can come from identity and access management systems, PKI management software, and custom policy decisions, intelligent policy coordination is a must-have for an effective secure deployment solution.
- Simplifies operations: Enables application and network operations personnel to use it without significant retraining. A good solution provides efficient tools, such as provisioning certificates, to automate error-prone, repetitive processes.
- Automatically mediates: Enables any-to-any platform, protocol, and standards mediation to save testing and deployment time in heterogeneous environments.
With a solid deployment infrastructure in place, new SOAs and Web services can be deployed in hours or days. Reactivity, Inc. provides deployment systems that enable customers to rapidly deploy secure Web services connections for business-critical applications. Aeroplan deployed its industry's first real-time rewards system in 38 days - from proof of concept to production - with zero change to its existing systems. The financial services firm successfully manages more than $12B in assets over the Reactivity secure deployment system. Both companies are generating revenue at a fraction of the cost of their previous proprietary, leased-line connections. They are provisioning new connections, services, and policies in minutes with significant operational and support cost reductions. They gained return on their investment almost immediately (see Table 2).
Through Reactivity, these companies - and others - are already realizing the competitive advantages of SOAs and Web services by deploying them with a secure and scalable system.