SOA Security

Hi. I'm Roger Thornton, CTO of Fortify Software. Today, we are going to be talking about SOA security.

When you see the letters SOA, you know what that means: Services Oriented Architectures, where we take inside the enterprise all of the systems that run core pieces of our business, of the inventory, sales, financial and we create interfaces around those so that we can build all sorts of adhoc applications and rapidly integrate systems together in real times, both inside our company and with all our business partners in the outside world.

But when I see the letters SOA as a security person, I see Secure Old Applications. Why is that? Well, in the security world, all these access points, all these real-time access points that we're making into these systems, we call those attack surface paths, and all the threats that are out there -- hackers, malicious insiders, viruses, and worms-- those aren't just for operating systems those will come after your business applications too. In the past they never had a chance of getting near these applications. Why? They were deep inside the enterprise computing infrastructure of your company. But once you go to a Service Oriented Architecture, there are going to be numerous paths into those systems, and what's the probability that back in the 1970s, or in the 1980s, or in the 1990s, when these were built, that people thought about these threats addressing those applications were zero.

So SOA is an important technology and it's an important enabler, but if you do it make sure you also read that as Secure Old Applications.