(Larger Image)
|
SOA Security
by Ramarao Kanneganti, Prasad Chodavarapu
Product Group: Book
Publisher: Manning Publications (2008-01-11)
ISBN: 1932394680
EAN: 9781932394689
Dewey Decimal #: 005
Paperback: 500 pages
Release Date: 2008-01-11
SKU: 110508000369
Condition: New
Comments: 1932394680 New, never read, may have minor wear on cover.
|
Editorial Reviews
|
Product Description
SOA is one of the latest technologies enterprises are using to tame their software costs - in development, deployment, and management. SOA makes integration easy, helping enterprises not only better utilize their existing investments in applications and infrastructure, but also open up new business opportunities. However, one of the big stumbling blocks in executing SOA is security. This book addresses Security in SOA with detailed examples illustrating the theory, industry standards and best practices. It is true that security is important in any system. SOA brings in additional security concerns as well rising out of the very openness that makes it attractive. If we apply security principles blindly, we shut ourselves of the benefits of SOA. Therefore, we need to understand which security models and techniques are right for SOA. This book provides such an understanding. Usually, security is seen as an esoteric topic that is better left to experts. While it is true that security requires expert attention, everybody, including software developers, designers, architects, IT administrators and managers need to do tasks that require very good understanding of security topics. Fortunately, traditional security techniques have been around long enough for people to understand and apply them in practice. This, however, is not the case with SOA Security. Anyone seeking to implement SOA Security is today forced to dig through a maze of inter-dependent specifications and API docs that assume a lot of prior experience on the part of readers. Getting started on a project is hence proving to be a huge challenge to practitioners. This book seeks to change that. It provides bottom-up understanding of security techniques appropriate for use in SOA without assuming any prior familiarity with security topics on the part of the reader. Unlike most other books about SOA that merely describe the standards, this book helps you get started immediately by walking you through sample code that illustrates how real life problems can be solved using the techniques and best practices described in standards. Whereas standards discuss all possible variations of each security technique, this book focusses on the 20% of variations that are used 80% of the time. This keeps the material covered in the book simple as well as self-sufficient for all readers except the most advanced.
|
Customer Reviews
|
This book is named incorrectly.
Rating  (1)
Date: 2008-12-04
Great book for starters.
However it misses the latest Standards in Security such as PKI, SAML, XACML, WS-Federation, WS-Trust and how it pertains to SOA based solution architecture. So much for a book titled "SOA Security". Also it totally ignores to explain how to ensure security at all integration tiers.
Not for security experts, more for people who are starters and do not have time to "Google" either.
Does not do detailed coverage only basic topics related to Web services security around SOAP and WSDL standards with Apache Axis sample APIs (which are out of box and can be googled easily) are discussed. It is a bit difficult to relate the examples to the meat on the book.
Also missing is the information on how to use the abused Apache API examples to compose/build a Secure SOA service base architecture or how to secure BPM workflows, SOA governance, Identity management using federation, entitlement issues with BPM portals,... the list goes on.
This book contains very repetitive content. The only good portion I found was the chapter on XML Web services. The authors should refer Information Security Management Handbook, Sixth Edition (Isc2 Press) and Core Security Patterns: Best Practices and Strategies for J2EE(TM), Web Services, and Identity Management (Sun Core Series) before the next version comes out.
|
|
Mostly Axis examples
Rating  (3)
Date: 2008-10-30
1 out of 1 customers found this reveiw helpful
This book is great for beginners to SOA security. The examples are mostly in Axis from Apache. My background is with a commercial middleware and it took some imagination to translate the examples. Also, commercial security appliances like the Alcatel-Lucent web services gateway were left out completely.
After reading this book, I might think that calling a service for security would suffice. The common thinking today is to abstract the security into a central location run by security experts. Most SOA developers don't have the time or the depth of knowledge about certificates, user-centric policies, or even XML threat management to re-invent common security patterns.
Still the examples are solid and the concepts are important to know.
|
|
Good start before securing SOA
Rating  (5)
Date: 2008-06-13
2 out of 2 customers found this reveiw helpful
The main goal of this book (as stated in introduction section) is to give a reader good background knowledge on security in order to facilitate the implementation of security in SOA-based systems. This book is not for security experts, it is more for people who have to deal with security without having previous experience. It helps to answer the questions like how to secure collaborating Web services, what are the common practices.
Nevertheless, the book does not cover all the topics, however, mostly the basic ones. I found this book helpful to understand the fundamental instruments used in SOA security and continued with my own more specific and advanced solutions.
|
|
good book
Rating (5)
Date: 2008-05-02
4 out of 4 customers found this reveiw helpful
Security is indespensable for web services, but difficult to understand and use. There are too many standatds relevant to security, W3C standards and OASIS. I think to understand whole structure need much time. It seems architecture or principle is required to consistent understanding. This book is good to grasp security standard structure. It is regrettable that this book seems written before 2007, the rush of new standards. I hope this book is maintained to the latest standards. Nonetheless it is good for readers to understand security standards structure.
|
|
Disappointing title.
Rating  (2)
Date: 2008-02-17
6 out of 9 customers found this reveiw helpful
If you are really serious about building security to your SOA stack of applications, then this book would offer only a hello world to security. All you find is a full-blownup security chapter for XML Web services beyond that nothing more. More importantly this book is completely disorganized...all I saw is the basic XML Web services security using out-of-box Axis examples. To the most disappointment, there is no chapter to show how to put-to-gether all these APIs in a real world SOA (as they claim in the title). Why should I read the book if it is repeating the API examples from Axis. This book is nothing but a theoretical junk with no proof. After browsing all the pages, I don't find anything which show how to build a SOA security architecture. The word security is abused and does'nt make sense for this title.
|
|
|