Security-oriented Architecture

Split your monoliths into myriad services and suddenly your established security boundaries fizzle into non-existence.

I would assert that all services need to think about security, namely:

• authentication: who is calling me?
• authorisation: are they allowed to call me?  are they allowed to request this particular data?
• validation: is the message valid?
• confidentiality: is my sensitive data secure?  what is sensitive data?
• integrity: how do I know the request has not been tampered with?
• non-repudiation: how do I know the request came from a legitimate source

Yes, all services, even the internal ones.  Don't think of hackers as spotty teenage opportunists.  Think of  them as sophisticated criminal organisations that spend millions on stealing precious corporate data, or threatening brands with ransom attacks.  Loyal as I'm sure your staff are, are they immune to greed, revenge or blackmail?

That's not to say you might not answer the questions above differently for internal services, as opposed to edge-facing ones, but consider these issues you must.

Read More

What is SOA?

What is SOA?  SOA or Service-Oriented Architecture is a software architecture pattern in which applications or systems are constructed from underlying (and usually distributed) software services that conform to a specific set of characteristics, namely:

1.Contract based
2. Location transparency
3. Autonomous
4. Abstract
5. Reusable
6. Composable
7. Stateless
8. Discoverable
9. Extensible
10. Loosely coupled

The primary goal of SOA is software development agility, i.e. the ability to respond the change easily, and cheaply, thus allowing businesses to rapidly respond to changing markets.

Services are typically (but by no means exclusively) implemented as web services, i.e. they operate over the ubiquitous web HTTP protocol, and are implemented either using XML-based SOAP or the lightweight (and more popular) REST paradigm.

The highly distributed nature of this architecture has resulted in a need for a runtime platform (the Enterprise Service Bus, ESB) to help manage the operation of these services, but also to handle complex enterprise integration scenarios involving multiple (and often legacy) platforms, protocols and security models - products like Oracle Service Bus or the open source Mule ESB.

In addition to being an integration solution, the service-oriented pattern also offers an opportunity for easier implementation of high-level business processes using Business Process Management (BPM) solutions that are often offered as part of the ESB product suite.

Service-oriented architecture is highly relevant to the rapidly growing cloud computing model where applications are built in the cloud as orchestrations over public cloud-based APIs, and we are seeing ESB vendors like WSO2 and MuleSoft in or moving into this space, offering cloud-based versions of their products, as well as API management products.

Some will argue that SOA is not new, and that distributed programming involving services has existed for a long time, and they are right.  However those early efforts stumbled on the hurdles of platform incompatibility and standards complexity.  Now, with ubiquitous, and easy to use protocols like REST, web service API development is growing rapidly, and the integration possibilities seem endless.

(What is SOA, Service Oriented Architecture)

Read More

What is Service-Oriented Architecture (SOA) - Competitive Services

I have been reviewing ITIL 3 with a view to updating my article on Service Management, and came across the notion of competitive services.

This is a very common notion when one looks at services in the usual, non-SOA sense where services are being offered in a market place and have to compete, but does it apply to SOA?

Well, clearly if you are looking at services offered in the internet by companies engaged in Cloud computing and such like, e.g. Google or Amazon, the answer is yes, but what about your typical corporate enterprise landscape?

Read More

Enterprise Service Bus (ESB) Benefits - Building a business case

Enterprise Service Bus (ESB) benefits to IT could include:

• facilitates enterprise integration
• provides and infrastructure backbone for Service Oriented Architecture(SOA) applications and services, for both event driven and composite applications
• allows faster and cheaper integration of existing (legacy) systems
• increased flexibility, making it easier to change as requirements change.
• standards-based
• scales from point solutions to enterprise-wide (distributed) deployment
• configuration based rather than code based integration
• reduces cost of implementing new processes through reuse of existing application and data
• reduced TCO (total cost of ownership)
• reliable delivery of messages across disparate technologies and protocols
• highly distributable, centrally managed service hosting
• disseminates data through the enterprise
• can be deployed incrementally

Read More