Managing Web Services Security

The promising features of Web services also make them vulnerable to new types of security threats. Web service providers must assure their clients’ confidentiality, integrity and availability over a trusted relationship that may be asynchronous and that may involve multiple business partners. Despite the continued significance of the traditional approaches to securing content, transmission and connection in a Web-based business environment, including Secure Socket Layer, Virtual Private Networks, Internet Protocol Security, and so on, they are not able to address the new challenges posed by Web services. This paper aims to provide insight into the management of Web services security. We first introduce key concepts and reviews state-of-the-art standards for Web services security. Then, by aligning the Web services security standards with security threats, we provide guidance for the practical implementation of Web services security. Finally, we point out some limitations in the current practice and suggest future directions of securing Web services.