Web Services Threats, Vulnerabilities, and Countermeasures

Abstract

Securing a Web service requires us to protect, as far as possible, all of its basic components, shown in Figure 3.1, and their interactions, along with the Web service life cycle, from the design to the operational phase. This is a complex and difficult task, due to the vulnerabilities which each software component may have, the large number of attacks that can eventually exploit the vulnerabilities of a specific component, and to the interactions between the components themselves. It requires us to combine and enhance methods, tools, and techniques for computers, networks, distributed systems, and application security and adopt an engineered security process. Such an engineered process consists of detailed plans and designs for security features and controls that support the delivery of solutions satisfying not only functional requirements, but also preventing misuse and malicious behavior.