Johannesburg, 08 Jun 2004
There is much hype and promise surrounding Web services. But concern over the performance, quality and security of the technology that some claim will be the universal panacea to integrating applications, is also increasing. Are Web services all hype?
"Not at all," says Paul Wandrag, QA Architect at Compuware South Africa. "Optimising the use of the Internet within business is the next logical step and a Web service provides application logic that is accessible using standard Internet protocols.
"However, while there have been many early adopters of Web services technology, established standards such as XML, SOAP and UDDI do not themselves provide a foolproof way of exchanging data and provide no guarantees in relation to the quality, performance and security of components. Crucial challenges relating to these areas still need to be overcome before we see widespread adoption," he explains.
According to Wandrag, one of these areas is quality - a particularly difficult one to address as Web services have no visual component. "Everything happens `behind the scenes` so to speak, unlike other components of the Internet which operate through visual interface. This makes the detection of bugs and errors tricky, raising the question about how companies can guarantee the quality of components embedded within the service.
"A solution for this could be script-based testing," suggests Wandrag, who also notes that Web services do not operate in isolation. They need to be developed within a framework that combines the business model with the applications that provide the desired functionality - a service-oriented architecture (SOA) - which incorporates structural features that delve deep into the IT system.
"The strength of Web services is in allowing functions to be made public, while SOA considers the layering and structure of the software. SOA essentially underpins Web services," says Wandrag.
However, he says SOA and script-based testing offer solutions only to management and quality issues, but don`t address performance.
"Web services have been mainly used inside the firewall where bottlenecks are easily identified, but when you start using them externally, the real questions about performance surface. How do you validate and manage the performance of these components?
"One way of validating functionality would be to certify Web services performance," suggests Wandrag. "Such a move would offer reassurances to those companies looking to consume Web services. Yet who would be responsible for certifying them? We have seen the emergence of various discrete Web services communities, but they could perhaps cause more confusion and questions than they do clarification, especially if they all have different expectations.
"Another burning issue around Web services is security. The security risk associated with internal Web services components is minimal, however, outside the firewall, security becomes a more significant issue."
Fortunately, he notes, there is a set of agreed and defined security techniques and algorithms - the Web Services Security (WS-Security) standards - which are supported by major technology players. "WS-Security has been developed to ensure that messages sent live across the wire cannot be lost or modified. But this can only succeed if users take no shortcuts and fully comply with the standard, otherwise security could be compromised," concludes Wandrag.
Share