Bringing value to SOA security

Security in the enterprise needs to run as a business itself; a business that can demonstrate how it adds value to the enterprise.

This is according to Johann van der Merwe, security architect for PricewaterhouseCoopers, who will discuss SOA security challenges and solutions at the upcoming ITWeb Service-Oriented Architecture (SOA) conference.

The conference takes place on 20 and 21 October at The Forum, in Bryanston, and will examine how SOA is transforming organisations.

Van der Merwe says SOA as a business-centric IT architectural approach exposes business functions as repeatable business tasks or services. “From a technical perspective, the biggest security challenge is to protect these business functions from unauthorised access when they are exposed on the network for integration into business applications.

”The major challenge is not technical in nature but to position security architecture in support of business value. Security needs to form better relationships with business and learn how to communicate their value better in a business context.

“This way, security will form part of the SOA systems development and integration life cycle from the beginning. Adding security as an afterthought will simply not work and result in costly reengineering.”

Van der Merwe believes the fundamental purpose of SOA-related security is to protect the business value of the SOA-compliant systems and information assets. “If security organisations can contextualise this value to the business leaders then business will demand security to be integral to the SOA systems development and integration life cycle,” he says.

“This will provide the security practitioners with the opportunity to overcome the technical security challenges of SOA and embed the necessary security mechanisms in the security architecture.”

The two-day conference will feature industry experts discussing how SOA can help businesses respond quickly and cost-effectively to changing market conditions.

Simon Carpenter, director of strategic initiatives at SAP SA, will speak on the business case for SOA, while Toby Sumpter, consultant at Salamander, will discuss the challenges of moving from pilot projects to enterprise SOA.

Other speakers include Ina Sutherland, head of architecture design services at Ovations, who will demonstrate how to develop a unified approach to business process management and SOA; and Ezra Kahimbaara, chief technology officer for Software AG, who will examine best practices for SOA governance. Joe Ruthven, business development manager for IBM South and sub-Saharan Africa will identify the implications of cloud computing for SOA.

Related story:
ITWeb SOA 2009