XML and Web Services: Dealing with Security

In a techno centric world that throws out more ‘new’ and ‘next best thing’ thinking than the latest washing powder advert, the adoption of XML as a major force of efficiency and expedience is exceptional.

While it is a relatively cumbersome code, the openness of its core elements equates to simple reading and therefore effective use. It has revolutionized how code can integrate with code at multiple points, which means the world is changing from bordered access to applications to non-bordered access to applications. More importantly, it enables access to data that previously required lots of discussion and mapping, big budgets and late deliverables, plus all the blackbox issues that technology projects have always been famous for.

Just to be clear, XML use does not mean all of those issues disappear, just that certain interaction that was not possible or very difficult to do previously has some hope of happening now. The industry is optimistic because XML, web services and – sooner rather than later according to some – service oriented architecture (SOA) are allowing freedoms not possible in a mainstream manner until now.

Opportunity and Threat

XML allows the freedom to integrate with anything, code in anything and access to everything. These are all ambitious goals for making the world a more accessible place but with access and freedom comes the responsibility of securing this process.

As well as the excitement about this new-found accessibility, a new threat has also arisen. By design, XML is an easily read code that explains exactly what the information contains, therefore it is not complicated to see data that might be private and harmful if misused.

And to make matters even more worrying, traditional security (e.g. firewalls or secure socket layer) are not designed to recognize XML or web services as being a threat or malicious because it does not scan information at a data level, i.e. you check the egg box and it seems fine but not the eggs inside so it is only when you get home that you realise that some are damaged.

This vulnerability is already rearing its ugly head in newspapers all over the world where financial institutions are being targeted and information is compromised. Of course, not all of these incidents are specifically XML breaches, but they will be more prevalent as XML and web services adoption continues its meteoric rise.

Experts estimate that by 2007, as companies strive to improve operational effectiveness and adopt new technologies, XML network traffic will reach 35% of all local area network traffic (in 2003 XML traffic was estimated at 3%)¹. Based on Gartner research, 70% of attack paths closed by traditional firewall security have now been re-opened with the use of XML and web services.

Not only can the damage be devastating to a network, but public awareness of breaches and data compromises have proven to have a dramatic impact on a company’s credibility and liability, one only need read about any number of financial institutions, universities or health care facilities being exposed to realize the diverse attacks on information.

Addressing the Problem

The solution is rigorous policy and standard processes to help establish a more universal format or at least narrow the playing field. Comprehensive solutions are being introduced by both big and small players that focus solely on the data level issue of XML/web services security.

Part of the problem is not a lack of packaged solutions, but organizations having the ability within an IT division to recognize this latest vulnerability, and understand that traditional security is not enough anymore. They must then execute a strategy before too much garbage has passed through their gates.

Education and an open-minded approach are the best defence to ensure proactive behavior for securing your environment and all important data. Unfortunately, most XML security discussions are met with: “We already have that covered with our firewall” or “We aren’t looking to add anything new right now.” In either case, this can lead to a rude awakening when the threats a firewall will not prevent affect them.

There are great things happening within the XML and web services movement, and business models are changing everyday to meet this new frontier of connectivity, but be cautious about how and where you are open doors that you might rather leave closed or more carefully protected. In adopting XML or web services as a viable direction, IT and business personnel alike must be as willing to identify the potential vulnerabilities and implement solutions to defend that path.