Security Engineering for Service-Oriented Architectures

Based on the paradigm of model-driven security, the authors of this book show how to systematically design and realize security-critical applications for SOAs. In a second step, they apply the principles of model-driven security to SOAs.

While their basic principles and ideas are well understood and cogent from a conceptual perspective, the realization of interorganizational workflows and applications based on service-oriented architectures (SOAs) remains a complex task, and, especially when it comes to security, the implementation is still bound to low-level technical knowledge and hence inherently error-prone.

Hafner and Breu set a different focus. Based on the paradigm of model-driven security, they show how to systematically design and realize security-critical applications for SOAs. In their presentation, they first detail how systems and security engineering go hand in hand and are integrated from the very start in the requirements elicitation and the design phase. In a second step, they apply the principles of model-driven security to SOAs. Model-driven security is an engineering paradigm that aims at the automatic generation of security-critical executable software for target architectures. Based on the general principles of model-driven software development, the automation of security engineering through proven and reliable mechanisms guarantees correctness and facilitates an agile and flexible approach to the implementation and high-level management of security-critical systems.

Their book addresses IT professionals interested in the design and realization of modern security-critical applications. It presents a synthesis of various best practices, standards and technologies from model-driven software development, security engineering, and SOAs. As a reader, you will learn how to design and realize SOA security using the framework of an extensible domain architecture for model-driven security.

See how to identify security requirements during all phases of systems engineering Learn how to model and implement security-critical applications and interorganizational workflows using model-driven security Check how to apply the principles of model-driven security through a case study in a healthcare application scenario Includes supplementary material: sn.pub/extras

Autorentext

Ruth Breu has been head of the research group Quality Engineering at the University of Innsbruck since 2002. Prior to that, she was a researcher at the Technische Universität München and Universität Passau, and spent several years in industry working as a software engineering consultant. Quality Engineering focuses on foundations of model-based software development, in particular in the areas of security engineering, IT governance, model quality assessment and workflow management systems. The research group cooperates with industry partners such as Siemens, Swiss Re and Telekom Austria.

Michael Hafner gained his industry experience in the automotive and the telecommunications sectors as a technical consultant on systems integration with Deloitte Consulting before joining the Quality Engineering group as a researcher. In this group he has been responsible for the design and the realization of the SECTET framework, a model-driven security infrastructure for SOA applications.

Inhalt
The Basics of SOA Security Engineering.- SOA Standards & Technology.- Basic Concepts of SOA Security.- Domain Architectures.- Realizing SOA Security.- Sectino A Motivating Case Study from E-Government.- Security Analysis.- Modeling Security Critical SOA Applications.- Enforcing Security with the Sectet Reference Architecture.- Model Transformation & Code Generation.- Software & Security Management.- Extending Sectet: Advanced Security Policy Modeling.- A Case Study from Healthcare.- health@net A Case Study from Healthcare.