It is critical to have a good understanding of the data flow in order to select the optimal protection approach at different points in the enterprise. By properly understanding the dataflow we can avoid quick fixes and point solutions and instead implement a protection strategy encompassing protection all the way from the data sources.

If you want your SOA to have robust security, where you are confident that the users of your web service are properly authenticated and that the information flowing back and forth between web service and their invoking applications is not read by unauthorized people, then you will almost certainly need to apply the powerful tool of encryption to your SOA security solution.

End-to-end data oriented encryption provides end-to-end field confidentiality across the enterprise data-flow, including the SOA layers, while WSS (Web Services Security), TLS and proxy only provide message-oriented or point-to-point confidentiality. SOA security including Web Services Security, TLS, proxy and SOA layers accessing backend applications and databases are discussed here.

Key management and key rotation is an important enabler for several of the protection methods discussed above. Please see this paper for more information on that topic.


A holistic layered approach to security is far more powerful than the fragmented practices present at too many companies. Think of your network as a municipal transit system – the system is not just about the station platforms; the tracks, trains, switches and passengers are equally critical components.

Many companies approach security as if they are trying to protect the station platforms, and by focusing on this single detail they lose sight of the importance of securing the flow of information. It is critical to take time from managing the crisis of the moment to look at the bigger picture.

One size doesn't fit all in security so assess the data flow and risk environment within your company and devise a comprehensive plan to manage information security that dovetails with business needs. Careful analysis of use cases and the associated threats and attack vectors can provide a good starting point in this area.

Continuous protection is an approach that safeguards information by cryptographic protection or other field level protection from point-of-creation to point-of deletion to keep sensitive data or data fields locked down across applications, databases, and files - including ETL data loading tools, FTP processes and EDI data transfers. Please see the discussion of end-to-end encryption here.