On The Insider: Miley Cyrus in Sex and the City 2
BNET Business Network:
BNET
TechRepublic
ZDNet

Category: General

November 14th, 2009

IT project risk aversion 101

Posted by Joe McKendrick @ 9:47 am

Categories: Business ROI, General

Tags: Information Technology, Geek & Poke, Strategy, Management, Joe McKendrick

Geek & Poke’s Oliver Widder picked up on my latest post on the lack of measurable results for IT, and posits as to where the greatest IT project risk may be found:

October 17th, 2009

What if they had a SOA and nobody came?

Posted by Joe McKendrick @ 8:15 am

Categories: General, Links, Management

Tags: SOA, Geek & Poke, Service-Oriented Architecture (SOA), Web Services, Middleware, Enterprise Software, Software, Joe McKendrick

Geek & Poke’s Oliver Widder reminds us that designing and putting a great SOA-based infrastructure out into the enterprise is only half the battle.

October 15th, 2009

Conference alert: let's make SOA work for a living

Posted by Joe McKendrick @ 9:32 am

Categories: Business ROI, General, SOA Events, Web 2.0-Enterprise 2.0, cloud computing

Tags: SOA, Conference, Dave, Service-Oriented Architecture (SOA), Web Services, Middleware, Enterprise Software, Software, Joe McKendrick

Welcome to Service Oriented Architecture, Phase 2. It’s bigger, It’s badder, it’s all business.  None of this namby-pamby JBOWs stuff. None of these SOAPY-REST tantrums. SOA is all grown up now, and it’s time it starts earning the bacon.

I am serving as conference chair and emcee for ebizQ’s upcoming “SOA in Action” virtual conference, scheduled for October 28th and 29th, and want to share some of highlights with you.

I will be joined by a number of leading industry figures in various sessions and panel discussions, including Forrester’s Randy Heffner, Software AG’s governance guru Miko Matsumura, Web Oriented Architecture guru Dion Hinchcliffe (also a rock star here at the ZDNet community), Gartner’s Yefim Natis, captain of the cloud Dave Linthicum, and US Department of Defense CIO Dan Risacher. The conference will be capped by a joint session featuring Gartner’s Roy Schulte and CalTech’s Mani Chandy.

Some author notes: Roy Schulte and Mani Chandy have just published a new work on event processing, Event Processing: Designing IT Systems for Agile Companies. Dave Linthicum has just published his latest book, Cloud Computing and SOA Convergence in Your Enterprise: A Step-by-Step Guide.

Topics to be discussed include organizational and governance issues, “selling” SOA’s value to the business is more difficult in today’s economy, ROI, complex event processing, and cloud computing.

October 3rd, 2009

How to speak the CIO's language

Posted by Joe McKendrick @ 8:38 am

Categories: General, Links, Management

Tags: CIO, Geek & Poke, Joe McKendrick

Geek & Poke’s Oliver Widder shows us what CIOs like to hear

October 2nd, 2009

Biggest cloud of all: Amazon EC2 makes about $220 million a year

Posted by Joe McKendrick @ 1:58 pm

Categories: General, Vendor Watch, Web Services, cloud computing

Tags: Amazon.com Inc., Amazon EC2, Randy Bias, Cloud Computing, Virtualization, Hardware, Joe McKendrick

Anyone wondering how the commercial cloud computing business model is working should look no further than Amazon Web Services.

Randy Bias just published estimates that AWS is pulling in about $220 million annually for its Elastic Compute Cloud (EC2) offerings. He bases his conclusions on “actual verified EC2 numbers plus some guesses and a rough model of it’s current annual usage.” He also estimates that AWS runs about 40,000 servers to support the service.  EC2 probably grew at a rate of 10% from year to year, Randy believes.

Not bad for a business model based on increments of 10 cents to 80 cents an hour for standard usage. EC2 is a Web service that provides resizable compute capacity in the cloud.

With these numbers in hand, Randy also observes that they may also tell the story about the overall size of the infrastructure cloud computing (Infrastructure as a Service) market. Randy sizes this marker at about $400 million to $600 million, and growing about 10% to 20% annually.

The EC2 revenues represent about 1% of Amazon’s revenues for the most recent fiscal year. ($19.2 billion.) Amazon has really effectively leveraged the capacity from its retail business to offer services to the rest of the market. Is this something other companies with large IT infrastructures can contemplate?

September 8th, 2009

Cloud may complicate SOA load balancing act

Posted by Joe McKendrick @ 1:47 pm

Categories: Enterprise Architecture, General, Links, Management, Vendor Watch, Web Services, cloud computing

Tags: Joe McKendrick

One of the major selling points of SOA and cloud computing is that service consumers don’t have to worry about the platform and hardware that the service is hosted on, be it somewhere else within the enterprise or maintained by an outside third party.

SOA’s greatest risk? Too much success, catching planners unprepared

Providers of services (and users), however, need to assure the availability of the service, and how much stress the underlying infrastructure can take as the service is repeatedly accessed. Lori MacVittie just posted a detailed analysis of the load balancing challenge associated with SOA-based deployments.

Lori cites a post by Stephan Koser, who provides a vivid scenario of what can go wrong with unbalanced SOA.

To function effectively, Lori observes, any load-balancing algorithm put into to place to assure availability and scalability of the service-delivery network be able to take into consideration the current load being handled by the particular server handling the request:

“This requires that the load balancer, the application delivery controller, be aware of the application, its environment, as collaboration well as the network and the user. It must be able to make a decision, in real-time, about where to direct any given request based on all the variables available. That includes CPU resources, what the request is, and even who the user/application is.”

However, when the cloud paradigm is introduced, this ability to see and monitor the systems providing services is, well, clouded over. If anything, Lori warns, cloud computing leads to poor visibility and renders load-balancing strategies useless. “The belief that the infrastructure should be ‘hidden’ from the user (that’s you) means that configuration options – like the load balancing algorithm – aren’t available to you as a user/deployer of cloud-based applications. Even though load balancing is going to be used to scale your application, you have no clue or control over how that’s going to occur.”

Lori very aptly points out that despite all the emphasis on virtualization, “applications are not islands,” and the ability to deliver and manage applications ” requires collaboration between a growing number of components in the data center.” Load balancing is a good start.

There’s plenty of talk about SOA failure, but, ironically, the greatest risk may come from too much SOA success. Organizations deploy shareable services, only to have them pounded into the ground by a growing number of requesting applications. Here’s a case where SOA costs may be driven up by the need to quickly put in or provision additional hardware. Cloud adds a new dimension to the challenge.

September 2nd, 2009

Enterprise architecture is for entrepreneurs, too

Posted by Joe McKendrick @ 1:31 pm

Categories: Enterprise Architecture, General, Links, Management, business process management

Tags: Electronic Arts Inc., Enterprise Architecture, Mike Kavis, Entrepreneurship, Strategy, Management, Joe McKendrick

Mike Kavis asks an intriguing question: “Is enterprise architecture only for big companies?

Small companies can’t afford to throw money away on the wrong systems

One’s first thought would be yes — it would seem that a larger organization would have a greater need for EA, since there are likely to be many systems, applications, and user groups to contend with, all under one roof. A small company, on the other hand, may be more homogeneous, with only one ERP system, one type of database, one platform, and so on. Plus, a large organization has lots of time and resources — including human resources — that can be devoted to EA planning and governance activities.

EA may be even more critical to small and medium-size companies than their larger counterparts. But there is a misconception that only big companies need EA. Mike reports that he is part of a startup with fewer than 20 employees, and yes, they are talking EA. He says Brenda Michelsen captured the misconceptions about EA perfectly in a within-140-character tweet: “Many equate EA w/jumbo frameworks & rigid governance, rather than set of values & practices for capability delivery.”

So, forget the heavy-handed frameworks, and look at what EA is really about:

“Enterprise Architecture is a complete expression of the enterprise; a master plan which ‘acts as a collaboration force’ between aspects of business planning such as goals, visions, strategies and governance principles; aspects of business operations such as business terms, organization structures, processes and data; aspects of automation such as information systems and databases; and the enabling technological infrastructure of the business such as computers, operating systems and networks (source: IFEAD – Institute for Enterprise Architecture Developments)”

There’s nothing in this definition that specifies large organizations. If anything, smaller companies may need a master plan to guide ongoing technology projects more than a large organization that can afford to waste money on shelfware or underutilized systems.

Mike observes that EA is effective at helping a small, entrepreneurial organization meet goals that may include business architecture, business roadmaps, and portfolio management that prioritizes what gets worked on and when.

September 2nd, 2009

SOA vs. JBOWS: here's an analogy that delivers

Posted by Joe McKendrick @ 12:52 pm

Categories: Business ROI, General, Links, Management, Web Services

Tags: Web Service, SOA, Service-Oriented Architecture (SOA), Web Services, Middleware, Enterprise Software, Software, Joe McKendrick

Alex Kriegel, an active enterprise architect, picked up on my JBOWS (Just a Bunch of Web Services) theme written back in 2005, and shared with us a great analogy that he says has served him well in explaining the difference between JBOWS and full-functioning SOA:

It all started with frustration on Alex’s that people just weren’t getting the message that putting up some Web services doesn’t magically gel into a service oriented architecture: “I found myself explaining – time and again – to the managers on every level why Web services do not equal SOA,” he says.

Thus, this metaphor to which the business can relate: mail delivery systems.

JBOWS: Brittle, non-scalable. “If you need to deliver a package from point A to point B, a courier service would be one option. It is fast, it is reasonably secure and it is reliable; you can even trace the way the parcel will be delivered to the recipient, All you need to know is the exact location (address) of the point B. Oh, and you need to pay the courier.

SOA: Economies of scale, built-in fault tolerance. “The second option would be USPS – United States Postal Service. It is a lot cheaper than private courier; it is reasonably fast, reasonably secure and reliable. It also could forward your mail should your intended recipient have moved without notifying you beforehand.”

September 1st, 2009

Another view: cloud not ready to take on SOA heavy lifting

Posted by Joe McKendrick @ 8:29 am

Categories: General, Links, SOA Surveys and Research, cloud computing

Tags: Cloud Computing, SOA, Service-Oriented Architecture (SOA), Web Services, Middleware, Enterprise Software, Software, Joe McKendrick

Anne Thomas Manes penned a thoughtful response to my recent post on “Cloud: the SOA we always wanted, but never had?” Anne agrees with my premise that cloud computing will boost the viability of SOA in business contexts, but takes issue with points I made about cloud finally delivering some long-sought SOA promises — including being understood by the business, being technology agnostic, necessitating provider-consumer contracts, or building trust between service providers and consumers. It’s too soon to make these assertions, she states:

As far as I can tell, cloud computing is none of these things. It should be. But cloud is too nascent for such assertions. Besides, in order to achieve these characteristics in cloud-based systems, organizations have to 1- design them that way, and 2- develop the contracts and trust described. You won’t achieve these characteristics automagically just by deploying a system to EC2, Force.com, or some other cloud provider.

I agree with Anne that we’re in the early stages of this paradigm, and the current cloud model for external-provided services (such as EC2) doesn’t address deep integration issues. However, with SOA as the foundation of private cloud implementations, we are more likely to see many of the above-mentioned promises of SOA finally being realized.

My colleague Phil Wainewright also provides some interesting thoughts on private clouds in his latest post. For enterprises, the future may lie in virtual private clouds, or “computing that operates within a public cloud but which uses virtual private networking to give individual enterprises the ability to mask off a portion of the public cloud under their own delegated control and management…  so that enterprises can begin to harness the benefits of cloud computing without having to expose their entire existing infrastructure to the public cloud in one fell swoop.”

Clearly the future of SOA as well. Stay tuned.

August 25th, 2009

Study: unified communications doesn't deliver -- yet

Posted by Joe McKendrick @ 10:02 am

Categories: Business ROI, Case Studies, General, Links, Management, Web Services, business process management

Tags: Unified Communications, Collaboration, Joe McKendrick

It would seem that converting technology that has existed as proprietary, embedded-code hardware-driven solutions to service-oriented software would be very productive.

Needed: baselines to measure UC gains

However, unified communications (UC) approaches still have yet to prove their ROI mettle, a new Forrester Research study claims. As reported by Tim Greene in Network World, half the world is not convinced of the efficacy of UC. Forrester’s Henry Dewing is quoted as observing that half the companies he spoke with don’t yet see the business value in UC. “When you talk to end users, they want a 12-month return and a triple-digit ROI,” he says.

For many businesses, the challenge is determining a baseline of costs before UC is implemented, Dewing says. UC brings various communications methods — including IP telephony, instant messaging, email, and voice mail — into more integrated settings running on standard IT systems.  Benefits include measurable, quantifiable metrics such as cutting down on business travel (in favor of teleconferencing) and enabling the decentralization of call centers.

However, there are many soft benefits such as cutting down wait times and increased end user productivity. Good stuff, but notoriously difficult to measure. Perhaps we will start seeing more cloud-based UC services that will add incremental pricing into the equation.

August 20th, 2009

Debate: Is SOA still too immature to secure?

Posted by Joe McKendrick @ 3:19 pm

Categories: Data managemetnt, General, Links, Management, SOA Surveys and Research, Standards Watch, cloud computing

Tags: SOA, Service-Oriented Architecture (SOA), Web Services, Middleware, Enterprise Software, Software, Joe McKendrick

Two recent posts by leading SOA thinkers have different takes on the state of SOA security. Is it a monstrosity that is almost impossible to secure end to end, or is it something that can be started relatively simply and grown with proper attention and management?

Will SOA outgrow its insecurity?

Forrester’s Randy Heffner says we have reached a point where SOA is secure enough for prime time. However, he cautions, while WS-Security has helped standard Web services using SOAP, some careful navigation is required for full-blown SOA. But it’s doable. “Advanced SOA security - involving federation among partners, nonrepudiation, and propagation of user identities across multiple layers of service implementations - is in its early days,” Randy points out. Still, the need for robust SOA security will be inevitable. “Many user organizations will find that advanced SOA security becomes mandatory - especially with increasing data privacy and other regulations.”

JP Morgenthal takes a dimmer view on SOA security, pointing out the world really hasn’t agreed on a consistent definition of SOA, and, therefore, there may be issues with attempting to provide security. As he points out: “If you can’t define it, you cannot secure it!”

JP adds that while there is plenty of research and literature on the topic of cybersecurity, there’s very little that connects SOA and cybersecurity. The problem is that SOA touches so many parts of the technology stack, and each has its own security solutions and protocols.

“If you’re tasked with focusing on cybersecurity for your SOA, you could focus on locking down access to your Web services, stopping SQL injection attacks, addressing DDoS attacks against the service, etc. Each of these areas requires considerable knowledge of the entire computing stack from telecom through the hardware through the operating system and into the application. Holy rotten fish Batman! That’s a tall order for even the most adept team, but it’s made even more difficult by the fact that there aren’t that many cybersecurity experts available that understands this entire domain.”

Still, Randy Heffner takes a stab at designing SOA security, starting with virtual private networks and two-way Secure Sockets Layer (SSL) at the simplest level. “Hackers cannot even connect to an SOA-based service unless they steal a certificate and key from a service consumer,” he says. Move up a step or two, and the next option is to leverage “existing SOA security features in Java or .NET application platforms and concentrating SOA security within an SOA specialty product such as an enterprise service bus, SOA and Web services management solution, SOA security server, or SOA appliance,” Randy says.

Ultimately, even when starting with a simple SOA security such as VPNs or SSL, SOA proponents need to recognize that the process will develop into something more intricate. The key is “to anticipate the need for and leave paths open to build additional, deeper security functionality as business requirements demand and SOA security maturity allows,” Randy says.  We’ll grow and learn as we go along, he believes:

“Typically not all applications need all of your security requirements; initial applications may be able to do with a lighter-weight pass on building your SOA security solution, while later applications require you to fill in your solution with additional features….  Each time you make a pass through, you will learn more about how to build the most effective SOA security solution with the pieces that you have.”

Still, JP says the current crop of tools and protocols are too immature for top-to-bottom SOA. Things will only get more complicated as SOA-enabled services become part of cloud offerings. “What I have experience in with regard to the WS-* security mechanisms, security tools and technologies for securing Web-based and non-Web-based applications, still do not begin to address the real hard issues regarding cybersecurity in an SOA; especially as we expand the notion of service.”

SOA raises issues that never arose in the days of siloed applications and point-to-point Web services. Both Randy and JP recognize that securing a complex network that touches many parts of the stack is going to take work. Where they disagree is whether current approaches are at least a place to get started. JP adds that SOA is too much of an amorphous, changing entity on which to base solid security decisions.

August 18th, 2009

WebSphere versus .NET: battle royale!

Posted by Joe McKendrick @ 8:32 pm

Categories: General

Tags: IBM WebSphere, Microsoft Corp., Application Servers, Middleware, .Net, Enterprise Software, Software, Software Development, Software/Web Development, Joe McKendrick

Lots of benchmarketing action on the application server/middleware front:

“After carrying out a number of benchmarks, Microsoft concluded that .NET offers better performance and cost-performance ratio than WebSphere.”  (Shock! Surprise!)

“IBM rebutted Microsoft’s findings and carried out other tests proving that WebSphere is superior to .NET.” (Shock! Surprise!)

“Microsoft responded by rejecting some of IBM’s claims as false and repeating the tests on different hardware with different results.”

And it goes on and on. All the gory details here.

August 18th, 2009

Microsoft Oslo shifting to the data side

Posted by Joe McKendrick @ 8:07 pm

Categories: General

Tags: Oslo, Microsoft Corp., Modeling, Darryl Taft, Research & Development, Business Operations, Joe McKendrick

Last year, I heard Brian Loesgen compared Oslo, Microsoft’s modeling strategy, to an onion, with many layers of features. Lately, it appears there is another layer to Oslo forming, which ties the platform closer to Microsoft’s data programmability stack.

Darryl Taft reveals that Microsoft has been shifting Oslo, originally intended to support SOA development, toward the database. He quotes Microsoft engineer Doug Purdy, who admits that the reference to Oslo as a new version of BizTalk “really confused customers.” He adds that “We started using the term ‘Oslo’ for only the modeling platform pieces of the overall vision.”

At its core, Oslo supports a modeling language and a repository, which are surrounded by layers of tools and other functionality.  Oslo refers to the modeling platform, and other pieces of the overall vision have migrated into the next version of the .NET framework, Visual Studio and the capabilities that Microsoft “Dublin” will add to the Windows Server application server.

Purdy notes that over the past year, “it has become increasing clear to us that the modeling platform is aligned in a deep and fundamental way with the data programmability stack (ADO.NET, EF/EDM, [Entity Framework/Entity Data Model] Astoria, etc.).” As a result, the focus of Oslo has shifted to the database, emphasizing its role of supporting metadata stored within the database. For this reason Microsoft has decided to merge Oslo with its Data Programmability team, which includes EDM, EDM, EF, Astoria, XML, ADO.NET, and tools and designers. The Oslo group will work on Quadrant, the repository and M, according to Taft’s report.

August 14th, 2009

Gartner: SOA out of 'trough of disillusionment,' cloud on hype peak

Posted by Joe McKendrick @ 7:38 am

Categories: General, SOA Surveys and Research, Web 2.0-Enterprise 2.0, cloud computing

Tags: Trough, Gartner Inc., SOA, Service-Oriented Architecture (SOA), Web 2.0, Web Services, Middleware, Enterprise Software, Software, Internet

Gartner recently released its latest “hype cycle” diagram for 2009, which shows service-oriented architecture to be well past the “trough of disillusionment” and climbing the vaunted “slope of enlightenment.”

Cloud computing, however, is now at the pinnacle of hype (no surprise there, right?), and ready to plunge into the trough. Interestingly, Web 2.0 now seems to be emerging from the disillusionment trough.

Being on the slope of enlightenment is typically the stage where vendors, analysts, and pundits are no longer gushing about how wonderful and world-shattering the technology/methodology is. Nor are they ranting on about what a flop the thing is. Instead, it’s the roll-up-your-sleeves stage, when companies and their technology professionals are getting down and making the stuff actually work.

Next stop: The “plateau of productivity!”

Source: Gartner (August 2009)

August 10th, 2009

Federal government validates cloud computing

Posted by Joe McKendrick @ 7:29 pm

Categories: General

Tags: U.S. General Services Administration, Government, Cloud Computing, Virtualization, Hardware, Joe McKendrick

Last week, we surfaced the views of Michael Daconta, writing in Government Computer News, who cautioned government agencies from diving in too deep into new approaches to managing technology, such as cloud computing, SOA, and Agile development.

It looks like the folks over at the General Services Administration — the purchasing arm of the federal government — missed Daconta’s article. As reported by Dave Linthicum in his latest blog post, the GSA has issued a request for quotation for cloud storage, Web hosting, and virtual machine services. (Dave cites an InformationWeek article.)

As Dave observes, the GSA RFQ shows “that the U.S. government is clearly getting behind cloud computing and, thus, is looking to provide a mechanism for validating and procuring cloud computing services for government agencies.”

August 10th, 2009

SOA services: stop worrying about protocols, worry about the business

Posted by Joe McKendrick @ 6:00 am

Categories: Business ROI, Enterprise Architecture, General, Links, Standards Watch

Tags: Watson Co., SOA, Service, Service Modeling, Service-Oriented Architecture (SOA), Research & Development, Web Services, Middleware, Enterprise Software, Software

Richard Watson says there is too much hand wringing over service protocols and standards (REST, WS-*, etc.), and not enough thought given to why a service may be needed by the business in the first place. In a new post, he states that while “debates about whether to use REST or WS-* interface styles are seductive. But, these are the wrong questions to ask first.”

Instead, Watson urges the creation of services using a service model that will provide the business context to projects.

This is the essence of service oriented architecture, he says. “If context is not driving you to create the right services, then they are most likely not adding value to your applications architecture, they are making it worse.”

Build services that add value, he says. Forget about the protocol issues:

“Should I use WS-* or REST? Should a service provide access over HTTP, MOM, or XMPP? These are the wrong questions for architects to ask when first conceiving a service. By concentrating on how to build, we lose focus on what to build.”

Watson points out that when he talks about service modeling, he isn’t talking about things such as formalism, notation, and tools.

Service modeling is a smart idea for SOA environments because it encourages that services be mapped to business requirements, and not take on a life of their own as technology for technology’s sake.

August 7th, 2009

More SOA tools emerge in the cloud

Posted by Joe McKendrick @ 2:28 pm

Categories: General

Tags: Performance, SOA, Simple Object Access Protocol, Tool, Service-Oriented Architecture (SOA), SOAP, Web Services, Productivity, Middleware, Enterprise Software

It seemed just like yesterday that Dave Linthicum issued his challenge to the SOA industry: “Move to service-based pricing, I dare you!” (Actually it was a couple of weeks back, in one of his final posts at Real World SOA. Dave now makes his home ar a new InfoWorld site called “Cloud Computing.

Well, it seems cloud providers are taking more of an interest in the SOA market. I just came across an announcement from Monitis that they are now providing a cloud-based SOAP testing service. The company announced that the online SOAP testing tool “is the latest update for Monitis’ WebLoadTester testing suite, and is specifically intended for applications of Service Oriented Architecture. The suite offers SOAP load testing with simulated heavy traffic in real time, allowing Webmasters to determine how performance can be optimized.”

The vendor observes that “automated load testing usually requires a performance engineer to find the hardware to test, set up load agents on multiple computers, configure the load agents, run the tests, and compile the performance reports.” Their tool, they say, doesn’t require all this up-front work and expertise. Monitis pricing starts at $4.18 per test for use of the tool.

August 5th, 2009

SOA, cloud not good enough for government work?

Posted by Joe McKendrick @ 7:49 pm

Categories: Business ROI, General, Management, cloud computing

Tags: SOA, Service-Oriented Architecture (SOA), Government, Web Services, Middleware, Vertical Industries, Enterprise Software, Software, Joe McKendrick

There are plenty of examples of government agencies demanding service-oriented approaches to programs and projects, including the recent revelation that the Department of Defense and Veteran’s Administration plan to spend more than $1 billion to bring their systems together in an SOA way.

However, Michael Daconta, writing in Government Computer News, says that government agencies should think twice before diving into SOA, along with other new initiatives such as cloud and agile development.

He observes that while SOA is “absolutely the right approach” to new application development, “has not yet convincingly addressed older applications.” Cloud computing is even more suspect, and it’s too early to move in this direction, he points out. Adopting the “fad now, before standards are in place and security concerns are dealt with, is a complete waste of time,” he writes.

Agile development? Don’t even think about it for government work, he adds. “In my more than 20 years of software development experience, I have never met a government program manager who is available on a daily or even weekly basis to help design an application on the fly…. Please don’t build the next space shuttle that way.”

August 5th, 2009

Another sign that SOA and cloud keep drawing closer

Posted by Joe McKendrick @ 1:21 pm

Categories: General

Tags: Joe McKendrick

More signs that “SOA” and “cloud” are becoming more synonymous: The 2nd International SOA Symposium, to be held in Rotterdam, Netherlands this October also includes a co-located “International Cloud Symposium.”

As Thomas Erl, event organizer, explains it, the symposium’s theme of ‘The Future of Cloud Computing’ “highlights many of the modern technology innovations that are being developed in support of Cloud-based services and the ever-widening convergence between SOA and Cloud-based services.” Thomas also mentions that he and some colleagues will soon be starting on a new book titled “SOA and Cloud Computing.”

August 5th, 2009

Open-source XML-enabled application risk identified

Posted by Joe McKendrick @ 12:36 pm

Categories: General

Tags: Vulnerability, SOA, Service-Oriented Architecture (SOA), XML, Open Source, Security, Web Services, Enterprise Software, Software, Software/Web Development

Since XML is the foundation of all things SOA, any perceived security vulnerabilities need to be looked at very seriously.

At issue appear to be XML-enabled applications built in Python, the open source language. Network World’s Ellen Messmer surfaced an advisory, issued by Codenomicon, working in conjunction with the Computer Emergency Response Team in Finland (CERT-FI): “Vulnerabilities discovered in XML libraries from Sun, Apache Software Foundation, Python Software Foundation and the GNOME Project could result in successful denial-of-service attacks on applications built with them.”  Dave Chartier, CEO of Codenomicon, is quoted as saying “that application would be vulnerable and there are probably millions of these applications.”

“The vulnerabilities could be exploited by enticing a user to open a specifically-crafted XML file, or by submitting malicious requests to Web services that handle XML content, according to Codenomicon. Chartier says it should be anticipated that attackers will explore XML-related attacks, and he advises organizations to follow the suggested recommendations, such as patching.”

Codenomicon’s press release on the security patch can be found here at their Website.

SOA opens up many vulnerabilities, since code is being shared across organizational boundaries. At the same time, SOA provides for enterprise security services that can help remedy the spotty and uneven approaches seen across many environments. But the bottom line is corporate culture and security awareness at many level. It always helps to be vigilant.

Joe McKendrickJoe McKendrick is an author and consultant with deep knowledge and insights regarding trends and developments in the technology industry. See his full profile and disclosure of his industry affiliations.


Email Joe McKendrick

Subscribe to Service Oriented via Email alerts or RSS.

SponsoredWhite Papers, Webcasts, and Downloads

advertisement

Recent Entries

Most Popular Posts

advertisement

Archives

Favorite Links

ZDNet Blogs

White Papers, Webcasts, and Downloads

Enterprise Applications

  • Check out some of the easiest and most powerful ways to boost productivity while saving money on your application infrastructure. See ZDNet's comprehensive Enterprise Application resource center, now!
  • New Online Dashboard
  • Read about top issues IT decision-makers face every day, plus get cost effective solutions to real life IT problems. Oracle Topline