Building a central reservation system based on cutting-edge Service-Oriented
Architecture technology has meant a decisive overhaul in underlying IT security
at hotel group Starwood Hotels & Resorts International.

Patrick Foley, director of global technology compliance at Starwood, whose
hotel chains include St. Regis, Sheraton and Westin, this week described how
the move to XML-enabled SOA for a new central reservation system has impacted
the underlying corporate security in sometimes unexpected ways. SOA, in defining
systems as flexible services, has meant existing perimeter security is no longer
as effective, encryption is more difficult, and logging requirements are intensified
for audit and regulatory compliance. Foley, who spoke about Starwood's shift
to SOA at the Infosec World Conference in Orlando, provided insight on security
consequences of SOA.

"Service-oriented architecture defines systems as a series of services,"
said Foley. "It's the ability to link services together in a way that they
can be used in many different processes, including credit-card authorization.
The good thing is, you can go global, no longer limited by your data center
or network."

However, the transformation must also be on the security level, Foley emphasized,
acknowledging that Starwood's first SOA project, launched a few years back by
an enthusiastic IT department eager to use the latest software development techniques,
suffered a few setbacks that slowed it down.

The chief problem early on was failing to understand how necessary it was to
bring in a security architect to advise developers on how to build SOA according
to security standards, such as those promulgated by OASIS and the W3C.

"You will need a security architect," advised Foley, noting that
Starwood ended up turning to a data architect to be the security architect for
the SOA-based central reservation system. Some of the security impact that Starwood
has seen in the evolution of the new reservation system, now undergoing beta
testing, is that SOA engenders far more logging and auditing, which must be
done for regulatory compliance.

As a consequence, Starwood acquired a security information management system
-- this one being the RSA envision product from EMC -- to handle the logging
needed to satisfy regulatory compliance, including the Payment Card Industry
guidelines. "With Web services, your logs are everywhere the services are,"
Foley noted, adding this logging adds to corporate network traffic.

Another challenge associated with SOA's Web services is determining how to
encrypt and otherwise secure data traffic when it's not as centralized.

"The initial reaction was, 'Let's just encrypt everything,'" Foley
said. But it quickly became apparent that encrypting all traffic put a huge
load on the corporate infrastructure and also brought in issues of key management.

Adjustments had to be made to selectively encrypt the more sensitive data.
Another hurdle was finding new approaches to security because with Web services,
"the perimeter controls are less effective than with only an internally
managed system," Foley said. He added that although a lot of the key data
will still be stored behind a firewall, some will not. Hardening servers, and
making sure hosting providers adhere to security guidelines as well, becomes
more important than ever.

Intrusion-detection/prevention systems take on greater importance with SOA,
Foley said, "because you may have to leave your firewall more open."
One adjustment has been to segment off the network more internally to create
more trusted areas that are harder to access.

All of these security questions that arise with Web services should be tackled
before gung-ho software developers go about building critical SOA-based systems,
Foley cautioned.

"Developers aren't going to stop developing while you're busy trying to
determine how to encrypt someone's credit card," he pointed out. Appointing
a security architect as chief guide on an SOA project is one of the best ways
to "save your organization from going over the edge," Foley concluded.

» posted by abennett

Network World

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine