using owsm assertions and policies

Using OWSM Assertions and Policies

November 14th, 2012

14:55-15:40

Room VT445-32

Harold Dost III Senior Consultant

Raastech, Inc.

of 31 © Raastech, Inc. 2012 | All rights reserved.

1. Introduction

2. Why secure your services?

3. Where does OWSM fit?

4. Demo

5. Summary

Agenda


INTRODUCTION


Harold Dost III

5+ years of Oracle middleware experience

Experience in large implementations involving SOA

Suite, BAM, AIA, OSB, OSR, ODI, OWSM, OER, OEG,

and more

OCE (SOA Foundation Practitioner)

About Me


WHY SECURE YOUR SERVICES?


There is a broad list of security aspects to consider:

Authentication (AuthN for short)

Authorization (AuthZ for short)

Spoofing

Tampering

Repudiation

Information Disclosure

Denial of Service

Replay attacks

Virus attacks and Intrusion Detection

Why secure your services?


Protect you against mischievous and dangerous attackers

Protect your customer’s data

Save money

For example, healthcare data security breaches cost:

http://www.hipaasecurenow.com/index.php/a-look-at-the-cost-of-healthcare-breaches/


# of records Cost

1 $ 240

100 $ 24,000

10,000 $ 2,400,000


Zappos

24 million customers

Address Information

Credit Card Information

http://www.darkreading.com/security/news/232500003/zappos-dealing-with-data-breach.html



UNC Charlotte

350k students and employees

Social Security Numbers

http://www.darkreading.com/insider-threat/167801100/security/news/240000307/unc-charlotte-breach-affected-more-than-350-000.html



WHERE DOES OWSM FIT?


Randomized Passwords

Scheduled Expiration

Encryption of sensitive data

Over the wire

On storage media

Authorization

Authentication

Layered Security Approach

http://marccortez.com/2012/09/27/beating-my-dead-horse-with-a-double-edged-sword/


“Oracle Web Services Manager offers a comprehensive

and easy-to-use solution for policy management and

security of service infrastructure.”

“It provides visibility and control of the policies through a

centralized administration interface offered by Oracle

Enterprise Manager.”

OWSM is a component of SOA Suite

Add-on

OSB

SOA Suite

What is OWSM?


Where does OWSM fit?

http://docs.oracle.com/cd/E17904_01/doc.1111/e15866/owsm.htm


Oracle SOA Security Strategy


HOW TO USE OWSM?


Filler

OWSM


IS IT RIGHT FOR YOUR COMPANY?


Yes

Is it for your company?


Yes

If you’re already using OSB or SOA Suite, it’s built-in

No extra cost

Is it for your company?


SUMMARY


OWSM provides a method to add both transport and

message level protections to Web Services.

Should be used as part of a layered security approach.

Summary


Contact Information

Harold Dost III

Senior Consultant

[email protected]

using owsm assertions and policies

Technology