Web service security - Threats and Countermeasures - Part 1 : Message Protection – Integrity and Confidentiality

Threats

• Network eavesdropping leads to disclosure of confidential information
• An attacker manipulates a message in transit influencing the service’s behavior

Vulnerabilities

• Lack of end to end encryption when sending SOAP messages
• Lack of a digital signature to verify authenticity of a SOAP message

Countermeasures

• Message Protection Design Patterns:
  • Data Origin Authentication - See https://msdn.microsoft.com/practices/default.aspx?pull=/library/en-us/dnpag2/html/wss_ch2_intro.asp 
  • Data Confidentiality - See https://msdn.microsoft.com/practices/default.aspx?pull=/library/en-us/dnpag2/html/wss_ch2_intro.asp 
• Message Protection Composite Implementation Patterns
  • For Direct authentication, Kerberos and X.509 see https://msdn.microsoft.com/practices/default.aspx?pull=/library/en-us/dnpag2/html/wss_ch3_intro.asp 

You might also notice that the implementations for these patterns are grouped together so that we are demonstrating implementation not just of data confidentiality but also data origin authentication. This is intentional. An encrypted message can still be tampered with - so we recommend you implement both of these patterns at the same time...

Hope to post another entry on Monday...