XML Security Learning Guide

TABLE OF CONTENTS

   XML Security Key Terms and Definitions
   Introduction to XML Security
   OASIS
   WS-Security
   SAML
   XML Signatures & Encryption
   XML Firewalls
   More Security Learning Resources
   Free Security IT Downloads

XML Security Key Terms and Definitions

Return to Table of Contents

• Security Assertion Markup Language (SAML) (SearchSecurity.com Glossary)
• Authentication (SearchSecurity.com Glossary)
• Authorization (SearchSecurity.com Glossary)
• Digital signature (SearchSecurity.com Glossary)
• SOAP (Simple Object Access Protocol)(SearchWebservices.com Glossary)
• Algorithm (SearchSecurity.com Glossary)
• Extensible Access Control Markup Language (XACML) (SearchSecurity.com Glossary)
• Organization for the Advancement of Structured Information Standards (OASIS) (SearchWebservices.com Glossary)
• Encryption (SearchSecurity.com Glossary)
• WS-Security (SearchWebservices.com Glossary)
• Firewall (SearchSecurity.com Glossary)
• Single signon (SearchSecurity.com Glossary)
• Public key infrastructure (PKI) (SearchSecurity.com Glossary)

Introduction to XML Security

Return to Table of Contents

• Article: XML complexity introduces security risks (SearchSecurity.com)
• Article: Web services require new approach to security (SearchSecurity.com)
• Article: Sorting out the Web services security landscape (SearchSecurity.com)
• Conference presentation: How to Overcome Web Services Security Obstacles (Information Security Decisions 2005)
• Quiz: Infosec Know IT All Trivia: Securing Web services (SearchSecurity.com)
• Advice: Confused about differences in Web services security technology (SearchSecurity.com)
• Webcast: Web Services Security School, Lesson 1: Why Web services need security and trust (SearchWebServices.com)

OASIS

Return to Table of Contents

• Article: Web services security specs hit the standards track (SearchWebServices.com)
• Article: OASIS advances security standards (SearchSecurity.com)
• Article: OASIS ratifies core security spec (SearchSecurity.com)
• Article: Latest Web services spec tackles application flaws (SearchSecurity.com)
• Advice: National standards, security bodies release security checklists spec (SearchWebServices.com)
• Advice: How will the battle between W3C and OASIS affect Web service security standards? (SearchSecurity.com)
• Article: Study shows companies still lukewarm (for now) on Web services (SearchSecurity.com)

WS-Security

Return to Table of Contents

• Fast facts: WS-Security (SearchWebServices.com)
• Q&A: Standards expert: WS-Security changing Web services landscape (SearchSecurity.com)
• Article: WS-Security celebrates anniversary as a standard (SearchSecurity.com)
• Article: Implementing WS-Security (SearchWebServices.com)
• Advice: What security concerns does WS-Security address? (SearchSecurity.com)
• Advice: Are there other projects for Web services security in the works beside WS-Security? (SearchSecurity.com)
• Advice: How will WS-Security impact Web services deployments? (SearchWebServices.com)
• Advice: A few questions regarding XML security (SearchWebServices.com)

SAML	Return to Table of Contents

• Article: RSA 2006: Hunger grows for federated ID (SearchSecurity.com)
• Article: Eight vendors pass SAML 2.0 sniff test (SearchSecurity.com)
• Article: Liberty Alliance begins SAML 2.0 testing in July (SearchSecurity.com)
• Article: Young SAML must conquer business pressures (SearchSecurity.com)
• Article: SAML 2.0 unifies support for federation (SearchWebServices.com)
• Article: SAML ratification enables vendor interoperability (SearchSecurity.com)
• Article: Federal agency demonstrates SAML interoperability (SearchWebServices.com)
• Advice: Limiting the risk and liability of federated identities (SearchSecurity.com)
• Advice: How SAML works (SearchWebServices.com)
• Advice: Are SAML and WS-Security competitive specifications for Web services security? (SearchSecurity.com)
• Webcast: Leveraging the power of SAML (SearchSecurity.com)
• Webcast: Web Services Security School, Lesson 4: SAML (SearchWebServices.com)

XML Signatures & Encryption

Return to Table of Contents

• Article: Securing Web services requires out-of-box thinking (SearchSecurity.com)
• Article: Web services pose identity management challenges (SearchWebServices.com)
• Q&A: The pros and cons of securing Web services with SSL (SearchSecurity)
• Article: Report recommends standalone XML security appliances (SearchWebServices.com)
• How-to guide: Supporting digital signatures within SOAP messages (SearchWebServices.com)
• Advice: Determining from WSDL if a Web service supports XML signature (SearchSecurity.com)
• Advice: Confused about differences in Web services security technology (SearchSecurity.com)
• Advice: Support for XML signature/encryption (SearchWebServices.com)
• Advice: What implementation(s) of XML encryption and XML signature would you recommend? (SearchWebServices.com)
• Webcast: Web Services Security School, Lesson 3: XML Signature and XML Encryption for Web services (SearchWebServices.com)

XML Firewalls

Return to Table of Contents

• Article: Web application firewalls create breathing room (SearchSecurity.com)
• Article: Rockwell Collins taps XML security appliance for services foundation (SearchWebServices.com)
• Article: XML viruses threaten Web services security (SearchSecurity.com)
• Article: XML firewalls dig deeper than traditional firewalls (SearchSecurity.com)
• Article: Web application, XML firewalls converge in one appliance (SearchWebServices.com)
• Article: Web services security vendors focus on access control, XML firewalls (SearchSecurity.com)
• Article: New XML firewall keeps watch on Web services (SearchWebServices.com)
• Article: Various flavors of firewalls are evolving (SearchSecurity.com)
• Article: XML firewall integrates crypto hardware (SearchSecurity.com)
• Article: Westbridge exec: When XML is a factor, standard firewalls don't cut it (SearchSecurity.com)
• Advice: XML-based attacks and how to guard against them (SearchSecurity.com)
• Advice: Securing Web services: A job for the XML firewall (SearchSecurity.com)
• Featured Topic: XML firewalls (SearchWebServices.com)

More Security Learning Resources

	SECURITY SCHOOL		LEARNING GUIDES		CHECKLISTS		GLOSSARY		ASK THE EXPERTS

BROWSE BY TAG Application and Platform Security,   Web Security Tools and Best Practices,   Web Services Security and SOA Security,   PKI and Digital Certificates,   Enterprise Identity and Access Management,   User Authentication Services,   Enterprise Single Sign-On (SSO),   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Web Services Security and SOA Security Information security book excerpts and reviews Security testing firm uncovers XML vulnerabilities Cryptographers say cloud computing can be secured Will cloud computing and virtualization save the day? MySpace, Facebook ignoring basic principles of security Kaminsky: DNS flaw capable of attacks on many fronts Kaminsky on DNS rebinding attacks, hacking techniques Which operating system can best secure an FTP site? IBM's Watchfire halts network research, focuses on Web apps How does identity propagation work? PKI and Digital Certificates How to encrypt passwords using network security certificates Best Authentication Products DoD urges less network anonymity, more PKI use Researchers to demonstrate new EV SSL man-in-the-middle hacks Portable security storage device could replace OTP devices What is most misunderstood about EV SSL certificates? VeriSign addresses MD5 flaw Rogue digital certificates strike blow to Internet security Can any firm or organization get a digital signature certificate? How to obtain a digital certificate for a server PKI and Digital Certificates Research Enterprise Single Sign-On (SSO) How to use single sign-on (SSO) for a server configuration How to log in to multiple servers with federated single sign-on (SSO) Security on a budget: How to make the most of authentication tools Best Identity and Access Management Products Changing times for identity management Kerberos configuration as an authentication system for single sign-on How to use single sign-on for Web access control to prevent malware Learn about enterprise strategy for server virtualization single sign-on Enterprise single sign-on: Easing the authentication process Exploring authentication methods: How to develop secure systems Enterprise Single Sign-On (SSO) Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary authentication server  (SearchSecurity.com) Certificate Revocation List  (SearchSecurity.com) Digital Signature Standard  (SearchSecurity.com) HDCP  (SearchSecurity.com) MD2  (SearchSecurity.com) MD4  (SearchSecurity.com) MD5  (SearchSecurity.com) nonrepudiation  (SearchSecurity.com) PKI  (SearchSecurity.com) public key  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary