Home
Topics
Application and Platform Security
Web Security Tools and Best Practices
Web Services Security and SOA Security
Answer page: Web services threats quiz

SearchSecurity Retention

Answer page: Web services threats quiz

1. Answer: a. XSL
They are built using a collection of protocols and standards such as XML, XML Schema, WSDL (Web Services Description Language) and SOAP (Simple Object Access Protocol), many of which are still evolving, and as with most new technologies, security issues are often overlooked in the early stages of adoption.

To learn how Web services operate, read Why Web services threats require application-level protection.

2. Answer: False
Web services face a lot of the same vulnerabilities that Web applications do, such as SQL injection and session theft, but unlike traditional Web page interfaces, Web service programs are far more open, often connecting to core enterprise applications and data.

To learn how to protect against Web services vulnerabilities, read Why Web services threats require application-level protection.

3. Answer: b. Content-borne threats
Additionally, your developers should also be educated on the additional XML-related attack vectors that Web services are vulnerable to, mainly:

XML identity threats, updated versions of the traditional identity threats, such as authentication attacks and eavesdropping.

Content-borne threats that use actual XML payloads to distribute XML viruses, SQL statements, Unix commands, etc.; and

Operational attacks, including XML-level denial-of-service attacks and XML bombs.

To learn how to protect against Web services threats, read Why Web services threats require application-level protection.

4. Answer: d. WS-Security
Web services specifications like Web Service Security (WS-Security), which addresses enhancements made to SOAP messaging to protect the message integrity, message confidentiality and message authentication.

To learn more about Web services security specifications, read Why Web services threats require application-level protection.

5. Answer: d. All of the above
Keep abreast of the other new standards like XML-Encryption, XML-Schema and XML-Digital Signature that aim to secure Web services traffic. Incorporate these standards into your security policy where appropriate.

To learn more about Web services security and how to mitigate Web services threats, read Why Web services threats require application-level protection.

More News and Tutorials

Articles
Sponsored Articles
- Steps to Faster and More Accurate Threat Detection
- Improving Security With a Multilayered Defense
- NetApp Brings Private Storage to Amazon Web Services
- How Do You Measure and Report Storage Efficiency?
- Put Your Snapshot Copies to Work with SnapVault Backup Software

Related glossary terms

Terms for Whatis.com - the technology online dictionary
- network drive

This was first published in October 2006

More from Related TechTarget Sites

Cloud Security
Consumerization
Financial Security
SMB Security
Security AU
Security IN
Computer Weekly

Cloud Security
- Storing data in the cloud: Addressing data location security issues
  
  When storing data in the cloud, ignoring the physical location of cloud data is a major mistake. Learn how to prevent data location security issues.
- An introduction to enterprise hybrid cloud security
  
  A custom cloud infrastructure requires a special set of security controls. Get advice on how to implement hybrid cloud security the right way.
- SOC 2 reports: The de facto cloud provider security standard
  
  They're not perfect, but SOC 2 reports are becoming the baseline for cloud provider security assessments. Expert Dave Shackleford discusses.
Consumerization
- Network connectivity, security issues hinder mobile strategies
  
  Enterprises are limited in implementing mobile strategies due to security issues, network connectivity and compatibility.
- Upcoming iOS 7 mobile management features affect MDM tools
  
  New mobile management capabilities coming in Apple iOS 7 have some enterprise mobility management vendors, including VMware changing their approach.
- What do you know about dual-persona technology?
  
  Dual persona is fairly new, so you may not be familiar with it yet. Take our quiz to see how much you know -- and learn more -- about the technology.
searchFinancialSecurity
- PayPal CISO: Laws must foster better cybersecurity information sharing
  
  PayPal's Michael Barrett says many firms fear misuse of shared cybersecurity data. He also discusses the evolution of PCI DSS and mobile payment security.
- Cybergang plans to use Trojan against U.S. banks
  
  A cybergang in Eastern Europe revealed plans to attack U.S. banks with a Gozi-like Trojan, according to RSA.
- Improved Shylock Trojan targets banking users
  
  The latest variant of the banking Trojan is causing numerous problems, Symantec said.
searchMidmarketSecurity
- Windows Phone 7 security: Assessing WP7 security features
  
  Windows Phone 7 security features are proving to be a mixed bag. Sam Cattle assesses the enterprise security pros and cons of the latest Windows mobile platform.
- Choosing the best security certifications for your career
  
  Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.
- A step-by-step SMB IT security risk assessment process
  
  Assessing your organization's security threats and risks takes just five steps, says Robbie Higgins. Check out his quick guide to the SMB security risk assessment process.
searchSecurityAU
- Black Hat 2013: Experts urge elliptical curve cryptography adoption
  
  A session by a team of crypto experts at Black Hat USA 2013 argued that RSA and Diffie-Hellman should be abandoned in favor of ECC.
- New advanced persistent threat protection: Beyond perimeter defense
  
  Firewalls and antivirus are ineffective in the face of APT attacks. Expert Nick Lewis offers suggestions for advanced persistent threat protection.
- Cisco spends cool $2.7 billion in Sourcefire acquisition
  
  In biggest security acquisition since 2011, Cisco has announced it will buy IDS maker Sourcefire for $2.7 billion.
Information Security
- Indian banks step up security amid mobile banking acceleration
  
  The Indian banking system is at the begining of a new era, driven by mobile technology, but the widening of access to banking services brings with it security risks
- Web app attacks demand automated defences, study finds
  
  Automation is the most effective way to tackle multiple prolonged cyber attacks on web applications, a study has confirmed
- BlackBerry ready to enable India to track messages
  
  BlackBerry is ready to provide Indian law enforcement authorities with a way to track emails, email attachments and chats sent over its services
Computer Weekly
- NHS Central Midlands CSU updates datacentre with standardised data warehousing
  
  It improved the quality and safety levels of healthcare for over 5 million citizens across the West Midlands by standardising data warehousing
- BlackBerry looks for a buyer to focus on BES and BB10
  
  The board of directors at BlackBerry are considering the sale of the troubled smartphone company, in a bid to focus on BlackBerry 10
- ICO to investigate London bins that track smartphones
  
  Information Commissioner's Office is making enquiries into bins in London that track passing smartphones to target advertising to owners

All Rights Reserved,Copyright 2000 - 2013, TechTarget