Gotcha! Implementing Security Layers - Applied SOA Patterns on the Oracle Platform - page 429

Tip
Without a doubt, the human factor is crucial in any security system; however, discussing
this is beyond the scope of this topic. Nevertheless, you have to contemplate the fact that
about 90 percent of all information leakages are carried out or initiated internally. Yes,
sometimes unintentionally, but even good intentions (or the absence of bad ones) provide
sufficient basis for anecdotic stories about lost or forgotten notebooks or CDs by agents of
one kingdom with allegedly the most proficient secret service in the world. As a result of
this contemplation, a clear understanding must be firmly implanted in your mind; in SOA
environments, starting from moderate complexity and higher, with more than two service
domains and the presence of intermediary, the reliance on TLS/SSL alone is no better than
publishing your connection strings with a username/password on your corporate front
page.
In this chapter, we will start with an analysis of the situation in order to formalize essen-
tial solutions patterns capable of reducing security risks.