An XML firewall has to go beyond inspecting the packet or protocol level to examining the actual content of the transmission, said Ron Schmelzer, a senior analyst and founder of Waltham, Mass.-based ZapThink, a firm specializing in Web services and XML. “This is much more complicated as messages have to be decrypted or uncompressed without adding latency,” he said.

For example, a SOAP message needs to be examined to make sure it’s an authorized request, said Jason Bloomberg, another senior analyst with ZapThink, a firm that specializes in security. Examining the message is even more complicated if part or the entire message is encrypted, he said.

Read more at: SearchWebServices