RSA: CA’s ‘Project SOA’ tackles Web services security

With companies now beginning to bring Web services online, customers are looking for tools that can help them thwart potential attacks and also ensure that the Web services are used by only authorized users and applications, said Jason Bloomberg a senior analyst with ZapThink LLC, based in Baltimore.

“The Unicenter WSDM product is a reasonably mature product for Web services management, and Transaction Minder was gaining some traction in the Web services security space at the time that CA acquired Netegrity,” Bloomberg said. “These are the two leading SOA products that CA offers, so it makes sense for them to be together.”

Read more at: ComputerWorld

HP & Sun Check ID

Jason Bloomberg, senior analyst at ZapThink LLC thinks that Sun’s decision to open source its identity management technologies could have a knock-on effect across the industry. “It will benefit users by bringing prices down overall in the identity management software market,” he says. “The more open source solutions there are out there, the less value there is to buying a proprietary solution.”

Bloomberg believes this announcement helps HP move towards Service Oriented Architectures (SOAs), which let users run services in the form of application software across different computing environments. “They are sort of cleaning up a lot of the old OpenView and moving towards a services oriented model,” he says.

With SOA technologies gaining momentum at the moment, Bloomberg feels that identity management is becoming even more important (see System Vendors Sight SOA). “You need identity management so that a request can be properly authorized and authenticated within a Service Oriented Architecture,” he says.

However, the big test for HP will be maneuvering the firm, which has recently undergone massive restructuring, to tackle SOA, according to Bloomberg. “For HP the challenge is turning their entire enterprise ship towards SOA,” he says.

Read more at: Next-Gen Data Center Forum

Big Blue Dips Into Federated ID

ZapThink analyst Jason Bloomberg said FIM differs from competing products because it covers the gamut of federated ID needs: identity and access management; single sign-on or federated user provisioning; and Web services security management.

“There are few other products on the market that can lay the claim of being so complete,” Bloomberg said. CA is currently integrating their eTrust and Netegrity product lines, and the resulting suite will give IBM a run for its money.”

“That being said, FIM is a substantial upgrade from Tivoli Access Manager, and brings the Tivoli product line squarely into IBM’s SOA product roadmap.”

Read more at: InternetNews

IBM to launch new security software

“It’s still an open question how CA will put all its pieces together” now that it has acquired Netegrity, said Jason Bloomberg, a senior analyst with ZapThink. “It’s still a horse race.”

Read more at: CNet

BMC Grabs ID Management Vendor

ZapThink analyst Jason Bloomberg said ID management is a necessary ingredient for a company’s enterprise architecture, making acquisitions a no-brainer. To date, he said the CA/Netegrity deal makes CA the market leader, with BMC playing catch up.

“We expect the gulf between these two to widen, as CA/Netegrity understands the power of service-oriented architecture (SOA) as the dominant form of enterprise architecture moving forward (as does IBM, for that matter), while SOA has largely been off the roadmap for BMC,” Bloomberg said.

Read more at: InternetNews

Netegrity updates provisioning tools

Industry watchers have labeled the Web services provisioning-tools business as one of the elements of Netegrity from which CA might benefit, if the companies’ pending merger is approved. Ron Schmelzer, an analyst at research company ZapThink, said the market for provisioning tools will continue to expand, as businesses look to build portals and Web services applications to access enterprise software systems.

Read more at: CNet

CA to buy Netegrity for US$430 million

Industry watchers appeared bullish on the acquisition. Ron Schmelzer, an analyst at research company ZapThink, said both companies should benefit through the merger because they have complimentary products and Netegrity has established a solid presence in the network access and identification space.

“Many people were wondering when CA would look to add access and identification tools, and (Netegrity’s) SiteMinder is considered one of the better products out there, so it’s a good fit,” Schmelzer said. “CA is doing a good job building out its product strategy for both management and security.”

Schmelzer believes the market for provisioning tools will continue to expand as businesses look to build portals and Web services applications for accessing various enterprise software systems.

“When you have applications existing in silos, such as CRM systems or databases, the password systems included with these products may work well enough,” he said. “But as you begin looking at building portals to multiple enterprise applications, or using Web services to access pieces of those systems, enterprise identification management becomes even more critical.”

Read more at: CNet

CA Agrees To Acquire Netegrity

Ronald Schmelzer, analyst for researcher ZapThink LLC, said the acquisition would give CA a stronger position in the identity management space were Netegrity has “considerable visibility with customers, software vendors and professional services firms.”

“The acquisition further bolster’s CA’s eTrust products, and makes them instantly viable in the security part of the web services and (service-oriented architecture) space, where eTrust hasn’t yet built up its reputation,” Schmelzer said.

Read more at: TechWeb

Web services pose identity management challenges

“The better idea is that you’re really supposed to separate the notion of identity of who you are from the specific system,” said Schmelzer. “You should have an identity that is separate from the portal and the ERP system and the CRM system. But somehow [those applications] have to respect that identity.”

“There is this whole area of enterprise identity management that is really burgeoning because of this context issue,” Schmelzer added.

The key to separating the notion of identity from specific systems is implementing an architecture that supports policy-driven identity management, explained Jason Bloomberg, also a senior analyst with ZapThink.

“You need to have an enterprise-wide sense of who the users are and what they’re entitled to do that cuts across different applications,” Bloomberg said. “And it has to be a way that maintains the policies that apply to those users.”

Read more at: SearchWebServices

Datapower XS40 XML Security Gateway: Comprehensive XML & Web Services Security on a Hardened Network Device

XML appliances have recently emerged as a category of network device that can address XML and Web Services security and performance issues that traditional network appliances cannot. To properly secure XML traffic, a device must operate on the content of the messages that pass through the network, and take appropriate action on parts of each message.

Clearly, such content-based operations are resource intensive, which is the primary reason for solving such problems on dedicated hardware devices like the DataPower XS40 XML Gateway. DataPower’s XS40 appliance can handle a wide range of XML security, performance, transformation, and routing, functionality, all at wirespeed, in a security hardened appliance that requires little skill to install and administer.