Y.: Best-Practice Patterns and Tool Support for Configuring Secure Web

This paper presents an emerging tool for security configuration of service-oriented architectures with Web Services. Security is a major concern when implement-ing mission-critical business transactions and such con-cern motivated the development of Web Services Secu-rity (WS-Security). However, the existing tools for con-figuring the security properties of Web Services give a technology-oriented view, and only assist in choosing the data to encrypt and selecting an encryption algo-rithm. The users must construct their own mental mod-els of how the security configurations actually relate to business policies. In contrast, the tool described here gives a simpli-fied, business-policy-oriented view. It models the mes-saging with customers and business partners, lists vari-ous threats, and presents best-practice security patterns against the threats. A user can select among variations on the basic patterns according to the business policies, and then apply them to the messaging model through the GUI. The result of the pattern application is describe