Reducing the Complexity of Application Security

As business-to-business interactions over the Web become more pervasive, so too does the complexity associated with securing those transactions.

Unfortunately, all that complexity serves only to dissuade businesses from integrating business processes across the Web at a time when we want to encourage that behavior. So the challenge facing chief technologists is to find a way to make it simpler to integrate business processes without having to introduce complex layers of security.

Forum Systems CEO Mamoon Yunus thinks his company has the answer in the form of an identity broker appliance that sits at the edge of the corporate network. Instead of trying to layer security software into every application, Yunus is arguing that all the security related to XML schemas associated with service oriented architecture (SOA) applications should be handled via an appliance.

The appliance in question traces its lineage back to an XML security appliance that Forum developed before being acquired by Crosscheck Networks. Today Forum operates as a subsidiary of Crosscheck that markets an identity broker appliance that is based on tokens assigned to each application. According to Yunus, this means each application can keep whatever security system it has in place. All that needs to happen is that each application linked to the Forum appliance needs to be assigned a token that is verified by the Forum appliance each time a transaction is made.

There’s an adage that says complexity and integration are the enemy of security. And yet, it’s pretty clear that in order for the economy to thrive, we need more integration. So at the very least, that means we should be focusing more on taking as much complexity out of the equation as possible.