RE: [wsdm] Security related events

Title: Message

Based on customer feedback, this seems like a good idea; 
I'll let other DataPower WSDM representative comment in more detail. 

 

\\ Eugene Kuznetsov, Chairman & CTO  : 

\\ DataPower Technology, 
Inc.        : Web Services security
\\ http://www.datapower.com          
: XML-aware networks  

 

  

  
  From: Jeff Bohren 
  [mailto:] 
Sent: Thursday, July 15, 2004 4:03 
  PM
To: 
Subject: [wsdm] Security 
  related events

  

  
I though I would 
  take this off-line so as not to waste time on the call. I see a lot value 
  in standardizing security related events as part of WSDM. The four events 
  that I would define are:

  
 

  
AuthN 
  Succeeded

  
AuthN 
  Failed

  
AuthZ 
  Succeeded

  
AuthZ 
  Failed

  
 

  
There are three 
  purposes for these events; general management, security monitoring, and 
  auditing. 

  
 

  
1) General 
  Management - in this case the AuthN and AuthZ Failed events are the important 
  ones. A increase in the number of these types of events could be an indicator 
  of problems in the system, such as clock synchronization issues, 
  authentication server problems, etc.

  
 

  
2) Security 
  Monitoring - again, the AuthN and AuthZ Failed events are the important ones. 
  A increase in the number of these types of events could be an indicator of an 
  attack on the resource in question.

  
 

  
3) Auditing - self 
  explanatory. There are, as Hal pointed out, QOS issues with this, but those 
  issues need to be addressed by WSN eventually anyway.

  
 

  
Obviously 
  different subscribers would want a different set of these events for different 
  reasons. 

  
 

  
For MOWS there are 
  some very specific use cases. For instance in the case of an AuthN failure, 
  the SOAP header could be included in the notification. Since WS-Security is 
  now an OASIS standard, it seems logic that WSDM should define a standard 
  WS-Security AuthN Succeeded and Failed events as part of the MOWS 
  specification.

  
 

  
I would be glad to 
  put together a proposal on exactly what would be defined in each of these 
  event types, but only if there is sufficient interest by the TC. Would 
  anybody be interested in seeing a proposal on this?

  
 

  
Jeff Bohren

  
Product Architect

  
OpenNetwork Technologies, 
  Inc

  
 

  

  
Try the 
  industry's only 100% .NET-enabled identity management software. 
  Download your free copy of Universal IdP Standard Edition today. Go to 
  www.opennetwork.com/eval.