"As organizations of all sizes embrace SOA to achieve the frictionless exchange of information and respond to changes in business requirements with greater agility, the need for security solutions that can effectively protect these dynamic environments is growing," said Barbara Lanci, vice president of eTrust business development for CA. "Forum's proven integration with CA's eTrust solutions helps fulfill this market need with a complete SOA security framework that effectively helps to mitigate risk, reduce administrative costs, and speed time-to-market."

Unlike Web applications, SOAs rely on distributed transactions and composite business processes using Web services communications that increase exposure to information leaks, workflow violations and data theft. According to a Burton Group report titled, "Developing a Web Services Security Strategy," enterprises must look to implement a security infrastructure that can prove the identity of messages, interpret different forms of credentials (e.g. Kerberos, SAML, X.509 Certificates) as well as defend against XML-related threats.

"Forum Systems clearly sees the need to leverage existing SSO and identity management investments within SOA implementations," said Walid Negm, vice president of marketing for Forum Systems. "CA's eTrust TransactionMinder integration offers our joint customers mandatory features for enterprise-class Web services."

"Policy enforcement, governance, and Web services security are three core challenges companies must face when building secure SOA implementations," said Jason Bloomberg, senior analyst for market research firm ZapThink LLC. "Forum Systems is among the leaders in the SOA security space, and their partnerships with a wide range of companies, including Computer Associates, offer a compelling value proposition for enterprises and government agencies to build comprehensive SOA security solutions that leverage existing infrastructure."

Benefits of an enterprise-wide SOA security solution include:

• Life-cycle management with policy authoring, governance and execution across auditing, identity, credentialing, security, protocol translation and routing.

• Authenticate and authorize using Single Sign-On Cookies, HTTP Basic Authentication, SSL/TLS X.509 Certificates, Security Assertion Markup Language (SAML) and WS-Security 2004/2002 Tokens including propagation and mapping of identity information.

• Support for Web Services Security: SOAP Message Security 1.0 (WS-Security 2004) including Username Tokens, Binary Tokens (X.509 Certifications, Kerberos Tickets), SAML Assertions as well as Rights Expression Languages (REL) licenses.

• Guards against corrupted XML, Schema poisoning, illegitimate scripts in message payloads misuse of WSDL (Web Services Description Language) operations.

• Prevent the latest strains of viruses and worms from reaching applications via XML documents and Web services transactions.

• Automatically discover Web services as they are added to an enterprise's network, catalog the service and continuously monitor different Web services operations.