One day, Snow White decided to deploy a Web service. Her IT dwarves immediately went to work and were pleasantly surprised to find how easy it was to create the Web service using modern development tools. To Snow White's development dwarves, it almost seemed like magic.

Since Snow White's cottage was a Java shop, they deployed the Web service in their J2EE application server, but they could have just as easily used .NET and it would have seemed just as magical - maybe even more so, given the wealth and power of the Wizard of Seattle.

Since Snow White had lived in a palace with a wicked witch, she was no stranger to corporate culture in general and risk aversion in particular. Snow White also had clear goals. She had wisely eschewed the use of magic mirrors, and tended to favor a few industry analysts along with a handful of software vendors who seemed both willing and able to partner with her for the long haul. She wanted to achieve a more flexible and agile IT infrastructure by gradually moving IT to a service-oriented architecture (SOA). Snow White understood that you can't build a robust SOA for your enterprise based on a foundation of unmanaged and unsecured Web services. She wisely instructed her IT dwarves to make sure that this first production Web service was manageable and secure before they implemented any other Web services.

Chapter One - The Stage Is Set
Security wasn't difficult to enable for their first Web service. Their application server provided a magical runtime environment that allowed developers to specify security declaratively within an XML file or using a pretty GUI. Her staff used this magic to make sure that their Web service, using WS-Security, would only work with client applications that supported XML Encryption and XML Signature. The identity of her customers was wisely required to be passed as a security token within the WS-Security element of the SOAP messages that she received. There was no need for federated identity management at this early stage since the cottage directory server had the IDs of all their customers firmly in hand, but they had a good plan to expand, as needed, toward a wider community of distributed identities in the future.

With their experience in building and securing a Web service behind them, Snow White's development dwarves next recommended the purchase of a Web services management product to monitor the availability of their Web services. As developers, they were particularly pleased that this product could manage a Web service without having to change a line of code. Also, the product could automatically discover and manage new Web services as needed. Automatic discovery was particularly important, since they were concerned about rogue Web services being deployed in the enterprise. Certain office productivity products had made this almost too easy, even for non-programmers. Of course, this Web services management product could also report on important service metrics and help make sure that the service was responsive and reliable.

Everything was tidy and in place, and Snow White felt safe, secure, and highly profitable in her little house in the woods. Everything seemed fine until one day the head IT dwarf (who used to be Sneezy before he found allergy medication) found his boss on the floor weeping. Six important customers had complained in the last hour about poor performance on the Web service. "How could this have happened?" demanded the tearful Snow White, "I thought you said that our Web services management software would warn us of potential problems!"

Chapter Two - What Went Wrong?
In truth, there were a number of IT management, development, and product evaluation issues that had contributed to Snow White's tears. One important issue was the ineffective and superficial integration between their existing enterprise management system and their new Web services management software. The operations staff was running the entire IT infrastructure (a multitude of hardware and software entities such as operating systems, application servers, messaging middleware, routers, networks, databases, networked storage, and so on) using an enterprise management solution from a different vendor than the one who had provided the Web services management software. This decision had unintended consequences.

Their Web services management software had correctly warned them that their Web service was performing poorly. So, from the perspective of the Web services developers, the Web services management software had performed admirably - reporting a wide variety of metrics that are typically of concern to the operations staff. It had even managed to send its messages to the enterprise management system console. But, the Web services management product used different terminology and had a different user interface than the enterprise management system. Despite some efforts to train some operations staff in the particulars of both management systems, in a crisis the staff was confused and frustrated. They found it difficult to work with two different management systems.

In terms of internal Web services expertise, Snow White had been forced to rely almost exclusively on the development organization since they had been the first to work with Web services. In retrospect, Snow White should have driven greater participation from her operations staff in the product evaluation - providing the training and consultative resources that they would need to better manage the issues from their perspective.

Web services management software is quite naturally focused on the higher-level specifics of Web services, such as messages and service descriptions (SOAP and WSDL). While such software can often identify a troublesome Web service even in complex aggregations of cooperating Web services, it quite properly lacks any root cause-analysis capability down to the IT infrastructure level. In other words, it isn't intended to trace the underlying cause of a problem down to a particular IT software or hardware entity, like a database or router. The underlying business logic and the supporting IT infrastructure are invisible to the Web services management software. So, in the case of Snow White's Web service performance problem, the operations staff had tried to correlate warning messages sent by the Web services management software with the large number of warning and error management messages related to underlying IT infrastructure and business logic reported by the enterprise management solution, but the lack of deep integration between the two management systems made such work tedious, time consuming, and error prone.

In retrospect, Snow White's strategy and evaluation team would have benefited from the understanding that management cannot be done piecemeal. As part of a comprehensive plan to properly manage new technology stacks such as Web services, on-demand computing, and Grid, the team should have considered the long-term interoperability, training, overhead, and partnership challenges that derived from the use of multiple management solutions. The IT dwarves had selected new Web services management software that was unlikely to enjoy a more useful level of integration with their enterprise software solution in the future. Were they prepared to deal with the added cost and complexity? Had they investigated Web services management products from their own enterprise management vendor? What was the current level of integration being offered by that vendor and, more importantly, what was the enterprise management software vendor's commitment to deeper, more useful levels of integration in future releases?

Of equal concern, the security officer had been absent from discussions concerning Web services management because of the common, but mistaken, notion that security and management are two entirely different concerns. These days, security management increasingly interacts with traditional areas of management such as systems and life-cycle management. The interoperability, visibility, and exposure provided by existing and emerging Web services standards are creating ever more interdependence between management and security. Consider the simple example of a denial-of-service attack on a Web service. Is this a Web services security issue (the enterprise is clearly under assault) or is this a Web services management issue (the service has experienced a change in utilization and SOAP message traffic)? The answer, ultimately, is both.

Many organizations are still in the early adopter phase of Web services use and might justifiably defer consideration of the inevitable convergence of security with other management concerns in the short term. However, Snow White's admirable commitment to an SOA and the deployment of her first production Web service clearly demonstrate that Snow White's strategy team should have had a long-term partnership and deployment plan in place that would allow them to steadily evolve their management and security operations toward a cohesive whole, as needed.

The absence of proper input by the security officer during the planning and evaluation phase also meant that enterprise-level security policy played a surprisingly small role in the decision by the development dwarves to utilize the Web services security functionality provided by the application server. While it is often true that platform-provided security can provide a relatively quick and inexpensive way to comply with enterprise Web services security and management concerns, this is not always the wisest course of action.

Tying security to the Web services platform can make it difficult to centrally administer and maintain policy in a heterogeneous enterprise. Even if the enterprise has standardized on one application server, there are often many other legacy processes and data sources that are not able to leverage the security and management capabilities provided by the Web services platform. In any heterogeneous SOA, integrated, enterprise-level Web services security and management solutions that are independent of the Web services platform may be the only way to ensure that all Web services, not just those deployed on the application server, are fully compliant with corporate policy and can be centrally monitored.

Conclusion
What conclusions can we draw from this IT management fable? Snow White's problem wasn't a poisoned apple (Snow White was not the kind of CxO to fall for that old trick!). It appears that even well-run IT organizations like Snow White's, with a clear vision of where they want to go, can be surprised by the complexity and challenges of managing and securing Web services as part of an SOA. The moral of the story is simple and of value to IT shops in enterprise cottages everywhere. To be useful in the long term, Web services management needs to be comprehensive and holistic - a carefully mixed potion of true Web services management genuinely integrated with IT infrastructure management. Also, in terms of implementing security for Web services, an important part of the total management equation, IT organizations would do well to look beyond the security needs of any particular Web service. Rather, they should begin to formulate a more comprehensive security and management policy and mechanisms that extend beyond any one Web services-enabled platform to serve the enterprise and the SOA as a whole. With these lessons learned, Snow White and her IT dwarves should live happily ever after.