Financial firm finds highly scaled testing for proliferating SOA services

Jack Vaughn, Editor-in-Chief of SearchSOA published this article on real life scenarios in SOA Testing and general SOA adoptions trends.  Article highlights are as follows:

• a well built re-usable service will have high demand and a high number of transactions and consumers
• through automated SOA Testing products such as SOAPSonar, 100% scenario coverage is possible
• endurance and performance testing are also a core part of SOA Testing.
• Service traffic includes traffic from RESTful services and has resulted in portals driving overall JSON, XML and SOAP message structures.  It's not just about A2A communication driving this traffic anymore.

Detailed article:  Financial firm finds highly scaled testing for proliferating SOA services

Using SQL Azure for SOA Quality Testing

SQL Azure provides affordable and rapid collaboration across SOA Test teams using SOAPSonar, the industry leading, comprehensive SOA and Cloud Testing product. This article provides an overview of using a shared repository: SQL Azure for collaborative SOA testing across dispersed SOA Test teams.

SQL Azure is a promising option for corporations that deploy Micrsoft technology and are interested in leveraging cloud computing to reduce IT costs and respond rapidly to business requirements. For companies that are simply looking for hosted relational databases, other options such as MySQL hosted by Amazon EC2, Rackspace, GoGrid or OpSource serve as strong alternatives.

Our impressions of SQL Azure have been positive. Through firewall rules, security provisions are adequete and not overwhelming for database and application developers. We do expect a richer web-based management interface in the future that goes beyond just creating an dropping databases. Although SQL Management Studio, installed locally on your machine, provides powerful management capabilities, it dilutes the power of installation-free, cloud-based components.

Corporations can use Quality Assurance and Testing as low-hanging use-cases for cloud computing. Companies should be less concerned about storing test data in external clouds compared to, for example, real customer data. Using SQL Azure for SOA test automation provides better collaboration for test teams, ease of database management and a cheaper alternative to procuring and maintaining on-premise test infrastructure.

For complete article, see:  http://soa.sys-con.com/node/1379631 

SOA-Cloud Testing: CloudPort simulates data-center to cloud migrations

In the absence of quantifiable data, enterprises are challenged to make well-informed choices when it comes to migrating to the cloud.  Instead, they often find themselves forced to make these strategic decisions based on ad-hoc or partial information.  This is a risky and unproductive approach, especially when typical migration process requires moving numerous components -- including databases, application servers, ESBs, identity stores, and BEPL orchestration engines -- to the cloud.  Once a full reference system is deployed, the behavior of the enterprise applications interacting with the cloud-based components must be tested -- using customized production code.  This is an expensive, time-consuming and potentially error-prone proposition.

With CloudPort, enterprises benefit by never having to touch production code -- while eliminating the substantial time, capital and IT staff resource expenses related to building a distinct cloud test environment.

For further information, see SD Times article:
http://www.sdtimes.com/link/34249

For details on CloudPort, see:
http://www.crosschecknet.com/products/cloudport.php

Tale of Two XML Gateways

Here's an interesting article on XML Gateways, their use in SOA deployments, and a comparison between hardware, software and cloud-based form factors.  SOA Tester have to be cognizant of identity, encryption, and signature artifacts that are consumed and generated by XML Gateways so as to build proper test cases for comprehensive end-to-end SOA testing.

Tale of Two XML Gateways
— These days XML Gateways are a core infrastructure component of any enterprise SOA deployment. XML Gateways provide the ability to integrate services securely with granular access control, data-level encryption, integrity through signatures and XML threat mitigation. XML Gateways can be deployed as a hardware appliance or as a software gateway. Both these form factors have their advantages and disadvantages. This article provides readers a quick synopsis of the advantages and disadvantages of each form factor.

XML Threat and Trust Modeling and Testing

Understanding XML Threat and Trust models enables SOA testing and QA professionals to build robust test suites that verify functional, performance, interoperability and security profiles of Web services.  SOA testing has to cover a XML identity tokens, XML signature generation and verification, and XML encryption-decryption to establish trust.  The test suites have to ensure that trust-based artifacts are scalable and interoperable.  In addition to testing such trust-based artifacts, SOA testers have to ensure that the web services have threat mitigation in place against threats such as SQL Injection, Denial of Service attacks and Malware threats over SOAP and XML traffic.

Here is an article published on XML Threat and Trust Models:

XML Security Trust and Threat Models for Dummies
— It is very rare today to find a business application that has not exposed its interface via SOAP/XML. XML is the building block that enables business or consumer applications to exchange data in a standard structured format. The exchange of XML data typically takes place through an SOAP/XML interface based on the Web Services standard or through the REST-based standard. These flexible standards that richly describe interface functions of an application also introduce a host of XML and Web Services security vulnerabilities. This article is a quick start guide to most common XML and Web Services security vulnerabilities and the two basic security models they follow.

Full Article: XML Security Trust and Threat Models for Dummies

Strategies for Securing Enterprise-to-Cloud Communication

Extending corporate boundaries to cloud infrastructure providers requires focused review of security practises used to integrate from the enterprise DMZ to external trading partners.  Here is an article that covers Enterprise-to-Cloud communications issues and how best to prepare from them.  SOA Testing and XML Gateway play an intergral part in ensuring that the security provisions are well tested and strictly enfored while interacting with cloud providers.

Strategies for Securing Enterprise-to-Cloud Communication
— The Cloud Security Alliance (CSA) published Version 2.1 of its Guidance for Critical Areas of Focus in Cloud Computing with a significant and comprehensive set of recommendations that enterprises should incorporate within their security best practices if they are to use cloud computing in a meaningful way. The Guidance provides broad recommendations on operational security concerns including application security, encryption & key management, and identity & access management. In this article, we will consider security implications of REST- and SOAP-based communication between consumers and specifically, Infrastructure as a Service (IaaS) providers.

Hidden Cost of Open Source SOA Testing Tools

Here is an interesting article that appeared on sys-con regarding the hidden costs associated with using open source frameworks for SOA Testing.  Corporate business process security, interoperability and scalability may depend on the kind of tools one chooses for testing services and may significantly contribute to the overall success a company's ability to safely add a growing number of business partners to its ecosystem.

Hidden Cost of Open Source SOA Testing
— Adopting an open source tool for SOA testing seems the simplest, most cost effective choice for developers and testers early on. However, you should plan and consider the implications of a longer term strategy with an open source testing tool. There are many aspects of service testing that contribute to a comprehensive solution across the SOA life cycle. Adopting a specialized tool for service testing is essential and will provide value, but may prove limiting if the adoption of the testing tool becomes something that can not grow with the business and maturity of your SOA strategy. This article will discuss some topics to consider before jumping headlong into an open source free testing solution for your production services.

MIT Techology Review covers "Swamp Computing" a.k.a. Cloud Computing

XML/SOA Testing of XML Security Policies (XML Encryption, XML Signatures) will become the centerpiece of Cloud-based deployments that are multi-tenant in nature and can inadvertently expose corporate information.

MIT Technology Review published an interesting article sumarized under MIT Technolgy Review covers "Swamp Computing"

Gartner AADI SOA Testing Sessions

It was exciting to see the extent of interest and coverage on SOA Testing at the Gartner Application Architecture, Development and Integration (AADI) event in Las Vegas last week (December 7-9th). SOA Testing has become an integral part of Enterprise Application Life cycle Management and Thomas Murphy, Research Director at Gartner did a great job in covering the core aspects of SOA Testing at the show is the following session:

SOA Testing: Confronting the Nightmare of Testing Shared Services: The Key Issues that were covered included:

• How will application testing and quality be affected by the shift to SOA and Web 2.0 technologies?
• What metrics will be effective at driving improvement and assessing the efforts of those collaboratively performing the development and testing of software services?
• Which tools will provide the best productivity and understanding of software quality and testing for the current and future SOA applications and platforms?

For more details about the SOA Testing Sessions at Gartner, click here.

Federated SOA essential aspects: SOA Testing, SOA Identity and SOA Security

Here is an interesting article by Rob Barry titled: "In SOA, cloud resources may exacerbate security and file transfers issues." It highlights significant requirements for Federated SOA especially around large file transfer using Web services attachments. The article makes the following interesting points:

• Attachment sizes are increasing driven by cloud computing such as transferring large files to Amazon S3 or a companies internal cloud.
• MTOM and MIME are used now for real time file transfer over web services instead of FTP or classic MFT protocols.
• Identity is critical to Federated SOA.

Standards such as MIME and MTOM are now being heavily deployed. For a deeper understanding regarding how MTOM works, see "Intro to MTOM."

Link to article by Rob Barry: http://searchsoa.techtarget.com/news/article/0,289142,sid26_gci1373331,00.htmll

Techniques in Attacking and Defending SOA-XML-Web Services

At OWASP AppSec, Washington, DC, Crosscheck Networks will present a session titled, “Techniques in Attacking and Defending XML/Web Services.” This session will examine the strategies in identifying new attack vectors and classifying security threats, including SQL Injection, Denial of Service (DoS) and XSD Mutation. Additionally, the Crosscheck Networks senior executives will offer countermeasure best practices to mitigate the risk of, and exposure to, those identified XML security threats.

To register, click here.

Hardware-based SOA Testing

Crosscheck Networks released an industry-first, hardware-based SOA Testing by intergrating SOAPSonar with Smart Cards produced by A.E.T. Europe B.V.

SOA Testing for signatures, encryption, decryption, and X.509 client authentication is now seamlessly provided within the SOAPSonar testing framework. SOAPSonar provides the ability to use keys from a SmartCard to perform digital signatures, encryption, decryption, and SSL X509 mutual authentication. SOAPSonar provides a native integration with A.E.T SafeSign Client software to dynamically access the digital keying information on the card.

For details, see: http://www.soatesting.com/2008/08/smartcard-testing-for-soap-and-web.html

SOA Testing Consolidation: Green Hat Software acquires Solstice Software

Green Hat Software, a London, UK-based SOA Testing company has acquired Solstice Software a Delaware, US-based SOA Testing company. The consolidation in the SOA Testing space is expected as larger companies add SOA Testing to their portfolio of SOA products. Although this is a private-to-private merger/acquisition, it's a good move that will give the combined companies European and North America coverage and will help them to effectively compete against established SOA Testing players such as Parasoft, Crosscheck Networks, iTKO and Mindreef.

HP and IBM have been touting SOA Testing products, however, they lack the functionality, maturity and and install-base within SOA Testing space. HP "SOA Testing" approach comes from a registry-based (Systinet acquisition) and web site testing approach (Mercury acquisition), whereas IBM's SOA Testing approach comes from its Rational UML modelling division. Both HP and IBM have yet to become serious contender is the SOA Testing space.

http://www.ebizq.net/news/9657.html?rss

SOA Testing considerations for SOA Gateways

SOA Testing touches a number of components within the IT Ecosystems including SOA Gateways. Since a SOA Gateway is usually deployed close to the corporate edge, rigorous SOA Testing ensures that traffic ingressing and egressing an enterprise are clean, secured and valid -backend systems should be able to parse them easily once the SOA Gateway has giving its stamp of approval about the quality of the message.

Download Paper (registration required):
SOA Gateways: Best Practices,Benefits & Requirements

This article published by Forum Systems - the pioneer of SOA Gateways - covers deployment best practices, benefits and requirements with a focus on service virtualization, message privacy and integrity, and message control and auditing. It will help the reader frame SOA Testing scenarios necessary for SOA Gateways.

"A SOA Gateway is a core infrastructure component of a SOA with the ability to integrate XML/SOAP-based services securely. Typically deployed as a hardware appliance, a SOA Gateway seamlessly controls access to services, protects information through data-level encryption, ensures the integrity of a message through signatures, and controls information flow."

Crosscheck Networks Announces New Product: SOAPSimulator

Crosscheck Networks, the company that pioneered comprehensive SOA Testing through its product, SOAPSonar, has now launched a new "paradigm-shifting" product: SOAPSimulator that enables QA professionals and developers to start getting their work done even if the service endpoint is not ready or available.

For details on SOAPSimulator, see:

http://www.crosschecknet.com/SOAPSimulator_News_0408.php

Make sure to download the white paper from the link above.

SOA Testing using Parallels on MacBook Pro

I have finally moved over from XP to Mac and I am loving it. Now I do have a number of applications that I will probably not migrate away from - such as the MS Office Suite that I purchased for my MacBook Pro - it works like a charm and has a number of goodies that weren't available on my XP.

I also can't live without Visio and heavily use Crosscheck Networks products, SOAPSonar and SOAPSimulator - applications that are not available natively for Mac's, however, Parallels comes to the rescue. For $79.99, Parallels Desktop 3.0 for Mac has been a great investment. It is easy-to-use, fast and the images of your Operating Systems can be moved around easily. I don't know how it compares to VMWare, but I have no complaints about Parallels, yet. I like Parallels' Full Screen Mode and Coherence Mode that lets your Windows apps appear as if they are running natively within Mac OS X Leopard.

The image above shows SOAPSonar (a .NET-based SOA Testing Application) running in Parallels on a MacBook Pro.

Service Simulation - Help Jumpstart SOA Testing

Here's a paper that the folks at Crosscheck Networks have authored on how Service Simulation can accelerate your SOA Testing, Client Side Development while saving you money by eliminating the need to build an expensive "SOA Reference System."

I have seen others talk about this concept in terms of virtualization and confuse everyone - I guess using hot marketing jargon helps get attention at the expense of adding confusion. The key aspects of Service Simulation are portability and ease-of-use, without which it adds more to the project timelines than what it promises to reduce.

Here's what Service Simulation is and how it helps:

"Reusable services are the cornerstone of a successful implementation of Service Oriented Architecture (SOA). Service simulation can mimic producer services before they are implemented, an alternative to an expensive reference environment. In this paper, we cover SOA Project Lifecycle issues and how best to address them through service simulation."

For complete article, see:

Accelerate your SOA Projects Through Service Simulation

http://www.softwaremag.com/pdfs/whitepapers/Crosscheck_WP4.pdf

Better Software Magazine Cover Story: Breaking Ground on SOA

SOA Testing has really become a mainstream discipline. Better Software Magazine, a publication for QA Professionals and anyone focused on Quality, published a coverpage article on Building and Testing your first Web Service.

This article will get you started on SOA Testing in no time and provide you a good overview on how web services are built and how they can be tested. It's great article to get your feet wet with SOA and SOA Testing.

You can read the full article here.

Crosscheck Networks Announces SOA Testing Tutorial at Software Quality Engineering's STAREast 2008 Conference

Crosscheck Networks Announces SOA Testing Tutorial at Software Quality Engineering's STAREast 2008 Conference

SOA Testing is becoming a mature discipline. QA Professionals are now actively re-tooling themselves to adapt to web services-based SOA Testing requirements. For the second year running, Crosscheck Networks is conducting a 1-day intensive SOA Testing Tutorial. This is a hands-on class that starts off by first covering the fundamentals of web services-based SOA and then quickly goes into hands-on labs that cover functional, performance, interoperability, security, regression, automation and identity testing.

The course, hosted in Orlando on May 5, 2008 is limited to 30 attendees. To find out more, visit STAREast 2008 (http://www.sqe.com/stareast/)

Recent SOA Testing Publications

Here's a list of interesting SOA Testing Articles that have been published recently:

1. 5 Things SOA Vendors are Missing, by David Linthicum
   
2. Intro to SOA Regression Testing: A hands-on Approach
3. Compress your SOA Life cycle through Development and QA Collaboration
4. Automated SOA Regression Testing.