Web Application Security Testing - The father of SOA Security Testing

Watchfire, the maker of AppScan, a web application security testing with around $20M in annual revenue was acquired by IBM's Rational division for ~$100M. The exact price was not disclosed. Watchfire's competitor, SPI Dynamics, maker of WebInspect was subsequently acquired by HP. SPIDynamics had revenues of 18.5M for 2006 and was bought for ~$120M. Again the exact value of the deal was not disclosed.

What does this all mean for SOA Testing: The next logical step for HP and IBM is to extend web application testing into modern web services-based SOA testing. Although HP's acquisition of Mercury that had acquired Systinet, provides HP "SOA awareness," it makes startups like Crosscheck Networks, iTKO, and Mindreef prime candidates for a deeper relationship with such large vendors that are now poised to address SOA Testing.

SOA Consolidation

Reactivity was purchased by Cisco for a cool $135MM, making it the largest acquisition in the SOA space. DataPower (aquired by IBM for ~$105MM and Systinet (acquired by Mercury for ~$102MM) were the other >$100MM acquisitions. Other smaller ones include Sarvega (acquired by Intel for ~$40MM), Conformative (acquired by Intel for ~$32MM), Infravio (acquired by webMethods for ~$38MM) pretty much consolidated the space leaving Forum Systems, Layer7, SOA Software and Amberpoint as the independent private companies. Further consolidation is inevitable.

The second wave of SOA Infrastructure startups in underway. Andrew Nash, CTO of Reactivity, started a company focused on XML identity. Sonoa Systems is the Next Gen XML Infrastructure Company still in stealth mode and is funded by SAP Ventures, Norwest Ventures, and Bay Partners.

Ofcourse, all XML/SOA infrastructure companies will require extensive SOA Testing to make their products enterprise ready. They will have to deal with the extensive web services/XML standards such as WS-Security, its profiles such as User Name, X.509, Kerberos, SAML tokens as well as SOAP signatures and encryption. Starting XML/SOA infrastructure companies from scratch will enable such new startups to build ground up on relatively newer and useful standards such as WS-Policy, WS-SecureConversation, etc. The second cycle will be shorter with exits taking 3-4 years unlike the 5+ years needed by the 1st wave of SOA consolidations.

For an interesting interview on Sonoa by Eric Knorr, see this video clip.

Watch your SOA Testing Blind Spots

This latest article by Crosscheck Networks' R&D team highlights various common SOA Blind Spots that SOA testers experience in real-life deployments.

The Blind Spots and remedies focus on the following areas:

1. Performance
2. Security
3. SOAP Attachments
4. WSDL
5. Interoperability

For these 5 areas of SOA Testing, the article describes how to identify common SOA blind spots and techniques for avoiding them.

The full article (PDF), can be downloaded here: Watch your SOA Testing Blind Spots

ChoicePay: Rising above the SOA Testing Challenge

Recently, Salman Akhtar, CEO Techlogix, published a good case study regarding SOA Testing Challenges and how ChoicePay, an electronic billing company, overcame these challenges "without throwing more bodies at the problem."

The article, published by SOA /WS Journal is a good read for anyone concerned about SOA Tesing:

http://webservices.sys-con.com/read/284568.htm

Web Services Testing NetWeaver Application Server, Java EE 5 Edition

SAP has recently released one of the first Java EE 5 compliant application servers. I tested this server's web services capabilities and found it to be easy to use. SAP NetWeaver Application Server, Java EE 5 Edition install contains the application server, the NetWeaver DeveloperStudio and MaxDB database. My biggest challenge was installation, but SAP Developer Network (SDN) came to the rescue and after my installation was complete, I was off to the races.

Details of the evaluation are published on TheServerSide.com.

You can also see details of the installation and test process at:

http://www.crosschecknet.com/web_services_testing_tools_sap_netweaver.php

Give NetWeaver Application Server a spin - you'll be publishing web services in no time.