Microsoft, IBM and VeriSign released WS-Security to the world, putting to rest some of the questions surrounding the adoption of next-generation application services.

Though the three companies plan on sending the security plan to a standard's body for final ratification, no timetable has been established, though industry experts expect to see widespread WS-Security adoption as early as the end of this year.

Mike Gilpin, an analyst at Giga Information Group, said the announcement of a security standard is a welcome surprise to the industry.

"Lack of security has been one of the major impediments to Web services being used widely outside companies in a business-to-business mode," he said. "We hadn't expected the standard to be agreed upon until later in the year. This is very positive for the Web services industry in the longer term."

Web services, lauded by many as the future of business productivity, ties together the corporate infrastructure and its e-commerce functions, bringing real-time accountability to the forefront.

One of the biggest questions for the technology, however, was keeping unwanted visitors from stealing sensitive information found on the Internet.

Eric Rudder, Microsoft senior vice president of the developer and platform evangelism group, said the incorporation of a failsafe security policy is a tremendous boon for businesses.

"Today's announcement of WS-Security is a major milestone on the road from today's situation, where Web services security is left as an exercise for the individual developer, to a world where we have broadly interoperable standards for Web services security," he said.

LATEST NEWS

Cyber Monday: More Shoppers, Deeper Discounts
Microsoft-Yahoo Deal 'Fiction,' Report Says
Cell Phones More Distracting Than Passengers
The Social Side of Shopping
Bloggers on Front Lines in Mumbai Attacks

WS-Security, according to the working group, "supports, integrates and unifies several popular security models, mechanisms and technologies, allowing a variety of systems to interoperate in a platform- and language-neutral manner in a Web services context.

In addition to the security standard, the working group outlined a road map for future security implementations. Its report, "Security in a Web Services World," is the start of what should be a continuing process for security measures.

The three companies took a three-prong approach to laying out a security approach:

• Enhancing single-message authentication, message integrity and confidentiality through the simple object access protocol (SOAP) messaging standard.
• Security tokens for individual users to access different levels of the Web service infrastructure (i.e., customers and administrators).
• Using encrypted keys on X.509 and Kerberos tickets and how they should be encoded.

Dr. Phillip Hallam-Baker, VeriSign's principal scientist and WS-Security co-author, said the business world will see immediate gains with Web services, it's just a matter of trust. With continued work on security measures, he said, corporate adoption will become more widespread.

"The industry is making solid inroads on the interoperability front, and the new WS-Security spec is among a series of open security specifications paving the way for widespread adoption of trusted Web services," he said.

While the three companies say the initiative is a joint venture of the three companies, Microsoft produced the lion's share of the work with nine of the 16 WS-Security group members.

The software giant has the most to gain from a secure service platform, as it moves forward with its .Net framework for Web services. The company has spent a tremendous amount of time and energy (as well as marketing revenues) to get their framework out and in the public before the competition.

WS-Security is only one initiative out of many at the Web Services Interoperability Organization (WS-I), a coalition of the high-tech community's biggest names. In addition to companies like Microsoft and IBM, Intel andHewlett-Packard have signed on as members. Sun Microsystems, a Microsoft rival, is still looking at joining but hasn't made a decision.

The group has several working groups established, aimed at improving Web services, among them WS-Policy, WS-Trust and WS-Privacy.