Oasis sets web services security standards

The development of web services has moved forward another step with the formation of a body to oversee the development of security standards.

The initiative comes from the Organisation for the Advancement of Structured Information Standards (Oasis), the global consortium devoted to data exchange standards.

The body created by Oasis, the Security Standards Joint Committee (SSJC), has been set up to oversee the development of security standards for web services technologies, aimed at increasing adoption.

The SSJC aims to create a common set of terms and components for web services security, and will co-ordinate the work of Oasis's other technical committees.

Darran Rolls, chairman of the SSJC, said: "The potential of web services will not be realised without security."

The SSJC "will try to instil consistency" across the standards bodies that make it up, Rolls said. The first meeting will take place on 13 June 2002, and will be attended by representatives from Sun, Entrust and HP.

The Oasis group is intended to complement the work being undertaken by others. Security standards for web services are also being developed by the Web Services Interoperability Organisation (WS-I).

While there was still considerable doubt over how standards for web services would evolve, end users should not be unduly worried, said Ted Anglace, technical sales manager at web services platform provider, Bowstreet.

"Irrespective of which standards emerge, the important issue for users today is choosing technology that will work with their current infrastructure," he said.

WS-I has so far delivered a secure messaging protocol, WS-Security, based on a set of Simple Object Access Protocol (Soap) extensions. Further specifications are to be delivered over the next few months.