Security management Toolkit

Keeping hackers out of your Web services

David Burgett Builder.com

Published: 14 May 2002 13:09 BST

SSL provides secure communications with both minimal development time and transparent usage. Because SSL encrypts all communication on the client machine, hackers intercepting Web service calls will only be able to see the encrypted message, protecting the secrecy of your method names and parameter definitions.

Nevertheless, there are some potential pitfalls to consider before depending on SSL alone to protect your Web services. There is the cost associated with purchasing a digital certificate and service from a Certification Authority. This cost can be as high as $1,000, depending on the Certification Authority and encryption strength of the certificate purchased.

Furthermore, despite the cost, the strength of the certificate purchased does not necessarily determine the strength of the encryption used for each transaction. Most browsers support full 128-bit encryption. However, due to export laws, these same browsers must also provide a weaker, 40-bit encryption version. The number of bits used to encrypt the message determines the difficulty in breaking the encryption. Even if you purchase a 128-bit certificate for your Web server, if a client browser (or other application) only supports 40-bit encryption, the messages will be automatically encrypted with the weaker protection.

Another concern is the ability of hackers to break the encryption. A hacker can easily obtain the public portion of your SSL key by simply accessing a secure Web service and analysing the traffic passed between the client and server. With the public key, it is possible to determine the private key, which would allow the hacker to decrypt all traffic hitting your Web service. This is a difficult process and not easily available to every would-be high school hacker, but if your Web services offer great-enough rewards, such as money transfers or stock purchases, it is well within the realm of possibility.

Have your say instantly in the Tech Update forum.

Find out what's where in the new Tech Update with our Guided Tour.

Let the editors know what you think in the Mailroom.