Security remains a concern SAN FRANCISCO — Speakers at the Burton Group Catalyst Conference 2003 here on Friday debated the pros and cons of Web services-based application integration, illustrating the diversity of opinions still surrounding the technology.Speakers varied from fanning the flames of excitement to playing down Web services as an immature platform that will have a place in, but won’t monopolize, the integration world.“The way I like to put it is Web services is one small step for technology and one giant leap for business,” said Anne Thomas Manes, research director at Burton Group. Web services is basically middleware, but it will enable the “virtual enterprise” and service-oriented architectures, Manes said. It will succeed, unlike previous efforts such as Distributed Computing Environment (DCE) and Common Object Request Broker Architecture (CORBA), she said.“The reason that Web services will succeed is because we have total industry buy-in,” Manes said. She also touted the Web Services Interoperability Organization’s Basic Profile, saying it will provide for basic interoperability across any language or platform.Issues remain, however, such as scalability and performance, said Manes. She also stressed that users of Web services need to fit their systems with Web services management tools. But Web services will become part of the IT fabric, Manes said. “Five years from now, you won’t even think about Web services because it will become just part of your fabric,” in the same manner that enterprises use sockets, Manes said.The issue of security, long a concern with Web services, is being addressed via the WS-Security specification, she said. “WS-Security is very close to being finished and it’s a very strong specification,” Manes said. WS-Security is under the jurisdiction of the Organization for the Advancement of Structured Information Standards (OASIS).A Web services user speaking at the conference, however, expressed concerns with the current level of security in Web services. “It’s a miserable story and I think it’s a reason why we don’t do a whole lot outside our firewalls,” said David Cohen, a vice president of the technology architecture group at Merrill Lynch. “To me, Web services is just a communications system,” Cohen said. “It’s just at a higher level of the network stack.”Merrill Lynch, however, is a “huge champion of XML,” said Cohen.BEA Systems’ Scott Dietzen, also CTO, stressed that Web technology providers need to get on the WS-Security bandwagon. “Anybody who doesn’t have WS-Security, for example, better have a road map where they’re going to provide it in the second half of this year or I would question their commitment,” Dietzen said.An official at integration software vendor Mercator stressed that non-standards-based approaches to integration will continue, despite the heightened interest in Web services.“A lot of people say you can do it with standards-based infrastructure, and I’m here to tell you that is not the case,” said Mercator CTO Dave Linthicum. While acknowledging a role for Web services, Linthicum said other technologies would survive, including autonomous, monolithic applications. “The legacy systems won’t go away and you can’t change them,” he said.He also said services-oriented architectures are complex. “It’s much more complex than other approaches,” Linthicum said. Software Development