Stories by: Randy Heffner

You might think that technology supports your business, but you're wrong: Technology has become your business. The 21st century reality is that you don't have a business without technology; it has become as integral to the way your business operates as are people, finances, suppliers, business partners, and all the rest. That means it's too risky to build your business and only then look to put supporting digital technology underneath. Instead, business and technology must be designed and built together, as a unified whole - there are simply too many design tradeoffs between the physical and digital aspects of your business to risk doing it any other way. The new mindset is that "your business is embodied in your technology," and this calls for a new approach to business technology architecture and strategy.

The worst CIO misunderstanding about service-oriented architecture (SOA) is thinking of it as only another technical initiative for software reuse. Although SOA's reuse potential is real and good, its business impact goes much further: In Forrester surveys, 38 percent of Global 2000 SOA users say they are using it for strategic business transformation. SOA's true source of power is in its business design models, not its technology - and this means that SOA provides a broad foundation for a much larger shift in business technology (BT) architecture that goes far beyond SOA itself. By correctly understanding SOA, CIOs can lead their organizations on a solid and well-managed path toward a strategic technology future and greater business value.

The simplest and most common approach to security for service-oriented architecture (SOA) is to route service requests over a virtual private network (VPN). This provides adequate security for simple, coarse-grained requirements, it works with SOAP, REST, and non-Web services protocols, and it is adequate even for many external integration scenarios. Yet not all security scenarios are simple, and for more complex needs and fine-grained SOA security, architects must do considerably more planning and design.

Service-oriented architecture (SOA) policy adds important business and technical flexibility and control to an SOA-based solution. At runtime, SOA policy provides ready access to change key operating characteristics of a service, including business parameters like approval limits and transaction routing. During development, SOA policy controls key aspects of how your services are built.

Among the ways to keep a service-oriented architecture (SOA) initiative on track, forming a center of excellence (COE) is a frequently named option. Indeed, a recent Forrester survey shows that having an SOA COE correlates with higher satisfaction with SOA.

Security is not a reason to stay away from SOA. Although full SOA security maturity is yet to come, 30 percent of organizations now use SOA for external integration with customers and partners. For standard Web services using SOAP, WS-Security has achieved critical mass as a foundational standard. On the other hand, advanced SOA security - involving federation among partners, nonrepudiation, and propagation of user identities across multiple layers of service implementations - is in its early days.

IT leaders must understand the general characteristics of the SOA policy life cycle. This will help you to watch over critical control points and organisational relationships.