Improving the Service-Oriented IT Architecture

By Elizabeth Wasserman

In today's global economy, companies need to be quick if they are to succeed. Rapid response can help a business win customers, react to market changes, trump competitors, and exploit technological advantages. Like a sprinter in a pack of the world's fastest runners, a company requires agility and the flexibility to change course in order to reach the finish line first.

Recognizing this need for speed, a growing number of companies have shifted to a service-oriented IT architecture (SOA), a software infrastructure that helps enable a variety of different applications and data sources to communicate in the same computer language. SOA is appealing because it can reduce time to market for new applications, more quickly allow different programs to be combined, and permit businesses to more easily share data. Gartner estimates that, by 2008, more than 60 percent of enterprises will adopt SOA principles to their mission-critical business processes and applications.

An SOA consists of frameworks, policies, and procedures that allow business-critical applications such as databases, spreadsheets, and word processors to be combined in one location at the server level and provided to end users as services, instead of being stored on the desktop. An SOA facilitates communication across different business units, even in organizations with complex IT structures, by allowing end users to query and retrieve these services using a software interface accessed from their desktops.

Today's business climate makes an SOA essential. Regulatory developments such as Sarbanes-Oxley require transparent data, storage of more data, and better controls. In the global economy, businesses must be up and running 24/7 to be ready to react. When companies acquire other firms, they need cost-effective ways to integrate computer systems and applications quickly. At the same time, threats from viruses and other malicious attacks require organizations to have a resilient and agile IT. An SOA can best position a company to manage these challenges.

For the IT department, an SOA offers flexibility in integration that can let the CIO or other IT managers weigh cost against functionality considerations. A company that has made five acquisitions over the past two years may have to make tough choices about integration, according to Gartner analyst Whit Andrews. For example, it might demand that the newly acquired companies switch to its enterprise resource planning system, which can be time-consuming and costly. Or, Andrews said, they could use an SOA to save 60 to 75 percent of the cost.

By laying out some of the benefits of an SOA to peers, the CIO can help gain support for a move to SOA. These include:

• Faster response to market  The foundation of SOA is to reuse services and components for development and integration. This means a company can more quickly respond to new markets, or changing conditions, by assembling new applications faster.



• Less costly integration  SOAs make integration easier because developers aren't saddled with writing new lines of code to connect diverse applications. By using standard protocols, such as Web services, much of the SOA code is reusable.



• Leveraging existing systems  Companies need to protect their existing investments in computer systems. Once "siloed" systems -- SAP, Siebel, Oracle, etc. -- can be repositioned to share processes and data.



• Reduce risk  The likelihood of success for an SOA implementation project is greater because a company is often reusing services that have already been tested and deployed.



• Allow internal development Future components may be developed within the company's IT department, reducing the cost of licensing commercial software products.

Security concerns have previously deterred some enterprises from considering an SOA because there are risks associated with exposing a company's internal computer system to potential outside threats. However, these are gradually being addressed. The Web Services Interoperability Organization, which has more than 120 corporate members, is currently developing security recommendations dealing with transport of data and secure messaging, among other security considerations. And major vendors have been committing time and research to develop security standards. In the short term, Gartner advises that companies can help minimize security threats immediately by using tools such as Virtual Private Networks, Secure Sockets Layer, or digital certificates. Gartner also recommends that companies move slowly, choosing Web services that don't pose major security risks, such as allowing people who use  a corporate Web site to get stock quotes.

On the bright side, once a secure SOA is in place, it may actually make applications more secure than they are now. Often, programmers in the company carry the responsibility for maintenance of application security, and having a lot of different programmers writing patches and code can ultimately pose more security risks. The SOA will allow enterprises to secure applications by setting up security rules at the policy level and restricting access to authorized personnel.

Another obstacle that the Web Services Interoperability Organization is working to overcome is a lack of industry-accepted definitions and XML standards support for service-oriented architectures. The group ultimately hopes to recommend guidelines, sample implementations, and support tools for the design of interoperable Web Services.

Until the industry has agreed upon standards and practices for SOA, CIOs can look to peers for emerging best practices such as:

• Educating the entire staff about the benefits of an SOA approach.



• Reviewing the organization's governance structure to make sure it is reliable.



• Developing a blueprint. It's easy for large enterprises with disparate operations to buy new technologies without regard to how they'll fit into an overall plan. The challenge in building an SOA is to keep people -- including both IT and executive staff -- focused on the architecture's goals.



• Ensuring that your organization realizes the benefits of an SOA by reusing applications and training staff to operate in this environment.

There is a growing consensus in the marketplace that companies that fail to pursue a service-oriented IT strategy will be left in the dust by peers that are early adopters. But there's no magic bullet. CIOs need to be vigilant and maintain a resilient service-oriented architecture to support business continuity and avoid disruption, keeping information both available and secure.

Elizabeth Wasserman has written about technology and business for Inc., the San Jose Mercury News, and CIO Insight. She is a freelance writer based in Fairfax, Virginia.