1. © 2008 The MITRE Corporation. All rights reserved Overview of MITRE SOA Activities 30 September 2008 Marie Francesca, Director Corporate Engineering Operations The MITRE Corporation maf@mitre.org 781-271-2263 Approved for Public Release; Distribution Unlimited; Case Number: 08-1416

2. © 2008 The MITRE Corporation. All rights reserved 2 Outline Background Observations Challenges

3. © 2008 The MITRE Corporation. All rights reserved 3 Background Many programs across our sponsor base are exploring the use of SOA MITRE needs to provide a coordinated view (internally and in collaboration with industry) of the use of SOA to our sponsors Initiated work on a set of papers in mid-2007; two have been approved for public release as working drafts –Some material presented at last eGov SOA conference Some industry feedback has been provided but would like others’ perspectives Other activities –Participating in Object Management Group SOA Consortium –MITRE SOA related research –DoD Industry AFEI SOA Acquisition Working Group

4. © 2008 The MITRE Corporation. All rights reserved 4 Observations Potential Benefits of SOA Enables agility to support changes in workflow due to changing missions needs Accelerates deployment of new capability due to decrease in development and integration time and costs –But... infrastructure investment is needed before significant ROI can be realized –Programmatic barriers need to be overcome (e.g., certification) Provides capability to leverage legacy infrastructure Improves information access and sharing –Supports data provisioning at the earliest point of consumability (post before processing) –Most instances to date are internal to a system-of-systems Allows partial implementations (i.e., wrapping components) –Better than no SOA, but may not result in full ROI compared with full SOA implementation –However, it may be a more practical approach Provides opportunity for benefits to accrue at the enterprise level; however, costs will increase for the program providing the service

5. © 2008 The MITRE Corporation. All rights reserved 5 Observations Early Successes... but the Jury is Still Out Programs exposing data through services (wrappers) One major program conducted a study with three vendors; showed services could share exposed data without changes to component systems Programs starting to recognize that business process changes need to be addressed Revised DIACAP* process: –No longer requires re-accreditation of services that have been designed and accredited to be re-used (enterprise services); i.e., each individual combination of uses does not need to be accredited as it does today –Minimal program experience with new process * Defense Information Assurance Certification and Accreditation Process

6. © 2008 The MITRE Corporation. All rights reserved 6 SOA Challenges and Considerations (1 of 2) Governance –Lack of mature governance approaches; minimum enterprise level governance is essential for success –Lack of measureable Service Level Agreements –Interdependent capabilities imply need to limit autonomy in deciding what service to continue or cease supporting/operating Acquisition/Leadership/Culture –Traditional acquisition is focused on systems, not services –Balancing program and enterprise objectives is difficult Portfolio management trade-offs Lack of understanding by (and incentives for) Program Managers to align with SOA goals –Establishment of trust between business partners essential to success Information Assurance –Balancing “need to protect” with “need/responsibility to share”

7. © 2008 The MITRE Corporation. All rights reserved 7 Challenges and Considerations (2 of 2) Economics –We’re not structured for shared services implementation; need to determine right funding model(s) for services (and then get those models accepted) –Declining budgets impact ability to transition to services-based approach SOA RoI requires infrastructure build-up Increased cost (20-100%) to build for re-use Technology –Technology trade-offs are required in implementation; one size does not fit all –Some military operations may not be well suited for COTS implementation –Defense Industrial Base is not well versed in tools and techniques for services development and deployment Policy –GIG end-to-end network management needed for mission success –Current certification and testing approaches don’t scale well to services based implementations

8. © 2008 The MITRE Corporation. All rights reserved 8 Points to Ponder Some Unanswered SOA Questions What criteria are used to determine if a services-based approach is appropriate? What constitutes a good service specification and a good service level agreement? How do you decide whether to use a service? How should services be specified and designed for resilience (to include under a variety of network conditions), testability, etc? What technology mechanisms make it easier? How do you test services from a both a consumer and provider perspective? How do you assess the pedigree of a service? What metrics should be used for services development and assessing the “ilities” of a service? How many services can be mashed together in an agile yet reliable manner? How can we model this? What governance constructs need to be established to make SOA work? What business/economic constructs need to be established to make SOA work? What commercial best practices can we draw from (Google, Amazon.com, NYSE)?

9. © 2008 The MITRE Corporation. All rights reserved 9 Where we Need the Most Help Explore management of services as a portfolio and the requisite changes –Policy –Organizational structure –Funding models for costs and benefits of development and operation of services –Incentives (for the Government and Industry) –Minimal enterprise level governance –Culture (recommend process changes to facilitate trust across the enterprise) Gov’t culture and processes are not structured to incentivize or encourage use of services  the Gov’t lacks the forces that exist in the private sector to drive use of services

10. © 2008 The MITRE Corporation. All rights reserved 10 Status of SOA Related Material Materials available now –Emerging Industry SOA Best Practices white paper and presentation –Leveraging Federal IT with SOA white paper and presentation –Interconnect Methodologies presentation SOA materials in the pipeline (expected Oct ‘08) –SOA Information Assurance white paper –Seven Greatest SOA Challenges for a Federal Leader white paper –Acquisition white paper –Interconnect Methodologies white paper

11. © 2008 The MITRE Corporation. All rights reserved 11 Backup

12. © 2008 The MITRE Corporation. All rights reserved 12 Definitions SOA is a paradigm for organizing and utilizing distributed capabilities that may be under the control of different ownership domains* –SOA is an architectural pattern, not a technology –It’s about the business, not just about the technology; business process changes are needed for enterprise success –SOA and security are not mutually exclusive Governance: establish and enforce how DoD Components agree to provide, use, and operate services** –Identify attributes of providing, using and operating services that have to be governed and at what level –Establish lines of responsibility, authority, and communication for making decisions about services across the lifecycle of services –Establish measurement, policy, and control mechanisms to ensure individuals carry out their responsibilities * OASIS Definition ** DoD CIO March, 2008

13. © 2008 The MITRE Corporation. All rights reserved 13 For Internal MITRE Use MITRE’s Perspective on Emerging Industry SOA Best Practices Key Messages –Determine whether a SOA is the correct solution –A SOA can be part of a successful Net Centric Solution (NC), but does not make it NC by itself (e.g., exposing data) –Focus on solving business/operational problems –Start small and evolve, but don’t lose sight of the big picture –Establish governance as a key component of SOA –Ensure the right security for the right services –Don’t expect all SOAs to save money in the near-term –SOA does not solve your data problems, it will likely expose them (reference: Gartner) Applying SOA to the right problems, establishing governance, and proceeding incrementally are essential attributes of successful SOAs

14. © 2008 The MITRE Corporation. All rights reserved 14 Government should select technology based on requirements and scope of deployment. The business, not the technology should be the driver. Interconnect Methodologies Trade Space

15. © 2008 The MITRE Corporation. All rights reserved 15 Leveraging Federal IT Key Messages –SOA is a means of leveraging existing Federal IT systems and past IT investment SOA allows service interfaces to be decoupled from legacy applications –Software service reuse – not code reuse –Commercial web service standards are best suited for robust networks; substantial engineering is required for limited networks –The enterprise is a new beneficiary; a program providing a service on the network will incur additional costs SOA should be used to incrementally improve portfolios, leveraging legacy systems.

16. © 2008 The MITRE Corporation. All rights reserved 16 SOA Materials in the Pipeline Information Assurance –SOA paradigm (e.g., legitimate unanticipated user, distributed system) poses particular challenges for security –SOA-specific approaches do provide some advanced capabilities –Security must be applied in proportion to the sensitivity of the system; need to carefully balance security with business needs Seven Greatest Challenges for a Federal Leader –Demonstrating value and establishing governance and trust are essential to successful SOA implementations in the Federal domain Paper from Interconnect Methodologies Trade Space slides Acquisition white paper

17. © 2008 The MITRE Corporation. All rights reserved 17 Information Assurance Paper Outline Service Security – Choosing the Right Fit Mediating Access to Services –Identification & Authentication –Authorization –Leveraging Enterprise Security Services Data Assurance –Data Integrity –Data Confidentiality Challenges in Trust & Policy Challenges in Audit Architectural Approaches C&A for an SOA 17