ORLANDO -- Building a central reservation system based on cutting-edge Service-Oriented Architecture  technology has meant a decisive overhaul in underlying IT security at hotel group Starwood Hotels & Resorts International.

Patrick Foley, director of global technology compliance at Starwood, whose hotel chains include St. Regis, Sheraton and Westin, this week described how the move to XML-enabled SOA for a new central reservation system has impacted the underlying corporate security in sometimes unexpected ways. SOA, in defining systems as flexible services, has meant existing perimeter security is no longer as effective, encryption is more difficult, and logging requirements are intensified for audit and regulatory compliance. Foley, who spoke about Starwood's shift to SOA at the Infosec World Conference in Orlando, provided insight on security consequences of SOA.

"Service-oriented architecture defines systems as a series of services," said Foley. "It's the ability to link services together in a way that they can be used in many different processes, including credit-card authorization. The good thing is, you can go global, no longer limited by your data center or network."

However, the transformation must also be on the security level, Foley emphasized, acknowledging that Starwood's first SOA project, launched a few years back by an enthusiastic IT department eager to use the latest software development techniques, suffered a few setbacks that slowed it down.

The chief problem early on was failing to understand how necessary it was to bring in a security architect to advise developers on how to build SOA according to security standards, such as those promulgated by OASIS and the W3C.

"You will need a security architect," advised Foley, noting that Starwood ended up turning to a data architect to be the security architect for the SOA-based central reservation system. Some of the security impact that Starwood has seen in the evolution of the new reservation system, now undergoing beta testing, is that SOA engenders far more logging and auditing, which must be done for regulatory compliance.

As a consequence, Starwood acquired a security information management system — this one being the RSA envision product from EMC — to handle the logging needed to satisfy regulatory compliance, including the Payment Card Industry guidelines. "With Web services, your logs are everywhere the services are," Foley noted, adding this logging adds to corporate network traffic.