Technical Support to SOA Governance

1. Technical Support to SOA Governance E-Government Conference May 1-2, 2008 John Salasin, Ph.D. DARPA 571 218-4925 jsalasin@darpa.mil jsalasin@verizon.net

2. Objectives • Provide examples of Governance functions that need (should have) automated support. • Using functions that one or more infrastructure vendors claim to provide.

3. Outline

4. Governance Definition • "specifying the decision rights and accountability framework to encourage desirable behavior in the use of IT.”* • Peter Weill, Richard Woodham, “Don't Just Lead, Govern: Implementing Effective IT Governance”, MIT Sloan Working Paper No. 4237-02, Massachusetts Institute of Technology (MIT) - Sloan School of Management, April 2002 includes “….leadership and organisational structures and processes that ensure that the organisation’s IT sustains and extends the organisation’s strategies and objectives.”

5. Policies (Design/process guidance) • Standards compliance—for example, WS-I Basic Profile compliance for service interfaces • Use architectural assessments, including reviews and change processes • Use architecture documents and guidelines covering use cases, views, service interface design, and design patterns • Use service-based application blueprints • Adhere to reference architectures • Provide policy assertions at multiple levels of granularity

6. SOA Infrastructure Support (Run-time)(1 of 4) • authentication and authorization, encryption, logging, auditing and service versioning in a centralized and configuration-driven approach • auditing and logging for compliance • enforce architectural standards, guidelines, and processes during design and construction • Support continuous evolution through dynamic deployment of BPEL and SOA artifacts and version management at multiple levels of granularity. • Execute process persistence policy • Provide registry integration by importing WSDL definitions and XML schemas from enterprise stores and publishing new interfaces • Automatically collect and populate the registry / repository with existing services and other assets

7. SOA Infrastructure Support (Run-time)(2 of 4) • Support policy assertions for partner interaction • WS-Policy assertions at multiple granular levels • Web Service invocation retry policy (policy can be programmatically asserted) • Setting JMS messaging properties through WS-Policy assertions • Support exception management • Process may be suspended on uncaught fault for examination and recovery • Provide a (WS-Distributed Management) standard-based secure remote deployment and management interface

8. SOA Infrastructure Support (Run-time)(3 of 4) • Deliver the critical traceability necessary for accurate impact analysis, change management, risk management, and optimized reuse • Map and manage existing relationships and dependencies that connect services, assets, business processes, policies, and applications • Automatically discover, map, and manage new dependencies as the service network expands • Support impact analysis with visualization into the composite flow of individual services or applications • Keep service metadata up to date through automated introspection • Automatically publishe service metadata, response time statistics, service level objectives, historical statistics, exceptions, and other vital information and key performance indicators • Automate notification of policy changes that affect services

9. SOA Infrastructure Support (Run-time)(4 of 4) • Establish visibility into the architecture, relationships, and interdependencies that connect assets to each other, to the policies that govern their use, and to the projects that produce and consume them • Collect and communicate information on service performance, quality, and compliance with corporate standards • Automate processes to control the creation and registration of services and related assets • Automate processes to control the creation and registration of services and related assets

10. Value Discriminators Do the Governance-related mechanisms: • Cover the complete life-cycle, starting at service conception and extending to services and consumers in the operational environment—including unanticipated rogue services? • Provide every stakeholder with a clear, easily understandable view of planned and available services and other software assets to reduce duplication and optimize reuse? • Support human, approval-based processes through automated workflow, including community reviews, lifecycle transitions, and change management? • Reduce risk and promote trust by ensuring that services and other assets meet standards and guidelines before they are promoted for broader use? • Help enforce architectural standards, guidelines, and processes during design and construction? • Ensure that projects and the assets they consume align with goals and policies? • Communicate both the existing and to-be states of the architecture and track progress?