Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet.
Given the port sharing abilities of IIS, or even that a web developer can host a WCF application unbeknownst to the IT security team, I think that the IT security team should have some control over what is exposed and it's configuration.
Examples of WCF configuration include: Protocol choice, encryption method, and which executable methods are exposed.
- Do you agree that this technology should be considered in-scope for the IT Security Team.
- How would you sell this to management for inclusion (given that you're not a manager)
- What processes would you put in place for auditing and deploying this technology?
- How would you define support boundries with the application team?
- ... other items
Part of the reason I ask this question is that at the large companies I worked for, SOAP security was out-of-bounds for the same group that handled perimeter security (often the same group who handled the firewalls and routers).
Perhaps the size of the organisation should be taken into account when asking this question. Is it unreasonable to expect a Firewall administrator to also understand WCF/Metro?