Basically, there are two ways that Web services security can be implemented. First is channel level security management. The second is modifying package to enable it to support security.

In channel security, there is no need for the developer to know anything about specific implementation. Standards-based mechanisms are used to create secure conversation between two systems using each other’s Web services.

The second method involves configuring a local certificate server and send out the certificates to companies that need to access Web services. You can configure your system to allow only Web services calls over secure PTP connection.

Choosing on which of the methods to use in implementing security would depend mostly on what is more beneficial to the companies that access your Web services.