Web Services security specifications include SSL/TLS (Secure Socket Layer/Transport Layer Security), XML Encryption, XML Signature, WS-Security specification family, PKI-related specifications etc. SSL/TLS are implemented in non-XML frameworks at the transport level, and others are implemented in XML frameworks at the application level. These specifications can satisfy the different requirements of Web Services security (confidentiality, integrity, authenticity, authorization, authentication and nonrepudiation). XML-based specifications are propitious to the integration and interoperability of Web Services security. SSL/TLS is sufficient for the basic generic security of internal Web Services projects. WS-Security is probably overkill, especially with the heavy XML processing that is involved in WS-Security.
Survey on Signatured Xml Encryption for Multi-Tier Web Services Security
