# SP-004 SOA Publication and Location Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Security architecture for protecting service registries and discovery mechanisms in service-oriented architectures. Addresses access control, change management, and certification of services published to UDDI, WSDL, and modern API registries.
Use when: Use this pattern whenever your architecture includes a service registry, API catalogue, or service mesh that mediates discovery between service providers and consumers. It is particularly important when you can distinguish between trusted and untrusted callers -- for example, internal services versus partner-facing APIs.
Not when: If all potential service consumers are equally trusted and operate within a single, tightly controlled environment with no external exposure, the overhead of full registry protection may not be justified.

## Controls (10, NIST SP 800-53 ids)
- Critical (4): AC-03, AC-05, CA-04, CM-03
- Important (5): AC-01, AU-01, CA-01, CM-01, SA-03
- Standard (1): SA-08
- Withdrawn from SP 800-53 by NIST: CA-04 (now in CA-02)

## What each critical control mitigates (4)
- AC-03 Access Enforcement: T-SR-001, T-SR-002, T-SR-003, T-SR-005, T-SR-006
- AC-05 Separation of Duties: T-SR-001, T-SR-004
- CA-04 Security Certification: T-SR-003, T-SR-004, T-SR-005
- CM-03 Configuration Change Control: T-SR-002, T-SR-003, T-SR-004, T-SR-007, T-SR-008

## Threats and the controls that mitigate them (8)
- T-SR-001 Unauthorised Service Publication: AC-01, AC-03, AC-05
- T-SR-002 Registry Entry Tampering: AC-03, CM-03, AU-01
- T-SR-003 Service Impersonation via Endpoint Redirection: CA-04, CM-03, AC-03
- T-SR-004 Rogue Developer Publishing Malicious Service: AC-05, CA-04, CM-03
- T-SR-005 Rogue Supplier Injecting Unauthorised Service: CA-01, CA-04, AC-01, AC-03
- T-SR-006 Discovery of Sensitive Service Metadata by Unauthorised Consumer: AC-03, AC-01
- T-SR-007 Uncontrolled Service Contract Change Causing Cascading Failures: CM-01, CM-03, SA-03
- T-SR-008 Stale or Deprecated Service Exploited After End of Life: SA-03, CM-03, SA-08

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-004/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-004/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 16 KB: /api/v1/patterns/SP-004
- Page for people: /patterns/sp-004/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-002 Server Module; SP-005 SOA Internal Service Usage Pattern; SP-008 Public Web Server Pattern; SP-011 Cloud Computing Pattern; SP-016 DMZ Module

This card, the API and the page are generated from one file. Checking one against another adds no evidence.