Category talk:OWASP XML Security Gateway Evaluation Criteria Project

Here is the outline I propose of evaluation categories:

1.Performance - critical for edge device parsing xml steam and performing de/encryption, signing

2. Administrative 
a) Audit and Logging
b) Monitoring
c) General
 - security of product's components, interfaces, hardware compliance
 - ease of use, installation

3. XML Gateway capabilities
Routing capabilities available
Supporing for WS-routing, WSCI, WS-Coordination, WS-Security, WS-SecureConversation, etc) 

4. XML Firewall capabilities
XML threats covered 
   a) Unauthorized access
     - Authentication (WS-Security token replay)
     - Auth/Authorization (Canonicalization of inputs, principle spoofing, modification of SAML attributes)
     - Interoperability with rights/privilege standards (XACML, WS-Policy)
     - Interoperability with authentication SSO (SAML, WS-Federation, ADFS. XKMS)
     - unsafe code (format string, CSS, parameter tempering, buffer overflow, sql injection, race conditions, malformed content)
     - malicious code (virus scanning)
   b) Data Tempering
      - message capture/update/replay ( checksum spoofing, principle spoofing, timestamp spoofing, canonization for DSig, intelligent tampering)
      - unsafe application code (SQL injection)
   c) Information Disclosure
     - probing (eavesdropping, forceful browsing, directory traversal, WSDL scanning, error messages, registry disclosure)
     - external reference (Schema poisoning, routing detours, external entity)
     - unsafe application code (XML Injection, URL String attack, external references)
   d) Denial of Service
     - coercive parsing (recursive payloads, oversized payloads, replay-flooding)
     - unrestrained registries ( UDDI, ebXML Spoofing)
     - unsafe application code (inadvertent XML parsing DoS)