This paper will discuss the building blocks of Web services. Web services threats and security requirements, the XML firewall for first-line perimeter defense, best practices for configuring an XML security gateway device, and industry-recommended security testing procedures for ensuring the effectiveness of this security control.