Nice whitepaper from Patterns and Practices:  Improving Web Services Security