Actually I am well versed in security. I have been programming for over 20 years. what I am not sure about is how to secure a soap/web server.

What you are saying is you believe ssl (which would handle the encyption) along with authentication headers should be enough. I do not know enough yet to disagree but have a couple of questions...

what about denial of service attacks?
do you think a digest (hash key) would be needed for integrity?

what I meant by a soap firewall is basically a process (or dll loaded by the web server...not sure) that accepts all soap/xml requests and does the validation. if it passes the security measures then it lets it go to the server. otherwise it rejects it.

any thoughts/comments from anyone is truly appreciated.