SOA has their own set of security vulnerabilities. Besides vulnerabilities such as weak encryption that have been faced before, new ones such as replay attacks must be considered. Fortify 360 is one tool to look into for help with these issues. Most importantly, think about security from the start. Your performance metrics might go from acceptable to not once you go from weak to strong encryption, for example. And that could trigger a vicious cycle where you need different hardware or tweaked architecture.