- Client/server authentication - Authorization - Application guards / firewalls - Message validation - Message size (buffer overflows, etc) - Request whitelists - TSL - Constraints on message content (avoid injections) ... also check out OWASP for other exploits.