I came across a post from Shaji At about SOA Security. It contains some links to free documents on the subject and websites that sounds promising. Make sure to check out that post!