I came across this very good article discussing web services security: Security Concepts, Challenges, and Design Considerations for Web Services Integration. It discusses concepts and design in a very straightforward manner.