In this tutorial we become familiar with the basic security architecture of Web Services. For those unfamiliar with the concepts, we review symmetric and asymmetric security protocols, identity, SSL and GSS-API. We review the options open to developers using Web Services, and make the case for more advanced systems based on the GSS-API framework. We then demonstrate a simple security system on a Web Service.