Thanks Pablo,
  then what's the most secure way to protect a webservices? should it
be using X509 to encrypt and sign or use SSL with some user name and
password? microsoft didn't provide any recommendation on this topic.
 to my best understanding, using x509 to ecnrypt the sign will involve
certificate management nightmare, imagine that both parties will have
to exchange their certificates, and if one expires, it has to get new
certificate and send the public key to the other party, and both
parties have to switch to the new public at the same time, and this
process has to be mannual, because physical certificate has to be
installed on each box hosting the app.
  on the other hand, if using SSL + username password is secure
enought, there are not much certificate management involved, only the
server side need to get new certificate when it expires, and when
server updates its certificate, the whole thing still works because
public key is automatically sent to the client.

you mentioned ssl is only good for webservice published through http
protocol, are you indicating webservices can be published through other
protocols?

thanks for your help
-bao