Firewalls can't protect very well against things like viruses or malicious software (malware). There are too many ways of encoding binary files for transfer over networks, and too many different architectures and viruses to try to search for them all. In other words, a firewall cannot replace security-consciousness on the part of your users. In general, a firewall cannot protect against a data-driven attack--attacks in which something is mailed or copied to an internal host where it is then executed.

Alternate Answer:
Properly configured firewalls can limit the propagation of worms - a form of malware.  Typically, firewalls are edge or parameter devices (separates network zones) and most viruses and malware targets end points (user workstations and servers).

For the most part, things that you do to secure a Web site can be used to secure a Web Service. If you need to encrypt the data exchange, you use Secure Sockets Layer (SSL) or a Virtual Private Network to keep the bits secure. For authentication, use HTTP Basic or Digest authentication with Microsoft® Windows® integration to figure out who the caller is.

An internet site is a normal site that anyone on the internet can access (e.g., www.msn.com, www.
microsoft.com, etc.). You can set up a site for your company that can be accessed by anyone
without any user name and password.
An intranet (or internal network), though hosted on the Web, can only be accessed by people who
are members of the network. They need to have a login and password that was assigned to them
when they were added to the site by the site administrator.

A container that provides the network services over which requests and responses are sent, decodes requests, and formats responses. All servlet containers must support HTTP as a protocol for requests and responses but can also support additional request-response protocols, such as HTTPS.

Stored procedures are database objects that perform a user defined operation. A stored procedure can have a set of compound SQL statements. A stored procedure executes the SQL commands and returns the result to the client. Stored procedures are used to reduce network traffic.

A technology that provides CORBA interoperability and connectivity capabilities for the J2EE platform. These capabilities enable J2EE applications to invoke operations on remote network services using the Object Management Group IDL and IIOP.