Re: Authorization Framework.

Babu Kopparam wrote:

>Hi Experts,
>
>I am working for product company which own around 80 products.
>My role is to provide security framework to all the teams.
>
>  
>
Good thing. Security is not really unique to any application and so a
solution to 'plug in' an existing framework/system should be sought.
This is the ethos to the Componenet (& Service Orientated) Architectures
that are more and more being utilised.

>I have proposed RBAC (referring NIST's specification) as the suitable
>solution for Authorization.
>
>  
>
This depends on you application needs. Traditional RBAC has grown out of
the historical need for a system administrator to manage a system (as
they were the only ones to have the IT skills to do so). More a more the
access decision should be pushed down to the end-users who are
responsible for the data/process - as they are the ones who truly know
who should have access to what.

>I want to know if my selection is right OR is there any other widely
>used method.
>
>Can you provide some links to gather more information about the same.
>
>Thanks in advance,
>-Babu.
>
>  
>

Particularly if your different applications are integrated you may want
to think along the lines of using an Identity (and Access) Management
system.

Regards,

Sean

-- 
Dr. Sean Radford, MBBS, MSc
[email protected]
http://www.aegeus-technology.com/