Does authorization equal entitlements?

TalkBack 1 of 8:

Next »

• Thread View
• Flat View

A few points...

First off, I'm glad to see you enlightened individuals come around. I've been in this specific space for close to 5 years, I've been trying to spread the light, but to little avail - good to see it getting some real traction.

I used to claim that "authorization" was just another word for "access control" - I still think that, in a wider sense - but I just understood from this article why some would differentiate, and why the difference is important. "Access control", in your lingo, is about the perimeter - who is in and who is out, whether you can "access" the *SYSTEM*. Authorization is about what you can do when you get there.
To me, these terms are still identical, but for reasons stemming from two inaccuracies, or mistakes, in your description: that this can be done (1) at the perimeter; and (2) should be done for systems.
(1) The perimeter no longer exists, in architecture if not in fact, and is no longer relevant. The perimeter is a networking concept, controlled by firewalls, routers, proxy servers, etc. and is limited to the world of the network.
Which brings me to my second point:
(2) Access control / authorizations should be done for systems. Systems (i.e. hosts, platforms, etc) do not provide proper context for correct authorization. This should be done at the application level.

And regarding Securent, while they are very interesting (I actually took a look at them not so long ago), they don't quite get it - hence the obtuse mouthful of an imperceptive term, "entitlement management".
I can say this based on 5 years doing "entitlement management", whatever that means. Just didn't know that's what I was doing....

Posted by: douglen@...   Posted on: 11/20/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• Email Security and Archiving - Clearer in the Cloud Google The time is NOW for businesses and organizations of all sizes to implement ... Download Now