Re: [service-orientated-architecture] Re: Yee on WS/Web Apps Security Threats

[Keith Harrison-Broninski]

Here's a thought to provoke discussion.  What if the root of this (massive) security problem is that organizational apps (and data) are mostly located on servers? Many organizations over the last 10 years have set out deliberately to remove all client-side "User-Developed Applications" (UDAs) in the belief that this would reduce overheads.  So this scenario covers nearly all cases at present (including of course all "Web 2.0" apps, in which only the UI is run locally) - and once a hacker gets in to such a server-side system, they've won the lottery. Whether or not this approach has actually reduced overheads is another question, of course, especially when you balance maintenance overheads against the increased productivity many users experienced from their own hacked-up spreadsheets and databases.  But that's a side issue. By contrast to the current approach, let's suppose enterprises were to switch to a truly decentralized model, in which all data, services, etc are supplied by clients, with servers being used only for non-interactive archiving/monitoring/analysis purposes.  The hacker has a much harder problem - not only finding a target to attack (since properly built client software could be run from anywhere), but in making use of any access gained (since they will only ever see a small part of the complete picture).  This supposes standardized, interoperable clients, of course, not a return to the mess of standalone UDAs. Further, it is commonly believed in the security community that security policies based on "Role-Based Access Control" (RBAC) are the most promising approach.  However, to date no-one has created a server-side operating platform that implements RBAC in a dynamic enough fashion to support the kind of adaptive business processes typical of modern human working practice - witness, for example, the J2EE authentication model, which is useless for such purposes.  I would say the current failure to implement dynamic RBAC is because modern business processes are inherently decentralized.  Hence you need a "platform" that is also inherently decentralized - i.e., client-side. [Declaration of interest: part of my work is building client software to implement organizational work processes] -- All the best Keith http://keith.harrison-broninski.info PS: I might write something about this in my blog, so if anyone has relevant references they would like quoted, let me know. __._,_.___ SPONSORED LINKS Computer software Computer aided design software Computer job Soa Service-oriented architecture YAHOO! GROUPS LINKS  Visit your group "service-orientated-architecture" on the web.    To unsubscribe from this group, send an email to:  [EMAIL PROTECTED]    Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service. __,_._,___