Re: [service-orientated-architecture] Re: Yee on WS/Web Apps Security Threats

[Keith Harrison-Broninski]

Paul Fremantle wrote: 1) "I would say the current failure to implement dynamic RBAC [role-based access control] is because modern business processes are inherently decentralized. Hence you need a "platform" that is also inherently decentralized - i.e., client-side. I really don't understand the connection between "dynamic RBAC" and whether data is centralized or not. The reason that J2EE doesn't implement RBAC control is because it wasn't designed to. Its really that simple. Very few platforms have been designed with a dynamic RBAC in mind. To implement a decentralised dynamic role-based access control system requires a hugely sophisticated security infrastructure. You need an exceptionally strong federated identity system. To give an example from real life, we all take part in a federated decentralised RBAC. We receive email and we have to decide if its from who it says it is. And the fact there is no successful Internet-wide federated identity system is proven by how successful phishing has been. Yes and no, Paul.  As you say, J2EE never set out to solve the dynamic RBAC problem - and email is fundamentally broken, since anyone can edit the headers before sending an email message to make the email appear to have been sent by someone else. However, there are emerging Internet-wide federated identity systems, for example Liberty Alliance and Shibboleth.  Whether or not these ever gain traction, it is interesting to consider what they can and can't do.  In particular, while they claim great security strength, they pay only lip service to the assignment of Roles to process participants - and have no dynamic RBAC mechanism whatsoever. My point in the paragraph you quote above was that to achieve Internet-wide dynamic RBAC - which I think is a must for the new economy - you have to let go of some assumptions.  The main one of these assumptions is that individuals are not suitable guardians of a trust store.  By contrast, my belief is that the only way to create a safe, Internet-scale computing fabric is to give people (as well as organizations) the ability to create and manage their own trust stores - trust stores in which your working partners are assigned not just an identity but also Roles in specific business processes. Does this sound crazy?  If you are locked into the perspective of current tools and techniques, you may be thinking that this sounds far-fetched.  But my guess is that, in a few years, we will be wondering how anyone could possibly have thought it was a sensible idea to try and centralize such controls over working life. -- All the best Keith http://keith.harrison-broninski.info __._,_.___ SPONSORED LINKS Computer software Computer aided design software Computer job Soa Service-oriented architecture YAHOO! GROUPS LINKS  Visit your group "service-orientated-architecture" on the web.    To unsubscribe from this group, send an email to:  [EMAIL PROTECTED]    Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service. __,_._,___