IBM WebSphere V5.0 Security - CGISecurity

There is a business wide change in focus from implementing application specificsecurity in order to prevent inappropriate users from accessing resourcestowards attempting to develop both a common and consistent security policy andbase its implementation on common reusable security services andinfrastructure.This is about controlling Network Identity, correctly identifying a user once viaAuthentication and passing that identity together with credentials through to theother components of the e-business infrastructure, applications included. Thenthe permissions for that identity can be tested locally and access givendependent on the security policy for those resources via Authorization.The externalized security provided by Access Manager includes strategies toinclude legacy applications in Single Sign-On solutions through integration withpre-existing user registries and authorization databases.If, regardless of which application a user accesses within an enterprise, theyalways log on with the same ID and password (although there may be arequirement for stronger authentication or re-authentication, perhaps token orcertificate-based around particularly sensitive information or high valuetransactions), then that consistent user experience appears, from the user’sviewpoint at least, as Single Sign-On. Attempting to ensure users have only asingle identity within your network increases the likelihood of leveraging existinginfrastructure to actually provide it.The central definition and management/administration of security policiesprovides a number of benefits.►►►►►Reduced security risk through ensured consistency from a services-basedsecurity architecture.Lower administration costs due to centralized administration of a reducednumber of security systems. This also allows for the “de-skilling” of supportstaff as the security policies are based on a single application suite ratherthan, as in many current examples, the multiple and different operatingsystems of chained infrastructure platforms.Faster development and deployment with a common services-basedarchitecture.Reduced application development and maintenance costs from increasedefficiency and productivity by saving on isolated system and/or applicationspecific security development effortsFor those industries where legislative compliance impacts security,forexample privacy requirements, centralized architecture provides a moreresponsive environment as well as a single point to apply policy.Chapter 12. Tivoli Access Manager 373