The Data-Centric Security for the Extended Enterprise whitepaper discusses four ways IT must change. They are
- Define business policies, not permissions.
- Manage attributes, not user groups.
- Control access to information, rather than securing containers.
- Make it easy for end users.
The paper states that ABAC provides a dynamic way to turn business rules into security controls structured explicitly around attributes of data that reflect business value. Do you think ABAC can address data-centric security sufficiently? What the challenges to implementing ABAC?
(Visited 128 times, 1 visits today)
