For years, the goal behind security infrastructure has been to thwart—or at least, mitigate—malicious attacks against an organization's secure data. But in today's world of interconnected computer systems and new generation of information technology capabilities, this old-style infrastructure is no longer capable of guaranteeing privacy for sensitive data.

Modern industry needs requires features that are difficult to implement, including:

• Flexible authentication on demand, allowing users to be authenticated with respect to task-specific requirements
• Access control systems that take user context into account, allowing administrators to fine-tune authorization policies
• Real-time authorization and enforcement, allowing systems to consider a myriad of factors beyond a user's organizational position, access point, and prepackaged authorizations when granting or withholding access

Organizations need a security infrastructure that is dynamic, contextually aware, robust, and also flexible enough to support varying security requirements throughout the enterprise.

Authentication requirements can be as simple as verifying the accuracy of a user-preferred ID and password combination. When necessary, same system can also authenticate a user by means of some combination of ID, password, and biometric data. Biometric data can include fingerprints, iris scans, and recognition of signature and/or voice patterns. Authentication systems can also incorporate various digital elements, such as e-tokens, radio frequency identification (RFID) tags, and electronic key fobs. To be broadly effective, security infrastructure should be able to cope with a full range of identification technologies, appropriate for the organization's various trust levels.

Complex relationships between users and data makes it difficult to guarantee security. Role-based access control (RBAC) is an acceptable basis for some authorization decisions, but it often requires other elements powerful enough to enforce data security policies regardless of complexity. This is a big reason why we should create dynamic policy enforcement mechanisms that are independent of any individual application or technology.

As authentication is generally the first step in protecting sensitive data, security personnel should assign each authentication technology a trust level based on its record of reliability, as well as its sophistication and resistance to attack. For example, passwords are generally considered less trustworthy than fingerprint identification, while iris and retina identification technologies are thought to be more robust. Assign the authentication device's trust level after on-site experimentation. Data regarding manufacturers' product rates of false acceptance and rejection tend to be fairly optimistic.

Security administrators can then determine each set of sensitive data's trust level and required authentication. It may be tempting to permit access to highly sensitive data based on the individual's position within the organization, such a policy is unwise. Access privileges should be granted on the basis of each individual's recurring need to work with particular data sets. Should an individual occasionally require access to more sensitive data, the security infrastructure can provide a mechanism by which the user can request and temporarily be authenticated to the higher trust level.

Security infrastructure is often analyzed in terms of three critical components:

• An authentication system responsible for validating current users and establishing each one's level of trust
• A context-sensing system that evaluates information about real-world characteristics of each current user, such as current location or other relevant data
• An authorization system that monitors each current user's data access requests and compares them to permissions policies before granting or withholding access

The goal is to extend traditional RBAC methodologies to bolster data security by means of infrastructure capable of supporting fine-grained authorization policies as well as specific constraints and regulations. This suggests security infrastructure should couple permission systems to dynamic evaluation systems that can include user context information, not simply organizational roles.

Such an infrastructure can provide data security administrators with significant flexibility in specifying complex authorization policies and in making them selectively pertinent to enterprise data structures and applications.

The result is a flexible, yet robust, data security environment that provides for easy expansion, revision, and restructuring to meet the changing needs of an evolving organization in a wide variety of dynamic business situations.