With our solution, the business rules ARE the security policies. The example you gave could be handled in a straight forward manner with a few rule changes, by changing any parameter for inclusion into a certain user group, and with a simple deny access rule to your South American reseller.

The major issue is the vast and largely unresolvable difference between security policies and business rules. For example, at 0900 today the business could decide that the line between Gold and Platinum changes from $100k sales/month up to $150,000 because there are too many Platinum resellers. Oh, and that reseller in South America has been screwing us on large deals, so they will still not be allowed access to this area…

That’s why I always draw a major distinction between “Let the Good Guys In” and “Keep the Bad Guys Out” – major different drivers.

I think what is needed post authentication is an authorization component that has traditionally been missing, and for that authorization component to be successful, it should incorporate the language and rules of business operations.

And anyway, Its just never productive to forecast maximum doom. Like John Dutra at Sun says, “The quickest way to become irrelevant in any conversation is to say ‘the sky is falling’.”

Of course, there is plenty of room for improvement. Breach rates are high and rising. Malware capabilities are advancing rapidly. There’s many skirmishes between enterprises and bad guys where the bad guys come out on top.

I remain optimistic because of: A) ongoing new advances in technical capabilities, and B) new trade-craft; that both point towards a future where the rising tide of breach events can be stemmed and where the malware-driven perimeter incursions can be kept to a tolerable level of damages relative to the (enormous) benefits that a connection to a network provide.