Policy Server Guides › Policy Server Configuration Guide › Implementing Policy-based Security › Strategies for Managing Security and Users

Strategies for Managing Security and Users

A complete security solution should answer the following questions:

• Where is security needed and how much security is needed?
• What kind of tasks will be performed? Security-related tasks?
• What resources need to be protected and what level of protection is required?
• Who has access to the resource and what are they authorized to do?
• How is control over user access to protected resources enforced?

Two of the most common methods for managing users and securing resources are access control lists (ACLs) and security policies.

Security policies provide the most complete security solution by defining not only the type of access a user or user group has to a resource but also what happens when a user or user group accesses the resource. Security policies go beyond the capabilities of ACLs by enabling you to manage the user experience. The SiteMinder authorization model is based on security policies.