Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • Where is the database? Commented Sep 12, 2014 at 18:01
  • Well currently sybase, and likely moving to SQL Server. However, it's been suggested to me that this data should not be stored in the same database as the data it's meant to protect. Commented Sep 12, 2014 at 19:59
  • the answer depend on many different business-aspects of your softwareproduct: How flexible/fine-grained is your role modell? How many different roles do you have? How many end-users exist per Customer/Installation (min/max)? Why is using "Active Directory Groups" not an option for you? Commented Sep 15, 2014 at 14:06
  • 1
    Well, someone actually has to assign permissions for the application or application systems to individual users. The IT department is typically responsible for managing/bookkeeping which desktop applications are available for whom (since they are the ones installing those applications). For more finegrained permissions inside one application system, either the IT manages this too, or you have some "power users" from the individual department, using some application specific administrative form or tool. Commented Sep 20, 2014 at 11:49
  • 1
    Why is storing the information inside your database considered not to be secure enough? Any why should storing that information somewhere else make it more secure? IMHO introducing a second storage system makes the system more complex and thus potentially less secure. Commented Sep 20, 2014 at 11:57