James Governer has prompted an important discussion on his popular blog regarding ECM and Security. He raises some very good questions while lobbying enterprise buyers to team with him to pressure ECM vendors to respond. I'm sure many ECM vendors will be secretly annoyed about this, for they pride themselves on their security capabilities. But it points to two different perspectives around security. The Architect views security as stopping bad guys from getting in (the Firewall Syndrome). The Document Management view casts security as assigning permissions (the ACL syndrome).They are two sides of the same coin, on the surface seeming similar but nonetheless remaining quite different. One is about putting up barriers, the other about ensuring that the right information is delivered to the right person at the right time. A vendor told me today they had 57 different types of permission levels, managing security not just from an object access viewpoint, but also via state and lifecycle of that object or group....now that is security DM style! It is quite different from (though compatible with) the Architect's world of Indentity Management, Encryption, and Electronic Signatures.

My suspicion is that many of James' (very valid) requests will be met by the emerging ECM platform vendors at the platform level, but not by application providers (bulk of the current ECM crop) who will more rightly focus on their need to manage tight control of content objects. Enterprise Security and ECM Security do indeed need to work in harmony and more standardized platform elements will help this, but two very distinct views of Security will remain: one at the enterprise level, and one at the document administration level.

Alan Pelz-Sharpe is a principle analyst at CMS Watch. Write him at [email protected]James Governer has prompted an important discussion on his popular blog regarding enterprise content management (ECM) and Security. The architect views security as stopping bad guys from getting in (the Firewall Syndrome). The document management view casts security as assigning permissions (the ACL syndrome). They're two sides of the same coin, but they're quite different.