Exactly -- for his example of a financial services system, just buy the commercial version, or tunnel using ssh. You can also encrypt the underlying file syste

Exactly -- for his example of a financial services system, just buy the commercial version, or tunnel using ssh. You can also encrypt the underlying file system using your OS's tools. I can't speak to how financial institutions use, say, Oracle's authentication and authorization. Most web apps & services use their own logic to manage access control. I'd love to hear what someone form that industry has to say. (An "architect" preferably. Not a mere "developer", who are the cause of this whole security problem ;) ).