The present invention presents a device and a method for handling security in a computer system comprising an existing organizational directory. Upon reception of an access request from an entity to a server machine of the system, the device creates or searches in a security directory for security data attached to the entity, without modifying the data of the existing directory.