Blog

Getting Started with IAM Co-Sourcing: Operations Management (Part 2 of 2)

Share

 

In part 1 of this two-part article, we provided the context and motivation for organizations to adopt a viable model for handling its IAM infrastructure operations. In this article, we will discuss options available to address this need.

What Are the Options?

Symptoms such as the ones described in part 1, indicate that your IAM operations are not optimal, and that perhaps your organization is not well poised to optimally run the environment.   They are also, entirely common to any IAM deployment of any size and scope; particularly, Enterprise deployments.  So what options do you have?

Here is what has been traditionally available:

• Insourcing – this was the de facto option up to five years ago. The organization bit the bullet, hired expensive and specialized talent, trained these resources on the IAM product, invested in their ramp-up, often shadowing during the implementation cycle, and retained them to support, maintain and evolve the infrastructure.  For the most part, this model has only worked well at large organizations, which can afford having dedicated staff that can be groomed to take over the operations management role.  But for the majority of organizations, the operations staff is not dedicated and rarely has the right skill set and experience to take on IAM. For the most part, the resources are either too expensive or not available in the geographic location where [and when] the organization needs them. With luck, the organization will retain these resources long enough to realize a return on the investment, before seeing them go to an IAM consulting firm or an IAM vendor company.
• Outsourcing – this option is more predominant nowadays. The organization contracts with an external provider who assigns a support engineer onsite or remotely to look after the IAM operation. They are typically focused on break-fix and remediation of issues, not on the ongoing evolution and configuration changes to the IAM infrastructure. The experiences tend to be mixed according to what we have heard from customers:
  • On one end of the spectrum you have offshore outsourcing, which is great from a cost perspective, but is a nightmare from a cultural and organizational fit standpoint. There are varying degrees of overall satisfaction with the level of competency of these resources, and the effect of the time zone and communication barriers.
  • On the other end, you have the onsite consultants who work alongside the customer staff. This scenario tends to work better from a customer satisfaction standpoint, even though attrition is an issue. Cost tends to be high, making this a less appealing option to executive management.

The Answer, well... Our Answer

At Identropy, we propose a different model to address this need: IAM co-sourcing.

The idea is to have a mix of staff and technology working together to optimize the operation of the IAM infrastructure. This model is delivered as a co-sourced managed service that combines a lightweight on-premises footprint with a cloud-based backend to provide a best-in-class operations management solution for IAM infrastructures. The organization can outsource monitoring, reporting, maintaining and remediating issues in their on-premises IAM infrastructure via a scalable service that is governed by defined service level agreements (SLAs), managed by a team that specializes in – and has a deep pool of IAM knowledge to draw from – IAM infrastructure and delivery.

This model enables the organization to scale operation management of their IAM infrastructure cost-effectively and with sound IAM expertise, without having to increase their Operations staff.

How is this Different from Traditional Monitoring and Support Models?

This co-sourced model provide much more than traditional system monitoring (i.e., monitoring that a system is up and running). It specializes in the IAM functionality that the customer cares about: Are events being synchronized to the target system?  Are the LDAP queries returning the expected values in the appropriate time? Are there events being queued up in a particular workflow? Is the Acces Request web interface available and can users log in to it?  Through a specialized correlation engine, it determines whether that behavior is abnormal for a given organization. All of these considerations go above and beyond pure system monitoring.

Additionally, the co-sourced model offers more than a break-fix service for issue remediation, since it also includes the notion of proactive up-keeping of the environment and incremental evolution, configuration changes, patching and preventive maintenance of the IAM environment.

It alerts customers when their IAM vendor releases a software update, whether a patch or an actual release. Which helps them stay on the upgrading or patching treadmill.

Lastly, it offers location independence for the IAM infrastructure, allowing customers to decide whether they want to host their IAM infrastructure in-house, or elsewhere, without trading off the operational efficiency they require.

Where to Go from Here?

We believe that this model introduces a paradigm shift in IAM thinking, and one that makes the deployment location choice a moot point from an operations perspective, addressing the organization’s concerns with the ongoing support and maintenance of the IAM infrastructure. Hence reducing the IAM operational risk for the organization.

An organization can adopt this model today with an in-house IAM environment and evolve into a managed services, hosted model later on, all while preserving the operational efficiency it requires.

As we announced recently, we are introducing a set of Identity Services under the SCUID framework that provide specific IAM functionality in a co-sourced model.  All of these Identity Services hinge on [and include] SCUID Operations for operational management, which allows us to scale effectively and offer a cost-effective and SLA-governed service offering to our customers.

In future articles, we will discuss the merits and rationale behind some of the other services that are part of the SCUID framework. I would love to hear your thoughts.

Getting Started with IAM Co-Sourcing: Operations Management (Part 1 of 2)

Share

 

For some time, we have been discussing the advantages of a co-sourced model for Identity and Access Management (IAM).  In this two-part article, I will focus on the first logical step for migrating from a traditional IAM deployment model towards a co-sourced, managed service model: IAM Operations Management.

Let’s face it, while there are lots of merits to “ identity-in-the-cloud” services models, they are not yet a mature technology so organizations are somewhat reluctant to fully embrace and adopt them.  Another reason is many organizations today already have some sort of IAM footprint in their environment.  Therefore, for the foreseeable future, organizations will continue to deploy IAM infrastructures on-premise.  I use the term “on-premise” to also include – co-located or hosted IAM environments that are considered part of the “internal” IT environment or the organization.

For it to succeed, any new deployment model for IAM would need to provide flexibility and allow for the IAM infrastructure to be hosted on-premises as a starting point, even if it is managed remotely or delivered via an appliance-based model.  Forcing organizations to move IAM infrastructure off premises from the onset will most likely not succeed.

This flexibility is what we refer to as location independence – it does not matter where the organization wants to host its IAM infrastructure.

The Question

So, how can organizations start shifting from traditional IAM deployment models towards a co-sourced, managed services model in a location-agnostic manner? Our answer: start with a managed services approach for IAM operations management.

This is something we have learned, and validated from over two years of working closely with customers across various industry verticals, such as Government, Retail, Financial Services and Healthcare. A managed services approach to operating and maintaining the organization’s IAM infrastructure is very appealing.

This is what we offer through our SCUID (Secure, Co-Sourced, Unified IDentity) Operations service.  It provides a cost effective solution that enables organizations to optimize the operations and maintenance of their IAM infrastructure.

Symptoms and Behavioral Patterns

Over the years, helping customers implement their on-premise IAM solutions, we have learned that traditional deployment models for IAM have very common behavioral patterns once the deployment is transitioned into production:

• Call for help - Most customers approach IAM implementations as projects, so once the implementation is completed, the team is dissembled and the know-how is diluted. The implementation team, often an external consulting firm, disengages. Despite good documentation and knowledge transfer, the customer’s operational staff still ends up needing to ask questions about their environment.  For the most part this need is only realized during an emergency/outage or during a change [gone wrong]. In these cases, the operations staff calls on our consultants directly asking: “do you remember what was the command we used to make X happen?” “Which configuration parameter was the one I needed to change to make Y happen?”   These questions did not exactly go away over time but kept coming. This indicates that the organization may not be ready to optimally maintain and operate its IAM infrastructure.
• Fall off the upgrade treadmill – When the IAM implementation is rolled into production, the software products involved are typically up to the current and recommended patch level.  But as with any software, and especially Enterprise software, the vendors release fixes and patches, which customers then need to apply, and in some cases are required to, in order to continue to receive support.  Or worse yet, when an issue is found and the customer calls the vendor support desk, the first question from the support personnel is: “what version and patch level of the product are you running?”, and almost immediately after the answer, comes the dreaded: “you need to be on patch level X [typically the latest or thereabout]. Please apply this patch and call us back”. And voila, now the customer needs to make a decision: undertake the upgrading or patching on its own, or start a consulting project to bring in external expertise to plan and carry out an upgrade.  And in many, many cases, these decisions need to be made while the “house is on fire”.  Definitely not the best situation to realize that an IAM environment needs to be actively nurtured to stay operational.
• Need to make minor changes – After the IAM environment has been in production for some time, customers’ needs evolve incrementally. A few weeks after deployment,
  
  • the approval group for a given workflow has to be updated,
  • a new user attribute needs to be added to the profile,
  • a new application is being integrated for provisioning,
  • a target system is being upgraded or patched and the provisioning connector now needs to be updated and/or reconfigured.

In most cases, these changes are reactive (i.e., the situation presented itself without much warning), and the impact to the interested line of business or stakeholder needs to be dealt with promptly (i.e., I cannot delay my ERP upgrade simply because you don’t have the provisioning connector for this version or it has not been certified by your IAM vendor). Now what do we do?

Has your organization experienced any of these symptoms?

In part 2 of this article, I will discuss traditional and new options available to addressing these symptoms.

IAM Assets Often Overlooked in the Enterprise

Share

 

After reading very interesting posts by Earl Perkins at Gartner, an article from Deloitte on financial institutions making Identity and Access Management (IAM) their #1 priority, and my friend Nishant Kaushik's recent series on Federated Provisioning and the Cloud, which is brilliant and thought provoking (nicely done Nishant); I felt compelled to chime in.

Having drunk the identity assurance cool-aid for way too long, I can't help but think about IAM in terms of risk and assurance levels, the yin-yang balance sort-of-speak. So, before thinking about automating and deploying technology, I wonder what kind of risk is being mitigated and what kind of investment is warranted to provide the right level of assurance. In reaching equilibrium, one will inevitably follow the path of maximum value at the lowest cost possible.

So, with that thought in mind, I have been considering "lazy" assets that often exist in the Enterprise. They have significant potential in helping organizations derive higher levels of assurance, without significantly increasing cost, and can also add greater value to IAM initiatives.

Notwithstanding the great thoughts of Earl and Nishant, here are three examples of such assets, and my attempt to illustrate their use in real life.

User Activity Logs

I referred to this in prior blogs dealing with the topic of identity activity monitoring. The point here is to think about how one could utilize information collected from system or application logs, particularly if they contain traces of identity that can be used to link activity to a human being.

With the maturity and pervasiveness that SIEM technologies have nowadays in the Enterprise, deriving value from correlating and reporting on data (whether near real-time or historically) is relatively simple and inexpensive. This information can prove crucial in increasing visibility into day-to-day risks such as insider threads, segregation of duty violations, detecting terminated accounts activity, and other undesirable scenarios that would normally go under the radar of traditional IAM infrastructures.

We see this as a clear trend that is here to stay. More and more customers in different industry verticals (from energy to financial services) are gravitating toward identity activity monitoring as an important part of their IAM initiative. And based on our insight, the benefits make for a great business case.

Employee Identity Proofing (ala US Form I-9)

I touched on this point within the context of a two-part blog posting regarding identity assurance in everyday life. In the US, the Employment Eligibility Verification Form I-9, constitutes a great identity proofing mechanism, yielding (for the most part) an Assurance Level 4 (AL4) compliant verified identity in accordance to the Kantara Initiative Identity Assurance Framework (as well as NIST SP 800-63).

I realize that this statement is a controversial one since many would argue that the form I-9 verification process is inconsistently followed and audited. This inconsistency was a precursor to the work being led by NASPO, specifically by Graham Whitehead. However, many organizations enrich their employment verification process with "know-your-employee" checks that help them meet high-risk mitigation and compliance requirements. This is particularly true in regulated industries such as financial services, healthcare, pharmaceutical, and aerospace and defense. Hence, I argue that this high-quality identity proofing constitutes a valuable asset to the organization.

For instance, this proofed identity could be leveraged in some instances to issue AL4 credentials. Examples include credentials issued within federations such as CertiPath in the aerospace and defense industry, SAFE-BioPharma in the bio-pharmaceutical industry, or by other credential issuing authorities cross-certified with the Federal Public Key Infrastructure (FPKI) Policy Authority.

There are multiple benefits that an organization can derive from using these credentials, whether within its firewall or outside it. For example, in the biopharmaceutical industry, paperless R&D is achievable by leveraging legally accepted digital signatures that comply with the SAFE-BioPharma standard. These signatures are accepted by the FDA for eSubmissions, by the US Patent Office, and within the EU as legally accepted in conformance with the Electronic Signature Directive (1999/93/EC). Therefore, significant value can be derived from the use of these credentials, which can be issued by leveraging the high-quality-identity-proofing asset the organization had to perform anyway.

Similar examples can be found in various industry verticals, such as the KYC (Know-Your-Customer) standard in banking, which conforms to the US PATRIOT Act requirements. Hence, if one can verify that the identity of an individual is that of a DDA account holder, this could be evidence of an antecedent high-quality identity proofing, which can be leveraged to issue a high-assurance credential. This could be an effective and scalable approach to proofing the identity of non-employees (i.e., contractors, vendors, suppliers). In this case, the organization could leverage the fact that an individual has a DDA account as a lazy asset (created by banks) to streamline and increase the assurance of the identities of non-employees with whom it interacts.

Employee and Non-Employee Data

Another approach to minimizing risks and increasing identity assurance in the Enterprise is leveraging existing data about active or departed individuals, whether employees or non-employees. The idea here is to leverage information that has already been captured and used about individuals to mitigate risks at the point of entry (i.e., on-boarding, registration).

I was introduced to this concept in 2007, through what is known as NORA (Non-Obvious Relationship Awareness). This technology mines data resources to determine relationships between people. As Tim O'Reilly explained, it has applicability in various real-life scenarios. I later had the chance to meet Jeff Jonas at a presentation on the topic of identity resolution. I was really amazed by the power and applicability of this approach. It leverages existing data assets that organizations may already have (but may not be leveraging in this way), to detect potentially risky individuals based on known data traces that indicate high risk.

Rumor has it that NORA was the technology used to catch the MIT Blackjack Team. For those who don't know them, they're a group of students and alumni from the Massachusetts Institute of Technology, Harvard Business School, Harvard University and other leading colleges that used card-counting techniques and more sophisticated strategies to beat casinos at blackjack worldwide. This was the inspiration for the movie "21".  Some believe this approach is being leveraged by intelligence agencies worldwide in fighting terrorism and organized crime.

NORA or NORA-like technology has matured and is available today, allowing organizations to easily determine who to let in and who to be weary about. Scenarios that immediately come to mind include re-hires, employee-to-contractor moves and vice-versa. Organizations can look back in history to determine if the same individual (or someone closely related) performed fraud, was fired for cause, or had some sort of "unpleasant" departure. At a minimum, having the ability to detect and handle these cases as exceptions could significantly help the organization mitigate possible risks by leveraging information assets it already has.

These are just three, poorly digested examples of how "lazy" assets that most organizations already possess can be leveraged to derive more value in IAM today, at a nominal cost. This approach can prove beneficial given the budget-constrained, fraud-riddled times we live in.

I am most interested in your comments.

Are MSSPs the future of IDaaS?

Share

 

Or is it the reverse: Is IDaaS the future of MSSPs?  That is the question...

For some time now, I have been talking about Identity as a Service (IDaaS) and discussed a few approaches to IDaaS for Enterprise Identity Management, which truly set a baseline for what we believe is the next paradigm in Identity and Access Management (IAM): the shift towards managed services, away from traditional Enterprise deployment models.

Are we talking about a paradigm shift?

I believe we are.  Let me illustrate with a few questions:

1. Have you been involved in, or responsible for, the deployment of an IAM solution?
2. Has this deployment succeeded in meeting the business objectives and stayed within the timelines and estimated budget?
3. Has your organization needed only one attempt to implement an IAM solution, without re-architecting, replacing technology vendors or system integrators, etc?
4. Is your organization able to measure the return on investment (ROI) on this initiative?
5. Lastly, was your ROI positive?

After over 12 years of experience deploying IAM solutions, large and small, I have seen only a small percentage of people who answered these questions in the affirmative. Even though the number has increased over the years, it is still not as high as most would want or expect, given the availability and maturity of IAM technology.

Why is this so?  Many respondents cite issues with the technology choices underpinning the solution. Others point to a lack of alignment and sponsorship between technology and business stakeholders. Some say that there were no clear business objectives and expectations were not properly managed.  A few venture that IAM solutions are complex and difficult to implement and underestimating their size or complexity proved a recipe for disaster.

All of these are valid reason.  But does this mean that most IAM solutions are doomed to fail?  The answer is not very encouraging if you follow "traditional" deployment approaches. To date, most if not all IAM deployments follow a scenario like this:

Faced with requirements from the business, IT selects a technology vendor, allocates the environment in which it will run (hardware, software, network, and data center), and in most cases engages a system integrator to help design the architecture, map the business requirements and processes, and implement the solution.  Once deployed, IT is then tasked with hiring, retaining, or developing the qualified personnel it needs to operate the infrastructure.  As we discussed in a recent blog post titled "Top 10 Common Pitfalls of an IAM Initiative", this combination of factors causes most projects to run longer and cost more and, in many cases, do not meet the business requirements they were meant to address. The organization is then left with a capital expenditure that needs to be recovered over time.  Therefore, IT embarks on programs looking to integrate more applications and absorb more environments (M&A, intranet, extranet, etc.)-and their success rate increases only marginally.  In many cases, attrition of the internal personnel further complicates the ongoing success of the deployment.

Sound familiar?  The fundamental issue with the "traditional" approach is that the organization's best interest is not well aligned with that of the partners it relies on to undertake the deployment.  The organization is at the center of the storm, looking at mediating and balancing the interests of vendors, system integrators, and, its own staff, who are typically not qualified to deploy an IAM solution or aware of its complexities.

This is why a new approach is needed-one that aligns more closely with the interests of the organization.

 In my view, this paradigm shift is the motivation for IDaaS.  One could also say that the economic conditions of the last two years, combined with the rise of the Software-as-a-Service (SaaS) model have been catalysts for this new direction.

But what is different about IDaaS?

The idea with IDaaS is that rather than having the organization strike a balance among the interests of vendors, system integrators and its own staff, an external entity acts as a trusted provider, entering a long-term relationship that is gauged by measurable results (i.e. SLAs, performance metrics, delivered milestones, etc.)

From the organization's standpoint, this model can alleviate the need for selecting, purchasing, and depreciating IAM technology; building, maintaining, and operating the IAM infrastructure; customizing and integrating various products; and staffing, training, and retaining personnel to manage the IAM environment, all of which will immediately translate in a reduction in costs.

The idea is to engage a trusted provider to build, integrate, deploy, and operate an IAM infrastructure that suits the organization's requirements. This approach should reduce upfront costs (not needing to procure hardware and software and their respective maintenance annuity), which are now blended as part of the managed service.  Likewise, by not having to recruit, train, and retain specialized staff to operate the environment, the model expedites deployment timelines and reduces operational costs and risks to the organization. For the provider, the need to reduce the implementation timeline and create the capability of a repeatable model forces it to streamline the deployment process and ensure that it is done with such quality that its operation after deployment requires minimal involvement. In the end, these elements accelerate time to value.

Under this model, the trusted provider is involved in the delivery of the IAM solution, which is then governed by established parameters and service standards. Whether it is hosted on premises or outsourced (in the "cloud"), in the end the organization sees immediate and measureable value for the services they purchase-in a predictable and simpler manner.

Well, this kind of sounds like an MSSP model?

Bingo. This is precisely our prediction: the IAM deployment model as we know it is already being transformed from a highly complex approach toward a simpler one. It does not mean that IAM technology is simpler; it just means that the deployment model needs to get simpler. 

"Everything should be made as simple as possible, but no simpler." - Albert Einstein

From my standpoint, this is just a natural evolution, and while it will take time for it to pan out, it is already at play, as evidenced by events like these:

• April 27, 2010: Verizon and Novell Unveil Cloud-Based Security Solution - an interesting quote from the announcement grabbed my attention: "Additionally, as part of this agreement, Verizon will be Novell's preferred identity and access management managed service provider."
• December 12, 2009: SecureWorks Expands its Global Operations and Services with the Acquisition of UK-based dns Limited - here are two relevant quotes from the announcement: "For ten years, dns has been delivering a wide range of security services to its clients, including an innovative Identity and Access Management Service"; and "SecureWorks is expanding the scope of its service offerings with the addition of dns' Identity and Access Management Practice which will benefit clients worldwide."
• May 14, 2007: Verizon Business acquires Cybertrust - and the quote: "Cybertrust's services include identity management, managed security services, vulnerability/threat management, security certification programs and a range of professional services..."

Similar events have been taking place for some time, such as IBM Managed Identity Services (part of IBM's Managed Security Services) and BT's Identity Administrations Solutions.

If you follow this logic, you will see that two paths are intersecting:

1. Established MSSPs are adding IAM to their model because they want to differentiate and grow their role as a trusted partner to their clients or are responding to client pressure.
2. IAM solution providers, and even software vendors, are evolving and embracing the SaaS model, and as such are starting to morph into MSSPs with a focus on identity, or as I like to call them: MISPs (for Managed Identity Services Providers)

Our prediction

Over the next three years, IAM will shift from the traditional deployment model (buy, host, deploy and operate) to an IDaaS model, making the latter the default. IAM technology will be mainly designed to enable IDaaS deployment models, and customers will most likely procure IAM via their MISSP of choice.

Identity Assurance, an everyday life issue (part 1 of 2)…

Share

 

In this 2-part article, I hope to explain the importance of identity assurance in everyday life. I will first level set on terms and definitions in part 1, and then illustrate with real-life examples in part 2.

The notion of identity assurance is to establish, with a level of certainty, that the human being represented by a credential in an electronic transaction is in fact the alleged person. Whether you realize it or not, whenever you perform an electronic transaction, you are making some kind identity assurance tradeoff.

Identity assurance does not only apply to scenarios in the extranet in which consumers or users from one organization interact with systems in another. It also applies within the enterprise where you need to view identity lifecycle management holistically, as opposed to fragmented steps, such as provisioning, authentication, single sign-on, etc.; and how they contribute to creating and maintaining identity assurance.

My Personal History

In late 2006, I was first introduced to the issue of identity assurance as a trend in identity management.  It all started with the FFIEC's October 2005 guidance on Authentication in an Internet Banking Environment. It appeared on my radar as I was strategizing on the future of web access management and the product portfolio for which I was responsible. I was also wrestling with transaction assurance and access management 2.0. At the time I did not realize the profound impact that this concept would have on my career.

In late 2007, as I was managing a high-assurance digital identity service offering at a large global bank, I was introduced to Liberty Alliance Identity Assurance Expert Group. I joined the group as a co-chair which led to my current role as Chair of Kantara Initiative's Identity Assurance Work Group that is responsible for the Identity Assurance Framework. It works closely with the Kantara Initiative Identity Assurance Certification Program, which actually instantiates the framework in an actual program.  So, I guess you can say I have become an identity assurance activist.

It's All About Risk

In any electronic transaction where a human is represented, an implicit identity assurance tradeoff is made. A human may be represented in a transaction by providing a user name, email address, or simply by checking off a box accepting certain terms and conditions. The question is whether we are aware of or comfortable with the tradeoff. In all instances, you and the party with whom you are transacting are agreeing that your identity can be representing in this way for this transaction, and accept the consequences of what might happen if something goes wrong (i.e. your credentials are spoofed or compromised, or you chose to share your credentials with somebody that acts on your behalf and does something wrong).

The higher the sensitivity of the transaction, the higher the confidence (i.e. assurance level) you would like to have.  Therefore, an identity assurance level (AL) should map to the risk level in any given transaction.

All identity assurance documentation that I have read or been involved with converge on four basic levels of assurance:

• Level 1: Little or no confidence
• Level 2: Some confidence
• Level 3: High confidence
• Level 4: Very high confidence

OMB Memorandum M-04-04 illustrates this rationale from the perspective of the US Government. It effectively explains the application of identity assurance to transactions, considering the impact of something going wrong, and also the expected frequency of its occurrence. Below is a table I borrowed from this document that focuses on authentication.

Advice:  Be aware of the sensitivity of a transaction. Think through the mechanism employed to mitigate risk and if it is sufficient enough to convey the appropriate level of confidence. Consider the intersection of identity assurance with your data and risk classification.

It's Not Just About Authentication

Another important realization, particuarly for me given my background as a product manager, was that identity assurance is not just how strongly you authenticate someone. A number of factors come into play. Moreover, identity assurance, like other facets of identity and access management (IAM), is a lifecycle process.   An identity lifecycle includes stages ranging from registration (initial creation, identity verification, credentialing) to contextual access control (authentication, risk and activity monitoring, stronger authentication), renewal and termination.

An IAM solution must account for the fact that identity assurance decays over time and that lifecycle processes, such as renewal or termination, are necessary to either preserve the assurance level or eliminate the risk of a compromised identity.

Even though this concept may seem obvious, traditional IAM deployments do not incorporate identity assurance as a guideline, and thus rely on a static notion of identity.

This approach towards risk and identity assurance allows end users and organizations to gain trust in relying on online channels to conduct sensitive and higher-value transactions.

In my next blog post, I plan to illustrate these concepts with some real-life examples. In the meantime, I look forward to your comments...

Considerations for an Identity Management Initiative in 2010

Share

 

First off, I would like to express my sympathy to victims of the terrible earthquake that hit Haiti. I can only wish that the rescue and recovery efforts yield positive results.

Thanks to the recession, we have learned a lot (or so we would like to think) on the importance of sound business decisions, have we not?

This blog post is my attempt to bring some of the lessons learned, along with scar tissue, that I have been able to sum up from the last 24 months, as it relates to identity and access management initiatives. Last year, I spent time reading some Harvard Business Review articles, and recall reading a blog post titled: "6 Lessons Learned in the Downturn" by Anthony Tjan, which were very influential in shaping my thoughts for this post.

At the risk of stating the obvious, I would start by saying that the last 24 months have forever changed the way in which Identity initiatives will be carried forward.

It is clear that identity and access management systems are, more than ever, critical parts of any IT infrastructure. Organizations will always need to grant application and system access to those who need it and eventually remove that access once it is no longer needed. This is a recession-proved observation. The circumstances of today's economy highlight the need to tackle these activities in a more efficient, transparent and scalable way, and in most cases, automation is about the only choice you've got. Manual labor is way too expensive today, even when outsourced. This should be an encouraging statement for any identirati.

5 Lessons Learned

Below are five points that best capture the essence of this change.  These are based on experience working with clients across many industry verticals:

1. Your dollar needs to go a much longer way than before - If you even have an approved budget, you really need to maximize the value you will get from your initiative, and be ready to show how. Consider getting a second opinion before you buy new IDM technology. Ask yourself some questions:
• Have you done proper due diligence?
• Do you or your team have the cycles to invest in carrying out the proper due diligence?
• Are you relying only on what the vendor says or what you read on an analyst report?
• Do you have enough insight on how to negotiate with the vendors you have selected, based on what is important for your initiative?

We have seen from experience that even a nominal 2-week investment in an Identity Management Workshop that assesses your current state, identifies business drivers, high-level requirements, and formulates an implementation roadmap can go a long way.

A case in point: One of our clients allocated $750,000 in budget to acquire IDM technology in 2009.  Before moving forward, they invested in a workshop and in the end, identified a set of previously unknown requirements and ultimately saved 40% ($300,000) in their purchase, all within 8 calendar weeks. Considering what they spent on our services, this is an ROI in excess of 450%. Not bad in any type of economy if you ask me.

2. Minimize capital expenditure if you can - Consider lease vs. buy scenarios. The maturity of IDaaS today provides options for customers to avoid procuring software and hardware products that require capital expenditure, and instead consume them on an on-demand basis as an operating cost. This of course will maximize your cash-at-hand. Evidently, not all of your identity and access management needs can be met with an IDaaS approach, at least not today, but I would argue that 24 months ago this was not even an option to consider. There are several approaches to IDaaS, which can be appropriate to your initiative. It may be worth exploring these and engaging with providers that specialize in these kinds of models. Not all organizations are ready or comfortable with an all-in-the-cloud approach, but there are managed services models that work on-premise that should be explored.
3. You have to have metrics - For identity and access management initiatives, there is no longer room for soft ROI; hard dollar is king. As you define your Identity initiative, you need to think about how you can measure value and ROI to the organization. For some organizations, which adopt internal chargeback models for managing budgets, this should be relatively easy. The idea is not to stop at simply measuring costs, but ensure that you are measuring returns. In a way, try to make your metrics meaningful to the lines of business that you support (i.e. your internal clients). A metric that is often overlooked is time to value - everything being equal in cost, you should look to shorten the wait until you can show measurable value to the organization. In practice this will help you decide how you undertake your initiative. Maybe shorter phases are better than longer ones. Perhaps rather than a pure waterfall project management approach, you start to introduce agile methodology concepts. We have seen initiatives whose budget is cut in mid-flight. Even though you cannot fully prepare for this, you want to consider what you will show for if it ever happens, and whether or not delivering value early is the key to preventing your funds from being cut in the first place.
4. Let's demystify identity management - This may get controversial, but after 14 years of experience in IDM, I would like to demystify it. I agree that IDM is complex, requires specialized skill sets, and above all, is unforgiving if you do not have the right experience, but at the same time it is not unattainable, and settling for less is not the right posture. There are many ways to meet compliance requirements, even if you have not automated all of the access granting flows in your environment.

I applaud the advent of identity activity monitoring (the term we like to use to describe this new trend) in 2009, and while the analysts have not yet coined a particular name for it, there is a great report by Gartner's Mark Nicolett and Earl Perkings that focuses on this area, separate from just SIEM or just IDM, more as a separate niche in its own right.

I intend to further discuss identity activity monitoring in a future blog post, but for now, I would describe it as an approach to tracking user activity in various IT systems and applications that is correlated to the definition of a digital identity; thus creating a closed feedback loop that allows you to more confidently determine if your IDM controls are effective, regardless of whether they are automated or manual. In this way, organizations have a way to extract value out of lazy assets (such as application, database or system logs), which otherwise are used only for security event monitoring, and leverage them to increase visibility into what users are doing within the IT infrastructure. This is a very clever and effective way to approach some of the compliance requirements that Identity initiatives often try to address, in a faster and cost effective way. Moreover, it does not conflict with a traditional IDM implementation, but rather complements it.

5. Understand and embrace identity assurance - this is not limited to scenarios in the extranet in which users from one organization interact with systems in another - scenarios that some would deem esoteric and not as business critical. Even within the same organization, you need to pay attention to identity lifecycle as a whole and not just as discrete steps: provisioning, authentication, single sign-on, etc. Consider the intersection of identity assurance with your data and risk classification, and ask yourself: am I spending too much in authentication technology and too little in the process of ensuring I know who the person is? Is it the reverse? Strong authentication alone is useless from an identity assurance perspective (a good friend assures me that a well-trained Labrador could figure out how to use a smart card - although I have not seen the documentary on TV yet). The point here is to ensure that your effort and investment is balanced in light of your requirements. Otherwise, you may be wasting precious dollars.

To illustrate, here is a real life example: a client has a request/approval process in place to manage the issuance of access cards (with no picture ID) to various facilities in their organization. When an employee first comes on board, to issue an access card, they undergo a process of vetting their identity against information in HR, and that the request that has been approved by two management levels. Now, since the process often takes a few days to complete, some managers tend to hold on to the access card from a departed employee, and literally keep them in a drawer. When a new employee comes onboard, the manager recycles the access card and increases the employee's productivity by orders of magnitude, but all access activity and access authorization is based on the departed employee's information. The organization is now incurring significant costs to ensure that access to its facility is tightly managed, but the process for ensuring that a departed employee event triggers the deactivation of the access card is not well enforced.  So in the end, this imbalance in identity assurance costs the organization money and does not really mitigate the risk it was intended to.

I would love to hear comments and feedback on these points, particularly if you disagree.

Identity Assurance in the Nationwide Health Information Network (NHIN)... a cross roads of sorts

Share

 

On Thursday January 7, 2010 (last week), I had the privilege of representing Kantara Initiative, in my role as Chair of the Identity Assurance[1] Work Group (also proxying for the Healthcare Identity Assurance Work Group) as a panelist in the Nationwide Health Information Network (NHIN) Workgroup hearings.

NHIN focuses on the definition of standards, guidelines and specifications on both technology and legal areas to enable the secure exchange of health information over the Internet. The focus of last week's session was authentication.

It was a great experience for me, particularly given the significance that NHIN's efforts will have in the way healthcare services are provided in the US over the next few years. The session made it clear that we are reaching a convergence of various efforts in identity management, which have reached the maturity level needed to address very real and critical business problems, and that the time to execute has come. Many of these efforts have been evolving over many years thanks to extraordinary contributions and leadership in both private and public sectors. This realization conveyed a sense of purpose and responsibility that quite frankly was not evident to me until the session actually started. Yes, I realize that at times I get very existentialist.

The format NHIN adopted for the hearings was very effective. It started with a viewpoint from US Government panelists followed by two sets of private sector panelists (I was part of the last round).  My fellow panelists did a really good job of providing their viewpoints in a clear and focused manner, and engaging in a very productive and dynamic round of Q&A after each round. This format made the sessions more productive, covered a wide range of viewpoints, and also helped identify themes and synergies. I commend NHIN on this.

Transcripts of the entire session, including audio voice-over and written testimonies, are available online. Also, Kantara published my written testimony in their blog area.

In this blog post, I intend to provide my summation of the event, and speculate on its potential outcomes.

Salient points

1. Panelists discussed the definition of authentication and reached a common understanding. In the context of the panel, authentication consisted of three distinct processes:
   • Proofing or verifying an identity,
   • Issuing a credential to the individual once her identity was proofed, and
   • The real-time event of confirming the validity of the credential as a digital proxy of the individual during a digital transaction.
   GSA's David Temoshok clarified that this definition excluded authorization - the ability to determine the kind of operation or data the individual can access.
2. I believe that the various panelists, including myself, converged on the notion that different assurance levels, as defined by NIST SP 800-63, provided a proven and practical approach to addressing different transaction risk levels. They also agreed that there is not a "one size fits all" approach that can address the broad range of use cases in scope for electronic healthcare. The discussions centered around the need to classify transactions and applications based on the risk profile, and avoiding the polarization on the highest assurance level for most use cases since it may be excessive and overkill.
3. Some recommended to NHIN existing frameworks that have been in use and proven for many years should be leveraged, rather than creating a brand-new, healthcare-centric framework for authentication. Leveraging existing Government programs and partnering with private sector players will help NHIN reach its goals in a more scalable and faster manner. NIH's Peter Alterman recommended that NHIN avoiding creating a healthcare-specific framework, highlighting the benefits of adopting cross-industry, best-of-breed standards.
4. There were great discussions on how to pragmatically reach the adoption rate required for the programs that HHS is driving forward. I particularly enjoyed the perspective provided by David McCallie, from Cerner Corporation; specifically, the statistics that show that in their network of 8,000 facilities, ~2,100 hospitals, 3,300 physician practices, 30,000 physicians, 500 ambulatory facilities, 600 home-health facilities, and 1,500 retail pharmacies; less than 30% of the systems use any form of SSO, and that provided the choice, less than 10% of the system adopt any sort of strong authentication technology. David also explained some of the challenges involved in achieving interoperability and federation across disparate system which were not designed to cross reference, and how much effort is truly involved in effectively mapping identities across different organizations.
5. Peter Alterman pointed out that Assurance Level 3 (AL3) is the minimum required to protect transactions that may expose personally identifiable information (PII), according to the Privacy Act. Later, Anakam's J Brent Williams talked about the ability to provide AL3 solutions that can scale both in terms convenience and cost, which can reach high levels of adoption, and are already in use at some large Government internet facing services. SAFE BioPharma's Mollie Shield-Uehling, made good points on the use of antecedent identity proofing as a scalable approach to AL3 remote identity proofing, based on SAFE's experience in the pharmaceutical community. My viewpoint on this topic was that AL3 should be demystified from being unaffordable and overkill, to being more attainable nowadays, particularly with remote identity proofing options, as well as evolving options for two-factor authentication options that could leverage mobile phones as authentication devices.
6. Brent raised two very good points that are worth mentioning:
• There are scenarios in which being able to provide identity proofing at a specific level of assurance level, but not necessarily having to issue a credential at that level or at all, will be beneficial, especially in cases in which a patient is granting permission to a physician to access her own electronic health record.
• PKI and SAML based authentication should not be viewed as orthogonal or in isolation in the context of identity federation and assurance levels. They are different ways to conduct and carry an authentication event, but in practice, they are techniques for conveying an authentication token. The real challenge in federating comes after the token is consumed, and particularly how the identity is actually "enrolled" in the target application (relying party).

My thoughts about the outcome

This was a worthwhile session with valuable insights and a broad range of important perspectives that rarely get discussed in a single sweep. I am very optimistic about the direction that NHIN could take in the aftermath of this event, and my read on some of the deliberations by the NHIN work group following the hearing fuels that optimism. My hope is that we do in fact see the convergence of approaches in healthcare that will allow for a faster pace of evolution and adoption, rather than a separate, healthcare-specific approach to authentication that may prove too ambitious and demand much longer timelines.

Here are my speculations on what may come out of this:

• NHIN will not reinvent the wheel in the area of authentication, but rather provide guidelines that leverage existing programs, such as the Federal Government's Identity, Credential, and Access Management (ICAM). This direction will help NHIN to increase adoption and use of digital credentials at various levels of assurance, by partnering with both the government and the private sector, thus removing barriers to entry and immediately tapping into established networks and communities that already have large numbers of credentials issued. It will allow the programs to hit Internet-level scale much faster.
• NHIN will focus on mapping various use cases and transactions to specific risk levels, equating them to assurance levels. It will also provide specific guidelines that will foster the development and rollout of digital solutions that leverage identity assurance within healthcare. These guidelines will lay a foundation for interoperability and risk-based models for these solutions.
• NHIN will define minimum assurance level requirements for its most critical use cases. For instance, NHIN may require that physicians obtain at least one AL3 credential that complies with an accepted identity assurance framework to be able to digitalize common transactions. It may focus on scenarios in which a credential may need to be upgraded from one assurance level to the next.
• NHIN will define acceptable models for performing identity proofing conforming to assurance levels for its most common actors. The idea here will be to clearly define options available to a physician for getting their identity proofed prior to obtaining credentials; likewise, to define acceptable models for how patients will get identity proofed [and credentialed], whether it is a responsibility that can be delegated to the patient's physician or some other stakeholder in the use case.
• Several requirements that NHIN will define for authentication will help advance and evolve existing identity assurance programs both in the government and private sector, as there will be new services or more granular scenarios that will require special handling. Having said this, I predict that these requirements will not be specific to healthcare. Instead, they will have applicability on other industries. A good example will be the need to separate identity proofing from credentialing as consumable rather than encapsulated services.

I would love to hear your comments and feedback.

[1] Identity assurance, in an online context, is the ability for a party to determine, with some level of certainty, that an electronic credential representing an entity - whether a human or a machine, with which it interacts to effect a transaction, can be trusted to actually belong to the entity.  In the case the entity is a person, identity assurance is the level at which the credential being presented can be trusted to be a proxy for the individual to whom it was issued and not someone else.

Approaches to IDaaS for Enterprise Identity Management

Share

 

Happy New Year 2010 to all. Best wishes in the year that just starts.

I will start this year's first posting by acknowledging Burton Group's (just acquired by Gartner) Bob Blakley September 30^th, 2009 vantage point titled: "2010 Identity and Privacy Strategies Planning Guide: A Market in Transformation", which has been an excellent reference in helping me shape some of my thoughts for this article. I think it is a great document with great insights on current trends in identity management.

My prior blog posting introduced a definition for Identity as a Service (IDaaS), setting the stage for this posting, which discusses models for deploying IDaaS, from the perspective of the entity that consumes the Identity service, in this case an organization (as opposed to an individual). The assumption will be that the entity and the service provider are two separate organizations, and moreover, two separate legal entities. In a way, this perspective is no other than the Enterprise identity management.

In addition, for this discussion, we will try not differentiating the kind of Identity services being provided (provisioning, registration, authentication, etc.), or which user population within the entity it is intended (i.e. employees, contractors, suppliers, customers or business partners). The idea is that the approaches should be applicable to all of them.

Defining Managed IDaaS

In this article's context, Managed IDaaS is an approach to IDaaS in which the entity employs one or more separate legal entities as service providers. The service provider is contractually bound to specific terms that define how the service is performed, and it governs its adherence to these terms through mutually agreed and measurable service level agreements (SLAs). In other words, Managed IDaaS, is the scenario in which an organization consumes Identity services from an external service provider. These services can range from operating a provisioning infrastructure, to verifying the identity of a person, to providing strong authentication or federated authentication credentials, to managing passwords;  and they can be provided both internally (i.e. within the organizations Intranet) or externally (i.e. through an extranet portal), and can physically reside on-premise or in the cloud, or a combination thereof.

Two main variants of Managed IDaaS are common today, and as Gartner forecasted, they should trend upwards in adoption within the next two years. They are mainly determined by who is responsible for and who owns what part of the Identity service infrastructure, which in many cases correlates directly to where the infrastructure component actually resides:

• Cloud IDaaS - where the service provider owns and operates the entire Identity service infrastructure, and provides it to the entity in a pure SaaS manner, without any sort of footprint or backend integration with the entity's IT infrastructure. Identity information is exchanged in an offline (manual or batched) manner.
• Co-sourced IDaaS - using Wikipedia's definition of co-sourcing, this is an approach in which the Identity service interacts directly or through some technical footprint with the entity's IT backend infrastructure (directories, repositories and other target systems). The entity and the service provider have a shared responsibility for building and operating the Identity service, the balance of this responsibility determines distinct scenarios, which we will focus in more detail in this article.

To better understand Managed IDaaS, it is useful to decompose it into building blocks. The diagram on the left provides a high-level structure for an Identity service, made up by three main functional areas:

Consumable Identity Service - this is the end point of the service, which interacts and integrates with the consuming entity, whether an end user interacting through a web UI or an application or repository that exchanges information with the service. This is the area in which the specific logic and functionality provided by the service is actually "wired".

Identity Management Stack - this is the middleware of the service; the software modules that provide the basic functionality to manage and process identity information.  The diagram shows an arbitrary sample of the software components that make up the identity management stack. It is not mean to be an exhaustive list, but rather a representative sample. Nishant Kaushik has done a great job explaining the identity services framework, which instantiate the identity management stack.

IT Platform - this is the technical backbone of the service. The basic IT computing infrastructure that is not specific to identity management, but generic to any IT service.

These three basic functional areas are useful in explaining how variants of a Managed IDaaS come to life, particularly co-sourced IDaaS.

Co-Sourced IDaaS

It is a Managed IDaaS variant in which the Identity service's consumable service interacts directly with backend (or back office) IT infrastructure managed and operated by the entity. And more importantly, one in which the entity and service provider enter into a partnership in which they share some of the responsibility in building, hosting or operating the Identity service.

The diagram below illustrates four common co-sourced IDaaS scenarios, which we'll discuss next. I admit that while I have spent time thinking about these scenarios, I do not think I have articulated them in a way that clearly delineates their boundaries (if any), so I am hopeful that by venting them out, I will get very good thoughts from you.

1. All on-premise, provider operated - when the entity owns the identity management stack used to build the service, as well as the actual IT platform; and the Identity service is hosted on the entity's premise where it integrates directly with the entity's backend IT systems in the Intranet. The service provider is responsible for configuring and operating the consumable Identity service. This model is a more "traditional" Enterprise identity management deployment approach, where an organization procures the entire IT stack, and hires an external integrator to build, and possibly operate the Identity service, according to defined requirements. The organization and the integrator establish service agreements which govern roles, responsibilities, response times, escalation procedures and son on.
2. Provider hosted and operated - where the service provider hosts and runs the entire Identity service, and integrates directly with the entity's consuming backend IT systems. This scenario is seen often at organizations that outsource their IT infrastructure and operations to an IT outsourcing service provider, and the Identity services are collocated and dedicated to the organization. From a connectivity perspective, the Identity services are typically accessed via dedicated lines (private clouds, private VPN). In this scenario, the service provider is often responsible for procuring and operating the consumable Identity service, the identity management stack and the IT platform. The outsourcing service provider and the organization establish service level agreements as well as licensing agreements which ensure that the organization is entitled to use the technology infrastructure require for the Identity service. This scenario is typically single tenant for both the consumable Identity service and the identity management stack functional areas.
3. Hybrid: on-premise and in the cloud - where the service provider hosts and runs the entire Identity service in an environment hosted in the cloud, and requires some technology footprint to be deployed on-premise at the entity's IT environment to effect the integration with its backend IT systems. The scenario is one where the organization "leases" the Identity service from the service provider, which includes the use of the on-premise footprint - say a virtual or physical appliance, and access to the actual Identity service which is hosted in the cloud. From a connectivity standpoint, the appliance provides secure communication through the public Internet, and it may also provide caching and queuing to increase the reliability and responsiveness of the service. The service provider owns and runs the Identity service backbone and may adopt a multi-tenant model. The organization and provider agree to service SLAs, which will also govern how the on-premise footprint is operated.
4. All in the cloud - where the service provider hosts and runs the entire Identity service in an environment hosted in the cloud and it integrates with the entity's backend IT systems without requiring additional technical footprint, leverage secure, open standards-based interfaces over the public Internet. In this case, the organization "leases" the Identity service from the service provider, and configures its backend IT systems to communicate directly with the service. The provider owns and runs the Identity service backbone and will most likely adopt a multi-tenant model. The organization and service provider agree to SLAs under an Application Service Provider model.

In future postings, we will discuss considerations and advantages of the co-sourced IDaaS model. In the meantime, I look forward to your comments.

Defining Identity as a Service

Share

 

In the midst of the holiday season, and with the anticipation and emotion that comes with the end of the year approaching, I have decided to write my first blog - an early new year's resolution perhaps. I must state that I have resisted the urge to blog for the last three years of my career for two reasons: on one end, I feared starting to blog and then dropping off and being inconsistent (just like I have been every time I started at the gym), on the other end, I dreaded becoming addicted to blogging and seeing it impact other priorities. But let's just say that I am resolved to give this a good try by sticking to some basic rules: keep the content lean but meaty, keep a constant blogging frequency, and try to be as interactive as feasible - sounds simple. Let's see how I fare (maybe I will also get in shape in the process)...

What is Identity as a Service (IDaaS)?

2009 has seen an increased interest and focus in a relatively new topic in identity management "Identity as a Service (IDaaS)", but just like any upcoming trend, it tends to be understood differently, explained differently and used differently depending on context. Burton Group provides a very concrete definition that focuses on the outsourcing of identity management, such as authentication, provisioning and attributes services. Dave Kearns has covered this topic extensively as well, under the context of "Externalizing Identity into the Cloud". My friend Nishant Kaushik defined the term in 2007 as "the notion of making identity management capabilities available as an infrastructure service to all applications in a SOA environment".

In a way, this reminds of the late 90's when the term identity management was making its foray in the world (yes I admit that I was an identity guy back then - lucky me!), and everyone had its own definition and everybody from Dun & Bradstreet to Access360 to Oblix provided identity management. And I think that the term is still misinterpreted today, though not entirely misunderstood, just like any normal teenager at this age.

So, one would wonder: why propose yet another definition for IDaaS? Well, I encourage you to keep on reading, as I think I will make my point clear, and hope to ignite good comments and discussion along the way.

With that: what is IDaaS? It is an approach to digital identity management in which an entity (organization or individual) relies on a service provider to make use of a specific functionality that allows the entity to perform an electronic transaction which requires identity data managed by the service provider. In this context, functionality includes but is not limited to registration, identity verification, authentication, attributes and their lifecycle management, federation, risk and activity monitoring, roles and entitlement management, provisioning and reporting. 

The relevance, or perhaps novelty, of this definition, is that it focuses on the interaction of four elements: the entity, the service provider (which could be the entity in some cases), the specific functionality and the electronic transaction.

The Context of IDaaS

I believe that IDaaS as a concept has seen increased interest and coverage this year, in big part due to the impact of the global economic challenges which are forcing organizations to revisit its models for adopting and implementing IT initiatives that require identity management, as well as an increased emphasis in regulatory compliance and privacy awareness.

In any case, there are some important considerations regarding the definition of IDaaS that I would like to point out:

• It is not meant to be just a technical definition. And while the definition does not conflict (I would hope) with a technical definition or architectural approaches, it is important to think about IDaaS from a legal and jurisdictional standpoint as well. In this context, the definition of ownership, responsibilities and liabilities is significant to all parties involved in IDaaS. Tom Smedinghoff, a well-known contributor to the identity management industry, has created great content and led several initiatives that are bringing the legal aspect of digital identity management at par with its technical evolution, all of which is relevant to adopting IDaaS.
• The strength, rigorousness and thoroughness by which IDaaS is provided, should be measurable in an objective and demonstrable way, such that they can convey a specific level of confidence or assurance to the parties. This in turn will translate to a risk mitigation level that the parties can agree to be sufficient for a specific type of transaction. The Identity Assurance Certification Program run by the Kantara Initiative provides a very concrete vehicle to achieving this measurement.
• IDaaS should not be restricted or misconstrued as only applying to "cloud" based models. While IDaaS is particularly relevant for cloud-based services, IDaaS could also apply to on-premise models. In fact, I argue that it is in this area where the definition is most beneficial, as organizations can view its internally-facing (and possibly internally deployed) identity management infrastructure as identity services, allowing the demarcation of service scope and boundaries that will make outsourced, on-premise, cloud-based models or any combination therein more concrete, and easier valuate in business terms. The intention is not to confuse IDaaS with "Cloud Identity" or with "outsourced identity management", since the term could apply to all these cases.
• The concept should also not be restricted to enterprise IDaaS vs. consumer IDaaS, since the notion is basically the same. Evidently, the actors, the types of transactions, the levels of sensitivity in them, and other elements will vary greatly from enterprise to consumer environments, but the notion of how digital identity management applies to each could be thought of in the context of IDaaS.

Why is this even relevant?

My motivation to introduce this definition at this point is to attempt to set a common understanding of terms, allowing us to better understand the new trends, services and paradigms in identity management that are unraveling before our eyes. As I believe that a significant shift in identity management from a monolithic model to a true services-based infrastructure, has been at play for the past 2 years, with noticeable effects only in the past 6 months.

With this shift has come some degree of confusion in the industry among identity management in the context of cloud-based services (i.e. SaaS, Infrastructure as a service), identity federation (claims or assertion based) and the more traditional enterprise deployment models, to a point where they are at times seen as independent or separate; causing people to think of IDaaS as not relevant to the enterprise facing environment or mystifying it as another "cloud" term. And in some unfortunate instances this confusion has impacted the way an organization looks at implementing an identity management solution (either by limiting the range of options that it could look at or by widening it to include the wrong set of options).

I intend to demystify this concept a bit more in subsequent blogs, and attempt to bring more pragmatism around it by explaining how it applies to concrete scenarios. In the meantime, I appreciate your comments and reactions.

IT Security Spending Trends

Share

 

A colleague recently forwarded me an article referencing ComTIA’s 7th annual “Trend in Information Security” survey.  I’ve always been a bit of a skeptic when it comes to some of these surveys, but with the current state of IT spending and how Information Security is impacted I needed to look into this a bit further.

Being in IT and Information Security now for close to twenty years it’s safe to say I’ve been through a couple of cycles where IT spending has been impacted based on challenging economic times.

Continuing to keep a pulse reading on the market and IT spending we’ve had our share of customers responding with the typical “Budgets are on hold” statements and “”We’ve just laid off 20% of our IT staff.”  No question IT spending has suffered, but I can attest to CompTIA’s survey on the fact we’ve experienced IT Security spending sustain itself and even increase in some areas.  Vendors we partner with who are focused on security solutions addressing regulatory requirements and operations efficiencies have had record setting quarters particularly Q4 of ’08 and most recently Q1 in ’09.
One of the key areas we’ve experienced increased activity in IT Security spending has been with on-boarding and off-boarding of employee accounts resulting from either downsizing or mergers and acquisitions.  These are Identity Management specific tasks and the focus and attention in these areas are required to address regulatory requirements, operations efficiencies and mitigating any potential security risks.  Organizations have worked diligently addressing these tasks manually, but when companies are now operating with a reduced staff members cutting corners to achieve these critical tasks should not be an option.  There are short term and long term gains in automating Account Provisioning and Deprovisioning both from a cost saving and operational efficiencies.