Global Headquarters: 5 Speen Street Framingham, MA USA P F

Transcription

1 VENDOR PROFILE Passlogix and Enterprise Secure Single Sign-On: A Success Story Sally Hudson IDC OPINION Global Headquarters: 5 Speen Street Framingham, MA USA P F Enterprise secure single sign-on (E-SSO) is a core component of a successful enterprise identity and access management (IAM) architecture. A strong E-SSO platform should provide a standards-based, secure approach to systems sign-on by eliminating the need for multiple passwords and allowing customers to leverage their IT existing investments while further expanding their identity management infrastructure. Further, IDC sees this technology expanding to incorporate multiple forms of access, including remote, physical, mobile, and wireless end points. E-SSO provides several essential criteria for both secure access and meeting compliance regulations. These include:! Defining users and mapping credentials! Offering rapid and easy access to applications! Providing strong authentication of individual users! Reducing help desk costs by reducing or eliminating password reset calls from end users IN THIS VENDOR PROFILE This IDC Vendor Profile examines Passlogix, a privately held company based in New York City that provides IAM software to enterprise IT shops across a variety of industries. Passlogix is primarily known for its v-go Single Sign-On software, an E- SSO solution that has been widely deployed in the industry through direct sales and successful OEM agreements and partnerships. SITUATION OVERVIEW Identity and access management technologies make up the who, what, where, why, and when of computer systems access and data delivery. The IAM market addresses some of the most burning business issues that organizations face today that is, how to create and manage user access to a broad range of IT and physical assets, ranging from client/server and legacy software applications to telephone systems and buildings or offices. Filing Information: December 2006, IDC #204899, Volume: 1, Tab: Vendors Security Services and Identity Management: Vendor Profile

2 The identity and access management market is defined as a comprehensive set of solutions used to identify users in a system (e.g., employees, customers, contractors) and control their access to resources within that system by associating user rights and restrictions with the established identity. This is accomplished via implementation of some or a combination of the following technologies within an organization: Web single sign-on (SSO), host (or enterprise) SSO, user provisioning, advanced authentication, legacy authorization, and directory services. These are all critical components of identity and access management. Enterprise SSO in particular enables users to log in to internal applications, databases, and other corporate systems with just one identity. Host SSO solutions enforce password policies and eliminate the need for employees to remember multiple passwords. Customer adoption of this technology occurred early on in the IAM market, as enterprise IT realized that it was an essential element in the foundation of sound IAM deployments. The next generation of identity and access management technology is focusing on providing individuals with a single form factor that consolidates their multiple authentication requirements into a unified merge identity. Today, this is usually a smart card or token, and this form factor captures and stores the user's credentials and identifies them across different and diverse access methods into a single, common, and secure digital identity. This can then be applied to either physical or logical access methods linked to a corporate back-end system. Many organizations are working toward this common goal to ensure secure, safe access and to facilitate compliance regulations. This will ultimately serve to streamline business processes as well. The ability to effectively manage credentials will become increasingly important over the next decade as both government agencies and corporate entities look for ways to securely and seamlessly unify physical (buildings, restricted areas) and logical (computer and telecom systems) access. In this document, IDC profiles Passlogix and its widely used v-go Enterprise SSO software, as well as other significant products in the Passlogix portfolio and its recent offering within the credential management space. Company Overview Passlogix is a privately held company headquartered in New York City. Founded in 1996, the company has a worldwide presence, with major offices in both Hong Kong and the United Kingdom. Passlogix products are designed to cost-effectively simplify and secure application access and improve authentication and management of these functions within an enterprise IAM architecture. Passlogix products are widely deployed in a variety of industries (e.g., manufacturing, petrochemical, utilities, financial services, telecommunications, healthcare) and federal, state, and local government agencies. While the vendor is primarily associated with its v-go Enterprise SSO product, it also offers several other modules as components of its SSO solutions platform. These include v-go Provisioning Manager, v-go Self-Service Password Reset (SSPR), v- 2 # IDC

3 GO Authentication Manager, v-go Session Manager and, most recently, the v-go Credential Manager. Competitive products in the Enterprise SSO market include those from ActivIdentity (formerly ActivCard and Protocom) and Novell. Details of these products are as follows:! v-go SSO. This is the company's core product and focus. It is designed to allow customers to integrate it into their existing infrastructure without change, integration, or a large deployment effort. The product utilizes any LDAP directory, Active Directory, or SQL database server as its user profile and credential repository. v-go SSO can accept primary authentication directly from the Windows log-on, and it also works with most industry-leading smart cards, biometrics, or token solutions. It provides a GUI-based Administrative Console and offers wizard-based configuration and control over all settings and users. This includes control all of v-go settings, including password policies, system rules, UI functionality, reauthentication parameters, etc. For security, the v-go SSO authentication engine relies on two independent factors that are only present at runtime and randomly encrypted during the session in memory. Credentials are secured at all times in the directory, in transit, on the client, and in memory. Individual credentials are decrypted on the fly as needed. The product operates within mainframe, client server, Windows, browser-based, mobile, and wireless, as well as a variety of other enterprise environments. It is full FIPS compliant.! v-go Authentication Manager (AM). This software allows organizations to use any combination of tokens, smart cards, biometrics, and passwords to control access to their applications. Depending on their locations, users may employ different types of authenticators to open some of the same applications. v-go AM interfaces to all authentication devices and acts as a mediating layer between the authenticators and the v-go Single Sign-On solution, which connects to any application. After v-go AM accepts a user's authentication, v- GO SSO connects to any application using the appropriate user ID and complex password.! v-go Credential Manager (CM). Released in 2H06, this product is designed to simplify deployment of strong authentication, as well as managing and automating the life cycle of strong authentication user credentials. This includes smart cards, certificates, biometrics, and proximity cards. This type of seamless integration with SSO and IAM systems is targeted at providing administrators with a single point of control for all authentication devices, user IDs, and passwords. The product is built on Microsoft.NET 2.0 and leverages the native Microsoft infrastructure for both user authentication and central administration via Active Directory. Although v-go CM supports multiple public key infrastructures (PKIs), it can be fully operational without one, thus eliminating the expense of purchasing a PKI.! v-go Provisioning Manager (v-go PM). This product is aimed at allowing system administrators to directly distribute user credentials, such as usernames and password, to an E-SSO solution. Passlogix labels this "Zero-Touch" credential provisioning because end users do not need to know or touch their 2006 IDC #

4 credentials. For example, when provisioning a new user on a network, the administrator can inject the user's credentials directly into their v-go SSO account so the user does not have to type them into v-go SSO. Whenever a password has to be reset, the administrator can update v-go SSO simultaneously to prevent the application from falling out of sync with the SSO itself. When a user leaves the company, all credentials can be instantly deleted. The product provides an open interface, and all operations can be automatically initiated and controlled under the auspices of leading provisioning systems, including IBM Tivoli Identity Manager, Sun Identity Manager, BMC, and Oracle Xcellerate.! v-go Session Manager (SM). This product is designed to enable organizations to implement v-go Single Sign-On in their kiosks. Historically, SSO has not been successfully implemented in a kiosk environment because of the inability to maintain user-specific sessions (an SSO system would have no way of knowing which user's credentials to use in this scenario). The v-go SM product transmits that information to v-go SSO by providing automated termination of inactive sessions and application shutdown. Inactive sessions end after a period of time predetermined by a systems administrator, and the kiosk returns to a ready state for the next user.! v-go Self-Service Password Reset (SSPR) 5.0. This product delivers a secure, easy way to use and administer a self-service password-reset solution for Windows. It encourages enrollment and adoption while providing convenient means for accessing the reset process via a simple Web-based access for end users via a simple, configurable Web-based question and answer process. The software provides In-the-Flow automatic initiation at Windows system log-on, which allows easy access and encourages enrollment. Enforce enrollment is an optional feature. The back-end repository is configurable, storing questions and encrypted enrollment answers (Microsoft Active Directory, Microsoft ADAM, Microsoft SQL 2000 or later, Oracle 9iTM or later). Passlogix has more than one million licenses worldwide. Deployments range from a few hundred to more than 100,000 seats. The company reports that its largest project to date, which took a mere eight months and a five-person team to complete, involved more than 140,000 users and 7,000-plus applications. Company Strategy The company serves as a poster child for successful OEM partnerships within the IAM space. To date, Passlogix technology is OEMed to several of the IAM market leaders, including IBM, RSA Security (a division of EMC), BMC, and Oracle Corp. Passlogix also has a reseller agreement with Sun Microsystems. Passlogix confirms that "100% of what we do is around SS0." Approximately 20% of annual revenue is allocated to research and development to solidify and extend this technology. While the company has always been recognized as a partner-oriented organization, it also does a fair amount of end-user sales. IDC estimates that the company garnered approximately $20 million in software license and maintenance revenue in # IDC

5 The vendor is expanding its scope in the strong authentication area, and it views strong authentication as a touching space to SSO. This attitude is reflected in the company's v-go Authentication software. As Passlogix moves toward card management systems (CMS), the pledge is to remain as open as possible to any technology. The goal is to try and remain truly horizontal, according to company executives. In 2007, the vendor outlines its goals as follows:! Continued leadership in core SSO! Strong authentication device management! Enhancements for software that continues to build native ties between OEM partner technologies Passlogix plans to continue its leadership position in the enterprise SSO market, a position obtained on a reputation of quick time to value and easy-to-realize benefits. In terms of strong authentication, Passlogix sees its SSO offerings as a bridge for customers. For example, if a company chooses to smart card enable all of its applications, it can elect to use v-go as the mediator. Passlogix's Provisioning Manager product provides the concept of credential management, and this inherent architecture can be added or removed from SSO container within customer deployments. Finally, it should be noted that the v-go SSO software can scale to any size of organization. It is available for use in smaller to medium-sized corporations, as it can be adapted to work with several hundred users. The technology is aimed at any organization with a significant amount of applications. FUTURE OUTLOOK Much of the demand for IAM products is, and will continue to be, fueled by the need for compliance with regulatory requirements and legislation. The SSO and provisioning market segments are, and will continue to be, fueled by demands from several sources, including:! Compliance with government and industry regulations (This is being felt increasingly on a worldwide basis.)! Security, especially to prevent identity fraud and identity theft, as well as to protect privacy and systems integrity! Adaptable business process integration and workflow within an identity management framework Compliance has consistently driven as much as 70% of IAM revenue over the past several years and will continue to do so for several years to come. IDC research shows that identity fraud detection and prevention have increased as a market driver 2006 IDC #

6 for IAM technologies over the forecast period as more and more incidents of ID fraud and theft have become known and publicized over the past 12 to 18 months. Further, as previously stated, the ability to effectively manage credentials will become increasingly important over the next decade as both government agencies and corporate entities look for ways to securely and seamlessly unify physical (buildings, restricted areas) and logical (computer and telecom systems) access. This will not only enhance security but eventually evolve to streamline business processes as well. ESSENTIAL GUIDANCE Advice for Passlogix Passlogix has been very successful early on in the IAM market with its Host/Enterprise SSO. Enterprise SSO and password management is generally the first step companies take in their move to establishing a corporate IAM infrastructure. The ability to partner with market leaders in this area has given Passlogix a solid reputation and name recognition not typically realized by a company of its size. IDC views the vendor's move to Credential Management Systems as both strategic and farsighted; however, Passlogix must strive to duplicate its successful partnership policies in the Enterprise SSO market to succeed here. As the company already has relationships with many of the leading IAM software and hardware providers, this may not prove too difficult. LEARN MORE Related Research! Worldwide Identity and Access Management Forecast (IDC #202728, August 2006)! Worldwide Identity and Access Management Compliance Forecast (IDC #201365, April 2006)! Worldwide and U.S. Security Services Forecast (IDC #200926, March 2006) 6 # IDC

7 Copyright Notice This IDC research document was published as part of an IDC continuous intelligence service, providing written research, analyst interactions, telebriefings, and conferences. Visit to learn more about IDC subscription and consulting services. To view a list of IDC offices worldwide, visit Please contact the IDC Hotline at , ext (or ) or sales@idc.com for information on applying the price of this document toward the purchase of an IDC service or for information on additional copies or Web rights. Copyright 2006 IDC. Reproduction is forbidden unless authorized. All rights reserved. Published Under Services: Security Services and Identity Management; Identity and Access Management Products 2006 IDC #