Pick an Identity and Access Management Standard, Any

Transcription

1

2 Pick an Identity and Access Management Standard, Any Standard Andras Cser Principal Analyst Forrester Research, Inc.

3 O l F d ti I C bl f Only Federation Is Capable of Meeting the Identity and Access Management Challenge.

4 Agenda Benefits of Federation Challenges of Federation Marketplace Trends Recommendations

5 Agenda Benefits of Federation Challenges of Federation Marketplace Trends Recommendations

6 The Benefits

7 Governance and Accountability Lower cost of security Lower cost of compliance Centralized and easier auditing of access Reduced need to audit partners Access recertification and deprovisioning is still difficult

8 Extended Business Services M&A activity is much easier and faster More authority for business units Delegated administration for business users End users need not to wait for remote password resets since passwords are administered locally SaaS adoption

9 Efficiency and Effectiveness Identity Administration is less costly it s done locally Consolidation of user repositories Standardized protocols (SAML, OpenID, etc.) reduce development effort and cost Replacing Web SSO Easier provisioning

10 Agenda Benefits of Federation Challenges of Federation Marketplace Trends Recommendations

11 Challenges of Federation Other IT priorities often take precedence Too many standards Lack of adoption at the potential partner Legal frameworks Circle of trust is bilateral, not multilateral

12 Challenges of Federation (cont d) Fear of hacking of the crown jewels No federation protocol translation No trusted IdPs Consumer Enterprise Business model is still lacking!

13 Agenda Benefits of Federation Challenges of Federation Marketplace Trends Recommendations

14 Security drives investment in IAM What is your firm's primary motivation for using identity and access management (IAM) within your enterprise? Improving delivery Don't know of services to 3% partners, customers, and/or employees 17% Cost reduction and worker productivity 9% Regulatory compliance 15% Security leads, but compliance has the budget! Governance 7% Security 49% Sample Size = 795 North American and European enterprise IT security decision-makers, whose firms are using IAM Source: Enterprise And SMB Security Survey, North America And Europe, Q3 2009

15 Single Sign-On and provisioning top list of IAM initiatives What are your firm's plans to adopt the following identity and access management (IAM) technologies? Planning to implement in the next 12 months Expanding/upgrading implementation Implemented, not expanding Enterprise/employee single sign on (E SSO) 14% 15% 16% Web single sign on /Web access management 12% 13% 16% Provisioning (automated user account administration) 12% 11% 13% Privileged user management 11% 8% 16% Multifactor authentication 11% 8% 16% Identity infrastructure consolidation 11% 8% 10% Role design 10% 8% 11% Consumer identity and access management 8% 6% 10% Federation 8% 5% 7% Hosted/outsourced IAM 5% 1% 4% Sample Size = 1009 North American and European enterprise IT security decision-makers\ Source: Enterprise And SMB Security Survey, North America And Europe, Q3 2009

16 of Secur rity Level Technology Federation Best practices Federation Security and Support of Standards SAML 2.0 SAML 1.x ID-WSF Liberty ID-FF 1.1/1.2 CardSpace WS-Federation OpenID Level of Commercial Support/Maturity

17 Enterprise major market trends ADFS 2.0 is late, little, but is here Consolidation of Web SSO and Federation Provisioning and de-provisioning is the next key step in federation Identity Proofing Access Recertification

18 Consumer major market trends The cost model is not robust OpenID is costly and not secure enough Functionality of OAuth will be eclipsed by SAML and attribute injection CardSpace is device dependent and is limited Facebook Connect solves the identity verification problem

19 Agenda Benefits of Federation Challenges of Federation Marketplace Trends Recommendations

20 Recommendations Coordinate with partners Create a template for a legal and technical framework Define data ownership and debugging responsibilities Pick a protocol: Facebook Connect or SAML Define, monitor and report cost/benefits to executive management KISS principle

21 Blur the lines Hosting/users External users Internal Users Externally hosted Priority Priority applications Internally hosted Priority Priority applications

22 Thank you Andras Cser /