An Overview and Competitive Analysis of the One-Time Password (OTP) Market

Transcription

1 50 Years of Growth, Innovation and Leadership An Overview and Competitive Analysis of the One-Time Password (OTP) Market A Frost & Sullivan White Paper Richard Martinez Research Analyst

2 Frost & Sullivan Introduction...3 OTP Market Landscape...3 Market Drivers...5 Competitive Analysis...6 RSA, the Security Division of EMC...7 Key Performance Drivers for RSA...8 Brand Recognition...8 Conclusions...9 CONTENTS

3 An Overview and Competitive Analysis of the One-Time Password (OTP) Market INTRODUCTION Labeled The Year of the Security Breach, 2011 was witness to a series of significant high-profile security breaches that reinforced the reality that no organization is immune to network intrusion. The criminal mindset continues to advance methods of network vulnerability discovery and social engineering tactics. With a click of a mouse, a criminal can gain escalated privileges to a network to disrupt normal operations, causing severe damage internally and externally to an organization. To ensure safety of digital resources, businesses must collaborate with security vendors to develop mitigation strategies, and Frost & Sullivan believes that one-time password (OTP) authentication plays an integral role in those strategies. Traditionally, OTP tokens have been predominantly deployed as hardware tokens, but we have seen that this is no longer the case, with organizations requiring a flexible mixture of deployment options in software token form factors, USB key tokens, and out-of-band authentication. The market is fueled by the rapid growth of software tokens based on their low cost, easy deployment, and ease of use in a variety of mobile devices. Mobile software development kits (SDKs), which embed OTP technology into a mobile application, are further promoting software token adoption. With the growing trend of workforces extending beyond the traditional workplace, the need for strong authentication is essential. OTP technology is increasingly being recognized as the minimum authentication product that should be in place for user authentication. Solutions such as risk-based authentication provide organizations in-depth network user authentication, significantly reducing unauthorized user access. Thanks to the availability of a variety of OTP form factors and risk-based authentication, organizations can achieve cost and time efficiencies by issuing tokens based on specific access and authentication needs of individual users. OTP Market Landscape As the number of endpoints connecting to any given network continues to grow, along with the bring-your-own-device (BYOD) trend and a growing remote and independent contractor workforce, it is imperative that organizations have the ability to properly authenticate each user and set access privilege levels accordingly. Today, OTP vendors are supporting customers by offering a broad suite of form factors, which includes hardware tokens, USB keys (including hybrid keys), software tokens, smart cards, and out-of-band authentication. Varied form factors not only provide flexibility to an organization, but also allow efficient use of the tokens. Frost.com 3

4 Frost & Sullivan As shown in Figure 1, the global OTP market is growing at a compound annual growth rate (CAGR) of 7.5 percent. In 2011, the market was valued at $770.6 million and is projected to grow to $1.1 billion in Figure 1: Total OTP Market: Revenue Forecast (Global), Revenue CAGR, =7.5% 1, , Revenue ($Million) Growth Rate (%) 0.0 Revenue ($ Million) Growth Rate (%) Source: Frost & Sullivan Revenue growth continues to be driven by hardware and USB key token sales. Combined, these segments equated to more than 80 percent of total market revenues in ardware and USB key tokens continue to be the de facto choice among organizations and remain popular, largely due to the corporate sector s preference for convenience and instant use. Product advancements align with a vendor preference for integration with keypad-enabled devices, smart cards, and digital signatures for expanded capabilities and use. Ease of deployment and lower cost are fueling the software token market, which accounted for more than 16 percent of global OTP sales in In a typical scenario where a mobile device is misplaced, the user will generally report it immediately. In the meantime, an IT administrator can quickly issue a new token for another device, rather than waiting for the replacement hardware token to arrive. Companies such as RSA have developed their mobile SDKs to allow developers to embed OTP technology into applications on leading mobile platforms such as Mac ios and Android, enhancing both the user and organization s security posture. Once the application is accessed, an OTP is automatically generated in the background, providing seamless, secure access and enhanced authentication while maintaining the traditional login feel users are accustomed to. 4 Frost.com

5 An Overview and Competitive Analysis of the One-Time Password (OTP) Market Market Drivers As malware such as Zeus and SpyEye Trojans continue to afford criminals escalated privileges and unauthorized access to penetrate networks, OTP remains a critical component of user protection and network validation. While many OTP vendors offer a wide variety of solutions, they are challenged to provide alternative, inexpensive, two-factor authentication solutions and multi-layered approaches to authentication. Figure 2 describes the most influential market drivers that address these challenges. Figure 2: Total OTP Market: Key Market Drivers (Global), Total OTP Market: Key Market Drivers and Restraints, Global, Market Drivers Escalating threat landscape and its effects on business continuity Growing demand for versatile authentication options BYOD and cloud applications promote OTP adoption 1-2 years 3-4 years 5 years M M M Source: Frost & Sullivan Compliance mandates: The leading driver for OTP implementation continues to be compliance mandates, such as the Payment Card Industry Data Security Standard (PCI-DSS) and the ealth Information Technology for Economic and Clinical ealth (ITEC) Act. With data security a current major focal point, compliance regulations and legislation continue to push organizations to employ technology that will effectively ensure proper handling of sensitive data. To further protect data, more organizations are employing a one-size-does-not-fit-all policy for two-factor authentication. By providing organizations a range of OTP form factors, administrators can manage user access rights through authentication platforms. Evolving threat landscape: The new wave of malware and sophisticated methods of criminal access has decisively put every type of organization on notice. In 2011, the industry witnessed the extent of damage a security breach can cause, resulting in loss of sensitive data and business revenue that eventually culminated in an end of operations, such as the shutdown of certificate authority DigiNotar. Growing demand for authentication: An OTP solution is one level of protecting a user from providing escalated privileges to a criminal. Some vendors have taken it one step further by offering transaction authentication and risk/context-based authentication, which includes OTP, to further analyze and protect users from fraudulent activity. Frost.com 5

6 Frost & Sullivan BYOD and cloud applications: As more organizations allow employees to use personal mobile devices to conduct day-to-day business, the BYOD trend has created many opportunities and challenges for corporate IT staff. Demand for software tokens has increased due to their ease of installation on mobile devices for authentication. No longer must mobile applications be exited in order to use the token application for authentication; mobile software SDKs integrate OTP technology in mobile applications for seamless use. Security in cloud applications has become a top priority for many enterprise customers. Organizations working in the cloud must be able to provide their users on-demand applications without compromising the security of their data. As an extension of remote access to a network s sensitive data, OTP is beneficial for anytime, anywhere secure access, from any device, to cloud applications. The use of OTP technology continues to be driven by the need for data and user protection to mitigate risk on a network. Competitive Analysis Successful OTP vendors will address the evolving landscape and compete with out-of-band authentication solutions by offering a multi-layered approach to authentication, and ensuring the return on investment (ROI) of OTP is succinctly articulated to customers. Key differentiators, such as mobile SDKs and risk-based authentication, are necessary offerings for those vendors seeking to gain OTP market and customer mind share. Competitive positioning within the global 2011 OTP market is shown in Figure 3. RSA has continued to maintain a clear position of market leadership due, in large part, to a highly interoperable, extensive product line and its continued efforts in providing strong authentication and innovative solutions. Figure 3: Total OTP Market Competitor Positioning Analysis (Global), 2011 Ability to Deliver Entrust Activldentity Symantec Gemalto SafeNet VASCO Data Security RSA Syferlock ID Control Kobil Market Contenders Market Challengers Market Leader Market Penetration Source: Frost & Sullivan 6 Frost.com

7 An Overview and Competitive Analysis of the One-Time Password (OTP) Market RSA, the Security Division of EMC With more than 30 years of experience in the OTP market, RSA has built a reputation for developing best-in-class, innovative solutions. The RSA SecurID product line has continually led the way in hardware authentication with its combination of a PIN and time-synchronous feature. The RSA SecurID product portfolio offers customers a choice of form factor based on unique end-user requirements, and includes hardware, software, and SMS OTP technology. As shown in Figure 4, RSA led the market with 44.4 percent revenue share within the global OTP market in Figure 4: Total OTP Market Percent of Revenue (Global), 2011 Competitor 4 4.8% Competitor 5 3.5% Competitor 6 2.1% Competitor 7 2.0% Others* 3.3% Competitor 3 8.6% RSA 44.4% Competitor % Competitor % Source: Frost & Sullivan RSA s broad portfolio of technologies and expertise enable the development of innovative solutions to meet evolving user demands, such as protection against APTs and mobile adoption. RSA has developed its SecurID Mobile SDK and Adaptive Authentication Mobile SDK to allow for seamless integration of OTP and risk-based technology in mobile applications. Its SDKs enable organizations to enhance their security posture and meet growing challenges, such as BYOD. Frost.com 7

8 Frost & Sullivan In 2012, RSA released its Authentication Manager Express, a risk-based, on-demand authentication system for SMBs. The system overcomes the total cost of ownership (TCO) challenge many organizations face when deploying authentication solutions, providing SMBs a cost-effective, high-quality solution. Since its breach in 2011, RSA has worked diligently with its customer base to replace tokens and offer additional support to prevent future attacks. The effect of the breach was minimized through a combination of proactive customer education and account support. Key Performance Drivers for RSA Brand Recognition With more than 30 years of experience in the authentication business, RSA has built a reputation for developing best-in-class, innovative solutions, and its SecurID product line continues to be a highly coveted solution for many organizations. Its wide spectrum of high-assurance solutions safeguard the integrity and confidentiality of customer information, and has enabled the company to maintain a leadership position for the past nine years within Frost & Sullivan s global OTP market analysis. Continued Innovative Development Much of RSA s market success can be attributed to a commitment to providing customers with innovative solutions that overcome current and anticipated challenges. RSA has expanded its SecurID hardware token technology into its software token and on-demand authenticator offerings. By providing an array of options for secure two-factor authentication, organizations will have the flexibility to issue different SecurID form factors to the appropriate users. Prime examples of RSA s continued innovation in OTP are is the releases of RSA Authentication Manager Express and SDKs. Authentication Manager Express meets the growing challenge of those SMBs forgoing implementing strong authentication due to cost. This cost-effective, risk-based, on-demand authentication system integrates seamlessly with a wide range of third-party products. Furthermore, it enables SMBs to protect SSL VPNs and Web portals from unauthorized access, and analyze abnormal behavior on the network. RSA s mobile SDKs allow developers to integrate RSA s SecurID OTP technology or Adaptive Authentication risk-based authentication into mobile applications. Once the application is accessed, an OTP is automatically generated in the background, providing seamless, secure access. Rather than launching two applications, users can access their application of choice without the need to switch back and forth between applications. RSA provides enhanced security to applications while maintaining the traditional login feel, and allows organizations to use the same software token outside the application for multiple authentication use-cases. 8 Frost.com

9 An Overview and Competitive Analysis of the One-Time Password (OTP) Market Interoperability and Collaboration with Third-Party Solutions RSA understands the necessity of easy integration with third-party solutions as a key criterion in authentication partner selection. RSA s SecurID technology delivers a multitude of out-of-the-box integrations with a wide range of third-party products. At RSA Conference 2012, the organization detailed its Secured by RSA Certified Mobile Partner program, and related partnerships with Citrix, Juniper Networks, VMware, Appcelerator, Feedenry, Good Technology, and Zscaler. Through this collaboration, mobile technology will be authenticated by RSA SecurID and Adaptive Authentication solutions, providing secure access to virtual desktops, virtual applications, VPNs, and application development platforms on mobile devices. CONCLUSIONS The OTP market is evolving as vendors focus on educating users in terms of how and where OTP fits within organizational security strategies. In the face of the ever-changing threat landscape, vendors understand that OTP should serve as a baseline standard and multi-factor authentication beyond where OTP is required. Vendors must continue to develop authentication suites, such as risk-based analysis products, to combat global cyber attacks. Secure access to mobile applications will be gained through mobile SDKs, providing clients the ability to customize software application authentication methods for their users. While the OTP market is in a stage of maturity, vendors such as RSA are continuing to build upon existing technology to bring to market highly sophisticated, innovative, and high-assurance authentication solutions. Frost.com 9

10 Silicon Valley 331 E. Evelyn Ave. Suite 100 Mountain View, CA Tel Fax San Antonio 7550 West Interstate 10, Suite 400, San Antonio, Texas Tel Fax London 4, Grosvenor Gardens, London SWIW OD,UK Tel 44(0) Fax 44(0) GoFrost About Frost & Sullivan Frost & Sullivan, the Growth Partnership Company, works in collaboration with clients to leverage visionary innovation that addresses the global challenges and related growth opportunities that will make or break today s market participants. For more than 50 years, we have been developing growth strategies for the Global 1000, emerging businesses, the public sector and the investment community. Is your organization prepared for the next profound wave of industry convergence, disruptive technologies, increasing competitive intensity, Mega Trends, breakthrough best practices, changing customer dynamics and emerging economies? Contact Us: Start the Discussion For information regarding permission, write: Frost & Sullivan 331 E. Evelyn Ave. Suite 100 Mountain View, CA Auckland Bahrain Bangkok Beijing Bengaluru Bogotá Buenos Aires Cape Town Chennai Colombo Delhi / NCR Dhaka Dubai Frankfurt ong Kong Istanbul Jakarta Kolkata Kuala Lumpur London Manhattan Mexico City Miami Milan Mumbai Moscow Oxford Paris Pune Rockville Centre San Antonio São Paulo Seoul Shanghai Shenzhen Silicon Valley Singapore Sophia Antipolis Sydney Taipei Tel Aviv Tokyo Toronto Warsaw Washington, DC