CIO Update: Gartner's Extranet Access Management Magic Quadrant for 2H02

Transcription

1 IGG J. Pescatore, R. Wagner Article 15 January 2003 CIO Update: Gartner's Extranet Access Management Magic Quadrant for 2H02 CIOs and many other executives are interested in insights on how to improve the data integrity and security of their enterprises. Inside-the-firewall (intraenterprise) integration to reduce costs dominated the extranet access management market in Enterprises and vendors will focus on Active Directory in Extranet Access Management Overview What Is an Extranet? An intranet is an internal network based on Web technology, most often used by enterprises for informational purposes, such as distribution of internal information, notification of vacancies, or displaying internal directories and organizational charts. An intranet will usually have links to the Internet and must therefore be protected from unauthorized access. A group of interconnected intranets for instance, between a company and its suppliers is commonly referred to as an extranet. Extranet Access Management Gartner defines extranet access management products as solutions that provide a unified mechanism to manage the authentication of users and implement business rules determining user access to applications and data. The business rules may be authorizations in a security sense, entitlements in a legal/contractual sense or personalization in a marketing sense. As the use of enterprise portal products increases, integration between user access management and portal personalization features grow in importance. Larger enterprises with multiple Internet domain names, as well as distributor or hub-and-spoke business-to-business extranets, require multidomain single sign-on and distributed user management capabilities. Performance, scalability and availability become critical as extranet access management solutions are relied upon for production applications both inside and outside the firewall. Market Trends in 2002 and 2003 Economic Impact on Extranet Access Management Uncertain economic conditions and a vastly reduced number of extranet and e-business rollouts dominated the extranet access management market in Most extranet access management Gartner Entire contents 2003 Gartner, Inc. All rights reserved. Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 activity was related to IS organizations attempting to reduce their operational costs of managing user access to externally exposed applications (primarily business-to-business) and Intranet-based applications and portals. That focus has changed product demands to more integration with Active Directory and employee-oriented applications, such as PeopleSoft and Siebel Systems, and has increased demand for provisioning integration and channel strategies. Funding for extranet access management deployment comes from flat IT budgets, and pricing pressure has been intense. Standards Activity There was much noise, but less action, on the standards front in The Liberty Alliance released its Liberty 1.0 specification, which extended the Security Assertions Markup Language (SAML). The Organization for the Advancement of Structured Information Systems (OASIS) approved the SAML specification. Major extranet access management vendors, and several other product vendors, announced SAML support in their products. Microsoft publicly stated that it would support several forms of identity tokens, including SAML and Kerberos, in the Web Services Security (WS-Security) extensions to the Simple Object Access Protocol that Microsoft and IBM had developed and turned over to OASIS as a royalty-free standard. The Liberty Alliance announced that it would support WS-Security in Liberty 2.0. However, Microsoft has not detailed plans for direct support of SAML in Windows authentication and access control mechanisms, such as Passport. Liberty and Passport Outlook Gartner research shows that financial services companies, which are the most-likely early adopters of federated identity services such as Liberty and Passport, had no near-term ( ) plans to adopt either service. Gartner believes that the initial wave of Liberty/Passport deployment will be in the 1H04 time frame and will be driven by business-to-business services. That forecast, combined with increased market attention on reducing the cost of managing internally focused applications, places Active Directory-centric solutions in a strong position for the future because enterprise identities are tightly bound to Windows PC and network logins. Unless economic conditions make a strong turnaround and invigorated e-business rollouts are driven more by business units than IS organizations, Gartner expects that the focus on Active Directory will dominate the market through Extranet Access Management Factors Most enterprise demand for extranet access management involved internal applications as IS organizations attempted to support a wide range of applications that were developed during the past several years. In 2002, most extranet access management product advancements involved integration with provisioning capabilities to provide workflow functions for automating user

3 management actions across applications. Integration can lead to fewer administrators required to support a given user population across large numbers of applications, but it often is yet another peruser fee that sometimes exceeds the cost of the user access management product. Consolidation among provisioning, extranet access management and platform vendors will drive the per-seat costs down as long as the flat economy continues in These factors caused some changes in vendor positioning in Gartner s Extranet Access Management 2H02 Magic Quadrant (see Figure 4). Figure 4 Extranet Access Management 2H02 Magic Quadrant Challengers Leaders IBM Ability to Execute Novell Netegrity Oblix RSA Security Entrust Secure Computing Entegrity Open Network Technologies A Wipro Baltimore Technologies As of January 2003 Niche Players Visionaries Source: Gartner Research Completeness of Vision Leaders Netegrity Netegrity abandoned its attempt to move beyond being a pure-play extranet access management vendor and announced that it would no longer offer the DataChannel portal product. Netegrity s large installed base, wide channel support and strong customer service capabilities provided advantages as IT spending slumped. However, the DataChannel acquisition forced Netegrity to compete with a wide array of portal and application server vendors, in addition to competing with other extranet access management providers. In late 2002, Netegrity announced a Web services transaction management product, TransactionMinder, as well as a core identity management product that will

4 compete with Oblix CoreID. However, Netegrity s long-delayed migration to the provisioning space has yet to bear fruit. IBM IBM has continued to execute its strategy of embedding Tivoli Access Manager (formerly Policy Director) into IBM s dominant products, such as WebSphere and MQSeries. WebSphere s strong position in the application server and portal market gives Tivoli Access Manager a strong advantage in the enterprise space. IBM s acquisition of Access360 enables it to accelerate the deployment of integrated provisioning capabilities via Tivoli Identity Manager across its product line. IBM s major weakness is a limited set of integration partners. Oblix Oblix made considerable progress in market strength and the completeness of its extranet access management offering in Oblix has been the primary beneficiary of the channel conflicts that Gartner forecast that Netegrity would experience after its acquisition of DataChannel. Oblix gained strong integration and business alliances with BMC Software, Plumtree Software and other vendors. Oblix s NetPoint product has been deployed successfully by large enterprises, with high marks by its customers for performance and after-sales support. Challengers Novell Novell made limited progress in advancing its ichain product in It mainly focused on rationalizing the Novell line of security products with a marketing and branding campaign. Novell s ichain 2.2 release should make it a more-competitive offering, but Novell will bring features to market more than a year after most of its competitors. ichain continues to be a cost-effective choice for enterprises that make extensive use of Novell s other products. However, it has limited channel support outside of Novell s base. Visionaries RSA Security RSA Security has completed the stabilization of Securant extranet access management software and the integration of Clear Trust into its product line. Because of its strength in the remote access token space, RSA Security has a strong worldwide channel and support structure. However, that strength has limited RSA Security s effectiveness in signing integration partners in the portal and application server space, where SecurID tokens are not a major factor. Entrust Entrust has moved away from enterprise infrastructure-based public-key infrastructure toward applications that integrate strong security (secure messaging and Web services). It has positioned GetAccess as a key product offering. Entrust has less visibility than RSA Security in the extranet access management market, mainly because of limited channel support. However, Entrust can build on a reputation for high-quality software and solid support.

5 Open Network Technologies Open Network Technologies made some important alliance deals with Microsoft s consulting services and Waveset in the provisioning space in Microsoft will push Open Network s DirectorySmart product to bridge Unix environments with Active Directory deployments. Although this will increase Open Network s visibility and deal flow, this type of relationship is a two-edged sword, as CyberSafe found out several years ago becoming associated with Windows-only deployments can cause a small vendor to be excluded from consideration by large enterprises. Niche Players Baltimore Technologies and Entegrity Baltimore Technologies and Entegrity dropped in their ability to execute because their financial status, partnering and visibility were reduced. They remain strong technology choices for niche environments. Secure Computing Secure Computing has developed PremierAccess to support its hardware token product. PremierAccess provides base rules-and-roles functionality, uniform resource locator protection and integration hooks. Although this offering does not compete with more-mature products in functionality, the tight integration with Secure Computing s token products makes it a solid choice for Secure Computing token customers. Therefore, we ve added Secure Computing to the Magic Quadrant. Wipro Wipro gained some enterprise wins and is a viable option, especially for enterprises that use Wipro s integration services. Not on the Map Gartner has removed or omitted the following vendors from the Magic Quadrant: Vasco Data Security s financial challenges will require it to focus on fewer product offerings. It has shown no evidence that it intends to advance its Vacman product. Microsoft has no product offering in this space, although it announced that its TrustBridge technology should be available when.net Server ships in 1H03. Gartner believes that Microsoft will position TrustBridge as.net Server features that, along with Commerce Server.NET, can be used to build an extranet access management solution for environments that use Active Directory or all- Windows servers. However, this will not occur until Computer Associates International released a 1.0 product for extranet access management in 4Q02, which is too new to market to be evaluated for the Magic Quadrant. Its etrust Web Access Control product is based on the Security for Open Systems technology that Computer Associates previously acquired from Memco Software.

6 Sun Microsystems Directory Server Access Management Edition never really became a product. It has been re-branded as the Sun ONE Identity Server 5.1, but it has experienced limited deployment. Calendra, based in France, offers Directory Manager for developing Lightweight Directory Access Protocol-centric applications. However, it doesn t provide much out-of-the-box functionality for integration with the typical applications that enterprises have developed. Secure Sockets Layer-based remote access vendors, such as Neoteris, SafeWeb, Netilla Networks and others, also offer some form of access control to Web-based applications. However, they don t support the variety of applications, Web servers and management capabilities that are required for effective extranet access management products. PassGo Technologies was re-established as a separate company in a management buyout from Symantec. PassGo acquired all of Symantec s authentication and access management products, including the WebThority extranet access management product. PassGo will need to demonstrate significant investment in advancing WebThority product capabilities and channel support for it to be a viable enterprise choice. Bottom Line The extranet access management market has broadened beyond extranets, and Gartner will consider this expansion in future research. Enterprises should continue to emphasize ease of integration when investing in extranet access management solutions. Written by Edward Younker,Research Products Analytical sources: John Pescatore and Ray Wagner, Gartner Research For related Inside Gartner articles, see: CIO Update: Answer Six Key Questions, Improve Internet Security, 6 November 2002