Total Cost of Ownership Advantage Identity Management as a Service

Transcription

1 Total Cost of Ownership Advantage Identity Management as a Service Whitepaper July 2013 AUTHOR: TOM EGGLESTON CHIEF TECHNOLOGY OFFICER SALFORD SOFTWARE

2 1 About Salford Software Established in 1988, Salford Software is a commercial organisation wholly owned by the University of Salford, based in Manchester. Salford Software has a core specialism in Identity and Access Management solutions, having deployed over 200 Identity Management solutions, into customers across the corporate, government, NHS, academia and education sectors. Our technical team are skilled in understanding our customers business drivers, and match the most appropriate technology for the requirement, whether this is based upon the Microsoft, NetIQ or open source Identity and Access Management solutions. Salford Software provides a full service portfolio, from consultancy through to technical support and full managed service. We also give you the choice to deploy solutions on-premise or in private or public cloud scenarios. Having achieved the necessary requirements, Salford Software holds the following vendor accreditations: Additionally, Salford Software is ISO27001 accredited, is a corporate member of UCISA and has a connection to the NHS network, N3: Salford Software s products are listed on the UK Government s G-Cloud Framework. Please refer to the following URL:

3 2 Executive Summary Identity Management as a Service (IDMaaS) is an emerging form of Software as a Service (SaaS), which provides cloud based Identity Management services to manage digital identities and access to systems and applications within the enterprise. IDMaaS is a compelling alternative to traditional, on-premise deployments of Identity Management technologies, which tend to require expensive license fees, significant investment in hardware and long and costly professional services engagements to deploy and configure the software. Hosted and managed in the cloud by the vendor, and with very short deployment timescales. IDMaaS avoids these problems normally associated with on-premise deployments of IDM, and allows customers to benefit from the economies of scale inherent in cloud computing. Using Total Cost of Ownership to analyse the true cost of deploying and running Identity Management software, this White Paper demonstrates that: A large University can make savings of up to 64% over five years by running an IDMaaS, such as justidm from Salford Software, instead of deploying IDM on premise. A typical Further Education College can make savings of up to 88% over five years by running an IDMaaS, such as justidm from Salford Software, instead of deploying IDM on premise.

4 3 Introduction 3.1 What is the total cost of ownership? Total Cost of Ownership (TCO) is a financial method which is used to estimate the complete cost of deploying a new technology, including all hidden costs which are necessarily incurred in the deployment, maintenance and management of a new solution. TCO therefore enables organisations to look beyond the headline costs, such as software licenses and hardware, to determine the full cost associated with running a service over a given period of time in most cases, TCO is measured over five years TCO analysis is a very powerful tool when procuring new technology, as it enables buyers to compare different products in a more meaningful manner than simply comparing initial purchasing and deployment costs. As a simple example, consider the selection of a new software package. Two suitable packages are identified, one which has significantly lower license and hardware costs than the other. Initially it would seem that this software package would offer best value, and should be selected. However, imagine that a detailed analysis of TCO revealed that the cheaper package would require niche and expensive in house development skills to maintain the product in production; the alternative package would require much less on-going development and would rely on readily available, more cost effective developer skills. After this analysis, it is quite likely that the TCO for the initially more expensive product may be lower over the longer term, and therefore it would offer the best value. 3.2 What is identity management? Identity Management is a set of technologies which provides organisations with the ability to manage the digital identities of their users, both within and outside of the organisation. Put simply, Identity Management ensures that the right people have the right access to the right data at the right time. In the internet age, and with the advent of cloud computing, Identity Management is a critical component of an organisation s IT environment. The technologies that make up Identity Management products typically include: - Automated user provisioning / de-provisioning - Access Management - Federation - Single Sign On - Strong authentication - Role Based Access Control - Reporting and attestation 3.3 What is SaaS/IDMaaS? Software as a Service (SaaS) is an increasingly prevalent method of purchasing and using software applications. In the SaaS model, software vendors host the application and data centrally in the cloud, and customers use the software on a subscription basis, typically charged per user per month. This is in contrast to the traditional on-premise model where organisations purchase software licenses and hardware up front, and deploy software solutions onsite.

5 Well known examples of SaaS offerings include Microsoft Office365, Google Apps and Salesforce.com. Common variants of the SaaS model include Infrastructure as a Service (IaaS) where customers can purchase cloud based computing resources, Platform as a Service, which allows customers to host their content on pre-configured delivery platforms (e.g. web servers), and Network as a Service (NaaS), which allows customers to benefit from complex networking technologies such as VPN or Load Balancers hosted in the cloud. Identity Management as a Service (IDMaaS) is an emerging category of cloud service, which provides customers with cloud based Identity Management services such as user account provisioning and de-provisioning, password synchronisation, role based access control, attestation and federation. Just Identity Management from Salford Software is a leading example of an IDMaaS service. Traditionally, Identity Management has been dominated by complex and expensive vendor solutions, which require significant effort to develop, deploy and maintain on-premise. Whilst there is still a requirement for some organisations to maintain on-premise deployments of Identity Management to accommodate automation of complex business rules, in many cases the Identity Management requirements are much less complex, and are well suited to a cloud based delivery model. 3.4 Customer benefits of SaaS Model SaaS models confer significant benefits to both providers and customers in the form of economies of scale which reduce the cost of the service per user; providers are able to pass these savings onto customers. In turn, these cost savings and other benefits translate into significantly reduced TCO as compared to on-premise solutions. The following are examples of benefits which customers can derive from SaaS, and how the SaaS delivery model is able to deliver the benefit. Benefit Elimination of up-front Capital Expenditure Flexible Cost Model How is the benefit delivered? The SaaS vendor is responsible for the implementation of all infrastructure and software required to run the service, and pays for the associated up-front costs so the customer doesn t have to. Accordingly, expenditure related to the deployment of the solution moves from Capex (for a traditional on-premise deployment) to Opex (in the SaaS model). As SaaS solutions are typically paid for per user per month, customers can manage their on-going costs very flexibly. Rather than having to estimate the total number of users of a service in a typical onpremise deployment, and purchase sufficient licenses up front regardless of usage, in the SaaS model, customers can pay for only the users who use the service, and can increase or decrease these numbers on a monthly basis. This move to a Pay as you Go model can lead to significant cost savings if tightly monitored and managed.

6 Access to Enterprise quality infrastructure Instant deployment Eliminates Maintenance Overheads Significant reduction in risk SaaS vendors build solutions to be multi-tenanted from the outset, meaning that multiple customers share the same infrastructure, without impacting data segregation. This is a much more efficient model than traditional on-premise deployments, where each customer must deploy and maintain a full enterprise infrastructure. As SaaS vendors can run hundreds of customers from a single environment, the per-user cost of the infrastructure is significantly lower than in the on-premise model. In the SaaS model, there is no requirement for a lengthy and expensive project to deploy and configure the solution on-premise. Typically SaaS solutions are pre-configured with settings known to be appropriate across a wide cross section of customers, or are easily self-configurable by the customer. The upshot is a significant saving in deployment costs, and a faster route to productivity for end-users. For an IDM solution, a typical onpremise enterprise deployment can take between six months and one year, during which time the customer derives no benefit from the up-front investment in hardware, licenses and consultancy. The SaaS vendor is responsible for the maintenance of the environment, so there is no need for the customer to plan and resource typical on-premise maintenance activities such as infrastructure management and updates, software maintenance and upgrades, on-going development of the solution. This enables customers to focus resources on other more productive activities which directly impact the business. Vendors are able to run large scale, distributed, resilient environments, which are maintained by a dedicated team of experts. Risk inherently present when managing on-premise maintenance (such as failed upgrades) no longer apply, and vendors are able to offer multiple nines levels of uptime (e.g %) made possible by distributing the environment across multiple data centres and territories. Cost savings attributed to reducing these risks are hard to quantify, but are real and significant.

7 4 TOTAL COST OF OWNERSHIP ANALYSIS 4.1 Considerations for an IDM TCO Model The Total Cost of ownership of an IDM system is made up of a number of areas of expenditure, which are described in more detail below Licenses Software licenses for IDM solutions can typically be purchased in two models perpetual licenses or subscription. Perpetual licenses are purchased up front and entitle the customer to use the software perpetually for a specified number of users. In addition to this there is a maintenance charge which covers the customer for patches and upgrades Servers Any on-premise IT service requires server hardware; typically, complex enterprise deployments require more hardware to allow for resilience and high availability considerations. Of course, the initial purchase of the server hardware is only a small part of the investment required to run the hardware. The servers must be located in a data centre; the data centre requires power and air-conditioning. Operating System licenses must be purchased to run on the servers. Additionally, hardware maintenance must be purchased to ensure that any failed components can be replaced promptly. All of these elements add cost which must be factored in when electing to run an IDM service on-premise Implementation Implementation of on-premise IDM can be a lengthy and time-consuming process. Overall, an IDM deployment can take between three months and one year to complete, but a useful rule of thumb is ten days plus ten days per connected system. As most IDM projects are consultancy driven, this can become an expensive undertaking. Frequently, IDM projects can become unnecessarily drawn out due to complexities related to business processes rather than the technology itself. As a traditional IDM deployment will typically gather input from key individuals from across the organisation, stakeholder management becomes crucial. There is a significant risk that the process can end up as design by committee which can both increase the duration and cost of the project and erode the business benefits of the solution. In addition, it is likely that there will a requirement for lights-on maintenance (I.e. minor modifications to the system to keep it working in a changing environment) and support. Typically support will be provided by the software vendor or technology partner Staff IDM software solutions are complex pieces of middleware, and require a broad blend of skills in order to properly manage and maintain them. The ideal IDM administrator will be part business analyst, part technical consultant and part software developer, with highly developed skills in each area. Such an individual is likely to be difficult and expensive to recruit, and hard to retain.

8 The following maintenance activities are typically required to maintain an on-premise IDM system: - Dealing with end user issues and outages related to the IDM system - Liaising with IDM system support partners - Maintaining the hardware, operating system and IDM application across preproduction and production environments, including testing and deployment of security patches, system health checks and backup and restore. - Change control and governance of the IDM system this may include preparation of change control documentation and participation in the Change Advisory Board process. The amount of time required to maintain an IDM system varies with the number of connected system, users and the complexity of the configuration. However, even a relatively simple system with up to five connectors is likely to take up to a half of an FTE s time Five year refresh Technology refresh is a significant, but often overlooked cost associated with on-premise solutions. Typically, enterprise IT solutions will require a major refresh after a number of years in service, often after around five years. This is due to the hardware and software becoming dated, and requiring updating or replacing. In many cases organisations work to a shorter refresh cycle such as three years however for the purposes of this analysis, the longer cycle of five years has been used. In the case of hardware, the servers may contain components which can no longer be easily replaced, and the servers are likely to be outside of manufacturer s warranty. On the software side, the technology is very likely to have moved on, and it may be necessary to update to the latest version of the solution in order to benefit from the latest functionality and best practice. A refresh along these lines is likely to involve significant expense, as new hardware, software licenses and consultancy will be required.

9 4.2 TCO Model Assumptions The following assumptions have been made in producing the Total Cost of Ownership model used in this White Paper. Licenses Category Server Virtualisation Server Hardware Server power consumption Server Cooling Costs Assumption The TCO model provides comparisons against licenses from IDM vendors appearing in Gartner s Leaders Quadrant specific details are available upon request. The TCO model assumes that perpetual rather than subscription based licenses are purchased. Annual maintenance on software licenses has been assumed to be 10% of the license cost. License costs were accurate according to vendor list prices in April It is assumed that servers will be virtualised where appropriate. It is assumed that each virtualisation host can support up to four virtual machines. It is assumed that four virtual servers are required for an on-premise IDM deployment. A single virtual server is required for the Appliance, as it is optimised to run with a small footprint. It is assumed that servers with similar specification to the following will be used: HP DL-380 Generation 6 with two Quad core CPUs, 24 GB memory, eight network ports, two 72GB 15K SAS hard disks with two 460 Watt power supplies It is assumed that such a server would cost 5,000 to purchase, with 15% annual maintenance. Energy consumption costs per server have been calculated using the following formula. ( ) The following figures have been used: Operating Hours = 365*24 = 8760 Hours Watt Usage / hour = 307 Watts Electricity costs / kwh = 0.15 Using this method, the annual power cost per server is assumed to be 400 Cooling costs per server have been calculated using the following formula: ( ) Staff Where: Operating Hours = 365*24 = 8760 Hours BTU = British Thermal Unit 1BTU = Watts Electricity costs / kwh = 0.15 Using this method, the annual power cost per server is assumed to be 400. It is assumed that (0.075xFTE x IDM Connectors) IDM Administrators are required to manage an IDM system. There is no universally accepted metric for this, and the true figure will of course depend on the complexity of the solution and the skills of the individual. However, based on Salford Software s experience of deploying and managing IDM solutions, this is a

10 Implementation and Maintenance reasonable, if conservative, estimate. A total employment cost of 75,000/year has been used to calculate IDM Administration costs. This represents the fully loaded cost of employing one IDM Administrator, and includes social costs such as National Insurance and pension contributions. A metric of 7.5 days of consultancy per IDM connector at a day rate of 1,000/day has been used to calculate deployment costs. A metric of 10% of the deployment cost has been used to estimate lights on maintenance costs. Support costs are estimated at 15% of deployment costs per annum.

11 4.3 TCO Example Large University Scenario: University with 4,000 staff and 40,000 students IDM connectors x 8 justidm Contract Length 5 Years Summary: In this scenario, the TCO of justidm is 64% less than the equivalent on-premise IDM deployment over 5 years. Cost Breakdown: Item Year 1 Year 2 Year 3 Year 4 Year 5 Total Licenses Purchase 118, ,400 Maintenance 11,840 11,840 11,840 11,840 47,360 Servers Purchase 5,000 5,000 10,000 Maintenance ,000 Power ,000 Cooling ,000 OS License Staff IDM System Administrators 45,000 45,000 45,000 45,000 45, ,000 Implementation Deployment 60,000 60,000 "Lights on" Maintenance 6,000 6,000 6,000 18,000 Refresh 45,000 45,000 Support 9,000 9,000 9,000 9,000 9,000 45,000 Annual TCO (On-Premise) 239,000 73,390 73,390 73, , ,560 Cumulative TCO (On-Premise) 239, , , , , ,560 Annual TCO (IDMaaS) 39,424 39,424 39,424 39,424 39, ,120 Cumulative TCO (IDMaaS) 39,424 78, , , , ,120 TCO % (against on-premise) 84% 75% 69% 66% 66% 64% Annual TCO - On Premise vs. IDMaaS IDM TCO - On Premise vs. IDMaaS 140, , ,000 80,000 60,000 40,000 20,000 0 Year 1 Year 2 Year 3 Year 4 Year 5 Annual TCO (On-Premise) Annual TCO (IDMaaS) 300, , , , ,000 50,000 0 Year 1 Year 2 Year 3 Year 4 Year 5 Cumulative TCO (On-Premise) Cumulative TCO (IDMaaS)

12 4.4 TCO Example FE College Scenario: University with 500 staff and 5,000 students IDM connectors x 5 justidm Contract Length 5 Years Summary: In this scenario, the TCO of justidm is 88% less than the equivalent on-premise IDM deployment over 5 years. Cost Breakdown: Item Year 1 Year 2 Year 3 Year 4 Year 5 Total Licenses Purchase 14,800 14,800 Maintenance 1,480 1,480 1,480 1,480 5,920 Servers Purchase 5,000 5,000 10,000 Maintenance ,000 Power ,000 Cooling ,000 OS License Staff IDM System Administrators 28,125 28,125 28,125 28,125 28, ,625 Implementation Deployment 37,500 37,500 "Lights on" Maintenance 3,750 3,750 3,750 11,250 Refresh 28,125 28,125 Support 5,625 5,625 5,625 5,625 5,625 28,125 Annual TCO (On-Premise) 92,650 40,530 40,530 40,530 69, ,145 Cumulative TCO (On-Premise) 92, , , , , ,145 Annual TCO (IDMaaS) 6,534 6,534 6,534 6,534 6,534 32,670 Cumulative TCO (IDMaaS) 6,534 13,068 19,602 26,136 32,670 32,670 TCO % (against on-premise) 93% 90% 89% 88% 89% 88% 100,000 90,000 80,000 70,000 60,000 50,000 40,000 30,000 20,000 10,000 Annual TCO - On Premise vs. IDMaaS 0 Year 1 Year 2 Year 3 Year 4 Year 5 Annual TCO (On-Premise) Annual TCO (IDMaaS) 300, , , , ,000 50,000 0 IDM TCO - On Premise vs. IDMaaS Year 1 Year 2 Year 3 Year 4 Year 5 Cumulative TCO (On-Premise) Cumulative TCO (IDMaaS)