The organization decided that creating a more robust approach to customerfacing identity management represented a strategic opportunity.

Transcription

1 BUYER CASE STUDY BuyerPulse Buyer Case Study: McKesson Utilizing Open Source IAM: Benefits in Cost, Customization, and Integration Sally Hudson Susan Funke Chris Skall Global Headquarters: 5 Speen Street Framingham, MA USA P F IDC OPINION McKesson, a global provider of healthcare products and healthcare IT services, has implemented the ForgeRock Open Identity Stack to manage identity needs for solutions and applications within the organization's customer and partner identity space. McKesson's selection of the ForgeRock Open Identity Stack was based on the following organizational needs: The organization decided that creating a more robust approach to customerfacing identity management represented a strategic opportunity. McKesson required a solution that was agile, lightweight, and customizable to better serve its customer base. McKesson completed a staged and limited implementation of the ForgeRock solution to address particular identity needs rather than completely replace its existing solution. IN THIS BUYER CASE STUDY This IDC Buyer Case Study examines how McKesson, a provider of healthcare products and healthcare IT services, selected the ForgeRock Open Identity Stack as the identity and access management (IAM) tool for its customer-facing identity environment. The document details why McKesson purchased an IAM solution, the product selection process, implantation, results, and lessons learned. SITUATION OVERVIEW Organization Overview McKesson Corp. is a global provider of pharmaceutical and medical services and products, including electronic medical systems, pharmaceutical distribution, patient relationship management systems, and pharmacy and nursing automation services. Headquartered in San Francisco, McKesson is the 14th largest company in the United States, with 2013 revenue of $122.5 billion. McKesson handles over one-third of the country's pharmaceutical distribution and has health solutions in approximately Filing Information: July 2013, IDC #242405, Volume: 1, Tab: Users BuyerPulse Analysis: Identity and Access Management: Buyer Case Study

2 70% of the country's hospitals. In addition to its U.S. operations, the company also has several global subsidiaries, including McKesson Canada, McKesson United Kingdom, McKesson France, and McKesson Netherlands. For this Buyer Case Study, IDC interviewed Michael P. Wilson, VP and CISO at McKesson. Challenges and Solution In 2010, McKesson began to examine its IAM environment and brought in a consultant to help drive strategy. While the company had a robust and dependable solution to handle internal employee identity needs, it wanted to find a new approach to handling partner and customer-facing identity management. Frequent and numerous acquisitions coupled with the size of the organization translated into a highly complex internal IT environment. In response to various technical concerns around ease of use and integration, McKesson decided to find a new vendor to begin to address the migration and management of multiple consumer-facing solutions and applications. Table 1 provides a summary of issues and factors that contributed to McKesson's decision to purchase ForgeRock Open Identity Stack. TABLE 1 Buyer Case Study Capsule Category Vendor/product User organization Vertical Size Purchase trigger/need Key tech requirements Short list Key win factors Decision cycle time Implementation time Details ForgeRock Open Identity Stack McKesson Healthcare Enterprise Develop a better strategy around the consumer-facing identity space Ability to customize, ease of integration, ease of use Non-competitive Proof of concept, security, ease of use Six months Six weeks Source: IDC, June # IDC

3 Key Requirements: Customization, Integration, Price At the time McKesson decided to work on developing a new IAM solution for customer and partner solutions, the company already had several identity products in place from some of the larger IAM vendors in the market. While these solutions were performing well, the organization wanted a more agile strategy for handling customerfacing solutions and incorporating various elements of identity. Accordingly, McKesson needed a product that could be flexible and lightweight enough to accomplish this strategic goal. Based on McKesson's complex IT architecture, the solution needed to be able to integrate well with existing systems and be easily implemented. The product also had to integrate with and support numerous externally developed applications and solutions that arose from McKesson's high volume of partnerships and acquisitions. Pricing the solution was also a driver that caused McKesson to look beyond its existing deployment of identity technologies and services. Product Selection McKesson experienced a relatively non-competitive purchasing process and did not submit a formal RFP to vendors. As the company's purchasing triggers were strategic in nature, McKesson was able to engage in extensive internal discussions and planning to determine what a potential solution would need to provide in order to deliver on the company's goal of creating a robust solution for the consumer-facing identity space. The selection team was introduced to the ForgeRock product after McKesson Pharmacy Systems and Automation (MPS&A), a business unit within the company that provides a pharmacy management and processing system, began to look at the solution to address identity and integration needs. This deployment of the ForgeRock Open Identity Stack served as a proof of concept for the company and allowed members of the selection team to educate themselves about the capabilities and functionality of the solution. As MPS&A began to utilize the solution, Wilson and other members of the selection team began to simultaneously research open spec solutions and evaluate whether ForgeRock could be a viable solution for the company. Despite initial reservations, Wilson found that ForgeRock offered thorough security features as part of its application strategy. "When you think about code in a software package, there are a lot of benefits to being open source it's under scrutiny, it's public," Wilson commented. Following a successful initial deployment, McKesson decided to expand its use of ForgeRock to other business units and solutions within the company. Implementation McKesson carried out a staged implementation of ForgeRock and focused on a select group of projects during its initial deployment. This process involved piloting various capabilities of the Open Identity Stack in controlled production environments to address different needs within the organization. The implementation team included approximately six McKesson employees, including two project managers, as well as 2013 IDC #

4 support from consultants and contractors. McKesson also relied on ForgeRock for support and development resources. One of the first implementations of the ForgeRock solution was to enable the help desk component of one of McKesson's outsourcing businesses. The goal was to enable the business unit to offer a more self-service solution that would reduce manual efforts needed to handle password resets and other tasks. With support from ForgeRock, the implementation team was able to get the solution in place and working in less than a week. The full implementation took approximately six weeks because of to the complexity of the environment and the need to integrate with multiple UIs. To further demonstrate the viability of the ForgeRock solution within McKesson, the implementation team utilized ForgeRock in several other limited pilot projects. These implementations included addressing areas such as single sign-on (SSO), federation, mutual directories, and user provisioning within various business units at the company. Challenges Wilson and his team were initially skeptical of the open source nature of the product, specifically in regard to its security capabilities in an enterprise setting. ForgeRock's lack of industry reputation (ForgeRock was founded in 2010) was also a significant point of concern. These concerns have been alleviated. Overall, challenges were not significant in size or scope. Wilson has identified a couple of minor weaknesses in the OpenIDM and OpenAM space involving aspects of SSO and access management, and he believes that ForgeRock has a solid road map to bolster the functionality of these components of the solution. Results McKesson achieved quick benefits and a significant ROI following the completion of some of the initial ForgeRock deployments. The first pilot project, aimed at enabling self-service to one of McKesson's help desk scenarios, helped achieve considerable cost savings and has continued to perform well. After the success of the early projects using the ForgeRock product, Wilson and other members of the implementation team worked to extend the use of the solution and demonstrate its viability and capabilities within the organization. Over a period of approximately two and a half years, customer-facing identity management continues to be standardized on the ForgeRock Open Identity Stack, and there are currently around 30 projects in development. Wilson is currently in the process of significantly ramping up the implementation and adoption of ForgeRock across the organization. The success of the initial projects that were completed with the Open Identity Stack has built a strong case to use ForgeRock to help turn hundreds of existing applications into services. This multiyear process will help bring added flexibility to the organization's customer-facing operations. 4 # IDC

5 The ease of use and customization that the Open Identity Stack provides have proved to be major benefits to the organization. Additionally, McKesson has found the solution, especially its performance and functionality, to be highly competitive with some of the market's larger vendors' solutions. "It is relatively light touch, but some of the pieces of it are more robust than what we are seeing from some of the other solutions," Wilson said. ForgeRock has excelled in addressing certain IAM needs within the organization where existing legacy systems proved to be complex and difficult to integrate. McKesson has received continued support from ForgeRock following the implementation. After completing several initial projects and developing repeatable processes, the organization has primarily called upon ForgeRock for development and coding support. The success of early pilot projects helped prove ForgeRock's ability to work within McKesson, and the organization is currently in the process of expanding the solution's scale and reach. Lessons Learned To facilitate the increased scale of McKesson's current and future plans for the Open Identity Stack solution, the organization would like to see ForgeRock work on developing a more extensive network of tier 1 and tier 2 support resources. Wilson believes that having access to this support base will aid in the development of more complex solutions on the road map and enable some of the company's future plans around ForgeRock. ESSENTIAL GUIDANCE Implementing the ForgeRock Open Identity Stack in a controlled and targeted fashion proved to be an effective way to address identity needs within McKesson and build confidence within the organization to further deploy the solution. Ease of use and control over the solution allowed McKesson to demonstrate the viability of the ForgeRock product and achieve a fast ROI on several initial projects. The decision to purchase an open source vendor that had not been in the industry long enough to establish a proven track record of success posed a certain set of risks to the organization. Wilson explained that as a CISO, he would not have received any scrutiny by playing it safe and selecting one of the larger and more reputable vendors in the IAM market. However, taking this risk ended up being advantageous to the organization and has offered the flexibility McKesson needed to accomplish various goals within the customer-facing identity space. Adding an open source component to the organization's environment has diversified McKesson's identity stack. This approach has helped McKesson not only support its own identity solutions but also work with partners to support external solutions. "The way the open source model worked in regard to the product is actually a little easier to work with than the partnering joint venture arrangements. Effectively we own the IT it is a whole host of good opportunities for you as a company in the IT space," Wilson explained. McKesson has also found that incorporating open source 2013 IDC #

6 technology has presented itself as a potential vehicle to facilitate future identity development projects. ForgeRock's commitment to support and service following implementation represented a vital aspect of McKesson's success with the company's initial projects. Working with a smaller vendor allowed McKesson to get development work done quickly and at a reasonable rate. "If we want something developed, they will do it," Wilson said. The solution's ease of use also gave McKesson the ability to replicate and expand use of ForgeRock following initial pilot projects while still being able to rely on the ForgeRock team for continued limited development support. As a healthcare provider, McKesson benefited from being able to observe the IAM strategies of companies in other industries (like financial services) where identity needs represent business-critical requirements rather than strategic opportunities. McKesson's dedication of significant time and planning resources while incorporating ForgeRock into the company's overall identity stack has resulted in a more versatile and flexible solution that is gaining traction within the organization. Perspective buyers whose purchasing decisions are also triggered by strategic initiatives may experience similar benefits by adopting McKesson's strategy of methodical, targeted planning when evaluating and implementing a solution. LEARN MORE Related Research Worldwide Identity and Access Management 2012 Vendor Shares (IDC #241382, June 2013) Worldwide Identity and Access Management Forecast (IDC #241685, June 2013) Copyright Notice This IDC research document was published as part of an IDC continuous intelligence service, providing written research, analyst interactions, telebriefings, and conferences. Visit to learn more about IDC subscription and consulting services. To view a list of IDC offices worldwide, visit Please contact the IDC Hotline at , ext (or ) or sales@idc.com for information on applying the price of this document toward the purchase of an IDC service or for information on additional copies or Web rights. Copyright 2013 IDC. Reproduction is forbidden unless authorized. All rights reserved. 6 # IDC