Connect and Protect: The Importance Of Security And Identity Access Management For Connected Devices

A Forrester Consulting Thought Leadership Paper Commissioned By Xively By LogMeIn August 2015 Connect and Protect: The Importance Of Security And Identity Access Management For Connected Devices

Table Of Contents Executive Summary... 1 Manufacturers Are Differentiating Their Products And Processes Using IoT-Enabled Solutions... 2 Firms Are Challenged With Implementing IoT Software Platform Functionality... 2 Security And IAM Are Critical IoT Software Platform Functions... 4 Challenges Exist With Delivering IAM Capabilities... 5 Firms Seek Assistance With IoT Platform And IAM Implementations... 7 Key Recommendations... 8 Appendix A: Methodology... 9 Appendix B: Survey Demographics... 10 Appendix C: Endnotes... 11 ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2015, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to www.forrester.com. [1-TWB3K4]

1 Executive Summary Internet-of-Things (IoT) solutions are transforming the operations, processes, and products deployed by many enterprises. IoT solutions enable objects and infrastructure to interact with monitoring, analytics, and control systems over Internet networks. 1 Proactive product manufacturers are developing and deploying smart, connected products to differentiate these products and transform relationships with customers, partners, and suppliers. Developing, connecting, controlling, securing, and capturing insight from connected products is challenging. Many manufacturers are rethinking the security requirements for their connected products, as well as the identity and access management (IAM) process to access these connected products and the data captured by them. In April 2015, Xively by LogMeIn commissioned Forrester Consulting to evaluate demand for functions to simplify the process of connecting, securing, managing, analyzing, and engaging with these connected devices among connected product manufacturers. In addition, this study identified the importance of IAM solutions to provide a differentiated customer experience and enable third-party access to connected products, devices, and data. The online survey was fielded to 100 discrete manufacturers representing a variety of industries based in the US or the UK. Results of this study showed that many firms are challenged with implementing the proper security and access controls to protect connected devices and data, and are looking for ways to improve their capabilities in these functional areas. KEY FINDINGS Highlights of the study results are included below: Enhancing customer service and experience are key benefits of using a software platform to deploy connected products. Between 44% and 46% of surveyed manufacturers can use a software platform to help them better serve their customers or improve customer experience through their connected devices. In addition, 37% of firms identified enhanced analytics and data insight as key benefits of using a software platform to connect, secure, manage, analyze, and engage customers through connected devices. Do-it-yourself (DIY) efforts to deliver IoT software platform solutions are falling short. Over half (53%) of surveyed manufacturers are building or implementing some IoT software platform functions in house to support their connected device initiatives. However, many manufacturers are challenged with deploying a comprehensive IoT software platform that includes a range of functions to connect, manage, analyze, secure, and engage with third parties using insights from their connected products. These results indicate that a deployment strategy shift is needed to deliver end-to-end IoT software platform functionality and address rising security and identity access management concerns related to connected devices and related captured data. Security is an important function of IoT software platforms but remains challenging for many organizations. Security is a high concern for manufacturers of Internet-connected devices. External hackers are trying to breach individual devices, and firms are concerned with misuse or breaches of device data stored in the cloud. Addressing these issues requires strong IAM capabilities to protect and control access to device data. Robust IAM functionality is a requirement for many manufacturers. IAM capabilities such as authentication, authorization, and policy-based access are essential for ensuring that only authorized users can access and view device data. This helps minimize the risk of data breaches (whether deliberate or inadvertent). Sixty-seven percent of survey respondents are concerned or extremely concerned about IAM for connected devices, reflecting the importance of IAM for today s IoT devices. IAM functions enable the increasing number of third parties to access connected devices and captured data. Currently, an average of four different constituencies (e.g., IT, operations, sales, field service, and customers) requires access to connected device data. The number of third parties requiring access to connected device data is expected to increase in the future as manufacturers provide connected product data and insight to vendors, distributors, and suppliers. Manufacturers are turning to third-party partners for IoT software platforms and IAM solution assistance. Many firms seek assistance from third-party partners to help deliver IoT software platform features and IAM functionality. In particular, manufacturing firms are looking for third-party vendors with security and technical expertise, reliable solutions, end-to-end solution capabilities, and integration experience.

2 Manufacturers Are Differentiating Their Products And Processes Using IoT-Enabled Solutions Proactive product manufacturers are incorporating sensors, connectivity, and intelligence into their products to differentiate these products, transform customer experience, and expand revenue opportunities. However, deploying and securing smart products is difficult for many manufacturers due to the fragmented array of networks, devices, application interfaces, and security elements to address. Forrester defines IoT software platforms as software solutions that simplify the process of connecting and managing smart devices and infrastructure in order to integrate operational data and control into business and customer processes. 2 For the purpose of this study, the five core functions of IoT software platforms focus on the following areas: Connect. Devices must connect to the external environment and communicate captured data to end users. Software platforms provide application software development kits (SDKs) and device enablement libraries to connect devices with their surroundings. Secure. Access to the vast amount of data captured by connected products must be controlled and managed. It is important to establish user access permission for connected devices and data based on the roles and responsibilities. Manage. Manufacturers must establish a process for managing thousands, tens of thousands, or even millions of connected devices. A key function includes configuring and provisioning devices and managing the capture and discovery of connected device data. Analyze. Captured connected device data must be analyzed and transformed into useful business and customer insight. Analytics functions allow for continued product improvement based on customer usage and feature preferences. Engage. Employees, partners, and customers need to access relevant connected device data and insight. Integrating data with existing processes and departmentspecific tools provides opportunities to optimize business processes and engage with customers and partners in new ways. Manufacturers achieve a range of benefits from implementing IoT software platforms to enable their connected devices (see Figure 1). The top two benefits focus on enhancing customer service and support and improving customer experience, with 44% to 46% of firms identifying these benefits. In addition, 37% of firms use a software platform to enhance analytics and data insight available on their connected products and services. FIGURE 1 Top IoT Platform Benefits Focus On Improved Customer Experience What are the top business benefits your company could achieve using a software platform to connect, secure, manage, analyze, and engage customers through your connected devices? Enhance customer service and support capabilities Improve customer experience Expand revenue opportunities from new products and services Enable competitive differentiation by offering IoTenabled connected products Enhance analytics and data insight available on connected products and services 37% 37% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015 Firms Are Challenged With Implementing IoT Software Platform Functionality 46% 44% 42% Deploying, managing, securing, and analyzing IoT solutions and engaging with third parties who use connected devices and captured device data is complicated for many firms. Our survey results show that manufacturing firms are challenged with implementing many of these core functional requirements:

3 Firms are taking a DIY approach to implementing IoTenabled connected devices. Survey results show that 53% of surveyed firms build or operate their own software platform to support some or all of the core functional components, and only 29% of respondents have purchased a vendor platform to support their IoT solution requirements. A DIY approach may work during initial connected device deployments with limited adoption and security requirements. However, as the number of connected devices extends into the tens of thousands and beyond and the variety of devices increases, the complexity of securing, managing, and deploying these devices expands exponentially. Manufacturers must assess their existing strategy to determine if they are equipped to provide a secure, scalable, end-to-end IoT platform that supports their connected device requirements. Manufacturers are challenged with delivering important IoT software platform functions. Eightythree percent of companies rated the ability to define, manage, and provide users with secure access to connected devices and data as important or extremely important; however, 62% of firms stated that it was challenging or extremely challenging to deliver these functions (see Figure 2). Across all IoT software platform features, at least 75% of firms identified each feature as important or extremely important, and at least 56% of firms identified each feature as challenging or extremely challenging to implement. These results highlight the range of opportunities for third-party partners to assist manufacturing firms with deploying IoT software platform functions that are important but challenging for their organization to deploy. FIGURE 2 IoT Software Platform Functions Are Important But Challenging For Manufacturing Firms To Implement Regarding your specific Internet-of-Things (IoT) initiatives, how important are the following IoT solution components to enabling your firm s connected device initiatives? (% reflects extremely important or moderately important only) How challenging is it for your firm to deliver on each of these Internet-of-Things solution components? (% reflects extremely challenging or moderately challenging only) Connect Secure Device enablement libraries Application SDKs Message broker that allows connected products to communicate with users Ability to define and manage users, employees, customers, and partners 56% 75% 66% 62% 69% 76% 81% 83% Extremely important or important Extremely challenging or challenging to deliver Ability to set up roles, permissions, and authentication across all connected product users 61% 81% Manage Device provisioning and life-cycle management for discovery of durable data 76% 67% Analyze Operational and investigative analytics to transform data into business and customer insights 64% 82% Engage Department-specific tools to enable new ways to engage customers and provide differentiation 63% 86% Data integration with partners existing business enablement solutions 72% 83% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015

4 Firms are in the early stages of deploying IoT software platform functions. Current adoption of each IoT software platform function ranges between 27% and 38% (see Figure 3). Security functions have the highest adoption at 38%, which highlights the importance of these functions to connected device manufacturers and reflects a generally high level of awareness about security. IoT software platform feature deployment is expected to continue in the future, with an average of approximately 40% of respondents planning to implement these features in the next six to 12 months. Security And IAM Are Critical IoT Software Platform Functions When implementing and managing connected devices, firms must manage the business needs for data access and integration with user needs to keep data secure. Every organization must assess and manage the balance between security, privacy, and data integration needs to find the most appropriate balance. According to our custom survey, device manufacturers listed a wide range of security and hacking concerns, encompassing both internal and external threats (see Figure 4). These findings indicate a strong awareness around the potential security risks of deploying connected devices. The concern regarding device threats highlights the role of IAM in helping to mitigate device risks by ensuring only the right users have access to specific data. Forrester defines IAM as the policies, processes, and technologies used to establish identities and control their access to resources across the digital business. 3 Based on this definition, 67% of our survey respondents are concerned or extremely concerned about IAM for connected devices. FIGURE 3 IoT Software Platform Feature Implementation Timelines What is your firm s timeline for adopting the following Internet-of-Things solution components? Already adopted Within the next six months In the next 12 months In the next 12 to 24 months Interested, but no immediate plans to adopt No interest in adopting these IoT capabilities Connect Message broker that allows connected products to communicate with users 32% 18% 20% 14% 7% 5% Application SDKs 30% 22% 16% 14% 8% 5% Device enablement libraries 35% 16% 13% 19% 8% 4% Secure Manage Analyze Engage Ability to set up roles, permissions, and authentication across all connected product users Ability to define and manage users, employees, customers, and partners Device provisioning and life-cycle management for discovery of durable data Operational and investigative analytics to transform data into business and customer insights Data integration with partners existing business enablement solutions Department-specific tools to enable new ways to engage customers and provide differentiation 38% 21% 19% 12% 6% 1% 38% 19% 14% 19% 5% 2% 27% 22% 22% 16% 5% 3% 33% 15% 26% 13% 7% 3% 29% 24% 16% 18% 6% 3% 29% 19% 24% 14% 8% 2% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015

5 FIGURE 4 Manufacturers Of Connected Devices Are Concerned With A Wide Range Of Security Threats Which of the follow security threats on your connected devices are you most concerned about? (Ranked by top 5, with 1 being the most concerning threat) Total % ranked Rank 1 Rank 2 Rank 3 Rank 4 Rank 5 in top 5 External hackers 32% 11% 9% 6% 7% 65% Leakage of sensitive or confidential data 9% 13% 10% 20% 8% Viruses, network worms, and other malicious software (malware) Lack of authentication and authorization for access to these devices Third-party collection of device usage patterns and data from intelligent devices 7% 9% 18% 10% 13% 8% 14% 9% 16% 9% 7% 15% 9% 8% 13% Physical compromise due to intelligent 4% 9% 12% 10% 13% device failures Internal hackers 11% 10% 12% 6% 8% 60% 57% 56% 52% 48% 47% Denial of service attacks to intelligent devices 8% 11% 8% 11% 7% 3% Compliance fines and penalties over 5% regulatory violations 8% 14% 1% 3% Safety of human life 8% 5% 6% 6% 45% 31% 28% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June, 2015 IAM and connectivity topped the list of important or extremely important attributes of connected devices. In fact 91% of survey respondents identified each of these attributes as important or extremely important. Interestingly, security was slightly lower than IAM, at 88%. Yet when respondents were asked what single attribute they focused on when developing connected products, data security was by far the top priority identified by 42% of respondents while IAM was only identified as a top priority by 12% of respondents. This finding shows that the idea of IAM is important to organizations, but it also indicates that IAM should be the cornerstone of a much broader information security architecture. Challenges Exist With Delivering IAM Capabilities Businesses face a number of technical and organizational barriers and challenges when implementing IAM capabilities. It is important for manufacturers of connected products to consider and address both types of issues, including: Lack of standard interfaces between devices and solutions. Over one-third of our survey respondents identified lack of standard interfaces as a barrier. Without a standard interface, it is hard for firms to quickly set up IAM controls without first understanding the devicespecific interface. The lack of standard interfaces prevents companies from deploying a consistent policybased approach to managing access. The lack of a

6 standard approach can increase security risks but can also increase administrative costs and overhead. Another barrier identified by 30% of respondents is that the diverse device universe makes interoperability challenging. This barrier ties back to the lack of standard interfaces. Both of these factors contribute to the challenge of integrating data with existing systems and limit the ability for fast deployment of solutions. Lack of clear ownership for connected device data. Establishing clear data ownership creates challenges for effectively implementing IAM controls. As multiple parties require access to the data, it is often unclear who owns the data and who should have full access privileges to it. Further exacerbating the problem, as highlighted in our custom survey, is that the number of constituencies requiring access to the device data is expected to increase going forward, particularly with more third parties, such as vendors, distributors, and suppliers, requiring access (see Figure 5). These data ownership complexities underscore the importance of implementing IAM to provide necessary controls to manage and secure data and application access, FIGURE 5 The Number Of Parties Requiring Access To Device Data Is Expected To Increase Which of the following currently requires access to your connected device data? Which of the following could benefit from access to your connected device in the future? Other connected products 26% Internal business systems and applications 36% 47% 46% Business systems and technology Sales 28% 27% Average of four parties require access today Average of five parties will require access in the future Marketing 31% 42% IT 62% 48% Operations 47% 42% Field service reps 28% 33% Finance 20% 22% HR 12% 11% Internal business units Currently In the future Customers 46% 44% Vendors 37% 42% Distributors 19% 31% Third parties Suppliers 18% 33% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015

7 ensuring that only authorized users can access sensitive data. Business requirements for stronger and more robust IAM capabilities will increase demand for device manufacturers to incorporate IAM functionality in the following areas over the next two years: Managing appropriate identity and access controls on the device data, whether on the device or in the cloud. Managing appropriate identity and access controls on the management platform to protect device data. Managing appropriate identity controls on the devices themselves. Firms Seek Assistance With IoT Platform And IAM Implementations The challenges and complexities associated with connecting, managing, securing, analyzing, and enabling engagement with data and insight from connected devices drives many manufacturing firms to seek assistance from trusted third-party partners. The study found that: Various stakeholders influence the decision-making process for IoT and IAM solutions. Survey results showed that the decision-making process for IoT and IAM solutions does not rest with one specific department (see Figure 6). A wide range of decision-makers representing IT, line-of-business, and operations organizations participate in influencing and making final decisions related to IoT and IAM solutions. For example, stakeholders from IT, product development, security, operations, and finance are often involved in influencing or making the final decisions for IoT and IAM solutions. FIGURE 6 Many Different Stakeholders Participate In The IoT Solution Decision-Making Process What is the role of each of these organizations in the purchasing decision-making process for IoT solutions to support your connected devices? IoT final DM Product development IoT key influencer IAM final DM IAM key influencer IT 48% 25% 14% 50% 48% 20% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015 8% 59% Finance 39% 15% 22% 41% Security 36% 21% 18% 45% Operation/ Field reps 37% 15% 23% 36% Marketing 32% 13% 19% 31% Sales 25% 18% 27% 23% HR 14% 15% 21% 20% Security and technical expertise and reliable solutions are important attributes of third-party partners. Connected product manufacturers seek thirdparty vendor partners with a range of characteristics and expertise (see Figure 6). Security expertise is the top requirement for manufacturers that must ensure the security of the devices, the data captured by these devices, and the third parties who are authorized to access the devices and data. Other important third-party characteristics include having reliable solutions, as well as offering integration and having the technical expertise to integrate the various elements of an end-to-end IoT solution.

8 Key Recommendations Results from our online study of manufacturers in the US and the UK show that some manufacturers are deploying connected devices to differentiate their company, transform customer relationships, and generate new revenue streams. Deploying IoT-enabled connected products is challenging for many manufacturing firms that require functions to simplify the process of connecting, managing, securing, and operating these connected products, as well as analyzing the data and insight captured from them. Security and identity access management solutions are core functions of IoT software platforms. To successfully implement smart, connected products and address security and IAM requirements, it is important to recognize the following: Proactive manufacturers of durable goods are deploying IoT-enabled connected products. Across various industries, connected product implementation is occurring in a growing number of manufacturing firms. However, developing and deploying smart, connected products is difficult, requiring network connectivity, application protocols, data analytics, and security solutions to transform these goods into smart, connected products. IoT software platforms simplify the process of deploying connected products and smart devices. A new category of enterprise software IoT software platforms is emerging to simplify the process of developing, connecting, controlling, securing, and capturing insight from connected products and assets. Manufacturing firms identified a wide range of IoT software platform functions as important to enabling their connected products; however, many manufacturing firms are challenged with implementing comprehensive IoT software platform functionality. IAM demand increases as more stakeholders benefit from accessing connected device data. IoT software platforms will need to incorporate a wide range of IAM capabilities to help meet end user and corporate business requirements. Delivering these IAM capabilities as a platform ensures a consistent, enforceable model across all devices and users. By delivering an identity-centric view across all devices, organizations can mitigate risks while simultaneously providing the appropriate level of data access needed by the business. Manufacturing firms seek assistance from third-party vendors with security and technical expertise. Deploying comprehensive IoT platform functionality requires a range of network connectivity, device management, analytics solutions, and security technologies. IoT stakeholders from many different organizational roles, including IT, line of business, operations, and security, influence the decision-making process for IoT software platforms and IAM solutions. In particular, vendors with security and technical expertise as well as solution integration capabilities appeal to IoT decision-making stakeholders.

9 Appendix A: Methodology In this study, Forrester conducted an online survey of 100 discrete manufacturers in the US and the UK that manufacture a connected product. Company sizes ranged from 250 to over 5,000, and the connected products served a variety of industries. Respondents were mostly at the manager level or higher and had responsibility for and insight into their companies IoT and connected device security initiatives, such as identity and access management. Respondents were offered a small incentive as a thank you for time spent on the survey. The survey began in April 2015 and was completed in June 2015. Appendix B: Survey Demographics FIGURE 7 Job Title And Understanding Of IoT Which of the following best describes your current title? What does the following definition best describe? A network of connected physical objects that can interact with their environment, people, and other Internet-enabled data. Individual contributor 5% Manager 28% Seniormost business leader 14% Executive 27% Internet of Everything 22% Industrial Internet 11% Machine-to-machine (M2M) technology 26% Director 26% Internet of Things 41% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015

10 FIGURE 8 Country, Company Size, And Industry United Kingdom 36% In which country do you work? Using your best estimate, how many employees work for your organization worldwide? 5,000 or more employees 33% 1,000 to 4,999 employees 22% United States 64% 500 to 999 employees 19% 250 to 499 employees 15% 100 to 249 employees 11% Which of the following best describes the industry for which your connected product was designed?" Computers, IT hardware, and consumer electronics 17% Industrial machinery and electrical equipment 14% Aerospace and defense 10% Software 10% Automotive and transportation equipment 8% Industrial products and construction materials 8% Industrial electronics 7% Consumer packaged goods 5% Furniture, home furnishings 4% Medical devices 4% Oil and gas 4% Agriculture 1% Chemicals and plastics production 1% Clothing and apparel finished consumer products (does not include retail stores) 1% Life sciences pharmaceutical, biotechnology 1% Metals, mining, and forestry products 1% Textile goods 1% Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and/or businesses in the US and the UK (percentages may not total 100 because of rounding) Source: A commissioned study conducted by Forrester Consulting on behalf of Xively by LogMeIn, June 2015

11 Appendix C: Endnotes 1 Source: Mapping The Connected World, Forrester Research, Inc., October 31, 2013. 2 Source: Internet-Of-Things Software Platforms Simplify Transformation Of Business Operations, Forrester Research, Inc., April 2, 2015. 3 Source: Evolve Your Identity Strategy For Your Digital Business, Forrester Research, Inc., August 15, 2014.