Webinar The Forrester Wave™: Enterprise Cloud Identity And Access Management, Q3 2012 Andras Cser, Principal Analyst Eve Maler, Principal Analyst September 20, 2012. Please call in at 12:55 p.m. Eastern time

App sourcing and hosting Cloud apps and the extended enterprise drive the need for cloud IAM App sourcing and hosting SaaS apps Apps in public clouds Partner apps Apps in private clouds On-premises enterprise apps Enterprise computers Employees Contractors Enterprise-issued devices Partners Public computers Members Personal devices Customers App access channels User populations

Agenda How and why cloud IAM came to be Selection criteria and evaluated vendors What did the Forrester Wave™ show? How should you use these results?

History of IAM Ad-hoc in-house systems Custom web SSO, authz, provisioning . . . Extended help desk systems and password sync Workflow, attestation — and self-service password reset! On-premises point solutions Web SSO, feed-based provisioning, RBAC . . . Access governance Formal processes Cloud IAM Access mgmt, then ID mgmt

Problems with traditional IAM Expensive Static snapshot Poor match with the extended enterprise Policy management costs that scale badly Overpayment for unneeded services Lack of insight into what others are doing — or not doing

Source: Amazon.com (http://www.amazon.com/)

Identity intelligence Exchange of information becomes critical Fraud management Data protection Identity and access management Understand normalcy and anomalies in access using patterns Understand normal data usage patterns Identity intelligence Certify access to data assets

Source: Flickr (http://www.flickr.com/)

Where IAM is headed Identity — not just access — management in the cloud Utility pricing Shared best practices Federation hubs Shared identity whitelists and blacklists Risk pooling Contextual risk-based attestation ERM/DRM — only where needed

Types of cloud IAM offerings Source: July 19, 2012, “The Forrester Wave™: Enterprise Cloud Identity And Access Management, Q3 2012” Forrester report

Results of the Forrester Wave™

We selected prominent vendors to help address its questions Source: July 19, 2012, “The Forrester Wave™: Enterprise Cloud Identity And Access Management, Q3 2012” Forrester report

Vendors included . . . Source: July 19, 2012, “The Forrester Wave™: Enterprise Cloud Identity And Access Management, Q3 2012” Forrester report

Detailed scorecards are on Forrester.com Source: July 19, 2012, “The Forrester Wave™: Enterprise Cloud Identity And Access Management, Q3 2012” Forrester report

The Forrester Wave™: Enterprise Cloud IAM, Q3 2012 Source: August 16, 2012, “The Forrester Wave: Cloud Strategies Of Online Collaboration Software Vendors, Q3 2012” Forrester report

Leader: Covisint The granddaddy of cloud IAM services Comfortable and mature in the federation broker role for automotive, healthcare, energy, and travel Has nascent support for employee SSO into SaaS Strong identity management and attestation

Leader: Okta Focuses on outbound SSO to SaaS, including proxying inbound SAML connections Has pre-integrated connections to many SaaS providers Smooth 2FA and IWA integration Tested version has a metadirectory with weak deprovisioning ability (*see recent Workday news)

Leader: Symplified Provides great access control into SaaS Identity Router component is deployable several ways: cloud, virtual appliance, real appliance. No just-in-time or bulk provisioning Partners with Symantec for VIP 2FA

Strong performer: Lighthouse Security Group Puts an attractive, task-oriented UX on top of a hosted IBM Tivoli suite Strong on dashboards, auditing, and reporting By design, does not support pulling user info from an on-premises user store dynamically Clients expected to show up with their own Tivoli licenses

Strong performer: Simeio Solutions Puts classic on-premises IAM solutions into the cloud, with the greatest affinity for — and vulnerability — to Oracle Interceptor appliance on site manages identity synchronization UX is a little schizophrenic: several places and paradigms. Does access control, but only for SAML-enabled apps

Strong performer: Verizon Mature role as a security service provider Federation and SSO components have a NetIQ/Novell heritage First private-sector IdP to win US federal government certification for “Level of Assurance 3” Closer to an MSP than a cloud IAM provider for policy administration: you have to submit a ticket

You should take away from this Forrester Wave™ . . . Access management performed in the cloud is more mature than identity management. Today’s solutions overlap only in part, with much more convergence to come. IAM services benefit just as much from cloud elasticity as other services do.

You should use this Forrester Wave™ to: Outline where your IAM elasticity (or lack thereof) is problematic. Identify opportunities for cloud IAM to complement or replace current functions. Develop a custom list of criteria that a vendor must fulfill. 25

Andras Cser +1 617.613.6365 acser@forrester.com Twitter: @acser Eve Maler +1 617.613.8820 emaler@forrester.com Twitter: @xmlgrrl