IAM legacies – bad for your business

It’s been almost 15 years since Business Layers and Oblix ushered in the new age of Identity and Access Management Systems (IAM systems) with what I called at the time the “killer app” for Directory Services – electronic provisioning. Even more incredible is that it’s almost 20 years since I wrote a workflow-based provisioning application (I even called it “employee provisioning”) based on Microsoft’s messaging application programming interface (MAPI). It actually was quite primitive in terms of 21^st century provisioning tools in that it relied on automated email messages to inform people of things that needed to be done (grant access, deliver hardware, etc.) with an automated “nag” system if the task wasn’t marked as completed.

I know that my system is no longer used and I really doubt that the Business Layers’ and Oblix provisioning systems are still in use. But lots of people are still using lots of systems that no longer are offered. In the provisioning area alone I’ll wager that there are still installations from Thor, Waveset, M-Tech, Sun and more none of which are still being offered – at least not under that brand name.

And it’s not only provisioning systems that have gotten “long in the tooth” in your datacenter. Every aspect of IAM has probably moved forward at least one generation since you installed it, and many have moved quite a bit forward. Let me hasten to add that it probably isn’t your fault that this has happened, especially if you’ve followed the advice we’ve been handing out over those fifteen years since electronic provisioning first became a real possibility and the IAM revolution was launched.

Back then, and for some time after, no one vendor could supply all of your IAM needs. It’s possible to argue that that is still true, but – if it is – it’s less true today than it was, say 10 years ago. So what we, the IAM gurus, suggested was that you choose “Best of Breed” solutions and hammer them together. “Best of Breed” was an amorphous term, though, covering a great many things. In reality we meant “best for you” depending on your circumstances.

Getting all of those apps from all of those vendors to work together was a real chore – one that kept IAM consultants rolling in dough as they cobbled together scripts, apps, services and more so that you had a semblance of an IAM infrastructure.

Anyone who had gone through the experience of surveying the market, demo’ing software or trying out a “proof of concept” from multiple vendors for each area (Provisioning, SSO, Access Control, Governance, etc.) of the IAM continuum came through the exercise very tired, very bruised and very wary of starting again.

Over the years, the apps that were chosen were sometimes updated (by the customer – they were frequently updated by the vendor) whenever doing so wouldn’t break the intricate relationship with the rest of your IAM services. Sometimes – when a vendor was acquired – the app you were using would simply disappear from the market to be, perhaps, replaced by something similar (or not) depending on the whims of the new vendor.

What it all means is that those of you who should be commended for being the early adopters in the IAM space are, essentially, stuck with a cobbled together system which in many of its facets is no longer supported by its vendor, or may not even have a vendor to support it any longer.

Others of you, of course, would have spent an inordinate amount of time replacing parts of the system as mergers and acquisitions occurred. So you may have started out with Business Layers’ eProvisionware as a provisioning app. When that company was acquired by Netegrity, you might have switched your provisioning services to the leader at that time, Waveset. Waveset which, less than a year later, was acquired by Sun Microsystems. Still, you might have stayed with the people you know and, gradually, installed Sun Identity Manager. Which has now been acquired by Oracle.

Another possibility is that you, early on, went with Oblix for provisioning. Until they were acquired by Oracle early in 2005. Well, you quickly switched to the then highly recommended independent provisioning vendor – Thor Technologies. Which was acquired by Oracle!

Where does it all end? Will Larry Ellison eventually acquire everyone in the IdM space? Probably not, at least not as long as there are other major players. But what does it mean for you?

Two points I want to make up front:

• What was “Best of Breed” a few years ago may no longer be;
• Choosing “Best of Breed” today may be a security nightmare.

But the whole idea of a Best of Breed IAM stack from multiple vendors needs to be re-thought. The Best of Breed IAM stack was never seamlessly integrated. Scripts, publicly available protocols, data conversion hubs and some manual tweaking always seemed to be needed to insure that everything worked together. And it almost did work together. At the best of times it was probably 95% successful. But that 5% was the camel’s nose in the IAM tent.

That 5% “seam” – which for most installations was closer to 10% or 15% - is the area that hackers, crackers and other malcontents can exploit for their nefarious purposes. That’s where the security loopholes appear,Which can sometimes end up being close to 80% of your project cost, not the 5, 10 or 15% it should be.

So if your current Best of Breed solution is insecure and too complex, and if there’s really no way to improve its security by adding updates, upgrades or other potential Best of Breed applications, what should you do?

It’s time to move up a level. Rather than “Best of Breed” applications, it’s time to look at “Best Fit” suites.

You might think that with all the mergers and acquisitions of the past ten years that provisioning applications, in particular, would be offered by only a handful of vendors, but you would be wrong. Here’s a list of almost two dozen vendors offering provisioning solutions from very basic to extremely complex.