KuppingerCole Blog

Quantum computing is one of those topics that always seem to exist just out of our reach. Well over a decade ago we were promised that a real quantum computer will appear just in a few years, and for most people, this feeling remains the same even now. But is this assumption correct? Do we really need to wait a few years more until the fastest, biggest, and most reliable quantum computers will finally find their way into every industry? Or is it something we should already be considering today? Understanding (or at least trying to) quantum computing Now, I will not attempt to explain...

Okta will purchase Auth0 for $6.5B. Okta is a leading IDaaS vendor , originally focused on workforce but now addressing B2E, B2B, and B2C use cases. Okta’s solutions are designed for organizations that want to quickly enable cloud-delivered identity and seamlessly interoperate with other SaaS applications. Auth0 had a different entry point into the realm of IAM. Auth0 was aimed at developers, both in functionality and their marketing approach. Auth0’s founders knew that this was an underserved market. Consider a case where a company needs to expose one or two major...

Oracle has unveiled new interesting capabilities in the Oracle database today, which they refer to as Immutable and Blockchain tables . While I am not entirely convinced by the names they have chosen, I can absolutely get behind the overall Crypto-secure data management concept that has emerged along with them. Whenever people discuss various applications of cryptography for information protection, they almost inevitably tend to think about encryption or, in other words, protecting the data’s confidentiality. However, while keeping the data out of reach of unauthorized persons...

The Ugly Face of Yesterday’s CIAM We all have multiple different personas. But before we put on our hats as identity “experts” -  either as architects, implementers or vendors - let us start by simply being consumers.  Consumers of online services for banking, e-commerce, education, entertainment, and more.  And by thinking as consumers, we can all tell endless stories of poor user experiences with respect to using those services. Those poor user experiences are essentially putting an invisible barrier to entry to the applications and goods we wanted to...

The recent SolarWinds incident has shed a light on an area of cybersecurity that is not frequently in focus. Better said, it is “again has shed a light”, if we remember the Heartbleed incident that happened back in 2014. Back then, my colleague Alexei Balaganski wrote in a blog post that “software developers (both commercial and OSS) […] should not rely blindly on third-party libraries, but treat them as a part of critical infrastructure”. What we need is a defined approach and consequent enforcement of what, in a slightly awkward manner, is called...

Oh, how time flies! It seems that the whole story of Zero Trust as a revolutionary concept for designing computer networks began just yesterday, but it’s been over a decade already. In fact, the very idea that was later somewhat awkwardly named “de-perimeterization” was being discussed nearly 20 years ago. Back then, in the early 2000s, years before the era of the cloud and ubiquitous presence of smart mobile devices, organizations were already feeling the pressure to reorganize their networks for the digital transformation – establishing communications to their...

Privacy-sensitive users are drawn to solutions with certain features: end-to-end encryption, granular consent, data ownership, and secure storage. But what is it that privacy can really do for users, and is there a non-exploitative business model in it for companies? KuppingerCole envisioned Life Management Platforms back in 2012 as the pathway to individual data sovereignty. Data sovereignty is incrementally being introduced as a right of individuals, with principles being introduced in the European GDPR, the Canadian PIPEDA, the CCPA, and others. While these regulations manage the...

On July 16 th , 2020 the European Court of Justice issued its decision on the adequacy of the protection provided by the EU-US Data Protection Shield for the transfer of personal data for commercial purposes by an economic operator established in an EU Member State to another economic operator established in a third country.  The use of cloud services is now commonplace and has been increased due to the need for working from home due to the coronavirus pandemic.  In addition, unstructured files like documents, spreadsheets and slide decks that are stored in these services often...

I had no intention to write any blog posts during the holidays or, God forbid, do any predictions for the next year (look how relevant last year’s predictions turned out to be). However, an interesting story involving Ticketmaster, a large American ticket sales company, has caught my eye and made me think once again about my career in cybersecurity. The whole story goes all the way back to 2013, but the details have only recently been unsealed after the company has entered into a plea agreement and agreed to pay a $10 million fine for illegal access to a competitor’s...

The ongoing SolarWinds incident illustrates that the much-lauded Zero Trust security paradigm is, in fact, based on trust. Zero Trust is about authenticating and authorizing every action within a computing environment. It is putting the principle of least privilege into action. In an ideal implementation of Zero Trust, users authenticate with the proper identity and authentication assurance levels to get access to local devices, on-premises applications and data, and cloud-hosted resources. Access requests are evaluated against access control policies at runtime. In order for Zero Trust...