News Archive


Why SSO is so popular in these days...

Our upcoming Identity Management market report 2007/2008 shows some interesting results. Not to surprising, at least most of them, but nevertheless pretty interesting. One important information is where the money will be spent next year. For sure there is Identity Provisioning. And, as expected, Role Management is a very important area. Besides these both areas there is Single Sign-On as the third topic on which a lot of money will be spent within the next 12 months. More than 30% of the survey participants will implement SSO, will enhance their implementations significantly or will replace...


VeriSign Identity Protection - an interesting approach

I still remember some tough discussions I had with eBay in 2004 when we had just started KCP around there missing investments in secure, strong authentication. Interestingly eBay and PayPal are amongst the first now to use VeriSign Identity Protection, abbreviated as VIP. And they start in the German market to roll out this technology. Basically VIP is sort of a combination of strong authentication with a user-centric identity which can be used with different vendors and other companies in the market. The user requires a token which provides an OTP (one time password) which is used for...

Vendor Report

Vendor Report: BHOLD

BHOLD ist ein spezialisierter Anbieter, der sich auf das Enterprise Authorization Management, also die Verwaltung von Autorisierungen für den Zugriff auf IT-Systeme aus Business-Sicht, spezialisiert hat. Mit dieser konsequent umgesetzten Positionierung nimmt BHOLD nach unserer Einschätzung eine Allein-stellung im Markt ein. Damit ist BHOLD kein typischer Anbieter des Enterprise Role Managements, auch wenn diese Funktionalität im Rahmen der BHOLD - Produkte mit abgedeckt wird. Das Unternehmen verfügt über leistungsfähige Produkte und eine validierte Methodik...

Advisory Note

Trend Report: Application Security Infrastructure

Anwendungssicherheitsinfrastrukturen oder Application Security Infrastructures werden die IT zukünftig immer stärker prägen. Sie sind das Bindeglied zwischen einer zentralisierten, stan-dardisierten IT-Infrastruktur mit Identitäts- und anderen Sicherheitsdiensten auf der einen Seite und den Anwendungen auf der anderen Seite.


Enterprise Information Management

In some of my last entries in this blog (here and here) I’ve mentioned the concept of Enterprise Information Management, something I will cover in depth in a report within the next few weeks. Enterprise Information Management will be sort of the long term evolution of today’s Identity Management and some of the tightly related topics, as well as the integration of IAM with some other technologies. I started thinking about this concept when I developed a simple chart which describes the future of IAM. It starts with today’s IAM, which is sort of “Identity Management for Administrators”,...


From risk-based to context-based authorization

Dave Kearns, who will contribute as a track moderator and speaker to our European Identity Conference 2008, has introduced the term context-based authorization (and influenced my thoughts on this topic - thanks to Dave) as an approach for basing authorization on the context in which a user acts, which goes beyond the risk-based authorization in two ways: It's not binary, e.g. either in or out. And it's based potentially on more information about the context. I'd like to add some thoughts from my side to this and explain as well the difference between today's risk-based authorization and...


Not invented here...

SAP tends to talk about its concept of business-driven Identity Management in these days and claims this to be a new approach. But honestly – neither the term nor the concept are really new (but valid). Business-driven Identity Management in SAP’s vision is role-based. Based on business roles, to clarify this, not on the technical system roles SAP supports today in its different business systems. There is no doubt that business roles are becoming more and more important for IAM. SAP supports them today in its GRC Access Control product. SAP NetWeaver Identity Management in the current and...


SAP NetWeaver Identity Management and the CUA

Sometimes the real important news are hidden pretty well. I’ve experienced this once again at SAP TechEd in Munich. Despite several analyst briefings before and during the event I decided to attend a presentation on the status and future of SAP NetWeaver Identity Management. At the very end of the presentation there came a slide about the relationship of CUA and SAP NetWeaver Identity Management which said that CUA will be replaced by SAP NetWeaver Identity Management on the long term. That is really important news. CUA is the Central User Administration in the SAP environments, allowing...


Service-based IT cost management

A side effect of application security infrastructures When writing my upcoming report on the architecture of application security infrastructures I thought also about potential business values of this type of service layer which sits between applications and the security infrastructure (in fact the term "application security infrastructure" is somewhat misleading because its more about a service layer which sits on top of the infrastructure - and the service layer is core, not the infrastructure). When thinking about the business values it became clear to me that there is a clear link to...


Oracle and BEA: It's about marketshare

Oracle today announced that they'd like to acquire BEA and have placed a bid for BEA. The BEA management on the other hand seems to not be willing to become a part of Oracle. To me, it's somewhat surprising that Oracle looks on BEA. Oracle has its own middleware product and, from a technical perspective, I don't see the urgent requirement to buy BEA. BEA, for sure, is one of the leading vendors in the market space but I don't expect them to add that much value at least from a technical perspective to Oracle that it would be worth to pay the pretty high price. So there is mainly one reason...


Bye Bye CRM

On this year's Digital ID World in San Francisco, Doc Searls held a keynote on Vendor Relationship Management (VRM), a concept he has been contributing to as a Harvard (Berkman Center) fellow. According to Doc, VRM is the inverse of Customer Relationship Management (CRM) and provides methods and tools for individuals to deal with customers. VRM being still quite early in it's evolution, definately is extremely interesting, as it is one of the first initiatives to look into what can be done on top of User Centric Identity, besides decentralized authentication and some kind of Web-SSO. VRM...


Oracle acquires LogicalApps

Oracle remains true to its strategic approach of growth trough acquisitions. The next company to become part of Oracle is LogicalApps. LogicalApps, pretty unknown at least here in Europe, is a vendor in the GRC space - more concrete of "automated GRC controls management solutions". GRC is an acronym for Governance, Risk Management and Compliance. The solution supports SoD enforcement, monitoring of business transactions, and evidence (e.g. audit). The vendor is focused on Oracle Applications with - as they claim - hundreds of successful deployments in these environments. With this...


The business value of Compliance

Today I read a press release from Novell where they claim that most enterprise don't realize the value of Compliance. For sure, if you think about Compliance, then most of us first think about the pain of being compliant. More reports, more rules, new applications,... And, honestly, Compliance is first of all something reactive, avoiding penalties. But there are as well some clear advantages, like we've mentioned several times. This is especially true if you look on it from a general "Governance, Risk Management, Compliance"-perspective. There are, especially in the risk management area,...

Product Report

Product Report: Oracle Identity Manager

Der Oracle Identity Manager ist die Lösung für das Enterprise Provisioning innerhalb des Oracle-Produktportfolios. Das Produkt zeichnet sich durch eine sehr große Leistungsfähigkeit und Flexibilität in den meisten Bereichen aus und zählt damit aus Sicht von KCP zu den führenden Lösungen in diesem Segment.

Product Report

Product Report: Passlogix v-GO SSO 6

Passlogix zählt zu den etablierten Anbietern im Enterprise Single Sign-On-Markt. Mit dem Kernprodukt v-GO SSO und ergänzenden Komponenten werden alle wichtigen Anforderungen im Bereich Single Sign-On abgedeckt. Die Lösung ist einfach zu implementieren und zu admi-nistrieren. Viele gängige Anwendungen sind vorkonfiguriert, weitere Anwendungen lassen sich über eine grafische Schnittstelle erfreulich einfach hinzufügen.


A new competitive situation in IAM

The acquisition of MaxWare by SAP finally has led to a new competitive situation in IAM. I define four segments or clusters of vendors in the market: The ones with focus on the business process The ones with focus on business service management The pure (or mainly) IAM vendors (and the ones which have a broader IAM portfolio but not integrated that into a higher level vision) The specialists  To start with the first segment - these are the vendors who compete for becoming the leading supplier of the infrastructure for business processes. To do this, they need IAM to provide identity...


The ERP for IT

During an analyst briefing I had some days ago with a leading vendor in the BSM space around the role Identity Management plays for BSM (which is quite important, given the fact that all leading BSM vendors are IAM vendors and that IAM plays a significant role within ITILv3) we came to the conclusion that there is no ERP for IT. There are specific ERP solutions for Finance, Customer Relationship Management, Product Lifecycle Management, and so on. But there is nothing for IT. That automatically led to the question whether BSM might fill this gap. The discussion also was sort of a reminder...

Welcome to KuppingerCole

How can we help you

Send an inquiry

+49 211 237 077 33

Mo – Fr 8:00 – 17:00

Stay Connected

KuppingerCole on social media


AI for the Future of Your Business Learn more

AI for the Future of Your Business

AI for the Future of your Business: Effective, Safe, Secure & Ethical Everything we admire, love, need to survive, and that brings us further in creating a better future with a human face is and will be a result of intelligence. Synthesizing and amplifying our human intelligence have therefore the potential of leading us into a new era of prosperity like we have not seen before, if we succeed keeping AI Safe, Secure and Ethical. Since the very beginning of industrialization, and even before, we have been striving at structuring our work in a way that it becomes accessible for [...]