Martin Kuppinger: Identity Fabrics - Delivering IAM for the Digital Business

It's also for me a little bit of new experience, a virtual conference. So I'm used to webinars. I'm used to standard conferences. This is a new format. And as Beth set, I'm one of the foreigners of, and I will talk about identity fabrics, delivering identity and access management for digital business. So identity fabrics, as the paradigm for future identity and access management, how to leverage your existing investments to a new level. This will be the topic of my keynote. Today. I'll start a little with some trends. I'll go down into the details of the identity fabric.

And I guarantee that I will stay on time with my keynote one hint, before I start, we have our brand new leadership on it. So the identity governance and administration available for download, you can access it by selecting this session in the app. So you need the app, download the app, go to this session and you will have the ability then to link to our KC plus, which is the area of Cola online, where we can access all our research. And there, you will find this report. So that further I do let's jump into the topic.

And so, as I said, I'd like to start a little bit with trends, because my perspective is that what we do is identity fabrics is very tightly aligned to what we see in the identity management trends. And one of the major trends we see in this is trend well going well beyond identity and access management is that everything is becoming a service. So we run software in as a service models. We also reconstruct software into that's.

I think I touch in a minute into services and there's a clear shift to observe in the broad identity and access management space from traditional deployment models in towards a, as a service model. So this is one of the, the important trends and the other, which is loosely align with this is a shift towards more modern software architecture. So I just recently published in my video podcast, one about microservices and identity access management. And this is one of the trends we also observed.

There is more towards shifting towards identity services, microservices running this in containers, being flexible regarding the deployment models, which again, relates to the asset service. It gives us the flexibility also to shift forward. We have with that more APIs and there will be more access for identity services, wire APIs. We will go beyond just managing applications towards providing identity service, which we can be consumed by for instance, our new digital services. We built within the digital transformation. So we will have a shift towards accessing these services.

Why are APIs and doing that for every type of identity? So we have this broader notion right now of identity and access measurement. When I started many years ago, it actually was employee identity management. So everything we did at the end was around the workers day workforce. We had then had consumer identity partner identity and factually identity must today serve devices, things, all the humans, the services, cetera.

So it's broader, and we need to serve this, which helps us then supporting the digital services, which are about connecting the people with their things, with the devices, etcetera. So again, this is all very tightly related. Some more of these trends, the way we also is changing, we have to password less notion. So things are becoming passwordless. And this is, I think, a very important thing here is multifactor authentication. If you haven't turned on multifactor authentication everywhere do so, we need to go there. It helps us against fishing.

It makes things easier if you do it right, and it makes things more secure. Identity access management still will be centered around three main pillars, which are access management, which are IGAs with the identity governance administration, which are British access management, but there are more elements around it. So there will be more than that. Access governance will change as another important trend. And that is something which I also believe is very important. We need to go beyond just looking at entitlements or systems and applications. We need to look at data access governance.

We need to use access policies across every type of access from the device to the network, to the system, to the data. So we need to redefine that for some of these things, which are changing when it comes to, for instance, identifying risks, identifying, identifying outliers, and access artificial intelligence definitely will help us making things better. And at the end, all of this will converge. And right now we are main theme. The main topic of my keynote, all this will converge into identity fabrics.

So what are identity fabrics about identity fabrics are a high level perspective on how we see identity and access management environments look like how we construct, how they are constructed, how we sorry, customer and you as a customer can construct them. So the big pictures that we speak of identity and access management in the future, and this all starts with a very simple question, which basically is what is identity and access management about. And when we look at this question, I start with a very simple view.

You will see at devices and things later on, but at the end we have all these people, the employees, the partners, the consumers, and what identity and access management need to enable is a very simple thing, provide seamless yet secure access to all these services. So give everyone on the left hand side of this picture, seamless and efficient access to all the services on the right hand side, this is basically the drop of identity and access management, give the identity access and manage it well so that it works well.

The challenges are, these identities are not all managed by ourselves anymore. So in the past it was all of these identities were our own. We had them in our corporate directory.

That's a, this has fundamentally changed. They come in from different sources. Like they might come in as consumer with a social network ID. They might come in in the future with a decentralized ID will here a lot about decentralized ID over the course of the day. They might come in from a partner, might be federated in the various ways to do that.

And we need to integrate in different manners with all these applications on the right hand side for doing so for granting these access, we need a set of services, which are the access management services provide access from the individual to the service, which are the administration and governance services. So manage the entitlements have control about who has access to work. And there are more services such as content, such as privacy and many more. So this is a very high level picture in the middle of that center of that.

There's the identity fabric, which is the set of services, enabling that and what I propose and what I also see working extremely well with organizations was customs. We have discuss this concept is this gives a good starting point for everything we do around identity and access management, thinking about what do we really need to do and look at what we really need. And when we drill down a little more into detail here, so again, and this is a little different picture and you'll get the slide deck. So you'll be able to download the slide deck.

If the font might be a little too small to read, depending on your screen, basically we have all these different identities. And as I've already said at the beginning, this is about more than trust the employees. It's more than trust humans. It's all types of identities. We could add services. We could add more here, even beyond what I have in this picture. They come from different sources. They are managing different ways and they need access to both the modern size services, cloud service and the services of externals and our legacy.

It in the broadest sense, all the stuff we have up and running for a long time. So this is what we need to do. You've seen that more or less before on the slide and on the previous slide. So what do we need to look at? We need to look at the capabilities. So what are the capabilities we need? And this is the next step. And in defining your identity fabric fabric, look at what do we, or what do you really need to do? What do you need first? What are your priorities? So these capabilities are derived from your use cases are derived from your business requirements.

These are, for instance, having APIs, I'll touch this in a minute. Having access Federation available to federate in from different types of identity providers to federate out to different types of services, having lifecycle management, having access governance, having privilege management, having delegated administration, whatever else, and that's for good reason and the low right edge. There's the more, which means there are way more options for capabilities. So there's no super fixed list. There are apparently ways to, to come up with the, the list of capabilities to prioritize them.

You might go at, don't have this in the slide because it would take too much time to go into detail. But if you look at our equipping or call identity management, reference architecture, this gives you a good starting point. For instance, for which capabilities might be relevant to prioritize them, to identify them. So these capabilities then are delivered by services. Services are logical philological perspective. So these are the services delivering the, to the capabilities required based on technology.

And you, there might look at what do you have, what is lacking? So this helps you then identifying, where are your gaps? What do you need to add? What do you already have? And in a modern identity fabric, apparently these technologies which are done building the foundation for what we do here need to be also delivered in a modern architecture. There's apparently I'll touch this on a minute. There's a migration path. There's a way to, to, to go from what you have to where you should be in future.

But my expectation on, on a modern identity fabric apparently is that we delivered in a modern architecture. So based on microservices, which are delivered in containers, which provide consistent set of APIs, and which also enables us, if we follow these, these architectural paradigms to operate such technology in a relatively flexible manner. So we can run parts, maybe in our data center or in a public cloud, we might do hybrids, the entire identity fabric.

So the more important thing is, is really here, architecture, modern architecture, flexibility, deployment, support, hybrid support behind what we do in this identity fabric. So we construct this picture and this is then what really helps us delivering the capabilities in defined sets of services based on technology. And the capabilities will remain the same. Even if we change technologies, apparently there's the need to support what you have. So you have a lot of applications, a lot of tools already out there, and these must be supported.

This must be supported easier by directly integrating your identity fabric. Why are the connectors that come with the technologies you use, why whichever type of custom integration you do into existing applications or indirectly with what you already have in identity management. So this allows you then this, I think is a very important thing to have a very smooth migration path where you continue running, what you have and gradually shift to new services. So it's not a ribbon through place approach.

It's really a gradual migration, which allows you to support what you have as well as what you want to have, what you're getting now. And this is on the upper part of this picture. We are using more and more SAS service, which we need to support with somewhat different type of integration. So the way we integrate with, with SaaS services frequently is slightly different from the way we integrate, which is traditional on premises solutions. So we have, again, the need to integrate more wire standards, such as OWAS such as skin to these 2d services.

We also need to support and manage some of the digital services we built, but, and this is even more important. Maybe we also are able to support a fundamental paradigm shift. We are experiencing in identity and access management these days. So I am for many, many years, for most of the time we had identity management was targeted at managing applications. So we write entitlements, we push users into an application. So we manage the applications.

However, in the digital transformation, we have to shift from sort of outside into the application, to, from inside the application, out to the identity management system, this is the total opposite direction of communication. We are looking at it. It is we provide an identity service to an external application, which could be the new app. We are constructing in the digital transformation. It could be the new application, the new Porwal, whatever we build as a digital service. And this is super essential for the time to value in digital transformation.

If we need to reinvent identity and security with every new digital service, we will lose speed. We will not only lose speed. We will have far too high cost. We will have at the end of negative of not good enough user experience, because then registration, he would look different than here. Indication would look different. We need to build against an API layer. We need to do it from that perspective in a very different manner. So we need to expose these services.

And based on the architecture I've talked about, we come with this API and we have the ability to provide an API layer to the new world of digital service. We are constructing within the digital transformation and being fast on that never has been as important as in these days where many businesses are really challenged by the, the gaps they have in digital transformation. So we need to speed up.

And this only will work when we work against defined layers of identity services of security services and the like, so what the identity fabric does is it combines this agility actually leads to bimodal approach. It has the agility, and it has the integration support for what you have. It balances these two words and helps you integrating what you have. And moving forward at your speed with focusing on which are the capabilities you need first, which are the integrations you need first and gradually moving to a consistent approach across all areas of identity management.

So now here a little bit British access here, a little bit IGA here, a little bit that this is the big picture for everything. This is your future identity fabric and our experience and our strong belief is that this approach helps you very much in moving forward towards modern future group identity management. So to come to an end. So my final slide is about what constitutes an identity fabric. So I try to put together the five essential characteristics of an identity fabric, the first status, it is an unified approach for all types of identities and for all types of services.

It is not only employee identity, lifecycle management. It is all types of identities to the things, to the devices, to the services, consumers, customers, whatever, and all types of services within identity management. So it's not only lifecycle or it not only access management.

It's all, it's the, the comprehensive architecture for your future identity management is where you can start and then start constructing and looking at which project which step to do first. And it also allows you to gradually small steps move forward. It's a paradigm and a concept, and it's not a tool. So there is no single identity fabric tool in the sense of I buy that tool and I'm done and you need technology. And there is technology which fits far better to this paradigm than other, some other technology. But first it is a concept.

It's a paradigm, it's a tool, a paradigm concept, another tool. And from there, you end up then in your tooling in what you need, it builds on APIs and microservices. So this all is about modern APIs, modern architecture, modern deployment models. It is a comprehensive set of capabilities beyond, or the traditional key elements within identity and access management. And that is something I believe is very important. From a conceptual perspective, it helps use segregating your requirements and use cases from the capabilities, from the services and the technology.

So you can start with your requirements and your use cases and then move forward. And you apparently also can add new requirements, use cases by adding capabilities, by adding services within this framework of the identity fabric.

With that, I'm at the end of my presentation. Thank you for listening to this opening key note of our first coming call virtual conference, our first virtual event,