Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. I'm an analyst and advisor with KuppingerCole Analysts. My guest today, and I'm really looking forward to our conversation, is Warwick Ashford. He is the senior analyst at KuppingerCole Analysts. And we want to talk about a blog post that you have just written with the nice topic of IPSIE. And I love that word. So welcome, Warwick.
Thanks, Matthias. So great to have you. And this topic came across twice in the recent weeks. So I've seen your blog post where you cover that as a standard, as a set of standards, as a set of profiles. And we had Dick Hart at the IFID, the Identity Fabric Impact Day in Munich a few weeks ago. And he's one of the chairs in the working group that is behind IPSIE. So now that I've mentioned it three times or four times, before we go into what it actually solves, what is IPSIE? What does IPSIE mean? Just before we explain what it is and say, okay, which problems is it solving?
What does IPSIE actually, what is an acronym, right? Yeah, it's a lovely acronym. And as you say, the Dick Hart's presentation was really nice. I think he said kind of more IPSIE with less OOPSIE or something to that effect. It's actually quite a difficult acronym to remember the constituent parts. And I am trying to remember. Yeah. So I think it's a great initiative. And so it stands for Interoperability Profiling for Secure Identity in the Enterprise. So yeah. So we can dig into what that means a little bit later. Exactly.
When one starts reading your blog post, which I really highly recommend, which is available on our website without subscription, just go there, search for Warwick and you will find all for IPSIE, which might be easier even because this word is not that often. You start that blog post with the sentence that identity is still one of the biggest vulnerabilities in modern enterprise cybersecurity. And that obviously is true, but that has even evolved with the introduction of more and more SaaS adoption. Why is that the case?
Well, first of all, as you say, I think it's safe to say that identity is a primary attack vector because most cyber attacks still involve compromised credentials in some way, whether they're stolen or whatever. And that shows that authentication and authorization remain weak points despite the other security improvements. But as you say, the proliferation of SaaS applications has effectively multiplied the number of identity systems. So each one's got its own logic for sign-on, session management, and provisioning. So this increases complexity and the potential for misconfigurations.
And we know that both of these things are well-known enemies of security. How long have we been saying complexity is the enemy of security? And so as organizations move to cloud-first environments, fragmented identity architectures make consistent enforcement of policies very difficult. And so this just amplifies the risks from things like identity sprawl and poor lifecycle governance. And we are preaching this concept of the identity fabric. And I think some of our audiences already have heard this once or twice from us.
But to make sure that you have, on the one hand, a proper administration of identities, which is the IGA part. And on the other hand, the use of these identities in account-carrying systems like AD, Entra, but also in SaaS applications, as you've mentioned. This should actually be some kind of solution to the problem. But as you said, the more account-storing systems you have, be they in the cloud, be they local, complexity rises and we get to this kind of fragmentation.
And fragmentation also means inconsistent standards, inconsistent profiles, inconsistent ways how we deal with identities, different ways of how we use MFA, etc. So what are the specific problems that come with this fragmentation? You've mentioned that already on a high level. Maybe you can dig a bit deeper into that.
Well, you've also kind of touched on it too, because developers face integration challenges. Because as you said, that each SaaS vendor uses a slightly different version or interpretation of common protocols like SAML, OIDC, and SCIM. So this leads to repetitive and error-prone custom integration work. It has to be done for each one of these. So the security teams struggle to maintain consistent access controls and provisioning. And this results in things like orphaned accounts, weak session management, and poor visibility across systems.
So this fragmentation leads to operational overhead, compliance uncertainty, and at the end of the day, a lack of trust that enterprise policies are being enforced correctly across all the different SaaS applications. Right. So this is a clear problem statement. So there is something to solve. There are issues that can be really addressed. And now we get to the point, enter IPC. So I look it up. Interoperability Profiling for Secure Identity in the Enterprise. There's a working group behind that, and they attack or address real-life problems. And how does...
Oh, and to mention, it's a working group within OpenID, the OpenID Foundation. So this is something that has some visibility and also some kind of backing in the industry. And how does this IPC initiative try to reduce complexity and improve interoperability and solve everything that you've mentioned, all these different kinds of interpretations of standards?
So, yes. So the mission is to create a unified sort of interoperability layer, if you will, for the enterprise identity ecosystem using profiles that define exactly how existing standards should be implemented consistently and securely. So these so-called opinionated profiles strip away all the optional features of standards to enforce secure interoperable defaults. So this introduces also measurable maturity levels for areas like SSO, account life cycle, and entitlements. And this gives enterprises a framework to assess implementation quality.
So by enabling things like conformance testing and certification, IPC ensures applications can be trusted to meet uniform security and interoperability criteria across the vendors. And as you mentioned, I think the fact that it's backed by all these different organizations in very much the same way that FIDO was.
You know, I think that's why FIDO has been successful, is that it wasn't just a single initiative. It was backed by the industry. And this is a rather young and upcoming initiative. So they are still working on that, but it's well published. So if somebody is interested in, hey, that sounds like a good idea to align these individual systems so that you have a single set of profiles for use of these standards, it's easily available. So and if you just google for OpenID and IPC, you should be there.
So when we look at the maturity levels at the profiles that IPC provides, they are around session lifecycle management, account lifecycle management. What are the practical implications for enterprise implementations? How can you use this in real life?
Well, it sort of creates a clear roadmap organization showing what a secure implementation looks like at different stages of the identity management maturity. So as you mentioned, for example, if we look at session lifecycle level one, it aligns with NIST's federation assurance level two requirements. So this is enforcing things like MFA and defining strict session lifetimes to reduce exposure. So higher levels of SL add capabilities such as session state communication between apps and identity providers.
And so similarly, account lifecycle levels progress from basic user provisioning in AL1 all the way up to AL3, which extends automation to include role and entitlement synchronization, supporting things like least privilege and more dynamic access governance. Right. And I think I really get the point of where IPC really makes complete sense because people like choice hackers as well, because when it's not clear how one key configuration is made this way or that way, that's always leaves room for interpretation. IPC does not.
It really says, OK, do it that way, and then you are compliant to IPC and at that specific level. And then you can assume that your systems are closer to each other and overall more secure. One point of criticism that you've mentioned or not criticism, but at least shortcoming as of now for IPC is that it's currently very much human focused in terms of employee workforce focused. Is this a limitation when it comes to the management of these? We have them overall in every news of these non-human identities.
Yeah, absolutely. I mean, you know, as we said, IPC addresses real and persistent challenges. And by stripping out the choices and enforcing secure defaults, it reduces the likelihood of weak or inconsistent implementations, which is absolutely essential for interoperability. But as you say, the IPC scope is currently limited to workforce users and SaaS applications. It doesn't cover things like service accounts, APIs and machine credentials. And these form a large and rapidly growing attack surface. I think non-human identities are increasingly central to automated environments.
Leaving them out just perpetuates blind spots in access control and lifecycle management. And so I think without expanding IPC's framework to include non-human entities, enterprises will need separate governance solutions. And then that opens them to risk of continued fragmentation, which is kind of not a good idea. Right. But if you think of a risk-based approach, and this is something that I've been preaching all my life. So I think some of the biggest risks that you've mentioned in the beginning are people risks, workforce risks, enterprise users, human risks in the end.
So starting with that surely is a good approach. Nevertheless, from what we see right now, we said it's an evolving kind of standard effort. How can organizations still use these profiles, these standards as they are described, to increase, to improve their overall identity governance, maybe even over to non-human identities?
Yeah, I think this is a case of one of those things where it's kind of better not to wait and see. There is this available. So organizations can use it as soon as it becomes available. They should start looking at it and start using the standardized profiles as kind of a foundation for secure SaaS integration. And then they can layer on additional controls for machine identity through things like lifecycle and secrets management tools.
But integrating IPCC's compliant SaaS identity with an overarching identity fabric will also help to maintain consistent policy enforcement across human and non-human identities. And enterprises should complement IPCC with governance mechanisms such as automated discovery, least privilege enforcement, and continuous monitoring, of course, to achieve a unified zero-trust identity model. So it perfectly fits into this overall model, this overall identity fabric. And that is, I think, also the reason why you wrote about that and why we talk about it.
Because it does not introduce a new set of standards that need to be implemented first, and new protocols and stuff. It does not. It just gives you guidance on how to implement that, what you already have, in a more consistent and, in the end, a more secure way. They still need support from end users, from people contributing to the working group, but also from vendors implementing that or integrating that into their framework. So there's still a way to go. But that should not hinder people in actually using that, right?
Yeah, I agree. I think IPCC represents real progress. Right. So we will watch that space, as we usually do. So we covered that in your blog post. We had Descartes at the event, and we talked about it right now. So if you're interested in having a first look at IPCC when you're out there and watching and listening to that, of course, Memoirics blog post is a good starting point, also with the links to the sources. If you want to go directly, you should find it, as I said, via Google or the search machine of your choice. That should be easily doable, and the profiles are not that technical.
They're easy to read, and it's really something where you can benefit immediately from and can improve your security posture. So yeah, I think that's it for today. We will watch that space. It will evolve because it has to. It is not yet fully complete. Not every level is fully defined, but what's there is ready to use, I think. So thank you again, Warwick, for being my guest today. This was fun, and really, it's so good to have something that, hey, there was an issue. Somebody tried to solve it. Here's the first approach. Use it. Isn't that great? Yeah. Right.
So thank you for being my guest, and looking forward to having you in an upcoming episode very soon. Thanks, Matthias. Bye.
Thanks, Warwick. Bye.
