Tim Barber: Creating an Innovative Identity Fabrics Structure

Okay. Good. Thank you for the introduction and good morning everybody. Yes. The idea of identity and access management becoming a business critical function is something that I will be talking about, but in the context of how you modernize your approach to identity and access management towards the concept of identity fabric, Q3 oh four basic pieces to the agenda for this presentation, first and foremost, why an identity fabric, then we'll look at what's potentially holding organizations back from moving forwards with an identity and access management strategy. Look at some strategies of how they can address that. And then finally, of course, I'm happy to take questions. Let me just check that you can still hear me. Are we good?
Yes we are.
Okay, good. Thank you. So why an identity fabric? I mean, we, we sell identity and access management platforms to all sorts of organizations all over the world. Typically very large organizations with complex it infrastructures and all of those companies are going through some form of business transformation. Typically that's framed as digital transformation. It's a, it's about really how do traditional organizations compete effectively with the, the challenges in their industry? The people who are digital native that have really been born in the digital age, we always come up against people or come in contact with people whose job title is something along the lines of digital business leader or digital transformation owner. And those people have a very compelling job to drive change in the organization. And there's a lot of pressure to do things quickly in order to maintain a competitive edge or at least prevent digital natives from gaining a competitive edge.
So there's a lot of pressure on the organization to create the kind of digital experiences for their citizens, if it's government or for their consumers, that they want to emulate the kind of experiences that people are now getting used to, which are very frictionless. But at the same time, give people confidence that things are being done properly and their data is being protected and that, and the security is being taken care of. It's a, it's a business critical need to do that. But for the, the people who run the IAM systems replacement, their existing legacy platforms becomes a key objection because it's perceived because they are business critical systems that are there to protect data and protect both the organization and consumers or employees or citizens, depending on what you're using IAM for. It's considered very risky. It's very risky to tinker with a business critical system that's working.
If you want to replace an it system, it's, it's typically very expensive. People are reluctant to ignore the sum cost and the investment that they've made in all of the systems integration that goes around that. And in a large complex organization, it's often difficult to see a path to navigate through a complex organizational structure to make a decision to, to change. So you, you, you get the situation where the, the sort of the, the front end digital transformation teams within organization are putting pressure on the, the identity and access management and it organization to make change, but they're reluctant to do so. So you end up in a St mate with paralysis where concern over really important things like security and data privacy leads to a fear of innovation. So that's, that's a typical backdrop that we come up against.
An identity is, is, is changing. It's becoming multidimensional. It's not just about people. It's not just about authentication and authorization of people to get access to systems and applications. You need to take into consideration a lot of other factors around the context of that. So not just who it is, but what are they trying to do? And when, and where are they trying to do it? And that requires an understanding of real time context in the decision making process. It could be your employees, it could be your customers. It will depend on things like what device they're using, managing the relationships between people and between people and their devices. And if you think of a very simple day to day activity like watching streaming TV, there could be numerous different people accessing that across a range of different devices within a household, they can take their access to hotel rooms, understanding all of that context in order to apply appropriate amounts of friction when it's necessary and remove friction when it's not necessary is really the key to what organizations are striving to do.
So understanding the context of who it is, what they're doing when they're doing it, where they're doing it, why they're doing it is, is really encapsulates the challenge of identity and access management, and really underpins why organizations are moving forwards towards this concept of an identity fabric. And the reason is because all of their existing approaches, the kind of the traditional legacy identity and access management platforms are falling short. They, they tend to have been born out of, of, of work workforce type environment where you're providing access management for employees. So there are issues around scale, typically, because if you're trying to provide a similar kind of environment for millions of customers, a platform designed for a few thousand employees might not necessarily be fit for purpose. There are increasing regulations around the way that people engage with their employees and they engage with their customers or their citizens, and keeping up, keeping pace with all of those regulations around, for example, data security and privacy put challenges on legacy systems.
They typically are not great at extending across a broad range of different applications, using different protocols to communicate. And you end up with a range of different silos. It's not uncommon for identity and access management to be applied tactically at an application level. And then those applications are unable to manage identity across the bigger picture. So existing approaches are falling short, digital transformation covers everybody it's it's customers and their devices. It's it's the workforce and their devices. There is often a trade off or people consider there to be a trade off between creating the right experience for people, which is about applying friction at the right level, in the right context with security. And it's true to say that successful digital transformation needs a comprehensive approach across all identities. Typically about 80% of the needs are very common across all of them. There may be different flavors and different emphasis. So typically customer identity has a slightly higher focus on creating better experiences. Whereas workforce identity and access management gives a bit more priority to security, but in essence, the common denominators for all identity and access management challenges are to create the right customer experience with intelligent and transparent security. So that's what we are all trying to achieve.
The legacy dilemma is really about the fact that legacy systems are entrenched with numerous technologies and business processes that are costly and difficult to modernize. So that creates a drag on the organization. Sometimes people put homegrown systems in place. They build their own. That also creates a drag because they're typically very expensive to maintain, and they contain a lot of different technologies. So as businesses try and compete in the digital age, it's not untypical for organizations to put tactical solutions in place where they, they build identity and access management capabilities that are disconnected from the rest of the organization. So as standalone systems, they work, but you are unable to get the context of identity spread, right, the way across your business, across all your different channels and all your different lines of business and products. The temptation to make tactical choices is really a manifestation of the way that organizations get around that paralysis that I was talking about at the beginning where the, the IAM and it department are at log ahead with the business imperative of trying to change quickly.
So let's look at what the actual scope is. We need to improve a full user experience. We need to overcome complex and Britt security. We need to get a broad understanding of what the total cost of ownership is for identity access management platforms. And we need to inject choice into the way that we do things. So that's really what an identity fabric is all about. Fundamentally, the goal of the identity fabric is to give organizations a single source of truth for identity and access, whether it's for their employees working in the organization or for customers conducting day to day business. And this slide really encapsulates what for rock. And I have say co Ja Cole called the identity fabric. It's a modern approach to simultaneously enabling high flexibility and speed from new digital services whilst integrating and abstracting legacy co J Cole actually wrote a white paper that's featured on the for drop homepage.
If you want to go and check it out in more detail and understand the, the rationale and the strategic thinking behind the concept of identity fabrics, but no business is unaffected by digital transformation businesses, and their leadership are challenged by the needs for continuous innovation. And that may be in both inbound and outbound from the organization. So an inside out approach where you get access via APIs and an outside in approach where you are able to manage applications wherever they are deployed, whether on premise or in the cloud, with the ability to integrate, to legacy across your entire IM infrastructure across all your backend systems creates the ability to serve up identity into the organization. As a service in all of its manifestations, the key aspects of that, being the ability to manage access the admin, the ability to manage con the consent and privacy and security of individuals and the ability to provide automated administration and governance in order to comply with regulations.
That's, that's really what we mean by an identity fabric. The ability to have very high flexibility and speed to deliver the new digital services that organizations are trying to put out into the market with integration and gradual migration of your existing estate into the modern world. And that is really about creating value. It overcomes the objection that things are too risky and too expensive to contemplate change. If you can get to value quickly by creating the applications and the choice that you need without having to incur the cost of massive it, infrastructure change and do it on a gradual basis, then it's much easier to get your head around what that cha change program needs to deliver. So we will take a look at that in a minute. Good. Fundamentally, we need to move to a strategic view that covers both your existing needs, but has an eye on what has happened in the past in order to remove those anchors that are dragging the organization down by migrating your existing legacy platforms and your homegrown platforms into an identity fabric, embracing them rather than thinking them of, of them as something that needs to be ripped out and replaced.
So a coexistence strategy based on open standards and API first as an approach enables you to integrate your legacy platforms, sweat those assets. If you like whilst enabling the new digital services that you are striving to achieve. So whatever your identity fabric solution ends up being, it needs to be thought of as an extensive, as a service type offering, where identity is served up into the organization, in whatever form, in whatever way that you need it to be. And typically these days, what that means is a hybrid, an it architecture, a combination of cloud-based SaaS services, working in conjunction with on-premise services in order to get the right balance of what your organization needs to drive change without incurring the risk and cost that is typically associated with that. So there's three things really that you need to think about before you start to plan how you are gonna unlock that value.
The first is the security needs of the business, balanced with the efficiency that you want to achieve in order to create the user experience that your digital transformation teams are demanding. How do you get the balance right between those three things? I can't compromise security. I need to drive cost outta my business, and I need to create competitive a competitive edge through the user experience that I deliver. This is the way that four drop looks at it. This is a very simple diagram, but it's really a seven step process. What we recommend is the first thing you do is you take an inventory in order to prioritize the applications, though, that are going to have the most business impact and create the most value upfront, prioritize those, understand in detail, the use cases that are required and the changes that are required in the experiences around those applications.
In order to add value, then deploy an identity and access manage management architecture that enables you to coexist your legacy platforms with the new services that you want to deploy. Once you've done that, and you've created the experiences that you need, then you are creating value. You are delivering what the business requires, and that gives you the breathing room that you need to then think about migration. And then ultimately sun setting platforms as you move towards a more modern architecture. So that's really the process that organizations need to go through. However, however, there's several different approaches to doing that. There's a nuanced way of thinking about it. And these are the three main strategies that we see organizations who are deploying for drop use. The first is a parallel deployment. Now, there, there are pros and cons of this. It does set the stage for an eventual migration, but because you are running a parallel deployment effectively, what you're doing is, is saying I am going to keep my legacy kind of traditional IAM platforms in place for my day to day business.
And I'm going to deploy a modern system for my new digital services. So there's typically no bidirectional, no bidirectional data synchronization across those platforms. The good news is you get the capabilities of a modern IAM platform before you migrate. And it does set the stage for migration, but in our view, you are potentially building up problems in the future. If you go down that route, because you will have at some point a migration challenge, which is going to be complex and expensive. So what a lot of people do is they actually go for what we call a coexistence strategy, where you integrate one or more of your legacy platforms into your new modern go to target platform. The way that that works is effectively you front end your identity and access management with the new platform. And you hand off from there to your legacy platforms to, to deliver your traditional services.
And then you use the modern platform to deliver your digital services. What you, the benefit of doing that is that you get data synchronization between the two platforms. So you get flexibility in the way that you are able to deliver new digital applications. You can use data consistently across the business, which moves you towards the concept of a single source of truth for identity. And it has typically less impact friend users. So from an architectural point of view, basically you are putting a new modern platform like for rock, for example, in front of your existing platforms, to create an extraction layer for identity, which then uses the assets that you've already got in place and delivers the new services separately to those. The third strategy is augmentation, which is really, really sort of the flip side of the coexistent strategy, where your legacy systems remain primary.
And if they have sufficient intelligence built into them, they can hand off identity decisions. So authentication decisions, authorization decisions to the new modern platform, where they are unable to handle it themselves. So basically a decision needs to be made for an authentication event or an authorization event. The existing platform is unable to handle it. For example, it may require real time context to be taken into consideration. So it hands that decision off to the new platform, that new platform makes the decision and returns the token required, say, yes, this is okay. So in this, in this augmentation strategy, the legacy platform is the front end. And the modern platform is handling the digital services in the coexistence strategy. The modern platform is put in place as an extraction layer first, and it, it makes the decision which route to take through the identity fabric.
I hope that's clear if it's not, then I'll have another crack at explaining it during questions, but those are the three broad strategies that we see our customers using. So to summarize digital identities is it's really important because it affects everybody every day of our lives. And in the last few weeks and months as a result of the current crisis, I think we've, we've, we've all seen and understood that to a level, which perhaps we hadn't appreciated before everything that we do when we buy things online, or we register for online services. When we use mobile apps or we engage on social media, or if we need to share information about ourselves, whatever it is, you know, when we pay our taxes or we need to access our healthcare, digital identity underpins all of those things that we do every day. So it really sits at the very heart of how you engage with your customers and your employees. If you get it right, you can create absolutely outstanding customer journeys. You can dramatically reduce, serve, and you mitigate risk, right, the way across your business. So that is why digital identity and access management is regarded as strategic.
So this is, this is how we frame it. What we do is help them to exceptional without is all for very your cloud. Our allow a public cloud, any kind of architecture that you need, that fits in with your strategy. And you need to be able to do that across your consumers, your workforce, and all of the things that they use day to day.
So just a little bit about Ford rock. We're a global company, we've got 600 people serving more than a thousand customers all over the world. Our goal is to help our customers use digital identity as a source of competitive advantage to stay ahead of consumer expectations, break free from regulatory overload and tackle the sheer scale and complexity of digital transformation using the concept of an identity fabric and the strategies that I've outlined so that they can become distinctly different in the eyes of their employees and the eyes of their customers. So that's what we are all about. I hope you enjoyed that. And I am now open for questions. I think we have a few minutes left.