The Hindu Business Line : Security is the password

IT'S no use crying over spilt milk - or a system whose security has been breached. The smarter thing would be to make sure that security is not compromised.

This is where Identity and Access Management technologies come in, says Binod Singh, Chief Executive Officer of Ilantus Technologies. Excerpts from a chat with eWorld where he dwells on the trends shaping this market and its outlook:

How do you define identity management? What does a company have to do to achieve this?

Identity and Access Management is a conglomeration of technologies to manage the Identities of users in a company or organisation.

Binod Singh

A host of technologies are brought together to meet business and technical needs and to manage users' relationship to the company's infrastructure. Identity Management deals with user provisioning (activation and deactivation of employee accounts), password management and access management.

It helps manage the user'saccess to infrastructure, across Web-based, client server, mainframe and legacy applications.

IDC estimates that expired user accounts may be upwards of 60 per cent of all accounts in corporate systems. This leaves companies open to serious security vulnerabilities.

Identity management simplifies employee accounts, access rights policies, cards and other privileges. Automated provisioning can activate and deactivate a user from across multiple points within a company.

This makes managing the churn of employees and contractors less costly from systems' and personnel perspectives. It also promotes heightened security. As employees change position, address and other work/personal information, multiple systems will need to be updated by multiple individuals. Identity management solutions offer the ability to self-serve.

Also, the change of information or access rights can be delegated to the groups within which an employee works. Groups are definable by characteristics such as geographic location, function and Line of Business (LOB).

In addition, enabling employees, for instance, to log in just once and have access to all necessary information and functionality provides a seamless work environment.

In today's age of the virtual enterprise, an effective identity management solution will include a variety of capabilities and features to achieve integration, security, service and streamlined operations.

The basic requirement for an enterprise to implement an identity management system is to ensure that the company starts moving towards a single data source. The other key requirement is the integration of all the critical systems in the enterprise with the identity management solution.

Where is the identity management market heading?

Numerous factors are boosting IT spend on identity management - such as ever-increasing costs of maintenance of systems and administering users, complexity of heterogeneous environments, business functionalities and IT management in general.

And then there are compliance issues such as Sarbanes-Oxley, HIPAA, RBI Guidelines, BASEL II and EU Data privacy acts, among others. There are also business demands for interaction with external businesses such as partners, channels, suppliers, and integrating other entities/systems obtained through mergers and acquisitions.

The West has grown to the fact of the imperativeness of implementing identity and access management in enterprises.

This is being seen in the India and Asia-Pacific regions. Accounting and auditing collapses like that of Enron have led to vast changes in auditing standards and systems, cutting across geographies and cultures. Adding to the complexity is the fact that companies today are present in and doing business across regions.

With a spate of security breaches hitting the headlines, identity theft is also topping the minds of businesses as criminals hack into corporate networks. The breaches cost companies and individuals billions of dollars each year. Identity theft is `booming' and the cost of neglecting security and continuity can be catastrophic. The damage to a company's brand and shareholder confidence can be significant.

A perfect example would be the outsourcing industry, be it the IT/ITES sector or the outsourcing trends in the pharma, manufacturing and automobile industry. Companies in these segments have to cater to standards, requirements and regulations that depend on the domain and region of operation.

An identity and access management solution will enable companies to adhere to these regulations, bring in accountability, auditability and increase the security of the enterprise.

The future of this market is bright as every governmental regulation demands adherence in a time-bound manner.

While the implementation of identity and access management solutions is inherently complex, combined with high costs of product licences, the return on investment is good.

Compliance seems to be the buzz word. US enterprises seem to be investing in a big way driven by regulatory issues?

Multiple regulations such as Sarbanes-Oxley and HIPAA mandate different aspects of privacy and accountability.

This requires organisations to have IT systems that ensure that employees are able to access only resources they are allowed to access. Identity management solutions help companies to check whether their policies are being correctly implemented and to detect system break-ins.

Compliance with regulatory demands has a telling impact on conducting business be it in the US, the UK, EU, India, Japan and Australia, and almost all the key markets in the world. India has felt a major impact, especially in the outsourcing industry spread across verticals.

Indian banks have awakened to the fact that RBI guidelines have to be adhered to by 2007.

With the Government moving in with new regulations to make all aspects of the industry accountable and auditable, compliance will be the buzz word in this part of the world as well, in the coming days.

What are the key trends in this space? How big is the market?

The identity and access management market is one of the fastest growing, as indicated by industry analysts such as IDC, Gartner, Radicati group, Burton Group, etc.

A key trend in this space, which is more or less complete, is the consolidation of the ID and access management suite of all the major technology vendors such as BMC Software, IBM, CA, Novell, SUN, HP and Oracle, with appropriate acquisitions. The stage is set for the battle royal between the vendors.

The ID management market is expected to grow at a compounded annual growth rate of 30-40 per cent to about $2 billion by 2006. According to Radicati Group, this market, with all its segments, will reach over $1.2 billion in 2005 in worldwide revenues and grow to over $8.5 billion by 2008.

Players in this space face the challenge of integrating new technologies and products into one ID access and management product face for the end customer.

For instance, Oracle, which has acquired more than one company in the space, needs to integrate their offerings into its homegrown products such as Oracle Apps, Oracle middleware, etc.

The next phase of consolidation will see the major vendors moving onto offering an SOA (service-oriented architecture) based approach, which, if successful will be the dream of every IT manager in every enterprise. This movement will see another round of acquisitions in the near future.

The other trend will see ID access and management technologies being integrated with other technologies such as Help Desk, Service Management, Configuration management, Monitoring etc, which will eventually lead to the concept of Business Services Management.

ID access and management will become an inherent part of the Business Services Management space. Vendors such as BMC Software, and IBM have taken a lead in this space.

What are the verticals driving growth in this space?

BFSI (banking and financial services, insurance), with compliance mandates, the ITES (IT-enabled services) sector - with the need to secure data and prevent data thefts, IT sector, mandated by international counterparts and clients, Healthcare and biotechnology - secure data and confidentiality requirements, are in the thick of this growth.

What role do you see for Ilantus in this market place?

Ilantus was amongst the earliest companies to recognise the potential of the sector at its nascent stage. The Ilantus management visualised the complexity emerging and has built skills in this domain of Identity Management, which requires mastery over compliance, heterogeneous technologies and understanding of the infrastructure. Over the years, Ilantus has delivered 200-plus highly complex implementations.

The sector has evolved tremendously in the US. In India, it is on the verge of blowing to its full potential. Ilantus foresees Indian companies driven by business and technical compulsions to start implementing ID access and management solutions over the next couple of years. Ilantus has created an IP in the domain.

The company offers technology and business consulting to enterprises from a technology agnostic standpoint and partners with vendors such as BMC Software, IBM, CA, Oracle, Novell, Passlogix, NetPro, HP, SUN and Mtech in this space.

vrishi@thehindu.co.in