The Hindu Business Line : Play safe....

Identity management is now a serious concern, both for consumers and businesses as loss of information due to security breaches continues. The task of defining and establishing `identity' is growing more complex and difficult to manage.

Thus cautioned a recent summit on identity management at the Georgia Tech Information Security Centre.

But first, what is identity management? It is an integrated system of business processes, policies and technologies that enables organisations to facilitate and control their users' access to online applications and resources.

Identity management encompasses user authentication, access rights, access restrictions, account profiles, passwords, and other attributes supportive of users' roles/profiles on one or more applications or systems, says Sameer Karmarkar, Product Manager, Persistent Systems. According to Radicati Group, this market, with all its segments, will grow to over $8.5 billion by 2008.

Globally, players in this space face the challenge of integrating new technologies and products into one ID management product face for the end customer.

Karmarkar says soon one will see ID management technologies being integrated with other technologies such as Help Desk, Service Management, Configuration Management, Monitoring, etc.

This will eventually lead to the concept of Business Services Management making Identity Management an inherent part, he says.

How does its implementation benefit the customer?

According to Karmarkar, the first benefit is of cost saving realised through automation, enhanced productivity and the elimination of redundant manual tasks.

When one looks at things such as intrusion detection or vulnerability assessment, it's very hard to measure the impact of what they will do specifically for the organisation.

But, when you look at solutions such as password self-service, it's very plain to see that you can begin to scale down your help desk, which results in saved man-hours, which ultimately can be computed in terms of money.

The second benefit is enhanced security and increased ability to have general controls within the environment. This means the ability to ensure that the proper people have access to the things that they should have access to - and no more.

Looking at the customer side, Identity management is the process of ensuring that the right users get access to systems, data, and applications quickly and securely. This process is accomplished by answering three questions within any system or application deployment.

Who are you? What can you do? Are you who you say you are?

These three questions are increasingly important in the age of the Internet and with highly complex systems. Even more so with increasing regulatory and privacy concern. Corporations and governments are keen to ensure that these three questions are well accounted for, in technology deployements, says Satish Mohan, Head, Engineering, Red Hat India.

Numerous factors are boosting IT spend on identity management such as ever-increasing costs of maintenance of systems and administering users, complexity of heterogeneous environments, business functionalities and IT management in general. And then there are compliance issues, as we have already seen, such as Sarbanes-Oxley, HIPAA,RBI Guidelines, BASEL II and EU Data Privacy acts. There are also business demands for interaction with external businesses such as partners, channels, suppliers, and integrating other entities/systems obtained through mergers and acquisitions.

An identity management solution enables an enterprise to bring in accountability and auditability, Karmarkar says.

The market is driven by government and industry regulations such as (in the US) Homeland Security Presidential Directive 12 (HSPD-12), which requires all US federal employees to use advanced authentication to ensure that they are who they say they are, Mohan says.

Federated identity

The key long-term play for the industry is federated identity. Federated Identity is a system that allows individuals to use the same user name, password or other personal identification to sign on to the networks of more than one enterprise in order to conduct transactions. But this technology is still immature, although successful implementations have begun appearing in the telecom industry and other verticals.

Over the long term, a services-oriented architecture approach to software may prove to be the ultimate driver of identity technologies, as identity management and service orchestration dovetail into a single infrastructure management discipline, say experts.

Identity management is still in its early phases, but it's never too soon to get on board, because big things are ahead, says Karmarkar.

The Georgia summit too reinforces that any approach for tackling identity management issues must centre on a national and international dialogue among all stakeholder groups for a cohesive understanding of what identity is and how to ensure the secure management of individual and corporate identities.

savitharin@gmail.com