SecurityNewsletter.com : What is the state of IAM by the end of 2007 ?

Christophe Therrey, Novell : This market is still hot, and one to keep a close eye on. I believe it has not reached its full maturity even though it's expanding quite rapidly, in France at least. Identity is a very rich concept and it does not end with security. Of course, authentication, access control or Single-Sign-On are true assets from an IT security point of view. But they only are part of the solution. Identity and Access Management software can do much more, like web services management and even contribute to the integration of diverse SOA architectures.    

The market, however, and especially in France [editor's note : and also in other countries without strong regulatory laws] is still lacking on the compliance side. Companies started to look into Identity Management in order to ease user accounts management and bring centralized authentication. Now, those two goals are necessary steps toward the compliance level IT departments have to sustain.

I believe 2008 will see more strict compliance levels being enforced across the board, and not just for those industries subject to business-specific compliance rules (SOX, etc..)

SN.com : Still, would you say the market has matured ?

The solutions are mature, yes. But I believe there is a real gap between what those solutions can do, and the sometimes basic needs expressed by our customers. For example, we provide the capacity to do Identity Federation, with the concept of "trusted partner", or give the tools to manage a distributed identities store. Yet, mots of our customers have yet to do basic provisioning within their own organization ! Of course, he who can do more can do less...

SN.com : Much has yet to be done. So far, what have been the main drivers ?

IDC showed the IAM industry to have reached $6 billion in 2006. Companies are still looking for more efficient ways to manage their IT security infrastructures and keep compliant within the boundaries of their budget.

But if it's true compliance has been the main driver for that market, it's been helped by other needs like Single-Sign-On, better password management or the integration of workflow into provisioning. And the SIEM (Security Information and Event Management) industry can also complement IAM, as we offer it with our Sentinel solution.

SN.com : Did the recent market consolidation contribute to standardize the offering, all solutions being now equal ?

I really don't think at all that all solutions are equal, for at least to reasons. First, because some vendors have made their offering from mix & match pieces and have yet to bring any value in their integration. Their customers have to do it in-house. And also because IAM can be approached through very different philosophies, SIEM being a good example.

I believe Novell can make a difference at many levels. We have been on this market since the beginning, and even before that since we were present in the directory industry with Novell Directory Services. And we are today the only player in this industry to be present in Gartner's IAM Magic Quadrant for the provisioning, access management and SIEM at the same time. And our size - being global but still at a reasonable size - makes us flexible. I'll add that our commitment to Open Source also makes our solutions open to standards.

As for market differentiators, I would strongly suggest to question the vendor's track record, be it a major or niche player. It can tell a lot about the maturity of its solutions and the quality of the vendor / integrator coupling.

SN.com : Identity Management is above all an organizational project. Nevertheless while the market is rich with software suites, it is quite poor with consulting. We mainly have major vendors with their professional services (that are not consulting experts), or numerous small to medium sized VARs for whom consulting is not the main business. Where are the major consulting practices that could bring I&AM vendors the essential business expertise, just like in the ERP world ? 

Your draw quite a dark picture here, but I do agree with you up to a certain point. Let's not forget IAM requires a high level of expertise from integrators, both on a technical level and in the understanding of the customer's own processes. And it's true that on some markets, like in France, there is a clear distinction between consulting players and integrators.

SN.com : Can Open Source play an important role in IAM ? Can we imagine a competitive Open Source IAM software suite ? 

Absolutely !  Open Source is here to stay, and IAM will not avoid it. There is no Open Source IAM solution yet that can rival the proprietary ones in functionality. But there are pieces of it, and there is a move, by Novell and other Open Source players, to create such a full blown IAM software suite. It's called Project Bandit and it aims at offering an easy access to multiple identity storage systems, to support multiple pluggable authentication schemes, an API to unify access policies based on roles, and even allow applications to enroll into a common compliance check. Novell actually is one of the project's leader.

SN.com : What is the trend for 2008 ?

Two strong trends : Open Source as we mentioned, and everything about common identity repositories, namely Identity Federation.