Identity Management as a Service Makes Strides

The economy may be in a downturn, but identity and access management as a service appears to be gaining steam.

According to analysts, the market is growing steadily among both enterprises and smaller organizations alike. The reason—cost savings and an end to the implementation and management efforts tied to IAM projects.

Such was the case with Motion Media Solutions, a new media company based in Dallas. Ross Mason, the firm's CEO, turned to TriCipher's MyOneLogin solution to meet the company's growing needs. 

"We founded Motion Media on the premise that we would have some core competencies on staff at the company, but equally important, we would utilize lots of variable resources all over the world to help us design, produce and execute our content," Mason said. "These partners would need to have access to many of our collaborative and communications systems, like Google Apps … stock photography accounts, YouTube Channels and many, many more." 

What started out as a means of managing employees internally and providing them with access regardless of where they were was ultimately extended to a new Web of people, managing various aspects of client's productions, Websites, blogs, Twitter profiles and more, he said.

Mason's story is not unique, as businesses are increasingly looking to get a faster time-to-value out of their IAM solutions. Poised to take advantage of any growth in interest are companies like TriCipher, Symplified and Simeio Solutions, all of which play in the space. 

In his April 17 paper, "Hosted Identity Is Real—Are You Ready for It?" Forrester Research analyst Andras Cser noted that the pay-as-you-go approach of IAM as a service is gaining popularity because senior executives often want to see quantifiable benefits of IAM in a pilot area before they roll it out to other areas or implement additional services. 

"Most IAM product vendors provide little help to companies to build the business case for these solutions, making the job of purchasing IAM products fairly difficult," Cser said in the report. "Forrester found that implementing a hosted IAM project is usually 30 percent to 40 percent less expensive than creating the IAM solution in-house—an often overlooked fact when building the business justification." 

Still, whether or not hosted IAM is truly viable for a given enterprise depends on a number of different factors, from the size and nature of the business to risk tolerance and exactly what services are offered, said Bob Blakley, a research director at the Burton Group. In addition, there are the normal concerns about service levels.

"Service providers can go out of business suddenly—it's important for their customers to have legal agreements providing advance notice of changes in provider business conditions, and it's important to have a detailed migration plan and test it so that if a provider fails a migration to another one does not interrupt the customers' business," Blakley said. "Service providers can also receive discovery orders, warrants and subpoenas [that] might disrupt customer business or reveal customer data." 

There are also issues of integration with applications developed in-house as well as with obscure, arcane commercial apps, Cser said in an interview with eWEEK. Security concerns also remain, though businesses shouldn't view IAM all that differently from other SAAS (software as a service) solutions.

"A lot of people want to know, How do I protect the whole data security of my organization? And the answer is if you're willing to let go of your CRM information, your revenue numbers, and transition to Salesforce.com, that's probably a lot more sensitive information than what you would have in your identity management system," Cser said.