Software vendors are introducing a slew of products that aim to reduce the growing complexity of managing user identities and controlling access to applications scattered across internal and external systems.
IBM Corp. and VeriSign Inc. recently rolled out a hosted service for identity management, and RSA Security Inc. introduced a new version of its ClearTrust access management suite that features key usability and security enhancements. Novell Inc. and Waltham, Mass.-based Netegrity Inc. are slated to introduce updates of their access and identity management technologies this week.
The latest announcements add to an expanding list of identity management products and services from vendors such as Oblix Inc. in Cupertino, Calif., Courion Corp. in Framingham, Mass., and Aventail Corp. in Seattle.
Driving all this activity is the growing demand for products that help better manage the task of dealing with multiple versions of user identities across multiple applications, according to analysts.
"Companies are realizing they have a problem with this thing," said Laura Koetzle, an analyst at Forrester Research Inc. in Cambridge, Mass.
IDC in Framingham, Mass., predicts that sales of security management software, which includes identity management offerings, will grow 30 percent annually, from US$550 million in 2001 to $2 billion in 2006.
Identity management products offer capabilities as varied as centralized administration and life-cycle management of user identity data, password synchronization across multiple applications, single sign-on, secure authentication and policy-based access control.
Oblix, for instance, has helped Oslo-based Norsk Hydro automate the task of setting up users, simplify the process of updating and maintaining user attribute information, and ease the delegation of access-control decisions to business units.
The energy giant is using Oblix's NetPoint technology to let third parties access corporate portals for tasks such as ordering natural gas. Oblix also helps Norsk control the manner in which its 40,000 employees access internal applications, based on a person's role or other attributes.
"As you open up your information assets to external companies, business partners and customers, you can't base your security on firewalls alone," said Mike Kimbell, a directory architect at Norsk Hydro. "You have to protect the information and how it is accessed."
For Blue Cross and Blue Shield in Kansas City, Mo., the hassle of creating new user profiles each time an application was launched pushed the organization to install Bedford, Mass.-based RSA's ClearTrust technology. Software from RSA has allowed Blue Cross to maintain a single user store to automatically provision access to new applications, said Kurtis Keling, senior security analyst at Blue Cross.
"It has reduced the time it takes for us to bring on new applications," Keling said.
Going forward, expect to see such identity management technologies playing a crucial role in enabling Web services, said Larry Hawes, an analyst at Delphi Group in Boston. "Distributed access management is a big hole in the service-oriented architecture right now," Hawes said.