ID Management Gets Set For Prime Time

If there's one software application that any organization must have today, it's identity management. Not long ago, comprehensive ID management was not honed enough to enter the market.

Now it is. Several established security vendors have rolled out some form of ID management, and others are taking steps to acquire the technology. Take Bedford, Mass.-based RSA Security, which in the past few months purchased authentication services provider Cyota in an effort to bolster its financial-services expertise. Hewlett-Packard announced plans to buy Trustgenix, which makes software that allows users to authenticate their identities to access accounts on multiple sites.

Those deals highlighted two primary concerns in the ID-management space: the need for companies to keep pace with compliance issues and the subsequent demand for stronger authentication tools that simplify ID management.

"Identity management started in the enterprise because that's where the complexity was," says Somesh Singh, vice president and general manager of BMC Software's identity-management business unit. "Companies with thousands of employees running hundreds of applications found that their systems integrators were having their days consumed dealing with access management, so the technology started with the desire to make the process of accessing their applications easier."

Companies in the telecom, financial-services, manufacturing and government industries, whose security and compliance concerns are most intense, are especially keen on the still-evolving technology. According to Computer Associates, that evolution will take place in two areas. First, stronger authentication will require more balance between overall risk and inconvenience for organizations. Second, security elements, such as threat and identity management, will begin to converge as they "talk to one another."

And that's key, because the demand is growing among businesses that need to let multiple partners, suppliers and customers access their systems via cross-domain authentication and secure access management, such as travel sites.

For VARs like Innovativ Systems Design in Edison, N.J., this spells opportunity.

"[We restructured because] we wanted to bring focus to some of the solutions that we've created and get out of being just a Sun reseller," says Innovativ CEO Tony Mellina. "We started the effort two years ago to be more of a diverse solution provider and develop our own intellectual property, almost like an ISV."

"Security is a wild card for this industry," he says. "The viruses and spyware attacks we've seen show the complete lack of edge security out there. And it happens in a heartbeat. So, a lot of what we're doing is promoting more tightly integrated security solutions so that ITVerify [Innovativ's proprietary software] can detect change instantaneously. Also, identity management has already gone off the charts for us. We've hired more people for that practice than any other."

Enterprise ID management tools are beginning to move downstream into the midmarket. In January, for example, BMC released BMC Identity Management for .Net, offering an open architecture-based, end-to-end solution that simplifies ID management needs for workflow, directory management, audits, self-service, password management and Web single sign-on.

"Smaller companies have lower costs and less complexity, and traditional identity-management systems have been too expensive," says BMC's Singh. "But 'less' doesn't mean no complexity; at some point, they all need this solution, especially Microsoft users, and the market for companies with between 500 and 2,500 employees is not being served."