Gartner identifies key Identity and Access Management trends

by CXOtoday Staff    Jan 31, 2012

Businesses need to increase their focus on identity and privacy projects, says the firm

Research firm Gartner identified six major trends that will drive the evolution of corporate management of identity and access management (IAM) and privacy management in 2012.

“In 2012, businesses need to increase their focus on identity and privacy projects that can achieve quick time-to-value and deliver real value not just to IT, but also to the business,” said Bob Blakley, Vice President and Distinguished Analyst at Gartner. “As organizational boundaries erode under the pressure of federation and outsourcing, and as organizations’ control over IT continues to weaken through increased adoption of mobile devices and cloud services, identity management is more important than ever, and more problematic.”

The six key trends are:

Tactical identity: The scope of, and budgets for, identity management projects will remain constrained. A major cause of failure for these projects has been an overly broad scope combined with a lack of focus on business value. There is no longer the budget or the appetite for projects that run the risk of such failure.

Identity assurance: Demands for stronger authentication and more mature identity provider infrastructures and practices will intensify. Organizations need to know who they are trusting, why, and for what. They also need to know what the consequences will be if the organizations they trust to provide identity information do not fulfill their obligations, and they need to know the strength of the mechanisms used to convey identity information.

Authorization: Authorization requirements will grow more complex and more urgent in response to continuing regulatory pressure and riskier and more complex IT and business environments. Identity life cycle management, authentication and auditing are fairly mature in many organizations. Authorization i.e. the creation and enforcement of access control policies is much less mature, but will assume a place as a first-class business function.

The identity bridge: Managing federated identities is a complex task, and the protocols for federated provisioning and federated management of identity policies and attributes are immature. The central authoritative source of identity information can only reside at the edge of the organization to look inward and outward simultaneously, and the processes that manage federated identity span the perimeter. The hole in modern identity architecture is starting to be filled and will become an identity bridge.

The sea of tokens: Identity information frequently has to be transformed by each domain that receives it, and then passed on to downstream domains. Identity information is transmitted via tokens, which may be carried in protocol headers, but are increasingly carried in protocol payloads. The new tokens-and-transformers architecture is more modular, more flexible and more loosely coupled.

Policy battles: The business community, the privacy lobby, and law enforcement and national security communities will continue to wrangle over identification and privacy laws and regulations — and this will continue to drive changes in the identity infrastructure.

“On the one hand, identity is the main point of control that organizations still have over information in a world where users own the clients and outsourcers own the servers. On the other hand, establishing identity in such a diverse and heterogeneous environment is becoming more difficult, and the identity information itself is increasingly problematic as a source of privacy breaches,” said Blakely.

“New technologies, new services and new architectures are emerging in response to these pressures, but plenty of work still has to be done before the industry can produce a comprehensive and dependable identity architecture for the modern world,” he said.