Role Up-Role Up

At the start of this week I attended the first European Identity Conference in Munich, Germany. A specialist event such as this has been a long time coming. The event was really well organised by Kuppinger Cole Ltd. and was aptly titled “Thought Leadership & Best Practices in Identity Management” As you would expect the entire spectrum of IM was included, from Single Sign On, Federation, User Life Cycle Management to Virtual Directories, Roles and Compliance.

Without exception all of the keynote speakers offered great inside into their field of expertise, the balance of speakers was right as well, a number of vendors, an few from academia and a good percentage of end users who gave some really candid presentations on their own experiences of deploying some of these technologies.

Outside of the normal networking I spent my time in the compliance and roles tracks. Some of the break out sessions where insightful and thought provoking, others where puzzling as to some of the project approaches adopted but equally thought provoking.

I have loads of comments and thoughts that I will blog over the next week or so. (time permitting)

I have attended the InfoSec event in the UK for at least the past 5 years as both an exhibitor and a delegate. The event seems to be on a downward spiral. After speaking to a number of people this year it would appear that the much sought after warm leads are just not materialising, this was very much my own experience. It would appear that it is starting to be the “norm”, I guess the big players must be experiencing the same issues, last year CA took the brave decision and failed to exhibit, this year neither CA or Oracle exhibited.

When the big software security houses do not see any value in the event you have to question the events viability…..

So what is wrong with it..IMHO there are a number of things, the event is too broad, well security is a massive subject I hear you say! It is but I do not think anyone with any buying power goes to InfoSec to resolve all their issues. Buyers are a lot  savvier and a lot more focussed, as and when a business need is identified they look to find a solution to resolve that issue rather than adopting a shopping cart approach.

Secondly InfoSec has become a magnet for pen and mouse mat collectors an open house event with no real vetting of the attendees, hence on the Wednesday it was packed with students stocking up on stationary.

Thirdly USP’s seem to have vanished, this year at a guess I would say 80% of vendors where claiming they had a product to assist in achieving some form of compliance, some of these may be very tenuous. Last year every ones USP seemed to be around Access and Identity Management…what’s next years USP.

On the positive side it is a good opportunity to meet up with old colleagues and friends and carry out some networking.

The conference market is extremely competitive, I firmly believe InfoSec UK will need to change over the coming years to make it a viable option for vendors to exhibit at.

Last week I attended the SunLive event in London, my main role was to support our colleagues in Wipro. Wipro had built a really powerful demonstrator showing the integration between RBACx and Sun’s IdentityManager. Unfourtunately I found the event pretty slow, the audience seemed to be more concerned about virtualisation, Java and Sun’s hardware, all intresting subjects in their own rights, just not my thing.

The one thing that caught my interest was a presentation by Drew Wagar from KPMG on the “Perils and Pitfalls of Identity Management”. The presentation was well informed honest and open, there was very little on the normal best practises around deployment. Drew adopted a refreshing approach and concentrated on the selection process, how in many cases projects are set to fail, due to poor vendor selection or lack of knowledge and lack of clearly defined requirements on the customer side.

The most salient point that Drew made (IMHO) was regarding the ITT process. He concluded that the process is fundamentally flawed, all vendors will state that their products meet all the requirements of any questions posed in an ITT.  On occasions, Drew suggested that vendors may bend the truth to receive ticks in the boxes on a scoring matrix, his comments naturally raised a few smiles. The net effect is that on paper all offerings are the same.

Drew laid out a sensible framework towards vendor selection, his presentation that outlines the approach can be found here. One of the best bits of advice offered to organisations looking for an IAM solution was to try and cut down on the ITT process, the suggestion here was to carry out a mini PoC’s with the same success criteria for each vendor, this approach would self select vendors, as those bending the truth would quickly be exposed.

From my own point of view, it was reassuring to hear one of KPMG’s advisors talking about law and regulatory compliance as a strong driver for procuring and deploying IAM, also the fact that roles, role modeling and role mining need to be considered factors in the selection criteria.  Fourtunatley Vaau have these 2 areas expertly covered within the “Identity Compliance Manager” and “Roles Manager” modules.  

In all it was a great presentation, with a bucket load of free advice from a KPMG advisor.