A snowy mountain with a sunset touching the peaks.

IAMTEAM recently attended the Gartner IAM Summit. From an IAM professional’s point of view, this is the most comprehensive Identity and Access Management conference currently available. It provides both IAM providers and consumers with information on the current state of IAM, best practices and the trends to be expected for future years to come. It gathers professionals from RSA and other IAM leaders for a comprehensive look at IAM right now and for the future.

Members attending a presentation at the Gartner IAM Summit.

As an attendee, it was well worth taking the time from our busy schedule as we were able to get more of a feel for how IAM is fairing outside of the project implementations and day to day operations we usually immerse ourselves in. It’s always good to know what everyone else is up to especially within the IT Community.

As this is Gartner, the biggest take away we can always expect to get is with the Gartner Magic Quadrants. It describes, the Leaders, Challenges, Niche Players and Visionaries with specific fields and provides a wide view of where the leaders lie in the market. It’s always interesting to see who the big players are (and who remain) and who are up and coming in the world of IAM. The list of Magic Quadrants offered by Gartner can be seen here.

There were also a lot of talks provided by IAM professionals from RSA and other companies that provided some insights into where IAM is and where it is going 5-10 years from now. A few key takeaways I had from the 2013 Gartner IAM Summit were regarding the Cloud and the trend towards Attribute Based Access Control and away from the more common Role Based Access Control.

The most dominant conversation amongst IT related conferences is the Cloud. More and more companies are gearing more towards the Cloud as it presents customers with a solution that is both cost-effective and efficient. Customers would only need to connect to the Cloud and they can already consume the residing services without any installations and configurations that the usual on premise deployment would require. Of course, there are still apprehensions. Security is the main concern as everything would no longer be segregated by a company’s own private network but would be up there in the Cloud. For Cloud technologies to be successful, a safe and reliable authentication and authorization mechanism needs to be put in place for customers to be able to securely connect to their Cloud provider. There were thoughts on different standards being implemented but SAML 2.0 would look to still be the common standard for signing on to the Cloud.

Another interesting topic was the move away from Role Based Access Control (RBAC) to more risk evaluated Attribute Based Access Control (ABAC). In this paradigm, instead of determining access through roles/groups, users would be authenticated and authorized using the attributes they possess. This can be through the IP they are using or where they are accessing the network from, the versions of their operating system or internet browsers to specific attributes they themselves must possess in their user identity. To make this work, there has to be a powerful engine supporting the risk assessment. The engine must have the flexibility to use some predetermined best practice rules and newly defined access rules to determine a person’s access. In theory, this engine should be able to automatically calculate and assess a user’s risk profile from these rules and decide if it will let the user get in or not. However from surveying the current products, it looks like we are not just there yet. The current engines available seem to be at their infancy as there are not too many predefined best practice rules in place to help a company kick start their access control. It looks like more data needs to be gathered in order to determine what these rules should be (aka trial and error). Maybe next year we’ll see more sophisticated risk analysis engines.

In all, the Gartner IAM Summit 2013 was an informative and insightful meeting of IAM professionals that I think would be invaluable to any IT/IAM professional looking to solve some current problems or look for solutions to prevent future problems from happening. As for next year’s conference, I am excited to see if the trends they predicted for the Cloud and Attribute Based Access Control would actually come to fruition.

Cloud IAM and the Shift from Role-Based Access

Services

Solutions

Pricing

Resources

Events

About Us

Get Started