Skip Links

Network World

  • Social Web 
  • Email 
  • Close

The emergence of identity access management governance

IAM governance includes identity audit and role management
Security: Identity Management Alert By Dave Kearns , Network World , 10/03/2007
Kearns
Sign up for this newsletter now!

I’ve been known to lump together Aveksa, SailPoint and Securent under the banners of “entitlements” or “governance” but all three, it seems, are adamant that – far from being competitors – they are actually complementary.

I had the opportunity to speak to the three at last week’s Digital ID World conference. I’ve known (and written about) SailPoint CEO Mark McClain and President Kevin Cunningham since their days with Waveset and later, with Sun. Securent Marketing Director Howard Ting has been a frequent name in this space through his stints at RSA, Identity Engines and Microsoft. Aveksa CEO Deepak Taneja has also been in the space (and in my interviews) since his days with Netegrity. These are all nice, trustworthy people, and when they tell me they aren’t competitors I believe them.

That’s not to say that all of them agree on how best to tackle your identity management problems; each does believe that you need to start with his products and services – while admitting that there may be one or more things you’ll need to add to the mix. Still, it can be somewhat confusing to tell them apart - especially when I’ve been lumpin’ them together!

McClain tried to explain it to me: “We see ourselves as part of the emerging ‘IAM governance’ space (Gartner’s term), which includes both identity audit (Aveksa) and role management (Vaau). So we see ourselves as complementary to entitlement management players like Securent. Interestingly, Burton takes a slightly different view, adding entitlement management to identity audit and role management to create a broader category of complementary technologies called privilege and policy management. Either way, I’m pretty sure most of us in the IAM governance arena see the entitlement management players as complementary to the audit/role vendors - in fact, just another set of entitlements for us to certify/audit.”

Personally, I like Burton’s idea of “privilege and policy management,” especially as it’s based on roles as a central piece. Most of these players agree that roles and role management, if not exactly necessary for their niche, is at least a desirable service to have.

There’s still a whole lot more to come from last week’s Digital ID World, including my introduction the guy that the Burton Group’s Gerry Goebel calls “The Father of Federation.” But that’s a story for next time.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.

Download the white paper.

Unauthorized applications: Taking back control

Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?

Download the white paper.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to moderator approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed
Save The Date!
What They Are Saying

I think he should demand that at least one network engineer be on the jury. Very few other people would...- Anonymous

Join the Discussion