Enterprise-Class SaaS Provisioning

I happened across this white paper - Enterprise-Class SaaS Provisioning - over at Conformity's website. The first paragraph of the executive summary caught my attention:

User provisioning provides the foundation for effective lifecycle management of user identity and access rights in complex IT environments. Historically, enterprises have addressed this critical need through a combination of business process and integration of premise-based applications with management tools. These tools have included local directory services, identity services and user provisioning and role management solutions. The recent rapid adoption of SaaS and cloud-based applications is now significantly straining the on-premise capabilities of existing IT models and approaches.

I think there are lots of executives and IT staff who are running around thinking that SaaS is the promised land. If you consider an SaaS application as "just another application" you will understand that your end-user identities still must be managed in that SaaS application. How are you going to provision, de-provision and update those identities? How are you going to manage the namespace of your corporate identities and the namespace of your SaaS application's identities? (Don't make me break out the Venn diagrams!)

We have a standard called "Services Provisioning Markup Language" (SPML) which was specified to help provision identities via a web service. Does your SaaS vendor support that standard? I'll bet they do not! What do you do then? I've met with hundreds of customers over the years and many are still struggling with provisioning inside the enterprise! Throw in SaaS provisioning - via some hairbrained interface because the vendor doesn't support SPML - and it only adds to the organization's identity management complexity.

Don't get me wrong. There's lots of promise with SaaS. Unfortunately, the road to the SaaS promised land passes through a few mine fields on the way...

Technorati Tags:
SaaS, SPML, Conformity, identity management, cloud computing

Catalyst Conference Discounts and Free Passes

Are you thinking about going to this conference? If you are let me help push you over the edge!

Here's how you can get free passes to the hospitality suites (only) here:

Go to: https://burtongroup.wingateweb.com/us09/portal/newreg.ww
Use code: queqp2cg

Or, discounted rates to attend the conference here:

Go to: https://burtongroup.wingateweb.com/us09/portal/newreg.ww
Use code: queFriend

This really is the best technical identity management conference out there so if you can only get to one then this is it!

Technorati Tags:
Catalyst, Burton Group, QSFT, Quest Software

Quest wins Active Directory Partner of the Year!

Yes, we did! Congrats to everyone at Quest! Here's what Microsoft posted on the Worldwide Partner Conference 2009 awards page:

Quest Software offers a suite of solutions that enables migration to Active Directory service from competing platforms, and delivers directory consolidation by extending Active Directory into heterogeneous IT environments. The suite also provides compliance by compiling an audit of system access events and secure dual-factor authentication through one-time password tokens, and creates a single sign-on solution using Active Directory. Quest implemented its solution, replacing a competing platform, to deliver dual-factor authentication of remote users at a lower cost and with zero impact to users. Seamless collaboration across Quest, Microsoft, and a key systems integrator partner enabled the Active Directory migration to be completed quickly and with no system downtime. Quest Software solutions have enhanced thousands of enterprise Active Directory environments, including Dell, Movado, Siemens, ADT, and Shell.

Finalist: Centrify, United States

Finalist: Likewise Software, United States

Update: More from Microsoft here.

Technorati Tags:
Quest Software, Active Directory, two-factor authentication, security, SSO, QSFT

Trusted Cloud Computing

In Infrastructure as a Service (IaaS) cloud services such as Amazon’s EC2, the provider hosts virtual machines (VMs) on behalf of its customers, who can do arbitrary computations. In these systems, anyone with privileged access to the host can read or manipulate a customer’s data. Consequently, customers cannot protect their VMs on their own.

I read two papers on this topic over the last few days and I invite you to take a look at them. If you are short of time at least try to read "Towards Trusted Cloud Computing". This paper gives a good overview of how cloud computing services "have no means of verifying the confidentiality and integrity of their data and computation". This paper helped me to understand some of the core security issues around cloud computing.

One of the references in this paper was to Terra - a trusted platform that enforces a closed box execution environment. While Terra is an academic study, out of Stanford, it does lay the ground work for a better architecture that could be used to secure and protect virtual machines. It's interesting follow-on reading if you're into a more academic discussion of the problem and their proposed solution. I love how they built "Trusted Quake" - yes, that Quake!

Ultimately, I don't know how many customer will care or won't care about security to this level of depth. My suspicion is customers will try to cover their bases via legal agreements versus computational security as discussed in the two papers above. Either way, it is a good idea to get educated on these topics. Also, it is interesting to me that we still have a long way to go yet around trusted computing hardware (and software).

Technorati Tags:
cloud computing