Burton Group Identity Blog

Oracle and Sun Clear a Big Hurdle

Blogger: Lori Rowland

Thursday the European Commission gave Oracle its unconditional approval to take over Sun Microsystems.  Oracle still awaits approval from other jurisdictions including Russia and China, but given the EU’s ruling it is likely that these approvals will be expedited. It is fair to say that the EU’s approval was the last major hurdle for Oracle to overcome before the acquisition can move forward. The EU’s prolonged approval process had cast a cloud of doubt over the acquisition, leaving Sun’s IdM customers anxious over the fate of their IdM solution. Today’s announcement is particularly good news for those customers.

The IdM community has been closely watching the developments of this acquisition. Whereas many of Sun’s products have no direct equivalents in the Oracle portfolio, there is significant overlap between the companies’ IdM products. Since Oracle announced its plans to acquire Sun in April 2009, Burton Group has been inundated with inquires from both Oracle and Sun customers wondering how to move forward with purchases, deployments, upgrades, and product choices.

Oracle remains restricted in the amount of information it can share before the acquisition closes. The company has, however, put a plan in motion to communicate its roadmap and integration strategy over the coming months.  On January 27, 2010, Oracle CEO Larry Ellison will host a webcast highlighting the combined Oracle and Sun strategy. Oracle and Sun customers can register for the webcast via this link:

http://www.oracle.com/go/?&Src=6806472&Act=22&pcode=WWMK09040443MPP007 

Once the acquisition closes Oracle will be able to provide more specific information on its planned IdM roadmap.  On January 27, we expect Oracle to lay out its combined IdM strategy and roadmap while discussing maintenance and support implications in line with Oracle’s track record in past acquisitions. Based on what we’ve seen with the BEA acquisition, Burton Group expects that representatives from Oracle will offer to meet with individual organizations to ensure that the transition is as smooth as possible. Burton Group encourages organizations that have a strong investment in Sun (or Oracle) IdM products to take advantage of such meetings to express their individual needs and concerns.
 
Although the European Commission’s approval does not mark the closure of the acquisition, it is significant progress.  The pending acquisition has had a measurable impact on the IdM market. The most obvious being the uncertainty it has left for Sun customers.  As the adage goes “it’s the not knowing that kills you.”  As Burton Group has done in the past, we encourage Sun IdM customers to remain calm – do not rush to any drastic conclusions regarding the acquisition. One thing that Oracle has consistently communicated throughout its past acquisitions is its intention to provide customers with long-term support and maintenance.  Burton Group urges customers to attend the January 27 webcast, continue to check the IdPS blog for updates, and schedule a dialogue with Burton Group analysts to discuss our perspective on a combined Oracle-Sun IdM strategy and the implications it may have in your environment. You may also visit the April, 2009 IdPS blog post where we laid out Burton Group’s perspective on the implications of the acquisition.

Gartner acquires Burton Group

Blogger: Gerry Gebel

Under normal circumstances, we are making comments on vendor merger and acquisition activity in his blog. Today, tables are turned as Gartner announced the acquisition of Burton Group this morning. Needless to say, it’s an exciting and tumultuous time for us as we become a part of the largest research and advisory firm in the industry.

Many details of the integration plan will be worked out over the next few months, but essentially the Burton Group research product that many are familiar with and rely on remains intact within the larger Gartner organization. For many years we have been saying that Burton’s research is complementary to Gartner’s offerings – obviously Gartner came to the same conclusion!

Here is a link to a note from Gartner CEO Gene Hall and you can expect more information in the near future. In the meantime, feel free to contact us with questions or comments

ActivIdentity acquires CoreStreet

Blogger: Mark Diodati

You may have seen that ActivIdentity Corporation will acquire CoreStreet Ltd. Since its de-emphasis of its enterprise single sign-on business (primarily the result of the Protocom acquisition in 2005), ActivIdentity has focused on strong authentication. While ActivIdentity has one-time password solutions, its technological crown jewels are its smart card offerings. Its smart card management system and smart card middleware products have a significant footprint in the US Federal Government.

CoreStreet’s products complement ActivIdentity’s smart card solution. CoreStreet provides a PKI certificate validation solution, which is arguably a requirement for large-scale smart card deployments. CoreStreet also has a handheld device that enables the authentication of Federal agency personal via their PIV smart cards. The device is handy in scenarios where emergency first responders arrive at a disaster site. Finally, CoreStreet offers a solution which enables the PIV card to be used in an unmodified physical access control systems (PACS). It is pure conjecture on my part, but I am guessing that the solution involves hashing or truncating the PIV card’s Card Holder Unique Identifier (CHUID) to make it compatible with Wiegand-based PACS. CoreStreet’s products are aligned with the Federal Government smart card market, which co-incidentally is ActivIdentity’s primary focus. The certificate validation solution is appropriate for large smart card deployments in the enterprise, too.

Overall, the acquisition is a good move for ActivIdentity; it will enable ActivIdentity to market a broader smart card solution to the Federal Government. For customers of both companies, the acquisition provides a single vendor relationship. For more information on PACS and Federal Government smart card initiatives, please see our research documents “Let’s Get Logical: The Convergence of Physical Access Control and Identity Systems” and "U.S. Federal Authentication Programs Making Progress, but Much Work Remains" (subscription required).

Microsoft acquires Sentillion

Blogger: Lori Rowland

Today Microsoft announced its plans to acquire Sentillion, Inc., a privately held identity management (IdM) company based in Andover, Massachusetts. Sentillion is exclusively focused on offering identity and access management products for the healthcare industry. Its portfolio of products includes single sign-on, provisioning, context management, advance authentication, and desktop virtualization capabilities. Sentillion is well known for its single sign-on (SSO) and clinical workstation solutions. Through these solutions Sentillion enables various activities including SSO to common health care applications, proximity based authentication, advanced audit capabilities, and streamlined workflow processes. 
According to the announcement, the Sentillion portfolio will be combined with Microsoft Amalga Unified Intelligence System (UIS), a data unification tool that allows health care professionals to aggregate data across multiple patient records.  These products are a component of Microsoft’s growing Health Solutions Group. This move is no surprise as investments in healthcare technologies are expected to grow particularly given that the US recently passed a $38 billion bill designed to make it easier for hospitals to invest in technology. 

The acquisition of Sentillion was initiated through Microsoft’s Health Solutions Group. That said, it may have wider reaching implications on Microsoft’s overall IdM strategy. Microsoft’s IdM portfolio has been lacking an enterprise single sign-on (eSSO) solution; Microsoft has relied on partners for this capability. Obviously with the acquisition of Sentillion, the Microsoft IdM product group may have an opportunity to utilize the capabilities provided by Sentillion’s SSO products. But, Sentillion has designed its products specifically for the healthcare industry and they may be lacking some of the functionality required by enterprise organizations. 

Although Sentillion brings some unique IdM functionality, there is some duplication between Sentillion’s provisioning solution and Microsoft Forefront Identity Manager.  It is not likely that provisioning was the primary focus of this acquisition, but it will be interesting to see what Microsoft does with Sentillion’s provisioning technologies. While Sentillion’s ability to integrate with AD and Microsoft’s identity infrastructure was probably a consideration by the Microsoft Health Solutions Group that sponsored this acquisition, there is no indication (as of yet) from Microsoft that any of the identity technologies offered by Sentillion will be added to the general identity and security portfolio for use outside of the healthcare vertical. Rather, it appears that this solution will be optimized for the healthcare vertical and may not fully leverage the more general provisioning and claims-based access control features available from Microsoft Forefront solutions.

The acquisition of Sentillion is a positive move for the Microsoft Health Solutions Group and may present an opportunity for the Microsoft IdM group. In the short term it does not appear that the acquisition will have an impact on the Microsoft Forefront Identity products, but it remains to be seen what impact it will have on Microsoft’s longer term plans. The company does run the risk of running two separate, but related, IdM strategies if the Microsoft Health Solutions Group continues to develop out its IdM capabilities without coordinating its efforts with the IdM development group. As the acquisition closes, the company must develop a unified IdM solution and message. 

Oracle Acquires Sun: The IdM Perspective

Blogger: Mark Diodati

At a macro level, the acquisition puts Oracle in the hardware business. Many organizations running the Oracle Database run it on the Solaris operating system and Sun hardware. This is a "peanut butter and jelly" combination, and it continues to be popular since its introduction over 15 years ago. Sun’s MySQL product will bolster the Oracle Database business, as the product serves a different audience at a different price point than Oracle 11g. The Sun acquisition also puts Oracle in the operating system business for real (though Oracle has offered a flavor of Linux for several years).

From an IdM perspective, there is significant overlap in the provisioning, web access management, and federation product classes. It will take some time before Oracle even announces their plans plus more time to enact the migration plan. Both companies OEM their enterprise SSO offerings from other vendors, so completing the enterprise SSO roadmap should be relatively trivial. Oracle has a strong fine-grained authorization product, the result of its acquisition of BEA in early 2008.

My colleague Ian Glazer notes that both Oracle and Sun have role management products and their functionality is not wholly redundant. Oracle may have the opportunity to build a better, more complete offering.

Sun brings its very popular LDAP-based Java System Directory Server to the table. Oracle also has an LDAP directory server (Oracle Identity Directory), which is frequently deployed to manage users and roles in Oracle Database and application deployments. There is overlap between these two products, and Oracle will need to choose between two very widely deployed directories. Oracle also has a virtual directory product as a result of its 2005 acquisition of OctetString; Sun has no virtual directory capabilities to speak of. Virtual directories are becoming more valuable as organizations tackle identity management projects. From a sales perspective, Oracle's possession of both directory server and virtual directory technologies provides a significant advantage over its IdM competitors.

My colleague Bob Blakley points out that if Oracle wants to keep any of the Sun IdM assets (which is by no means a sure thing), it will have to modify the products to conform to the Fusion Middleware architecture; customers should expect Oracle to make decisions regarding IdM portfolio overlap more on the basis of business considerations than on the technical merits of the products.  In any event, Oracle is very likely to place a higher priority on Sun products outside of the IdM suite.

In light of all this, customers currently selecting an IdM vendor who are seriously considering Sun should not panic, but they should speak both to Sun and to Oracle about the potential costs of an IdM migration two to three years out in the event of a completed acquisition.  Oracle will not be able to make any forward-looking statements until the acquisition is complete, but the customer discussion with Oracle puts the company on notice that the future of the Sun IdM suite is of interest to the customers it brings on board.  Sun customers should seek and Sun may be able to provide contract terms which reduce both future migration costs and risks for customers who are purchasing Sun IdM products during a period of uncertainty. Going forward, all customers must hold Oracle accountable to its service level agreements as there is great opportunity for customer dissatisfaction during this transition period.

In summary, Oracle’s acquires highly complementary hardware and operating system products. From an IdM perspective, the acquisition will bring some roadmap turmoil for the provisioning, web access management, and federation product classes. Oracle’s directory services portfolio (both directory server and virtual directory server) looks very strong, with no competitor coming close to the same capabilities and market share. Add the XACML-based, finer grained authorization capabilities provided by the BEA acquisition, and Oracle has significant coverage in IdM products. Strong synergies exist between IdM and ERP products, and Oracle has both.

For Oracle to be successful, it must improve its product integration and enhancement efforts, which have not been optimal with its prior IdM acquisitions. With this acquisition, Oracle is not just adding one more IdM product to the mix, but an entire suite. My colleague Gerry Gebel has commented that Oracle – and customers - will be in better shape in 2-3 years, after the acquisition dust settles. In the interim, there is great opportunity for aggressive competitors to take advantage of the situation and Oracle must be prepared to defend its turf.

CA's Acquisition of IDFocus

Blogger: Ian Glazer

Yesterday CA announced its acquisition of IDFocus,  a small Israeli company.  Among other abilities, IDFocus provides a finer-grained segregation of duty (SoD) analysis engine.  CA has previously integrated this engine into Identity Manager, their user provisioning tool.

This is an interesting wrinkle in an ever-changing market.  CA now possesses a preventive-controls engine with the ability to look further into the security stack of an application.  This engine allows customers to make SoD decisions below the role or group level, at the lower ACL/security object levels.  Provisioning vendors have until now done this by calling external services provided by Enterprise Application Controls Management (EACM) vendors.

On one hand, CA has partially obviated the need to integrate with an SAP, Oracle, or Approva by integrating the IDFocus capabilities into CA Identity Manager.  On the other hand, CA’s move may have made things more confusing for customers.  By increasing the number of controls repositories that a customer has to maintain, integration of IDFocus makes compliant provisioning deployments more challenging.  What would be really slick is if CA could find a way to work with the EACM vendors to synchronize SOD tests so that a customer could use the same test for both detective and preventive applications.

I was speaking on this very topic in Europe last week.  I commented on the various architectures for integrating EACM into user provisioning to provide compliant provisioning services.  (For more on this subject, check out Lori’s report on the matter.)  CA has now introduced a fourth deployment model in which the provisioning engine owns the entire compliant provisioning event from the request through the SoD test to the provisioning event itself. An interesting alternative. I’ll be curious to see where CA takes this.

Hitachi! Who knew?

Blogger: Lori Rowland

Using the 2008 RSA conference as its platform, Hitachi announced the acquisition of majority shares in M-Tech. The new formed company will operate under the name Hitachi ID Systems and be rolled into Hitachi’s information security portfolio. Hitachi ID Systems will operate as a subsidiary of the Hitachi parent company.

M-Tech, headquarter in Calgary, Alberta Canada has been a long standing vendor in the IdM market. The company’s product profile includes provisioning, password management, privileged account user, AD group management, and various other IdM technologies. M-Tech is best known for P-Synch, its password management offering, but has also faired well in the provisioning market.

While Hitachi is well known in North America, it is a powerhouse in Asian markets. Hitachi sells various consumer products (e.g. electronics and power tools), but also offers hardware and software components for enterprise organizations. Hitachi has a heavy presence within Asian enterprise organizations. The Asian market has been slower to adopt IdM technologies, however it is gaining traction primarily because of the enactment of laws and regulations, such as Japan’s Financial Instruments and Exchange Law (J-SOX). Hitachi ID Systems may have “a foot in the door” with Hitachi’s existing customer base.

Another interesting characteristic of the acquisition is that Hitachi ID Systems will operate as a subsidiary. According to M-Tech founders Gideon Shoham, CEO and Idan Shoham, CTO, M-Tech had been approached by other vendors in the market and had turned down acquisition offers. What made the Hitachi offer stand out? As a subsidiary, M-Tech founders will maintain control over technology direction and day-to-day operations, the M-Tech employee base will remain intact, and the impact on M-Tech’s existing customers will be minimal.

M-Tech realized several other benefits to the acquisition. As the IdM market has become increasingly competitive it was difficult for M-Tech to compete against large, major brand vendors. The acquisition gives M-Tech (now Hitachi ID Systems) access to a global sales team and a large information security consulting team which will be trained on the Hitachi ID Systems product family. Most importantly it gives M-Tech global name recognition.

The attitude of this acquisition seems somewhat different than acquisitions we have seen in the past. While the benefits of the acquisition to M-Tech are obvious, Hitachi’s (the parent company) overall vision for the IdM it is not yet clear. The company does offer various security technologies such as RFID and vein pattern recognition biometrics. However, how and if these technologies will be integrated with M-Tech’s product family has not yet been defined.

Hitachi’s acquisition of M-Tech will no doubt leave some in the market scratching their heads in wonderment.  It is too early to tell the full impact of the acquisition. However, one thing is clear, M-Tech needed the backing and sales channel of a larger vendor to progress in the market. However the battle is yet to be won. This is an unpredictable market; customers are concerned with vendor viability and longevity. The long-term relationship between vendor and customer has become a differentiating factor for many IdM purchases. To be successful, Hitachi ID Systems must quickly communicate a clear vision and an aggressive strategy. Although Hitachi is a recognized name – they are competing with large vendors such as IBM, Oracle, and Microsoft all of whom have already established themselves as powerhouses in the IdM market.

This acquisition proves that the IdM market is full of surprises – never a dull moment. There is still ample opportunity for acquisitions. Acquisition activity will likely continue in the role management, entitlement management, and authorization spaces.  However, even the more mature markets like the provisioning market may see continued activity – as evident by the M-Tech acquisition.

Why Enterprise Single Sign-On (E-SSO) is More Than Just a Tactical Add-on

Blogger: Phil Schacter

Today’s announcement of IBM’s acquisition of Encentuate, primarily positioned as a supplier of enterprise SSO technology, is a significant milestone in the maturing of the market for E-SSO. Two years ago E-SSO was viewed as a standalone product that was somewhat complementary to the deployment of stronger authentication and a convenient way to support legacy applications with internal logic that prompted for login credentials, typically a user id and a simple password.

Most identity and access management vendors were content to license or resell technology obtained from smaller specialist firms. IBM, Oracle and Sun partnered with Passlogix, while Novell works with ActivIdentity and Quest with Evidian. CA has its own E-SSO offering stemming from an earlier acquisition of Platinum/Memco.

However, the identity and access management vendors discovered that E-SSO was both a market accelerator and offered some important features of interest to customers with regulatory compliance requirements. E-SSO has a shorter sales cycle (typically six months or less) and is able to deploy more rapidly (one to three months depending on the complexity of the environment). Cost for E-SSO varies but many deals are less than $100K, which is easier on the IT budget than most user provisioning software and service projects. Customers could start with E-SSO and then over time add user provisioning, web SSO, federated SSO, and other components of the identity management suites. E-SSO technology also can provide an audit trail of user sessions and any interactions with applications accessed through the E-SSO system.

So who wins in the IBM deal to acquire Encentuate? First, it’s a big win for Encentuate’s 80 plus customers that can look forward to continued support and a more aggressive product roadmap funded by a premier vendor. Although no financial numbers were shared the deal provides an exit strategy for investors that poured about $24M into Encentuate over the years. The 160 plus customers of IBM’s TAM ESSO v6 will have support from IBM for three years from v6’s general availability date of February 2007. They also will have to choose between continuing to use ESSO v6, and transitioning to become a direct Passlogix customer, or migrating to IBM’s new v7 offering, based on the technology acquired from Encentuate. TAM ESSO v7 is expected to be available in Q3 2008 and will include planned enhancements to Encentuate’s product plus address IBM’s integration requirements.

IBM also plans to build on the engineering talent obtained as a part of this acquisition to build out a Security Software Lab in Singapore for more than just the E-SSO and former Encentuate product lines. This area offers high quality engineering talent and a more efficient operational infrastructure and cost than labs based in some other regions. Another key reason for IBM’s shift to a new technology provider is that Encentuate builds on a J2EE foundation, as do most other Tivoli product offerings.

Another interesting question is what is the impact of the IBM deal on their former partner, Passlogix? Clearly IBM will try hard to convince existing customers that they should migrate to TAM ESSO v7, but any migration is hard and it’s not clear who will fund the professional service cost of doing so. Passlogix expects to derive significant ongoing maintenance revenue from a portion of IBM’s 160 customers, and that this revenue stream will more than offset any lost OEM royalties. There is also the question of what happens to the healthy pipeline for ESSO v6 and whether Passlogix can convert any of these prospects into direct customers. Overall Passlogix is prospering in a strong market for E-SSO and related offerings, and indicates that no one source contributes more than a sixth of overall business revenue.

One final observation about the impact of this deal is that it’s likely to start one final wave of consolidation, with Oracle and Sun considering the business risk of the other acquiring Passlogix first. Another acquisition that should probably happen is for Novell to buy ActivIdentity. Novell already provides the channel for 80% of ActivIdentity’s business, so why not bring this important function inhouse?