Identity management to the fore at Infosec

Security experts advise firms to take a structured and prioritised approach to identity and access management solutions

Many identity and access management (IAM) solutions are overly complex and costly to implement, and firms must take a clearly structured and prioritised approach if they are to gain value from such technology, according to security experts speaking at Infosecurity Europe.

Andrew Kellett of analyst firm Butler Group told a keynote audience that identity and access management solutions often suffer from being “resource hungry, run for too long, and often fail to fulfil the objectives of the organisation”.

“Identity management shouldn’t be about huge projects taking years to implement,” Kellett added. “Organisations should do their homework up front to see where they’ll get the most benefit – whether it’s single sign-on or federation, for example.”

But others maintained IAM solutions remain very popular. Stuart Okin of consultancy Accenture told IT Week that he is seeing “an increase in pace around identity management solutions” driven by the need to federate with partner organisations, outsourcers and other third parties.

“It’s increasing year-on-year, forcing companies to do two things,” Okin added. “They're segmenting their flat network infrastructure and web-enabling or SOA-ing their applications so they are able to federate with partners better.”

Some vendors were quick to point out that they had been listening to customers. "We recognised the complexity and cost [in the industry]," said Mike Smart of Secure Computing. "We created a new offering using existing technology and simplified it in terms of the way you manage and buy it – we recognised that simplicity is best."

Meanwhile, keystroke biometrics specialist BioPassword has officially launched in Europe with a new version of its Enterprise Edition software featuring optimisations for Windows Active Directory and Citrix environments.

The software, which recognises users according to their unique typing rhythm, now also allows firms to authenticate users via a selected question and answer format in the event that they are denied access because their typing style has changed, according to the firm’s Jarod Pfost.