Don’t you know that December is a great time to blog? There are end of year reviews, predictions for the next year, holiday hubub – this stuff nearly writes itself. Speaking of which, Earl Perkins at Gartner put up an interesting question the other week that prompted some soul-searching. He wants to know what identity access management companies (we’ll call them IAMs for short) think about.
He proposes, based on extensive knowledge of the market, that most IAMs are focused on one of two things – either purely securing access to data, or on the other hand, understanding all aspects of the access event. I think we’ve got something a little different going on here.
When I walk through the office the buzz I hear from my colleagues takes on three very distinct tones.
- Usability. Yes, real security is why we’re in business. But perceived security is what sells solutions and makes them popular. If our clients’ customers are happy with what they see and how user-friendly it is, we’ll succeed. Of course, that assumes that we do a rock-on stellar job of actual security, but hey, in my office that’s a non-issue. What we’ve got rocks the house.
- Staying ahead. We can stop man-in-the-browser attacks. We have a handle on phishing, in all its many varieties. Key-logging – done. Password-stealing malware? Bam! Take that! (as Batman would say). But what’s next? What are the criminals working on next, and how can we beat them to the punch? For us, it isn’t enough to protect our clients from today’s problems. We want to protect them from tomorrow’s too.
Your gramma, or Gram, as we like to call her. Can she use our product? Can she do it easily? Can someone trick her into using it to divulge sensitive information? Does this protect Gram? Does it do it in a way that will leave her satisfied at the end of her transaction, looking forward to her next online interaction? See, knowing that Joe Techie can use our system means nothing to us. He can do all sort of things online, and if he has issues he knows where to go for help. We want to make sure Gram is taken care of, happy with her interaction, and ready to tell all her friends that she doesn’t know what all this hullabaloo is about – her bank (or favorite online store) is easy to use and entirely worthy of her trust.
That’s what we talk about in our office. Well, that and the new curry place down the street. They’ve got a mean Tikki Masala. Ok, fine. So we also talk about which fair trade coffee we’re going drink this afternoon and who’s going to the cricket match this weekend. But that’s just us.
Good blog. I like it when others see things that I either don’t see or don’t write about. Without attempting to critique your response, my attempt at talking about IAM was from the eyes of (a) the vendors and (b) those that have to make IAM work for those who use it. I did not look at it from the context of the user itself– you’re absolutely right that it brings other important needs to mind. In fact, I had written that a lot of users care about 1- user experience, 2- reporting ability, 3- ‘works well with others’ functions, i.e. the best IAM is the IAM you don’t see, and 4- fits the natural workflow of the business (all this in the research note “Comparing IAM Suites”). If I look at what you wrote here, that has some parallels.
This is why they’re called musings, rather than hard facts. That’s the nice thing about blogs– we can see something similar in more than one way. Maybe there should be a “Musings Part 2” to capture your concerns accurately, but I need not worry about that now that you have done so. :-/.
Merry Christmas
earl