Today's recessionary pressures have accelerated the outsourcing trend among financial and health care institutions, including credit unions. They figure it's better to hire someone who knows how to handle things like identity and access management (IAM) so they can concentrate on what they do best.
That's why more security and risk professionals in these industries, along with others in government, education and retail, are choosing hosted identity providers for the crucial operations involved in IAM, according to a new Forrester Research report.
In the report, analyst Andras Cser said these industries are leading the charge to outsource management of complex business processes and large volumes of data such as credit card numbers and other such financial information and health records.
"With the current economic downturn, many organizations are looking for ways to reduce the costs of their security operations and are looking at outsourcing to achieve this objective," Cser said in his report.
The hosted IAM market has exploded during the past year, the think firm said. Forrester estimated the hosted IAM market's annual revenues for 2008 were $95 million, a 130% growth from 2007.
Forrester investigated the IAM business by interviewing 13 vendor and user companies and found that organizations are struggling with the cost, complexity and long implementation times of current IAM solutions, but that hosted IAMs are helping solve these problems by offering a menu of options for companies to purchase and use as needed.
Rather than shell out a half million dollars or more in implementing just the first phase of an IAM project, companies can streamline the process-creating quicker, leaner, more affordable solutions-by working with an outside IAM provider, Cser said.
He said research shows that can be 30% to 40 % less expensive than creating the same functions in-house and that the service is maturing as an outsourced choice.
"Identity and access management projects have long been plagued with their long implementation times, high services-to-license ratios, integration challenges, labor-intensive build-out and operations, and long wait times to produce compliance and end-user benefits," Cser said in his report, titled "Hosted Identity Is Real: Are You Ready for It?"
"The recent emergence of the hosted IAM market alleviates these concerns by offering managed services that deliver clear benefits of 'instant' compliance, reduced IAM operational and staffing costs, and pay-as-you-go, operational-expense pricing models," Cser said.
Forrester expects the share of revenue from these services to grow by 80% to 90% over the next year, driven by expansion in the health care and financial services verticals.
IAM projects resist simple solutions, the Forrester report said. Most IT professionals working on these projects in-house said preventing loss of information and data assets is one of their top concerns.
Careful handling of access to data and precise compliance with auditors' requirements for information about who has access to these data can take many hours of administrators' time, often pulling them away from core tasks, the report added.
More time still must be given to guarding and updating appropriate access rights to data within the organization and, when applicable, from outside users.
Another problem is that in-house systems demand dedicated positions to run the services. With the full scale of IAM operations designed and contained in-house, an organization may have to use three to four full-time employees to operate the system.
Given these complications and expenses, it's hard to justify the bottom line in investing in IAM infrastructure in-house, Cser said.
Business managers want a hard look at the bottom line, and the more an organization can plan and incorporate business functions with IT security, the more unified the functions will be and the more money they are likely to save by outsourcing IAM projects, he said.
Forrester interviewed vendors providing a range of IAM solutions. "Vendors have started to offer these services as part of their portfolios, and annual revenues for the hosted identity market in 2008 were $95 million," Cser said. He predicted that the share of revenue generated from these services will grow by 80% to 90% over the next year.
Services include password management, remote-network access, federated access management, approval processes for requests to access data, workflow-based interfaces for approval application processes, federated identity management, password reset, privileged account management, remote access from PDAs, cross-domain provisioning, hosted access recertification, user provisioning and compliance standards support.
This growth in the market for IAM providers is in direct response to demand from organizations not equipped to handle crucial business and data management functions and hesitant to invest big bucks to invent, implement and maintain an IAM system. In many cases, IAM providers can do this quickly and efficiently using prebuilt templates and systems developed previously and sold piecemeal to meet specific needs of clients, the Forrester report said.
Organizations can pick and choose from several types of hosted IAM, depending on their needs, thus paying only for those necessary functions.
"Hosted IAM, or IAM as a software-as-a-service (SaaS), comes in three distinct flavors," Cser said in his report. Organizations can select one of three capabilities (or some mix of these three): managing identities for business SaaS applications, managing the company's identity life-cycle process and authentication for internal applications, and providing a trust network between parties.
–[email protected]