CA continues to round out their security portfolio

Lots of interesting things happened last week in the information security space. This was largely due to the RSA Conference and the number of company announcements that coincide with it each year. Of course, Oracle stole much of the thunder by announcing their acquisition of Sun Microsystems. I've chosen not to comment on it because there's enough speculation out there (some informed, some less so). Also, I would have sounded like a broken record because any analysis on my part would have sounded very similar to my piece on the potential IBM and Sun deal that eventually fell through, but with an Oracle spin.

From a large Identity and Access Management (IAM) vendor standpoint, the most interesting piece of news actually came from CA. In fact, the only bit of IAM vendor news came from CA because the others didn't announce anything at all (I don't count "what the heck is going to happen to the Sun IAM stack" as news because at this point it's all speculation and is very much dependent on what Mr Ellison and his cohorts decide to do once the deal closes and the dust has settled).

I've written about how CA has been running faster than their competitors since late last year and they haven't stopped if the latest announcements are anything to go by. They actually made 3 announcements around RSA; the first was a pointer to Dave Hansen's (Corporate Senior Vice President and General Manager of CA’s Security Management business unit) keynote at RSA (the video of the keynote is here), the second I'll talk about in the next paragraph and the third related to a survey conducted by CA which Dave also referenced in his keynote.

The second announcement was the most interesting as it involved news around their portfolio, where they announced 3 new products:

• Enterprise Log Manager - a brand new, internally developed product
  
• Role & Compliance Manager - from their acquisition of Eurekify
  
• DLP - from their acquisition of Orchestria
  

Note: The DLP acronym generally stands for Data Leakage/Loss Prevention

I spoke to Dave Arbeitel (Vice President of Product Management for the Security Management Business Unit) about the new products late last week and got to find out a little bit more.

I hadn't actually noticed this but Dave pointed out that CA's approach to security management is now solution-focused and grouped as follows:

• Data & Resource Protection
• Identity Lifecycle Management
• Secure Web Business Enablement
• Security Information Management
  

The large IAM vendors are split between being product-focused and solution-focused and the approach taken is very much dependent on the overall company strategy. One thing I should note is that being solution-focused is fine as long as you don't get too smart for your own good and confuse customers (as I've accused IBM of doing on occasion).

Each of the 3 new products fits into one of the solution categories. My interpretation of the solution areas is that CA seems to have grouped what they deem to be the most complementary products together. The most interesting thing to note is that they've grouped CA Access Control together with CA DLP. This makes sense and is evidence that CA gets DLP and are starting to implement a strategy around how IAM and DLP can work together effectively. I'm not saying they get it completely yet, but this is not necessarily a bad thing. The industry as a whole doesn't quite understand the IAM/DLP/Data Security overlap at the moment. At least CA are trying to work it out by putting their money where their mouth is. But I'd caution them against putting too much of a marketing spin on things because people (like me) will call them out when required.

They key thing Dave wanted to get across was that CA has a broader security management strategy and these product announcements are simply steps along the execution path. This has been apparent to those of us following the market over the past couple of months and if CA keeps going, they're going to do just fine as long as they execute well.

I didn't get too much into product features of the Role & Compliance Manager and DLP products with Dave because Eurekify and Orchestria had relatively mature products. There wasn't much point in trying to pick those products apart. The only noteworthy change was that CA combined Eurekify's products into the single product (for those that are unaware, Eurekify had a separate compliance management product that integrated with their role management product). Dave also noted that the new products were not just a re-brand. CA's done additional development work to add functionality and integration points into the existing CA IAM suite.

While we're on the point of integration into the existing IAM suite, I'd like to pinpoint the supposed deep integration and "identity-awareness" of the DLP product. I had a chuckle watching Dave's keynote (and it wasn't from watching the almost cringe-worthy parody of "The Office"). During the demo, they supposedly showed identity management and data security integration. For anyone who hadn't seen a DLP product in action, it looked pretty slick/impressive.

As someone who has demonstrated a DLP product hundreds of times (maybe even thousands - I lost count after a few months) I can tell you that most of the demo only showed the DLP product in action. The solitary identity bit was the de-provisioning of the user (Dave) from a role (which took away access to the SAP application in the demo). Apart from the fact that CA Identity Manager probably has a standard connector into CA DLP to provision and de-provision access for users, they weren't doing anything in the demo that anyone else couldn't do by taking a decent provisioning product and building a connector into a good DLP product. Unfortunately CA, this isn't what I'd call identity-aware-DLP. I realise I may be dismissing other potentially (but unknown to me) nice integration points between DLP and CA's Identity and Access Management suite but I'm going based on the demo and calling it as I see it.

I did try to dig a little deeper into Enterprise Log Manager's features however, mainly because it's brand-spanking new. The only problem with Security Information and Event Management (SIEM) products is that you can't really get a handle on how good a product is until you get your hands on it. Dave assured me that installation is a breeze and that it can even be deployed as a virtual appliance, which I have no reason to doubt. From a technical standpoint, this is not difficult to achieve.

Good SIEM products tend to be measured by the ease of integration, number of standard collectors to other systems and reporting capabilities. The questions I asked Dave were driven by these factors and I gathered that Enterprise Log Manager is still very much a 1.0 product (that is, fairly immature). As an example, Dave mentioned that the product was tightly coupled with their IAM solutions. CA is probably referring to the fact that they can reference policies defined in some of their IAM products (although I'm not sure how deep or wide this integration runs) and have Enterprise Log Manager report on policy violations. But from a customer standpoint, I would expect that this also means I can point Enterprise Log Manager at any CA IAM product and have it be able to collect all relevant user events and report on them without much effort. Unfortunately, this is not the case (I'm sure CA will correct me if I misinterpreted Dave's comments). There needs to be some level of work done to have collectors that can pull information out of the other CA IAM products.

This is not to say there aren't any standard collectors, but I got the impression that this covers the main operating systems and some standard security devices but not much else. The thing about a lack of collectors however, is that the issue fixes itself over time because the more a product is deployed, the longer the list of standard collectors gets. CA needs to build standard collectors for their other IAM products sooner rather than later (I would start with Access Manager, Access Control and DLP). You cannot claim to have tight integration with your own suite of products if you don't at least have these products sorted.

The reporting capabilities seem to be a little more fleshed out. The vision for reporting is that customers use a combination of standard reports, services and new report packs that CA sends out from time to time. The list of standard reports includes many of the usual regulatory suspects, but in my experience these types of standard reports tend to need customisation to meet business needs. For customers that don't feel like using the standard reporting interface, there is a level of integration with SAP BusinessObjects Crystal Reports.

I'm not trying to belittle CA's SIEM efforts. They obviously see SIEM as part of their strategy, but they are a little late to the party on this. It doesn't preclude them from trying however, and at least they have now arrived at the party. I think they knew they weren't going to get a market-leading product at the first attempt. They made the decision to build the product from scratch and they would have been foolish or delusional to expect a world-beater at the first attempt. It does seem a little puzzling why they didn't choose to acquire a leading SIEM player and went with the build approach instead.

As is the norm with these discussions, I tend to ask about things not related to the news at hand as we move past the main items of discussion.

My first unrelated question related to the IDFocus product they acquired and whether any part of that solution made it into the 3 new products. The answer was no because even though it has some level of potential integration with role and compliance efforts, it fits best into the Identity Manager product where it helps to link business processes with provisioning requirements.

My second unrelated question was around the notion of having a central policy management point for all the products (like Symantec and McAfee are trying to do with their own products). The point of this question was to gauge if CA's strategy includes the centralisation of policy management. I didn't expect much because it's actually a VERY difficult thing to do and very few of the large IAM suite vendors have the appetite to invest in this area. I'm not talking about the engineering aspect, which is simple when compared to the actual analysis behind how one would rationalise all the different ways policies could be represented and trying to figure out how to apply an over-arching model to a large portfolio of products. Add DLP to the mix and it gets exponentially more complex because of all the data-centric requirements. For the record, Dave's answer was that the focus shouldn't really be on having a central policy store or management point. It's more about having the right processes occurring between the IAM products to ensure the correct policies are in place at the points where they need to be applied.

Overall, I think CA's got the right idea in terms of strategy. Whether their products are able to deliver remains to be seen. They've got some serious integration work to do so they can get a more coherent story out there and have products that deliver on the promise they are showing. CA does have a trump card to play that their competitors don't have (yet), and that's the DLP product. As I've said before, identity and data security go hand in hand.

CA sprints towards 2009

Oracle acquired Bridgestream (I wrote about this here). Then Sun acquired VAAU. Now CA's acquired the last remaining high profile role management player, Eurekify.

First of all, congratulations to founder Ron Rymon (he's the only person from Eurekify I've actually met) and the team. As I said to Ron earlier this week, it makes a lot of sense and I think it's a good fit.

I've written about CA's moves in the past and also mentioned the CA-Eurekify partnership in passing. It looks like they're keeping the momentum up and making a lot of headway towards competing with the other leaders in the Identity and Access Management marketplace.

I don't think the Eurekify acquisition is going to change the landscape too much mainly because of the existing partnership. The initial benefit is going to be that their sales reps probably get paid more commission for selling "CA Role Manager" or whatever they call the Eurekify product. In the longer term however, they're obviously going to have to integrate Eurekify's products into the CA stack so there's eventually going to be the "out of the box" integration benefits. Of course, the main benefit to CA as a company is in being able to market the fact they are now a serious role management player (along with Oracle and Sun).

The Eurekify acquisition also plays very nicely into CA's move towards being a strong GRC player. Eurekify's product set does include some GRC components geared towards identity compliance with an obvious focus on roles. CA's existing GRC Manager lacks some of the features around the identity-centric compliance niche that SailPoint and Aveksa play in but I'd be very surprised if CA doesn't fill the gaps using Eurikify's technology given that Sun just released their Identity Compliance Manager (which I believe was based on VAAU technology - all you Sun bloggers can correct me if I'm wrong about this) product and the fact that Oracle has something along these lines on the roadmap (according to Amit Jasuja when I spoke to him).

CA compounded their GRC march this weekend at CA World by announcing a Software as a Service (SaaS) version of their GRC Manager product, dubbed GRC Manager On Demand. This makes them the first large Identity and Access Management software vendor (the others being IBM, Sun, Oracle and Novell) to release a SaaS offering. I'm unsure how well it's going to sell given the results of my Managed Identity Services survey but what it does show is intent on CA's part to get serious about competing and getting ahead.

Oracle, Sun and CA have been very active of late. IBM and Novell have not. In fact, they have been VERY quiet. IBM will actually be releasing a new Entitlement Management product later this year but that's a little ho hum as I've already said. I have a feeling something is brewing because IBM and Novell cannot afford to sit around and watch everyone else get waaaay ahead. Novell's Access Governance Suite is an OEM of Aveksa's software. In other words, if Novell acquires someone in the role management/identity compliance area, my money's on Aveksa. This leaves IBM and SailPoint as the remaining pair. Watch this space.

Sun joins the role management game

The large vendors have largely ignored the role management aspects of Enterprise Identity Management. I outlined some of my thoughts on this in a previous post in response to Oracle's acquisition of Bridgestream. I also asked an open ended question around what the other large vendors would do in response to this. I just got part of the answer as Sun announced a few days ago their intent to acquire VAAU, another player in the role management game.

I won't repeat myself so read my Oracle and Bridgestream post if you want to know what I think about this whole role management thing. All that's left to add to that post is that Sun's just joined the game. Your move IBM/CA/BMC.

Whatever happens, all this is pointing towards the day when Enterprise Identity and Access Management = commodity. We're not quite there yet. But soon.

Oracle and Bridgestream

This news is about a month old, but in case you've been in a cave for the past month (like I have, well not a cave but I've been in China so that's close enough) and don't know, Oracle bought Bridgestream. Now that's 2 things they have on the competition. The Bharosa and Bridgestream acquisitions give them 2 things their major competitors (IBM, Sun, CA, BMC, Novell) don't have.

Role management is a bit of an ambiguous term. It means different things to different people. In the software world, this usually refers to some sort role mining, automation and discovery. There are a few vendors out there doing this (Bridgestream was one, Eurekify is another) and they end up calling their offering role management because it helps automate the whole process of figuring out what the heck an organisation's roles should look like and who should be in these roles.

This all sounds good in theory, but role management in the form I've just described has not exactly taken off. It's one of those things that people keep saying they need to do. Except all they end up doing is sticking a bunch of roles they think will work into their provisioning systems and waiting to see what needs changing later on. Of course, by then it's too late and they have to re-do all the roles. As always, they pay an exorbitant amount of money to a consulting firm (I'm looking at you Accenture and Deloitte, and perhaps IBM too) to do the work.

It's also been a victim of priorities and security maturity levels in organisations. Most are not at the stage where they are ready to look at role mining and automation. Provisioning and access controls are usually the first things that get implemented, then some sort of audit, compliance and reporting capabilities are tagged on to feed off phase 1. Role management ends up being the nice to have...and by then there's no money, no time and no resources available. So we get into the near enough is good enough syndrome.

Yes I know proper role management helps with proper segregation of duties and also keeps auditors happy. But role management as a single discipline does not solve the whole issue. It needs to be used in conjunction with all the other Identity Management capabilities that typically get implemented. The role management/mining vendors have also suffered from being too low on the food chain and not being tied into a major vendor to be dragged along as part of the sale. It's also usually too difficult to integrate into whatever Identity Management software solution an organisation is implementing and becomes another moving part that is usually one of the first things to get thrown away...or at best pushed to phase 5. I've yet to see organisations get past phase 2 or 3 in the space of a few years. Phase 5 will show up...eventually.

And this is where Oracle have just placed themselves in the driver's seat. By buying Bridgestream, they've got another selling point over their competitors. And when organisations do indeed get to that phase 5 (or whatever), guess what...Oracle's going to ride in on their white horse and say they have a tightly integrated solution that has been tested and kicked around in production. I'm sure a few of their customers will want to be early adopters. Oracle will throw in a bunch of financial incentives to ensure that happens. It's the smart thing to do.

And when Oracle's doing this, whoever buys Eurikify (SAP, are you listening? You want to get in the Identity game get ahead - also makes perfect sense if you want to link it all nicely into R/3 and NetWeaver) will be left behind (although they'll still be ahead of the others that are just sitting there hoping sales will fall into their laps while their Identity Management technologies lag behind the competition).

And at some stage, someone's going to realise that just sucking in all your roles (and users) in from HR into your provisioning system only does half the job. Operational roles (stuff that is useful for day-to-day use) are not usually representative of what you find in HR. It helps to have an automated way to figure out what the operational roles really are. It's not going to be easy, and putting in a tool won't be a no brainer, but if it's integrated nicely into the provisioning system it certainly helps cut out a lot of the work...and takes business away from consulting firms that roll out whole teams of fresh graduates (who know nothing) to implement your enterprise security infrastructure for you. Scary isn't it. But we know that's what they do.

The Bridgestream acquisition isn't a huge game breaker. It's just Oracle buying insurance for the future. They may get a few deals here and there because a customer happens to think the world of role management/mining. But it's a smart strategic move.

They're fleshing out their capabilities nicely in the game we know as Enterprise Identity Management. I don't know what the other vendors are doing. For their sake, I hope they're not sitting there in blissful ignorance thinking their market share will not get eaten up by Oracle.