ID MANAGEMENT FOR CLOUD-BASED APPS As more data leaves the enterprise strong identity lags
In addition to convenience, cloud computing is touted for its money saving capabilities as companies reduce software licensing costs and hardware requirements. Identity management in the cloud isn’t as cut and dry. Standards are emerging to manage identities in the cloud but, until now, it hasn’t been a priority. The auditing and provisioning capabilities that are typical with enterprise-based ID management systems are tough to come by with cloudbased systems. “ID management is the biggest weakness we have right now,” says Tony Busseri, CEO at Route1, a digital security and ID management provider. “People have rushed to embrace a technology that’s great in concept, but they have ignored the ID management.” These issues exist more in the public cloud than the private cloud, Busseri explains. “The public cloud is great in terms of functionality but from a privacy standpoint you don’t know where the information is going,” he says. A private cloud, while more expensive, enables a corporation to put its own security and ID management protocols in place. “With the public cloud, security and identity are treated
56
SPRING 2012
as a secondary concern,” Busseri says, “or not at all.” And once the data is in the cloud it’s not necessarily possible to get back. “It’s like trying to put toothpaste back in the tube,” Busseri explains. The problem begins when an organization decides to start using a cloud-based application, says Andy Land, vice president of marketing at UnBoundID Corp. The use of a cloud app typically doesn’t begin with IT but out of a business need. “It starts with a business case,” explains Land. “It becomes important but then they don’t want to manage it anymore.” He cites the example of a sales director who finds an app to enable his staff to more easily track of sales leads in the cloud. He has a few of his staff start to use it and they find it is easier than the prior system. The director migrates the entire sales staff to the cloud-based solution, and only after some issue arises does he go to IT and ask them to fix it or manage the system. This doesn’t make IT happy, he notes.