Identity management - a lot more than single sign-on

Users in the IT industry tend to have different conceptions about identity management with many of them thinking that it's about single sign-on or building a meta-directory.

"Yes. It is that, but a whole lot more," says Lodewyk de Beer, technology architect at Sun Microsystems, sub-Sahara Africa. "We say it's a more consolidated view such as where an identity lives, where it has access, what access it has and what controls that access."

De Beer was speaking at a Sun Forum in Durban last week (August 17) where he told users and channel partners that an identity management system communicates with identity resources making sure they fall in line with compliance issues.

"Unlike the general consensus where the belief is that identity management systems are expensive with long implementation cycles, Sun sets the stage for consistency."

He brought the following statistics to the delegates' attention:

* An average user spends about 16 minutes a day on authentication tasks
* Frequent IT users have an average of 21 passwords of which 49 percent write them down and 67 percent rarely change them
* Every 79 seconds an identity is stolen
* World wide fraud losses amount to $12 billion annually.

"The benefits speak for themselves with improved IT efficiency topping the list through reduced help desk calls. Productivity improves and users can expect a return on investment payback between 7.5 and 13 months."

De Beer said identity management can apply to the following areas:

* Physical access to installations such as buildings and offices, vehicles, equipment and tools
* Enterprise access such as networking, servers, data storage, computers printers
* Data by category or sensitivity
* Organisational issues such as purchases, travel, expenses, approval procedures.

"They are all based on digital identities, policies and business rules."

On the subject of why the need for identity management, he said the most pressing requirement was the need to mitigate risk and optimise ROI on capital investments such as information systems, physical assets and operations.

"It mitigates the risks of unplanned expenses, security breaches, loss of information, exposure, bad publicity and regulatory issues.

"Identity management solutions must address multiple conflicting business goals, improve access and service, become more secure and reduce costs. A company's priority should be to cleanse and consolidate its data stores, directories and databases.

"It can then create virtual identities for enterprise users followed by an identification provisioning platform and include password management or a similar authentication process."