Initial FedRAMP operational capability is required within the next six months, at which time all federal agencies are expected to use FedRAMP before acquiring cloud-based services and to require vendors to comply with the program’s standards. The government estimates that allowing all departments and agencies to share security assessments will save 30-40% of the cost of assessing, authorizing, and continuously monitoring cloud-based IT systems. And more importantly, it will apply consistent security and risk management standards to cloud services deployed by the federal government.

Looking at this from the point of view of the private sector, a couple of thoughts struck me:

• Enterprises have a similar, though smaller scale, set of cloud adoption issues as the U.S. government does. In the past year, I’m guessing that the average enterprise negotiated dozens of procurement agreements for cloud computing services, ranging from licensing SaaS applications to buying compute time using a personal credit card. The very nature of “on-demand” cloud computing lends itself to this decentralized, self-service procurement. But as we all know, there are very real risks here. As cloud adoption becomes even more prevalent in enterprise environments, I think we’ll see more organizations adopting their own cloud adoption programs to ensure consistent vendor risk management, conformance to security and risk management policies, and to avoid the inefficiencies and waste of decentralized cloud procurement.

• Perhaps more importantly, our industry is in dire need of a workable set of standards for service assurance of cloud providers. It’s much too difficult for enterprises to assess security and compliance practices of service providers. Because the enterprise remains ultimately responsible for the security and integrity of data and applications deployed in the cloud, most enterprises will do their own due diligence before fully adopting cloud technology for critical business applications (SAS-70 is not enough). But without meaningful cloud compliance standards or certifications, it requires an arsenal of auditors to assess service provider practices and lawyers to negotiate contractual protections. There is frankly too much cost and risk in adopting cloud computing for critical applications, with the result that most enterprises will not make the move any time soon.

FedRAMP for enterprises, anyone?

I’ve spent the past 11 years working on IdM standards, beginning with SPML back in 2000. Sometimes our worst failures teach us the best lessons, and that’s absolutely the case with SPML. SPML never really gained widespread market adoption because it failed to deliver in three key areas: simplicity and ease of adoption, industry support and true customer demand. SCIM aims to improve upon each of these areas in order to improve connectivity, manageability and governance for SaaS and cloud-based applications.

Keeping It Simple

SPML turned out to be far from simple. The effort was well-intentioned one by everyone involved, but ultimately, the resulting spec was too large and complex, and created as many problems for customers as it solved (if not more). At the end of the day, SPML was a complete operating model for provisioning and as such came with a lot of baggage and a lot of complex use cases. In contrast, SCIM focuses on the core tasks of account management and leaves out a lot of the “provisioning platform” extras. This simplifies things for everyone concerned. SCIM is also 100% based on a newer RESTful web services approach that is both easier to write and use in the code, and easier to read and understand in the specification.

App Vendor Support

Today’s cloud application vendors understand the importance of IdM, and they recognize the need to simplify and standardize how organizations provision to their cloud application services. While the cloud has been designed to provide simple on-demand computing for today’s business needs, it has opened up several IdM issues, including remote application user administration and synchronization of identity data between the enterprise and the cloud. Recognizing the importance of solving these issues, companies like salesforce.com, Google and Cisco have invested their time to help drive SCIM forward and build SCIM interfaces into their products. Support by the major SaaS vendor platforms will prove critical if SCIM is to achieve widespread adoption.

Real Customer Demand

Despite the naysayers, business adoption of the cloud is accelerating. And as more and more SaaS applications are deployed, it’s incumbent on organizations to manage the identities they now own in the cloud. These organizations aren’t interested in adding more complexity to their IdM implementations, and are beginning to push both management and application vendors to provide a simple, standardized way of managing their SaaS accounts. This growing and real customer need has resulted in genuine customer push – push for their SaaS vendors to support SCIM on the account side, and push for their identity management vendors to make use best use of it.

SailPoint will continue its contributions to the SCIM effort as it moves toward adoption by the IETF. We strongly believe that this type of standard is critical to addressing IdM in the cloud and to providing the level of manageability, controls and governance that’s needed for today’s increasingly mission critical cloud-based applications. If you’re interested in more technical details on the spec, take a listen to the webinar I recorded last week with Dave Kearns of KuppingerCole and Patrick Harding of Ping Identity.

As the SCIM standard evolves, I’ll be sure to keep you updated. In the mean time, I’d like to hear your thoughts on SCIM. Do you think we are guiding the market in the right direction?

As I think about the coming year, I wanted to share my annual predictions for the IdM market in 2012:

1. Identity Governance Gets Proactive: When we first brought identity governance to the market several years ago, most customers were focused on addressing immediate compliance or audit issues. Now, as those same organizations are several years into their deployments, I see more IT organizations moving to adopt preventive controls to block violations or inappropriate access at the point of request. Even more encouraging, we are seeing clients using risk scores to drive the prioritization of remediations and frequency of certifications, focusing controls where risk is highest. I predict proactive identity governance will help companies reduce the burden on compliance staff and improve audit performance.
2. Auditors Wake Up to SaaS: One of the most interesting phenomena I’ve observed over the past year is the extent to which IT auditors continue to exclude SaaS applications from their audit scope. As SaaS applications become more broadly deployed in mission-critical parts of the business like HR and finance, companies are placing themselves at increased risk for fraud, privacy violations or data breaches. I predict that 2012 will be the year that enterprises wake up to the risk of placing sensitive data or transactions in the hands of a cloud service provider without effective controls over who has access to what. A major data breach will certainly get everyone’s attention!
3. Provisioning Gets Slimmer – and Simpler: I’ve heard several analysts talking lately about provisioning “bloat” and the damage done by overly ambitious provisioning projects that never delivered on the promised benefits. As we enter 2012, I think we’re at the end of the age of bloated provisioning and are embarking on a new era of “slimmed down” provisioning that is easier and faster to deploy. We are seeing many clients implementing self-service access request with manual (non-automated) fulfillment via service desk or manual methods. And many clients are deploying provisioning on SailPoint’s identity governance foundation, which allows them to leverage business-friendly entitlement catalog and well-defined policies to simplify workflow and rapidly implement self-service.
4. Proving the Business Outcomes of IT Decisions Remains a Top Priority: It’s no surprise to anyone that we are living in a time of constrained budgets, but enterprises continue to invest in technology despite that fact. In most organizations, projects are being scrutinized even harder and require more justification than in the past. Regardless of what happens with the economy in 2012, I believe businesses will continue their careful scrutiny of IT investments. For this reason, IT organizations will need to learn to communicate and sell the business case for any large-scale IT project (including IdM) AND prove that the promised ROI was realized. (My cofounder Jackie recently wrote a great blog on this very topic.)

These are just a couple of my thoughts for next year. I’d like to hear your thoughts. What do you think will happen in the IdM market next year?

At the same time, for every benefit the cloud may provide, it brings new challenges. At SailPoint, we’ve been talking with our customers about cloud adoption for the last year, and regardless of industry or location, there is a constant theme: security and compliance concerns are the primary inhibitor to widespread adoption of the public cloud. As a result, enterprises are taking a cautious approach to deploying applications in the public cloud, particularly their mission-critical, “compliance-relevant” applications.

Interestingly, these same companies are plowing full steam ahead with SaaS applications, primarily driven by business units that have purchased them without IT involvement. There is a commonly held perception that these SaaS applications are not mission-critical, but we beg to differ. If you think about the value of your company’s data in SaaS solutions like Salesforce CRM or Workday HRMS, you realize the need for strong access controls and policy enforcement.

To help companies manage the risks associated with SaaS applications and public and private clouds, SailPoint announced a new solution, the Cloud Identity Bridge, which seamlessly extends the identity management capabilities of IdentityIQ to all applications deployed in cloud environments. We also announced the immediate availability of connectors for Salesforce CRM and Google Apps, which extend these same benefits to popular SaaS applications.

In the coming weeks, we plan to devote a significant portion of this blog to addressing identity management in the cloud, covering the need for a centrally managed identity governance strategy, as well as strategies for regaining IT control over SaaS applications. Our goal is to separate the hype from the reality, and provide you with pragmatic advice on how to securely and compliantly manage the cloud.

We’ll also be hosting a free webinar on April 26^th to discuss identity governance and the cloud. If you’d like to join us, please register here.

I’m always interested in what themes get the most play at RSA. This year, I’d have to say that “the cloud” wins the contest hands-down. Cloud computing was ubiquitous – a centerpiece of most keynote addresses, a feature on booth signage throughout the show floor, and not surprisingly, the butt of quite a few jokes (example: let’s do a tequila shot every time we hear the word “cloud”).

In the show’s opening keynote, RSA’s CEO Art Coviello declared cloud computing “the most over-hyped but underestimated phenomenon in history” (borrowing a phrase from Nicholas Negroponte). Coviello went on to say that cloud computing presents us all with the rare opportunity for a “do over” – to be present at the rollout of a new wave of computing with security built-in from the get go. I have to admit I raised my eyebrows at this turn of phrase. I predict that the evolution toward cloud computing will be moderated and incremental – and not a “do over” by anyone’s definition.

Another interesting observation about this year’s show is the continued (and perhaps even bigger) blend of public and private sector speakers. Past years’ shows have featured Michael Chertoff, Melissa Hathaway, and Al Gore. This year’s speakers included Secretary of Homeland Security Janet Napolitano, Howard Schmidt, the U.S. cybersecurity coordinator appointed by President Obama in December, and Robert Mueller, director of the FBI. On Tuesday, Schmidt presented a keynote address and hosted a heavily-attended town hall meeting. In both of these venues, he conveyed a very measured and pragmatic approach to addressing the cybersecurity responsibilities of the federal government. He said more than once “there is no silver bullet.”

During an entertaining Q&A session with the audience, Schmidt revealed the following about his agenda:

• He’s not a proponent of more regulation to drive better security practices. The one exception he mentioned was the area of data breaches (where there is pending legislation).
• He assured the audience that any measures taken by the Fed will respect privacy and civil liberties issues.
• He admitted that the Federal Information Security Management Act (FISMA) is archaic and needs to be changed. He mentioned that some changes are being rolled out this year.
• He believes that we, as a society, are making real progress with cybersecurity. He pointed out that there are fewer devastating attacks and service disruptions than in previous years.

Unfortunately, Schmidt’s position is made all the more challenging by the bureaucracy and interest groups he will have to navigate in Washington – it’s not just a matter of fixing problems and fighting the bad guys. On a positive note, the amount of focus being put on the issue of cybersecurity at the federal level can only be a good thing.