CA Community






This Blog

August 2010 - Posts

Delivering the Enterprise-Ready Cloud – The Acquisition of Arcot Systems, Inc.

Published: August 30 2010, 10:08 AM | 1 Comment(s)
by Matthew Gardiner

Today CA Technologies announced an agreement to acquire Arcot Systems, Inc. This transaction will result in several immediate and longer term benefits for our customers.  Current on-premise IAM customers, particularly customers of CA SiteMinder, will gain immediate benefits by using Arcot's strong authentication and fraud prevention capabilities to complement their well established SiteMinder deployments. 

Over the past 10-plus years CA SiteMinder has become the "gold standard" Web access management product on the market, literally defining what it means to be a WAM product.  The addition of Arcot's strong authentication and online fraud prevention - deployed either on-premise or from the cloud - significantly extends CA SiteMinder's value to the enterprise.  SiteMinder's centralized security position within its customer base means that the organization can experience increased security and reduced fraud while continuing to improve the user experience.  For example adding one-time password (OTP) authentication for Web users without having to issue physical tokens is a boon to both security and usability on Web sites and is a great example of an identity service offered from the cloud.  This OTP service is well described in a short video that can be found here

CA has clearly stated our strategy for cloud security: enable organizations to extend existing on-premises IAM systems to support cloud applications and services; provide IAM technology to cloud providers to secure their services - whether public, private or hybrid; and enable IAM services from the cloud. The acquisition of Arcot significantly accelerates our delivery of identity services from the cloud - making them available today.  If you need multi-factor authentication as a cloud service, it is available now.  If you need OTP as a service, without the annoying tokens for users to carry around, it is available now.

And finally, not only will Arcot bring to CA a proven set of "from the cloud" security services of strong authentication and fraud prevention, it also will bring many years of experience and technology which underlie these services. Combining Arcot's cloud security platform with CA's deep bench of IAM solutions - CA Identity Manager, CA SiteMinder, CA Federation Manager, CA DLP to name just four - positions CA to to more quickly offer even more identity services from the cloud.

For the cloud to truly reach its potential, it is critical that it become more enterprise-ready from a security and management perspective.  The combination of CA Technologies and Arcot advances the enterprise-ready cloud.

Share this post:  

 

By: Matthew Gardiner
Matthew Gardiner is a Director working in the Security business unit at CA Technologies. He is a recognized industry leader in the security & Identity and Access Management (IAM) markets worldwide. He is published, blogs, and is interviewed regularly in leading industry media on a wide range of IAM...
Read More..

Different Opinions of Cloud Computing

Published: August 16 2010, 01:05 PM | 1 Comment(s)
by David Gormley

If there is one thing that we have learned in the last year with the "cloudification" of everything technical, it's that different groups have disparate views on exactly what the cloud is and how valuable it will be.  Over the last couple of months I have talked to a number of people in various industries about their view of cloud computing and how it will be adopted. From these discussions there were a couple of themes that I thought were worth mentioning.

I am going to break down the people that I talked to into two groups: Business-centric and IT-centric. While there was some overlap in the commentary, they each had some unique ways of talking about and approaching the cloud. Let's start with the more typical or predictable opinions.  On the business side there were a set people with a rosy, excited view of the cloud.  This group has the attitude that this is another shift in the technology landscape which will enable the business to be more agile and less dependent on IT and its dictated timelines.  One business unit director told me that his IT group was resisting cloud initiatives just as they had resisted the previous shift to client server technology and the reasoning was the same, the technology is dangerous because it pushes outside the previously defined, well-protected area which they had worked for years to standardize and control. 

On the IT side of this equation I spoke with several people that were eager to point out the discrepancies between how different people defined "the cloud" and they concluded that it was not imminent if people don't even have a clear view of exactly what it is.  This segment of the IT population is very wary of the business group mentioned above, who they feel are overzealous about cloud potential. They are concerned that the business group will create a corporate directive that may force them to change many of the processes that have taken years to put in place.  This would include a lot of change and would require learning new skills.

This commentary reflects some of the more predictable differences between the way many IT and business people view cloud computing. But there are other, unique viewpoints about cloud that I had not heard about until recently.  First on the IT side there was a contingent that asked a lot of questions about cloud computing and how it works, what the new security concerns are and how they could be addressed. Their goal was to formulate something concrete to present to business when the inevitable "we want more in less time and for less money" discussion comes up.  In the words of one person, "the next time they come to me with the usual catch 22 scenario (the popular combination of an aggressive wish list and a reduction in the IT budget), I want to lay out the cloud based approach as one possible option."  They were looking at it as a way to break the strained "we can't do it"or "it will take 6 to 9 months" kind of discussion that has been creating an ever increasing divide between the business and IT management in many organizations. 

There was an interesting angle on the business side as well. A couple of people that I talked to were interested in aggressively implementing some cloud-based concepts, not just for the potential cost savings but to innovate in their industry and be the first to offer new services. These scenarios included companies playing the role of an identity provider or an aggregator of SaaS/cloud based services within their industry.  Companies that are out in front of this concept are finding some creative ways to offer flexible, automated and enhanced services to members of their own supply chain (both upstream and downstream).  They are exploiting "first mover advantage" by embracing some pretty well established technologies and standards in a new way to connect multiple parties and reduce the friction in the traditional business partnership processes.  For example:  

  1. Broadridge provides IT and processing solutions for the financial services industry.  They offer a range of applications in a hosted (or SaaS) type arrangement. Broadridge is currently using web access management, federation and identity management tools to enable secure access and proper provisioning to these applications. One positive side affect from creating this efficient, automated system is that both customers and other vendors (that offer related SaaS applications) have asked them to incorporate additional services into their model.  This has become a successful, revenue producing offering which increases Broadridge's value to their customers and improves the stickiness of their overall solution.
  2. MEDecision is a leading provider of collaborative healthcare management solutions.  They have created a platform which allows patients, providers and payers to all interact and share the appropriate information.  MEDecision is utilizing a combination of WAM, web services security and federation to facilitate HIPPA compliant interactions between the multiple parties in a healthcare supply chain.

Neither of these companies started out with the objective of being a Managed Service Provider (MSP) but both have used proven technology to solve problems in their respective industries that required secure Internet ("cloud") interactions between various constituents.  These are especially poignant examples because they represent two of the most highly regulated industries.  If this type of solution can work effectively in these environments, they are sure to offer similar opportunities in many other industries.  Cloud technologies are not just for a few select companies to consume elastic technology resources for low priority projects, they can be applied to drive innovative new (revenue producing) solutions.    

Share this post:  

 

On the Path to the Enterprise-Ready Cloud

Published: August 03 2010, 04:13 PM | 2 Comment(s)
by Matthew Gardiner

CA Technologies recent announcement regarding identity and management (IAM) and the cloud has garnered the attention of the industry - and rightfully so.  Our pragmatic approach to IAM for cloud computing reflects the needs and questions of our customers. Our approach is evolutionary for the large enterprises who want to use their on-premise IAM systems to support cloud adoption. It also offers a way for cloud providers to deliver enterprise-level (or better) security for their cloud services - something they need to do in order to exist. Finally, we know there is an entire market interested in using a service for IAM - and that's the revolutionary part of the approach.

Enterprises need to be able to evolve their existing IAM systems, deployed today almost exclusively on-premise, to incorporate cloud services - what we have referred to as extending IAM to the cloud.  We are enabling companies to do this by enhancing CA Identity Manager to support various cloud applications, including newly announced support for Google Apps and existing support for salesforce.com's cloud platform, force.com, and cloud applications. These capabilities are an extension to a proven approach for the management of identities by enterprises.  The integrations give organizations the ability to manage user entitlements to these SaaS applications and enforce existing governance policies as an integral part of their existing automated user entitlement management workflows.  This is one step in our plan to expand our product functionality to help our customers more securely consume cloud services using their proven enterprise solutions.

Second, cloud providers themselves need to become "enterprise ready" from a management and security point of view.  This was a topic of significant discussion by Gartner Analyst Dru Reeves at the recent Burton Catalyst conference in San Diego.  To become enterprise-ready it's no surprise that cloud providers will need to control their own IAM systems and processes.  We see this as IAM for the cloud.  Cloud providers, like large enterprises, need to improve how their identities are managed, both for internal and external users.  This was the point of the second part of our announcement last week - how CA is enabling cloud providers themselves (with MEDecision as a representative example) to automate IAM.  To earn the trust of current and future enterprise cloud consumers, cloud providers will need rock-solid IAM systems of their own, that are also interoperable with those of the cloud consumers.

Finally, and a little more generally (one can only fit so much in a press-release), CA discussed ongoing activities, in conjunction with multiple partners, to provide identity services from the cloud (such as proofing, credential management, strong authentication, SSO, provisioning, etc.).  This is certainly the more revolutionary part of what is going on in the industry and is a significant area of focus for CA.    Stay tuned for more updates from CA and our partners, as this is a quickly evolving area of IAM and the cloud. 

The enterprise-ready cloud will be a reality when enterprises can easily extend their existing IAM processes to the cloud, when cloud providers themselves use enterprise-grade and interoperable IAM systems for their cloud services, and finally when specialized cloud providers offer IAM services from the cloud.

Share this post:  

 

By: Matthew Gardiner
Matthew Gardiner is a Director working in the Security business unit at CA Technologies. He is a recognized industry leader in the security & Identity and Access Management (IAM) markets worldwide. He is published, blogs, and is interviewed regularly in leading industry media on a wide range of IAM...
Read More..

More Posts