"Things" will force makeover of enterprise ID, access management
Enterprise identity architects will have to scale their systems and consider new features in order to morph from a people-centric ID service to one that encompasses the complexity of interactions envisioned with the Internet of Things concept, according to Gartner research VP Earl Perkins.
"Things" being deployed in the enterprise and in the cloud will need identities and access controls. This will create the need for an "Identity" of Things (IDoT) extension to current identity management systems, according to Gartner.
This extension will address all "entities" on the network including people, services and things. And IT will want to manage all that within an integrated suite of tools.
Perkins says decision-makers within IT will need to be prepared to bring together the work they are doing in managing network identity (DNS, IP), managing identity of devices (key management, asset management, supply chain management, various embedded security practices) and managing identity of humans (user IAM) so they can define the connecting tissue between them for building IDoT management.
The Internet of Things in an enterprise setting won't necessarily include the break room frig, but for IT will include viewing and implementing such operations as processing, analytics, storage and communications, according to Gartner.
"IAM leaders must reconsider how traditional approaches to cybersecurity and IAM work in a world where devices and services are so abundant, in so many different forms and positioned at so many different points within the IT ecosystem," said Perkins, who will host a session on this topic in two weeks at the Gartner IAM Summit in London.
The IDoT will cause asset management responsibilities to overlap with IAM and will require IT to refactor system integrations, including network management.
Gartner says IDoT will take on some functional characteristics of IT asset management (ITAM) and software asset management (SAM). Those features may be added to IAM or integrated via ITAM as attribute stores.
Perkins says this convergence of identity and Things will require enterprises to quicken the pace of IAM adoption and force vendors to accelerate updates to governance and access capabilities.
"Enterprises with IAM systems in play will face a new problem of associating not only attributes and entitlements with a user identity but in associating devices, services and their data with that user as well," Perkins said. He added that new vendors would pop up to solve those issues, while current vendors scramble to modify and extend their products.
On a scale of 1 to 10, Perkins said the complexity of this merger of identity and Things comes in at an "8". "It is a high number due to the formidable integration issues coupled with the frustratingly slow pace of acceptance of traditional IAM maturity and adoption among customers," he said.
"The IDoT for some will require IAM to become a real-time, event-driven engine, where changes are made and unmade by the minute in some scenarios." Perkins said.
"Business decision-makers will see the requirements to combine operational technology (OT) and the Internet of Things with a "traditional" enterprise IAM system and that in almost all cases they will find their existing engines will not take them there in their current forms," he said.
Of course, this transformation will take time. Perkins says those that plan strategy now will see less disruption later.