Identifying an opportunity

Cloud has both direct and indirect opportunities - and the latter is about cloud service support, with security high on the list, notes Bob Tarzey

Resellers looking at cloud services need to consider both direct and indirect opportunities.

The direct ones are the selling of cloud services themselves, perhaps implemented by the reseller or from a service provider or an aggregator. The indirect opportunity comes from selling technologies that support the cloud services, especially those relating to security.

Our latest report, Digital Identities and the Open Business, shows that companies using lots of cloud services recognise the need for security, and are spending more on it.

The stand-out area is identity and access management (IAM) - 97 per cent of cloud ‘enthusiasts' have an IAM system, compared with just 26 per cent of cloud ‘avoiders', as defined in the report.

Single sign-on (SSO) has made it easier to provision and de-provision access to multiple cloud services. This ensures given users can access the resources they need via a single identity with strong authentication, only logging in once.

Charts copyright Quocirca 2013 -- All rights reserved

When the relationship with a given user ends, all access rights can be deleted quickly and completely through a single update. SSO also makes it easier to create granular access policies for different types of users and to keep accurate audit trails.

Notice we say ‘user', rather than ‘employee'. This is another benefit; applications can easily be made available to external users. It's a top motivator for deploying IAM in the first place; 58 per cent of firms interviewed for our latest research had opened up applications to consumers or users at customers or partners.

Our report The Mid-Market Conundrum reveals the average UK mid-market business has 40 times as many external users as internal ones.

SSO can enable access to multiple applications for external users. Think of a travel agent organising flights, hotel bookings and car hire - or indeed a reseller selling various customers aggregated access to several cloud applications. A further benefit of many IAM systems here is federated identity management.

Most businesses still rely on Active Directory to identify their employees, and they often rely on other sources for external users. This is most likely to be a given organisation's own directory system, but it could be a government database or a membership directory of a professional body.

However, when it comes to consumers, one source of identity, as it were, is coming to dominate: social media. Social login obviates the need to manage millions of identities.

Specialist providers such as Gigya and LoginRadius check social logins, brokering multiple social media sites with services favouring social login to enable a single view of individuals. It is possible to be quite confident it's a real person.

Social login vendors limit themselves to social identities and maintain a consumer focus. Incorporating external business users alongside employees and consumers requires the broader federated identity management capability described earlier.

The big identity vendors such as CA, IBM, Oracle and McAfee are adapting their systems accordingly, and new vendors such as Ping Identity, Okta and Symplified have emerged.

Charts copyright Quocirca 2013 -- All rights reserved

Coming full circle, many of these are now provided as on-demand services -- IAM as a service (IAMaaS). Our research suggests 43 per cent of IAM deployments are either pure on-demand services or a hybrid deployment of a legacy on-premise system with a cloud service.

Those using cloud services extensively are the most likely to turn to IAMaaS - about two-thirds use it in some form.

If the users and applications can be anywhere, why not the IAM system: cloud feeds and cloud? Resellers should make sure they have the capabilities in place.

Bob Tarzey is analyst and director at Quocirca