Nelson Cicchitto, Avatier CEO, Gartner IAM Presentation 2011

All right, it looks like we're starting here. Everybody doing well? Very good. My name is Nelson Checchetto. I'm the CEO of Avatier Corporation. I'm very happy to be here. Thank you all for having me, and thank you for coming. Today we're going to be talking about shifting identity and access management out of it. I want to shatter kind of our beliefs and what we're thinking about and how we think about identity and access management today. It's in it. We're talking about moving it out of it. We're talking about using storefronts to move it out of it. And also looking into the future beyond the storefront to a trusted identity fabric, which we'll be talking about. So before I begin, I want to see a hand. I'm reading a book called the Innovator's DNA. I don't know if has anyone heard of that book? Anyone heard of that book? Few. Folks, this book is really the DNA for our company, Avatier Corporation. And that is we're always trying to innovate and trying to stay ahead of the curve in identity and access management and beyond. And what I'd like to do is run through the group that we have here and just see in the audience who here is doing this within their company or what company is promoting you to do this within your own organization. So, managers. How many of you have a manager that's encouraging you to innovate? Is it allowing you to take a risk? Okay, very good. It's good to see that. How many of you have managers or you do it internally that are questioning what's being done within your corporation today? Just a show of hands. There are some people. I'm from Chevron, so don't be bashful. At Chevron, we never raised our hand. It was all. No, we would all go through a formal process of that. How many of you are observing what's being done in your organization today, Listening intently? Obviously, if you're at the show, you're there. You're doing the networking side of it as well. But how many are taking back what you've learned in these seminars and experimenting in the labs and experimenting at your corporation? Let's see a show of hands there, because that's really where it all hits the rubber, right where it's taking. Everyone can come here and get great knowledge. They can observe, they can question, they can network. But then do. Do you actually experiment? And then the associated thinking this is, hey, I saw something cool from Avatier. We have a competing product. We're going to think about doing the same thing on top of that competing product, or maybe hiring Avateer to throw it on top of the competing product. That's the association side of it. Or that was a neat idea, but I think I could take this a whole other direction in my company. So it's a great book. I would encourage you guys to take a look at it. But a little bit about what, what we'll be discussing today. I want to take you back into the past of identity and access management, at least as we see it, and how it grew up. I want to talk to you about what Avatir is doing today with storefronts, what we're doing today. And we'll have our customers validate those storefronts. So we have a couple of customer vignettes, three customer vignettes that we'll talk about. Then you'll actually see a demonstration of a storefront and how your organization might look if it was a store. And then finally we'll talk about the future and where we see identity and access management moving. And then we'll open it up to questions. I have Ryan Ward here from Miller Coors. So he'll be here to answer some questions about his deployment. I think that will be very exciting. So you guys can hear from some people out in the field who are actually deploying this and making this all work. And then we'll talk about evening's reception. I think it's Tuesday, and we'll get that going as well. So the past, I would argue. At the keynote, we heard Earl talk about identity management, and he said we're the keepers of identity management. Did everybody hear that? I felt like I was at the Lord of a Ring presentation or something like that. We're the keepers. It's not that, guys. No, it was never intended for us. I say identity and access management was intended for the business owners, the people who need to do the job right. These are the people who need access to finance. I don't know anything about SAP when I worked at Chevron, but I could get people the access that they needed on the finance side or make sure it all happened right, make sure it was the right access, not too much or too little. So we're not really the keepers of what people need to do. We're making sure that the company and the business is not hurt by somebody requesting access or gaining too much access. But we're not the keepers of the access. The access in the business actually knows more about. I worked for an oil company. I didn't know anything about the geological applications. I didn't know anything about the refining applications. I knew they were hooked up to some strange computers and using Rs232 to do what they needed to do. But the keepers of the information are the people doing the actual job that pays for our salaries. So Earl also talked about control, accountability and transparency, and I reversed it. And this is what he told me at a lunch meeting before he changed his presentation. So I have ACT up here. Accountability, control and transparency. What we mean here is control is what we've been doing. That's traditional identity and access management. We're controlling all the resources. Transparency is what we've been doing with the identity management systems as well. We have auditing, we have reporting so that we could see who has access to what. But I would say that accountability is where it's all moving towards. This is making other people besides us accountable for the access. Right now a lot of people use administration tools and they give people rights to an AS400. They'll give people rights to Unix system, to Active Directory. What accountability do they have? What audit and controls are in place? Even if you go through an identity management system, what accountability do you. You have? There's a better way. The problem right now is complexity is the enemy. And this is why we are the keepers of identity and access management. It's too complex. Our users can't do this. It's been relegated to us to maintain. Most of us work in the back of the house. Our face is not in front of a corporation. I know, at least that was the case when I worked at Chevron. I wasn't always out there presenting. So complexity's the enemy. And let's talk about a way to look at how and why identity and access management got so complex. When we look at our magic quadrant, I would venture to say right now, you guys can go out there and talk to a bunch of identity access management vendors. They're all going to do the job for you. They're all going to get it done. You can buy any product, you can make it work, you can will it to work. I would say if you have enough time and money, you can will it to work. But here's the real distinguishing factor is how long is it going to take you to get it deployed and how much will it cost to maintain this and keep it up and operational? And can the business sustain itself? Can the identity management system change fast enough as the business changes? So let's take you through a little history. So the quickest time to Value that people had in the beginning was they were doing things manually and they would set up accounts and they would get a call from somebody saying, we need to set up Johnny or Joe or the HR department would say, I just set up Donna, go set her up in active directory and all these other systems, figure out what she needs. And people would fill out pieces of paper and they would file those pieces of paper and pass them around to the different people and they'd set up those accounts. So the quickest time to value is to do what you're doing today. If it's manual, how many people are still doing things manually? Let me just see a show of hands. Okay, we got a fair audience. Avatr may not be the right solution for you because you're not ready yet. You don't understand all the complexities that I'm trying to describe here on stage. You're just beginning. You're getting your feet wet. We'll talk about where AVATR really excels. So what did people do? They said, hey, we have a manual process. Let's automate that process. Okay, so what did they do? They wrote custom applications. One of our customers who's not up here speaking today, Texas Capital bank, was doing this all in SharePoint. They said, hey, we can write our own identity management system. We could do it in SharePoint. We can make it all happen. How many people are writing their own or written some automation to their current provisioning, deprovisioning process? Yeah, big show of hands, right? Because why? You all have independent workflows, you have independent processes. Your business is not like their business. It's completely different. You could never ever merge it. Right? I disagree. That's not true, but that's the belief. So what a lot of people did was they said, hey, writing our own code is a great idea, but the time to value, to get this exactly the way we want and to get the optimal operational efficiency, we're never going to get there. So most people stop doing development. Plus it's not their core competency. If you're an airline company, you're flying people around the world, you're not developing identity and access management systems, so they turn to some early legacy identity management systems. I'll let you guys close your eyes and fill in the blank as to who you think those companies are and what they do and how long they've been around. But these efforts are massive programming undertakings. Has anyone built a custom house? I haven't, but just, I mean, does anyone know anyone that's built a custom house? I mean the process of building and trying to get all the contractors and everything figured out, that's what these identity management systems were. You were basically out there building your whole thing. They gave you the set, they said, you got this land, let's build it. Then along came some identity management vendors that sold just identity management products. Wow, what a novel concept. They weren't selling the databases and, and all these other wonderful things that the hardware devices, they just sold identity management systems. This was a lot more efficient in terms of getting the system up and operational. But to make it run in the environment it still required programming. So with the avatier solution, the next generation identity management system, we are focused on delivering the fastest time to value with the least amount of cost to run it and to operate it with the highest operational efficiency in the environment. So you might ask, well how do we do that? So let's talk a little bit about that. Most organizations, if they business changes, they have to modify their scripts, they have to modify their code to make the system work, the identity management system work. So they're primarily development systems that happen to have an identity management engine maybe for scheduling and for things of that nature. At avatu, what we said is instead of developing, let's configure the identity management system. Let's have some pre built connectors. I know we're doing an implementation right now. We have a customer they wanted us to connect to Teradata. Okay. To Tuxedo. I mean I'm going to say some things that I don't even know. These things were new back when I was young. So Tuxedo and what else are we connecting up to RDBMS or. So there's just some real old legacy systems. Once we write these connectors, they're there and they're in the product so our next customers don't have to think about it. They just click on a button and connect up to their existing environment. I would say this is what your environment looks like today. You have a bunch of enterprise package applications. Oracle, SAP, PeopleSoft, JD Edwards. I could go on and on. These are your enterprise apps that are deployed, they're running on your servers. You also have built homegrown applications that do specific items for your business. How many people have a homegrown app that's running on an Oracle or SQL back end? Almost everyone in the room. Okay, almost everyone. So yeah, SharePoint, your identity and access management systems have to connect up and manage these two sides of the house. But what's happened in our world, I look around the room. And I see people with iPads, I see people with iPhones, with mobile devices. Most identity management. And Earl talked about this, he goes, it shouldn't be identity and access management. It should be identity for access. Well, I would agree with them, but that's an old school way of thinking of this. It's beyond that. Your identity is not just what you have access to, it's also what's on you and what me as the corporate IT person needs to get back from you or disable if you cause something that requires you to be terminated or as you leave the organization or as you get promoted and move from one organization to another. I need to get back those mobile devices. And then what's happened? Well, we have these cloud applications out there. Some people are putting their ERP out in the cloud, Ceridian, adp, these are all ERP systems that are running out in the cloud. And in addition to Oracle on Demand or SAP, et cetera. But a lot of universities are adopting Google Apps and people are starting to use Salesforce and success factors. So what AVATU does is we bring all this together in one consolidated view so that you have centralized auditing and control over this very complex environment that's growing and becoming more complex. So what I'd like to do now is share with you a couple of video vignettes from a few of our customers to validate kind of what we're talking about in this store. And as we go through that, we'll do a brief demonstration of the store. So the first customer is a Fun customer, small 2000 users. I think when they first bought our product, they were about 1,000 users. There's kind of an entry point where it's like, it doesn't make any sense here, but they bought. They started off with password management. They had another identity management vendor in there. They spent six months with this identity management vendor. They spent $650,000 in professional services. And that wasn't their cost. They couldn't get anything to work. They couldn't get SAP and Active Directory and Exchange working together nicely. The cost wasn't the 650. The cost was, this is a small company. Two thirds of their IT staff was consumed. It was more than two people. It was like six or seven people were consumed in it trying to get this identity and access management going for six months. That was where the true cost was. So what they did was they bought our solution and within six weeks they deployed it with one fte. And I'll let David talk a little bit more about what's going on.

In the heart of the Silicon Valley? Intuitive Surgical is the global technology leader in robotic assisted minimally invasive surgery. Its Da Vinci system enables surgeons to perform complex process procedures such as heart valve and cancer surgery. Like many companies, Intuitive Surgical has an extremely busy IT staff. To keep up with their workload, they needed to reduce the time they spent performing routine tasks.

We use metrics to gauge our ticket counts and where our tickets are coming from. In the help desk, we realized that approximately 30% of our tickets that were coming in on a yearly basis were for password resets. So when you divide that out amongst the technicians, if a technician is spending 30% of their time doing password resets, there should be an automated solution available for that.

As they looked at streamlining IT processes, Intuitive searched for a solution that would minimize their password related account account maintenance.

We first bought Password Station from Avatier and we brought it in and it was a very easy rollout. It took us three or four days to get it into the system and we were up and running with the proof of concept to be able to change passwords from a user endpoint at will. So after using Password Station for a while, we realized the benefits from it. IT freed up our technicians to be able to do other work and we wanted to start using Avateer's account setup, role creation user management tools as well as the termination tools. Since we already had avatir's existing infrastructure in house, it was very easy for them to come in and turn this on for us and get us started in creating privileges and roles that define what a user gets when they're onboarded.

Intuitive Surgical implemented avatr's identity management suite. The software sits on a server between their HRSAP and Active Directory. HR enters a new employee's information and Avatier's identity management suite detects the information and makes the appropriate entries in Active Directory and the custom application.

So avatr has really benefited us in that it's free freed up our IT support technicians from having to do tasks like password resets and user account setups and allows them to go and do other types of work. We've gone from an average of 1 and a half to 3 hours average for user account creation and setup across all our systems to under five minutes for any given user in the company for full access and account setup.

Avatr helped Intuitive Surgical automate routine IT processes, freeing their staff for other tasks. What can they do for you? Avatir Agile Efficient Identity Management.

That was David Loudermilk. That was a very interesting Deployment we had there with him. I'd like to go into two others. One is from A.J. gallagher. We'll be talking about that here in a second. A.J. gallagher is one of the largest reinsurance out of Chicago. 12,000 users about nine months. Let's listen to what Phil has to say.

What I need to worry about is my end users, the business, how we get people into our business quicker.

Arthur J. Gallagher is a global insurance broker brokerage headquartered outside Chicago, Illinois. Business to business AJ Gallagher has about 400 locations worldwide. Gallagher serves a variety of industry Energy, shipping, construction and environmental.

We have five major divisions over the course of the last five years each of these divisions had their own help desk. They've had their own components components where they did all of their own it. Part of our strategy was to centralize and build out shared services. One of those strategy components was a global service desk.

The global service desk fields calls domestically and internationally across all divisions.

My desire around having a dot net platform brought in avatier. We pitted one of the larger identity management vendors up against Avatier and we said we have four major systems we want you to connect to, provision and remove users.

Ames from AVATR automates daily operational processes such as user provisioning and deprovisioning, account management, self service, password reset and strong password enforcement.

The other provider was unable to connect to any systems. After one week with avatier we had provisioned and removed users from all four systems. Gallagher one's a vision that I had around creating a single interface for all the employees of Gallagher so that they could come in, gather the data that they needed to do their job, access the systems that they needed via single sign on request, access to systems via avatr, reset their passwords or work within the cognos and financial information that we have all within one interface. Instead of having this disparate group of interfaces where nobody really knew where to go.

With a track record providing advanced user provisioning products to thousands of organizations, avatr draws on first hand knowledge improving the user experience.

With avatr you have a great identity management system. It's very intuitive and very easy to use. We Launched Password Station 11 2011. Within three weeks we had 9,000 people enrolled. Our password reset calls to the global service desk dropped dramatically. The on site project support and then the developers themselves as we worked with them on customizations couldn't be better. I don't have a relationship like this with any other product vendor currently. If I could have more relationships like this, I'd be far more successful.

You guys. AJ Gallagher is a gartner customer. And I have to say, you know, the way it works here, you guys call the analysts, the analysts, they listen to what your requirements are and then they say, well, you should look at these three or four vendors. And I can tell you from experience, Avatr gets the ones that nobody else wants. So in that particular case, they had J.D. edwards, they had. Do you guys remember Lotus Notes, ID files? Yeah. Fun stuff. As 400. They had just a bunch of really hard technology that we needed to integrate. So that was a pretty good case study. What I'd like to do. Ryan Ward from Miller Coors is here. I'd like to. Ryan's going to talk more about what they did at Miller and Coors. They were two separate companies and he'll be available for questioning after this presentation.

In 2008, Miller Coors entered a joint venture to create the second largest beer company in America, Miller Coors. With 7.5 billion in annual sales, the company employs around 9,000 people and outsources another 4,000. In addition, Miller Coors has a large network of distributors, and managing those relationships is a key part of staying competitive.

Coming out of the joint venture between Miller and Coors, we had a number of consolidation issues that we had to deal with. Multiple systems, different directories. People were logging into the Cors systems and people trying to log into the Miller systems and then vice versa. And they didn't know which accounts to use, what passwords to use with that. So the main concern was really how do we get those accounts to be synced so people can log in successfully.

Miller Coors turned to Avatier, the developer of Aims. The solution automates daily operational processes such as user provisioning and deprovisioning, account management, self service, password reset, and strong password enforcement.

As the head of information security at MillerCoors, it's my goal to ultimately secure our systems, make sure we're meeting compliance needs. Avatr is helping me do that. We are currently at about 30 different connectors. That includes SAP systems, AIX servers, multiple Active Directory domains, SQL servers, Oracle servers, DB2 databases. It is covering just about every application and system we have in place. Security has definitely improved. I mean, first of all, it's unified our password scheme so that we have everyone synced across their accounts. The biggest improvement, though, is definitely around provision and deprovisioning. So we have extreme confidence now that when someone leaves the company, their account is being terminated, obviously with distributors, they're the ones who order the beer and pay our bills. So we really needed to make sure that they had a Single face to Miller, Coors versus Miller and Coors. To enable that capability, we engaged avatier and basically came up with a single front end for the extranet environment. And that front end from avatir actually enforced the security so we could stop sharing accounts, we could stop people from having weak passwords. So it was a huge win. And that project was actually delivered in about three months time. When we looked at the implementation cost and the time to actually deploy Avatir, the other estimates came in at about 400 man days of effort where Avatr came in about 100, 150 man days of effort to actually implement the solution. Now that avatier has been deployed and we are eliminating those other solutions, we've actually reduced our headcount by two people just in supporting our identity and access management solutions. Improve the operations of the solution as well as increase security at the same time.

The AIM suite from avatir complete, proven, fast efficient. While the competition develops, avatier configures.

Thank you. So those are a few of the customer case studies vignettes that you've seen. We have many others. Starbucks is a customer of ours. You see me up here drinking at Starbucks, I would be drinking a beer. But it's a little bit early in the morning right now today. So they're using us at 15,000 stores around the world, 150,000 employees. Every store you go into has the AVATR product installed or they're accessible, I should say. So what I'd like to do now is prepare for a demonstration of mobile identity management, how we see it in the future along with an IT store. But before I do that, I want to talk about role based access control. Control everyone. I think Gartner has led us to believe, and analysts and the industry has led us to believe that this is an absolute requirement. How many people are doing role based access control today? You guys have your own project teams, you're mining who has access to what. And do we build a role based on that? I take a little bit different approach, guys. I think our back that we're doing today as we're doing it is dead now. That doesn't mean it's completely dead. Okay, there's still rbac, but rbac, the way we think about it is dead. You guys that are on these big projects know how much it's costing you. You know how much time it's taken you. You guys, I don't need to reiterate any of that. What I do need to do is have you think of a different way of Doing rbac, maybe a simple, lightweight rbac, what we call at avatir birthright roles, so that every department, every division gets their birthright role. And that's not always true. I mean, in the case of intuitive surgical, they were hiring 2,000 salespeople. They needed to have full RBAC roles. Well, we gave them full RBAC roles. We hooked it up to SAP and we provisioned those salespeople exactly the way they need it because they have high turnover. They go in and out. 600 people a year are terminated from the sales side and they're hiring 2,000. So they're growing very rapidly. So RBAC needs to be used, but use it more strategically, more surgically. So before we begin the rest of the presentation, I need you all to put away what you know about identity management. I'm going to flash you all right now you need to forget what you know about identity and access management, because if you take any of that into the rest of this presentation, this isn't going to make any sense to you. Okay? So a lot of people know we hook up. We build our RBAC roles, we hook it up to an HR system, we automate it all, we go to sleep, maybe throw some workflow in there, maybe some access validation, things of that nature. I say that there's a different way, and that is you can't manage what you can't see. You all are managing today an IT store. You have aisles. Has anyone ever walked into Home Depot and you know you're going in there for something? I need a light bulb. Something very simple. Right, But I'm in the lawn and garden aisle. Okay, Do I ask someone over there to help me out with this light bulb or this fixture? No, I want to go talk to the people in the electrical aisle. As a matter of fact, I want to talk to the people in the electrical aisle inside the lighting department because I want this fan or I want LED lights. Your ID department's exactly the same way. If you have a question with SAP finance, you want to find the SAP group and then go talk to the finance person. And they're not the AK person. Okay? Those are your owners of the different aisles. Okay? Think about that. These owners in these aisles with the avatier solution become workflow owners by just building out an IT store. Your workflow, your approvers could be part way there, not all the way there, but part of the way there. Think of it this way, too. Your access validation can also be determined because if you pick up that light bulb, I need to know everyone else that. That bought that light bulb from that person or took it out of that aisle. My question to you is this. Can your mom and dad order a TV on Amazon? Raise your hand if they can. If they can't tell, ma'. Am. Okay. A lot of people can. Their mom and dad can order that off of Amazon. Can your kids download an app from the Apple App Store? Yeah, show of hands. Kids can do this, right? So why can't our staff, our employees, be able to order what they need from an IT store? Why can't we visualize that IT store and share that? So that when I define something in the store as a business owner, the IT people understand what it is. We can index it, we can describe it, we can put hyperlinks into it, we could Wikipedia it. We could put all this into a rich store. Maybe from an ITEL standpoint of view, we would call that a business services catalog. Okay, how many people have a business services catalog? One, two. And where does that reside, guys? Is that in a spreadsheet? Where does your business service catalog reside? A database or online like Amazon? I like it. All right, anybody else who's storing it in a database right now? Anybody? Okay, very good. So let's take this now and we'll see a demonstration of where avatirs take in their store. So I'm going to do a brief demonstration. Very good. All right, what you're looking at is our main menu of the avatr AIM suite. It can be purchased as one product or you can buy modules. You see the password management module up there, the items in green. You see the user provisioning module, which is user management. It also has RBAC capabilities, things of that nature. Then we have a compliance governance and a group enforcement project. And then all the items down here are more shared items that are used across the identity and access management. So this would not be something that your end users would see, but more of what your administrators would see. I'm giving this demonstration on the iPad. So I'm going to click on my identity enforcer icon. And what this is going to do is take me into an environment where I can start to manage my users. Where I can, as the manager, I could be the end user here. I could be a manager. I could be it. You can see things, traditional things like user management. This is what a lot of people are doing today. I would personally close that icon, hide that from everyone. You can see some new ideas like user request. What's that? You can see Request access, and you can see Select Manage user. You can Also bring things into this portal from websites. So I have the Avature website, some connectors, but you can integrate this with the portal very easily. Everything that you see here, it looks a lot like an Apple iPhone. You can move items around, you can drag and drop them. This is all controllable through OU delegation by group or by user. So this screen can completely be different based on who you are. We can also lock down the screen in the look and feel so that everybody could have their own portal. Unique portal. Let's go into the view here. Notice I can go from small icons to large icons. And here I can have more of a description of what's going on in my environment. Now I'm going to walk you into Home Depot, so you'll see all the aisles. But imagine if I know that you're an electrician so that when you come into my store, I hide all the other aisles. So I know you're an SAP finance person. I'm not going to show you marketing or anything else. Right. And again, we leverage the groups and the OUs and the users information to be able to do that. So let's go select a user to manage. So we designed this for the US Air Force. It's a million users. They're one of the largest identity and access management rollouts underway right now is with the U.S. air Force, our customer. And I'm going to click on Steve Childs. Okay, so now I'm logged in as a demo administrator. I'm managing Steve. I'm going to request access for Steve. So I'll go in and I'll just click on this from my iPad. And now I see a store. I see all of these aisles. I see things from laptops to mobile devices to Windows Active Directory to Google Apps to Oracle financial apps, PeopleSoft, Salesforce, whatever you want to display, whatever your business service catalog is, and as it pertains to that portion of your user community, you can display to them. In this case, I'm going to request something. As I mentioned, we believe that the merging of identity access with assets are very important. So I'm going to go into mobile devices. And now I can see the mobile devices within my identity department that are authorized for my employees to purchase or request. I also show what it costs them in US dollars or euros. I don't know how many international folks we have here, but this is all internationalized, localized. So I show what you can do here. And then up here. Notice that there's also an item. I'll go ahead and add the iPhone 4 to the cart. And when I select on this, now I have one item in my cart. And if I go over here to Assets, I actually show a budget per employee. So this employee has a $10,000 budget. He has 399 in the cart. And it shows what the available budget is. If there are items pending or approval, that would also show up here as well. So it's a way that you can allow people to go buy what they need, but don't give them the full keys to the kingdom. So let's continue shopping. Let me go back to this idea of the store and let me expand this to large icons and notice what we've done here. Now we have the summary, plus a description, plus we have hyperlinks to items that we want our employees to know about. What's the badge policy? I shouldn't share this or give it to my wife or kids. You can't come in on the weekend unless you request badge access. So that's what you have here. Let's go into Active Directory. And I have Active Directory organized a little bit deeper structure. So when I go into Active Directory, I have it organized by country code. And I'll show you some stuff that we're doing for the U.S. air Force. So let's go into the country code. All right, so you can see Canada in here, Germany, France. Whoops. What did I just click? Sorry about that. We're getting there. But yeah, there's Canada, Germany, et cetera. I can scroll through. So let's just click on Canada. Inside Canada, there's items like create invoices, be part of the marketing team, or write checks. So this would give me access to Active Directory groups that would enable writing checks, maybe integrated with some of the Microsoft CRMs. But let's go and look at what we've done for the Air Force. So at the Air Force, you have people with GED education all the way up to rocket scientists working for the Air Force. The Air Force is organized by major commands. So what you're looking at is a major command. But when you go down into a major command, whoops. When you go into a major command, you can see the actual Air Force bases. So here's Langley, here's Shaw, and we can add additional bases. There's over 122 different bases in the US Air Force. Notice you can have rich text where you actually have a hyperlink to map that shows you where Langley Air Force Base is. And all of this is just integrated because we have a simple web interface to allow us to leverage this store, I can also go to the Langley homepage. If I click on Langley now, I see the access that I need. Now, as a person within the Air Force, you would only see the bases that you have access to. So it makes it very simple for them to go browse and select the access that they want or access to SharePoint. Alright, let's go into this cart and check out. All throughout this store there's rich features like Favorites and other intelligence that we're gathering as people are using the store. So in this store, notice that people can request an item. There's an informational button here. If we click over the iPhone, we can start to describe a little bit about the owner. So here's the owner of the iPhone and you can find out what iPhones are used for. It's only used for salespeople. Well, maybe I shouldn't request this if I'm not in sales or if I don't need it for this particular purpose. Notice that there's also form support. All the forms that we develop are done without any HTML programming, but they're all exportable to HTML. So you guys can customize these forms. But this is a way to send rich text information along with your request to the IT staff or to the people who need to approve the request. So let's click on 500 minutes. We can say send to home. And we'll save this request. We can type in our justifications. Notice also we can say we only want items for a given time. So if people need access to the SharePoint only for the weekend, you could give them access to the SharePoint only for the weekend. So I'm typing in some information here and now I'll submit this request. And this is where today's technology for Avatr stops. We're going to stop that demo and I want to fast forward a little bit to the future and some of the technology that we're working on. Imagine being able to be at lunch or you just got home, or you're out getting a cup of coffee at work and your cell phone rings. You get a little page and the page tells you, hey, look, some people are requesting access. I've got this approver app here using push notification and they need me to assist them. So you can click on your application. And go into. You see lots of different requests, requests for deleting users, requests for privileges, moving ous, maybe changing the mailbox size. Lots of capabilities that you can keep adding to these requests. There's no limit to the amount of requests that you can get or have, but eventually you get to the point where you see the items that are requesting. Here's Steve Childs. There's that iPhone4, here's Langley, here's the write checks. Okay? Very graphical, very simple to understand. If I click on the Apple iPhone, I'm logged in as an administrator. So I see some more items up here besides just approve or deny. But your typical business owner would be able to approve or deny this request. They'd see the comments, the justification, they'd see who it's for, Steve Childs, and when it was done, it's an ad. They could type in their comments, they could change the duration, or you could turn that on or off. They see the workflow that's occurring and they see the data that we filled out four gigs, send it to the home, all of the information that we filled out earlier. So what they can do is approve or deny. But since I'm logged in as an administrator, I could maybe send a reminder to the next workflow person, say, hey, it's been seven minutes, you haven't approved this yet. Or I can cancel the request. Or I could say, skip this approver and go down to the next approver. Or me as the IT person, the keepers, as Earl called it. I can bypass all this and approve it if I want to allow that again. You can turn on and off whatever buttons you have there to give the desired result. So I'd like to end the demo with that and we'll go back over to the presentation. So this is moving more towards the future and where AVATIR is taking identity and access management. When I look out beyond what we're doing today, I look at a trusted identity fabric. I had somebody in the audience say, hey, Nelson, define what you mean by a trusted identity management fabric. I wish I could. I know it's not what we're doing today. I can define it that way. There's gotta be a better way of doing this. I know some of the components of that trusted identity management fabric. I know it's gonna be not only cloud based, but multi cloud based, which radically changes the way you write applications. It's easy to write an application, throw it up on Amazon or throw it, but how do you get it to work across Amazon and Rackspace and all of these other providers out there? Very different request. I know that identity and access management will be offered as a service and you can potentially buy or consume what you want in this trusted identity management fabric based on what you use, or you can have it Dedicated, you can have your own electrical. I know that you'll be able to do whatever you need to do from anywhere. That will make your life a lot easier, freeing you to get access validation done maybe while you're at home or at lunch. I know that single sign on as we know it today and federation, which is a whole separate discipline. I think we have to fill it out when we apply for the user provisioning Magic Quadrant. I know that those are going to become APIs. I know that I will be able to use my Facebook ID to log into the corporate environment or my Google id. I know that your corporate environment or id, the active directory ID or whatever it is that you use that's just merely going to be there to get you access to what you need at work. But who you are and how you're known and who you project, that whole keynote is changing. It's not just what you have. So why not embrace that? We're going to have to embrace it at some point and allow it. But we're not going to write, we're not going to buy a single sign on product. You're never going to do that. It's just going to be part of the infrastructure of your identity and access management vendor. It's going to be part of the application. I know this. Steve Jobs said simple can be harder than complex. You have to work hard to get thinking clean to make it simple. But it's worth it in the end because you can move mountains. Remember what we were talking about earlier? Everybody's written their own custom identity management system or have modified their own custom identity management system to fit into their business. And I'd argue you don't need to do that. I was at a German conference and a person from BMW got up and said, oh, none of these systems will ever work in our environment. I said, in the future you'll build a store. You're running a store. You can't see it. It's not visual to you today. Build your aisles and set up your infrastructure that way and the identity management system can run your business. We're all running in a store. So in the future identity management as we see it, and as we think of it now, at least avatir this is a short term solution. Steve Jobs always talked about the post PC era. What does he mean by that? He sold laptops and imacs. He still does, or still the company still does. But then he created the ipod, the iPhone and the iPad. This was all the post PC error. And that's what he was really focusing on, he was simplifying why do you need a keyboard? Why can't we use a spinner wheel? He was trying to figure out what's a quicker way to make this all happen. And that's what I say we're at right now with identity and access management. What's driving that is the accountability in the act slide. Remember, we had control, we have transparency. But accountability means that everything becomes a request. No more do you have your administrators doing things without somebody else saying, yeah, yeah, that should be done, that's good. In the Air Force, what I learned is that there's two person security. You've heard of two factor security? There's two person, there's more than two person security. Two person assurity. You can't launch a missile unless you have the codes and you've got two people that are following the directions. That's where the IT world is moving. You need that assurity. You need the assurity. They should have the access that they need. The business owner knows that you and IT can give it to them. You two can come together and allow that to happen. So in summary, let me just conclude on a couple things and then we'll open it up to questions. In the trusted Identity management fabric, there will be dashboards, identity management vendors will be providing dashboards. And the dashboard is what's going to distinguish one identity management vendor from the other. What bubbles up to that dashboard is going to be the unique distinction and how that is organized. Let's think about this for a second, guys. Right now we're doing access validation, so we're verifying that people should have the rights that they should have. But if we keep validating, Johnny has access to report, write checks, that's pretty laborious. Maybe we can use some pattern matching, some pattern intelligence to say Johnny should always get access to write checks. But hey, I noticed that he also got the ability to print invoices or some other new. Right, let's bubble up the exceptions and start to attest to the accessions. In a trusted identity fabric, regardless of what identity management system you're managing, the fabric, the console can sit on top of that and, and look for patterns and see patterns and then bubble those patterns up and deliver them to you on your mobile device and say, hey, Joe just requested access to or has gained access to something he's never had before. That's also flagged as a critical item within my company. So in summary, you can't manage what you can't see. Building a store is not something that you're doing today. It's something you're going to have to do in the future. You're managing a store, you're. You're putting items on the shelf, you're taking items off. The laptop you're using today is not the one you used three years ago. It's not the one you're going to use three years from now. There's applications that you have in your environment today that you didn't have three years ago. There's apps that we haven't thought about that are going to be available three years from now. You're going to need to give those employees application access to those applications. So in conclusion, the best identity management system is the one that's operating. Get it operational, make sure it's understandable, bring it to the front of the house. You're going to get more visibility. You'll get more pats on the bat, more kudos. I know this because that's what we did for password management. And I know what it's done for our company at major organizations like Halliburton, NASA and Starbucks and espn. A lot of major organizations in it put them front and center. The same is happening with identity and access management. It's not a back of the house application. It's one that belongs in the front of the house. It's one that defines your whole business. So what I'd like to do now is bring Ryan up here and I'm going to open it up to questions. I don't know if we have a roving mic or not, but this is a small enough audience that you guys can just ask whatever questions. Ryan, deploy the Avatier solution. You're mic'd up, Ryan.

I should be.

There we go. Very good. So he deployed the Abatier solution at Miller Coors. I think it would be good for you to hear from him about the trials and tribulations. It was a very agile method. What did we. The Scrum meetings, I remember two or three times a day.

Stand ups.

Stand ups. Yep.

Before we get to that though, did anyone go to the reception last night and notice there were no Miller Coors products? Drink wine. Anheuser Busch is the enemy.

That's okay. At our reception. There will be MillerCoors products there, so we'll definitely have those at our reception. A couple things I know some of you are leaving. We do have shirts if you're taking off. And be sure to stop by our reception Tuesday night. The key thing at the reception, the first hundred people. And since there's only about 100 or so of you here. If you're there, you get a goodie bag. We call it the jet lag bag, celebrating what we've done for the US Air Force. There's some great goodies inside that bag for you guys. I think there's a rumor that there's some Rumbauer wine in there as well, if you guys like Cabernet. We're from the California region there, so go ahead, Ryan. I'm going to open it up to questions. So you want to talk?

First of all, are there any questions to start off with?

So repeat the question. So how do we force people to put what's in the cart that we want them to have in the cart, not anything else? Is that the question?

Thank you. That you are. That's loud. That you're actually having them request the access that we need. Because one of the things we find is people think they ask for everything and oops, I forgot the shared drive. Oops, I forgot, you know, those types of things.

Well, when we started laying our whole store out, we involved the business very heavily. And really, I tried to get it away from it. And the people we targeted on, we actually looked at our old identity management system. We basically ran a report and said, who are the most common requesters? So by grabbing those most common requesters, getting them in a room and demoing some of the stuff that Nelson showed today, it kind of jumped out in their mind and they actually kind of dove in and took ownership of the solution. They said, you know what? For my groups, I need xyz. Luckily they knew their groups and the people that they were requesting access for enough to also say, you know what? I'm always requesting access to put them into the finance group, and they should be sitting in this organization unit. So out of that information, which again, was heavily gleaned from actually getting the business involved, we were able to then map that and say, okay, all of these items and these roles only allow the finance group to actually take a look at that and see those visible from an approval standpoint. Then we targeted and actually made application owners responsible for the primary approval for access to the applications. So we do a manager approval first, then it jumps, and the application owner has to actually then approve that access. That to us is pretty much, we standardized on that approach across every single application. So we didn't just, you know, say, okay, only manager here and sometimes application owner here. It just got a little bit too confusing based on the fact that we have the application owner as the final approver. Then that's where we get into using Compliance Auditor, which is our access certification system. And we then have the application owners go through. They'll see everyone who's requested access for their application. They can basically click through, just like Nelson was kind of showing approve or deny and validate that that person should still have access. Because it is critical to remember that. I think, Nelson, you mentioned the person that you needed to write checks. That person could move in 90 days and now be in a totally different department. So it's really critical that you give the application owners the information they need to. You know what, wait a minute. This guy's title has now changed. Even though they may not, they may have known that person at the time, but giving them that information at the time of then doing those certifications really allows them to say, you know what? Yeah, this guy now moved from finance to supply chain. I need to revoke this access for writing checks. And I don't know how it slipped through to begin with, but those access certifications really help with the whole approval and validation part of it, if I may add.

Real quick. Follow on and then we'll get to some more questions. I just want to add, Miller Kors has also added a feature to the product called a reviewable cart. And that's new. So before you just shop and you had the cart and then you check out and you're right that those type of things could happen. But now it goes to a review committee that verifies that it is not for all things. You can flag specific items in the store and say, this is reviewable, these are not reviewable. So these items need to just get that extra step of validation to make sure they pick the right SAP role or particular item that they're looking for.

And we're using that specifically in the SAP world. So we have a pretty large SAP deployment that's being integrated into the AVATR suite today. There'll be about 120 connectors specific to SAP. So those are 120 unique clients. And all access is being basically granted through ames.

And we're using CUA and BAPI calls to integrate with SAP the right way. So next question, right here.

Do you use this tool or a.

Different tool for giving access to people that are not employees, such as maybe.

Distributors, shippers, trucking firms?

Yes. How did you fed that?

Yeah, we have two instances of AIMS actually deployed. And the first project that we rolled out was specifically for our business partners. So distributors, carriers, agencies. And that rollout, that was the one where we were basically within two And a half, three months to create an entirely new front end, get all the distributors logging in through that front end, enforcing the password security. And then we also, which I think is really slick, we handed over the keys to the castle of application access. Two site managers at every single distributorship. So they have a key IT person on their staff that actually goes out to the AIM suite, chooses the access for their people, assigns roles to their people, and it's all automated on the back end. Prior to that, these distributors were faxing sheets into our service desk. It could take two, three weeks for them to get the access.

There is no pressure from us. The CEO basically said, well now we bought these two companies, they're merged, we have our user, our distributor conference in.

Vegas and you have to have it.

Done by, you have to have it up and running by the system.

So that, yeah, we were forced. And that was exactly the situation where I mentioned in the video where the big Java stack companies, the big names that you'll see around here were coming in at 400 man days of effort. And like I said, I'm going to say slammed it in because we did slam it in, but it worked. I wouldn't recommend that approach going forward, but I don't know any other solution that we could have pulled that off.

$7 billion worth of beer is basically flowing through that distributor network. Go ahead.

Good presentation, Nelson. As you said, any of the products will meet most of our requirements. So Ryan, the question for you is what were, let's say the top three? Was it the user experience? Was it time to deploy? What exactly? Maybe top three or top five, where you had to pick this one versus the big 400 day implementation?

Yeah, the free ones. Ryan, why'd you pick the one that cost money versus the ones that were free?

I came from the development focused world that Nelson touched on at the beginning and we had nothing but problems. Anytime we wanted a customization, you basically couldn't do it. So Nelson mentioned if business process change, you should be flexible enough to just go in and configure that change in the the system. Well, essentially as business process has changed on our end at Motor Core's through the consolidation, the custom developed solution, we just lost those capabilities. So we basically lost all the functionality that we wanted. So really it just steered us in. The UI was great, very easy to use, but the time to deploy and the ability for me to actually go in if I wanted to and just make a tweak in a day versus filling out change requests, testing code and everything else that Made it a no brainer. Support is really easy.

Yeah. And we still have all those controls. We have a dev, a test and production environment, and test and production environments at metal cores mimic each other behind an F5 load balancer. But it just allows you to move the identity piece of this the whole discussion. I like the discussion here. We're not talking about programming, we're talking about how do we change the business and the way we think. So I really appreciate those questions.

Next.

Yeah, hi, I'm just curious. So the interface that I saw was, you know, pretty and you can throw things in your cart. Do you find that you have people requesting things that they don't really need just because it's there as an option?

Yeah, we've, you know, I mentioned I took the approach of involving the business on this is the new solution we're going to. And look at all the cool stuff you can do in every phase of the AVATR projects that we have actually gone through. I've added scope that was not in the original requirements for the project, mainly because it is easy to get these things set up and added. However, there are the things where you've got to say and kind of step back and say, you know, what is that really worth it? You know, am I going to put the effort in to put that button there? When it's just a simple phone call and only two people use the app, those things get pushed to the bottom. But my ultimate goal is absolutely everything that needs to be access granted should be in our AIM suite and that's our approach. So we totally opened it up and we received a lot of feedback and I think we have 100 applications in our corporate deployment right now.

At AJ Gallagher, they took a different approach where it's very locked down based on business units. So only the business unit is requesting. And that demo would be a lot less eye candy if I gave that demo. You just come in, you see the two or three requests that you have. So you really need to gauge it based on the department, the level of sophistication on your users that you have and what you want requests on. The bottom line is you need the accountability. The other thing that I want to say is Avatar is building tons of analytics into the store, is opening up a world of information. What department's been requesting these items, what location is requesting these items. Now we can start to really think about this intelligently. I know identity intelligence was a big theme last year. So again this year I'll just make.

One more comment on that most difficult piece of kind of building out. What you saw here is trying to figure out what icons to put on all those buttons. That's really frustrating for us. We're trying to figure out how many beer bottles do we have to try to put on the icons A lot of applications don't have.

We do. In all of our proof of concepts, which are four days, we have graphic icon builders, so we're doing a large one right now, and we make sure that the icons really match those custom applications that you have, and that looks very tight. We also make sure people define everything that's going into this business service catalog. So you have a description, hyperlinks, searchable items. I think we're out of time. Do we have time for one more? Are we done? Who's the keeper of the time over there? We're at zero. We're at zero. We have five seconds, actually, according to this thing. Oh, it's going back up now. All right, well, I want to thank you all, please. A couple of things real quick, guys. I just want to show you this. I don't know if this is still up here. Stop by the Commander's Club, pick up your bag. The first hundred people, get a nice bag. There's some fun stuff that we'll be doing. That's Tuesday night. And then make sure you grab your shirts on the way out. Okay. And thank you all for your time. I really appreciate it.

Cool.

Yeah. Good deal. Yeah.