Nelson Cicchitto, Avatier CEO, Returning Identity and Access Management (IAM) to the User HDI 2012

I appreciate all of you joining us. My name is Nelson Checchetto. I'm the CEO of Avatier Corporation. We're a premier sponsor of hgi. We're happy to be here again as a premier sponsor and happy to have you guys here this early in the morning. I know it's hard. I've got a little bit of voice left, so I hope with the microphone I'll be able to give this presentation. But today we're gonna be talking about returning identity and access management to the business user. We believe that's where identity and access management was originally intended for. So we'll start the presentation here. Identity management as we know it is being shattered. So everybody has concepts of what identity and access management's all about. And I guarantee that whatever pre notion you guys come in here thinking, this is how identity management should be done, it's changing and it's evolving as we talk. So today I'd like to offer a different way of managing risk and providing access to your end users. But before we get there, I'd like to talk about a book called the Innovator's DNA. It's a book that we read at avatir. We recommend all of our employees take a look at it. And it's all about innovation. And avatr's an innovative company. And what we do is we encourage our employees to innovate. And to do that, you need to have courage to innovate, which means you need to challenge the status quo. As you look around you, you need to say, hey, I think we have something that's different than everybody else. I'm not satisfied with the way our help desk is being run. I'm not satisfied with the way our IT systems are being run. What can we do to be better? So that means taking some risk. How many of you do that today in your environments? How many of you try to continuously improve the environment that you have? Well, that's very good. Then you guys are at the right presentation. For those of you who haven't or where it's difficult to improve the task, Then I'd like you to bring some of this back to your management. You need to adopt some different behavioral skills, and that is you need to question what's happening in your environment. You need to observe not just items in it, but items outside of it. You need to network with people, which you guys are doing at the show here. And then you need to be able to experiment and try different ideas. So there's behavior skills that you have to adopt. If you're going to innovate and then you need to have the skill to pull all of the things that you've learned together and associate them and that creates an innovative idea. And that's really what we did at avatir. You'll see that in today's presentation. So our agenda for today, we're going to talk a little bit about identity management in the past, where it is today. We're going to share a couple video vignettes with you from customers that we have and then we'll give you a sneak peek presentation of some of our current technology in form of a quick five or ten minute demonstration. And then we'll talk about the future of identity and access management as we see it at avatir. So the past identity and access management was never intended for, was intended for your business users to get access to what they want and what they need to do their jobs. The problem is it's been so complicated that we needed IT people and engineers and programmers to make all of it work. So identity management was about the bottom two items, control and transparency. And most systems out there provide that today. And that is they'll give you control and they'll give you transparency over what is happening and who's accessing what, who has access to what. But what abateurs added to this is accountability. And accountability is making sure that not just one administrator, not one help desk person, is able to make change on their own. That's not very accountable. Accountability is about sharing responsibility among a group of people. And that's what we're going to show you today. So in the past, complexity was the enemy. These systems were just designed in such a way that I was talking to a few customers yesterday, they said, nelson, anytime that we need to make a change, we have to pay developers to come in and make a change to our identity and access management system. As the business evolves, we have to spend money. That's not what identity and access management should be. It should be able to change as your business changes and the business user should be able to change the identity management slide or recommend changes and you should be able to implement it without any programming or code. When we look at identity and access management, we look at an access and that is time to value. How quickly can we get a solution to the end users versus operational efficiency? Operational efficiency is how much does it cost to maintain, how much time does it take to maintain the system once it's up and operational? When we look at the environment, what we see is the quickest time to value is to do what you're doing today. If you have a manual system, right, it's already in place. You fill out a form, the form's handed to the help desk people, it's maybe then handed to the network administrators and they go create the accounts on active directory, Microsoft Exchange, Lotus Notes, whatever. You have PeopleSoft, SAP, Oracle, you guys are familiar with that process and that's a manual process. What people determined was the manual process is inefficient. So let's develop a solution. And a lot of people went out and they said we're going to build a solution in house. I talked to a large chip manufacturer, you guys would all know the company I'm talking about. And they had I think 30 people in their environment that created an in house identity and access management system. Had some great features in there. It was missing some good features as well, but it had some really cool features. But you have a group of 30 people managing the identity and access management system. That's inefficient, okay? And it was difficult to maintain. You had to have those programmers around, you had to document the process. So what a lot of people did was they went out and they looked for early legacy systems. You guys know the big name systems out there, the IBMs, the CAs, oracles, they're all the early legacy identity and access management systems. Very expensive, very hard to deploy, very costly. And what they found out was it wasn't much better than a custom solution. I just have a bunch of building blocks and now I have to customize the solution. And this is where the consulting dollars come in from PwC, Accenture and all the big five consulting companies. So then they looked at legacy identity management systems, kind of the next generation, a little bit lighter touch. Some of the vendors are out there on the trade show floor but all of these systems are still scripted. There's still a lot of programming to make the system operational. To integrate with your help desk ticketing system typically requires scripting or programming. So what happened was Avatir said there's gotta be a better way to provide a solution that can be installed very quickly and provide the user with access that they need very simply and have operational efficiency. That's similar to our self service password reset solution. Avatier Self service password reset's being used by large companies like Starbucks, Marriott, Halliburton. You guys have heard of a lot of these large organizations. The system just runs. A lot of people don't even know that it's Avatir in the background providing self service Password reset. We wanted to bring that same technology to user provisioning, access management, deprovisioning of the user accounts and assets. So when we look at the next generation of identity and access management, we have to compare and contrast it to the the competition very scripting. The competition is very script heavy. Lots of programming, lots of development. This is I think some xml. This is typical of what you have to do to get existing systems up and operational. With Avatier, we're proposing a script list system. We try to avoid as much scripting as possible and turn it more into a configuration based system. So configuration over development for as much as we can do. And if we could do everything through configuration, we would. Obviously people have custom tasks and custom processes that we need to be able to integrate into. So we provide web services as well. But mainly we try to do everything through configuration. So when we look out at the world we see an environment full of systems like Oracle, SAP, PeopleSoft, IBM, AS400, Unix systems. This represents the package applications that a lot of your environments have. Most identity management solutions can handle this. They have connectors or they hire consultants that write connectors to these systems. Some of the identity and access management solutions also integrate with your homegrown solutions. But it costs a lot of money to perform that integration because there's lots of custom scripting, programming, screen scraping, whatever they can do to integrate with that custom solution to be able to create the users and terminate the users. Avatier's developed a solution that limits a lot of that scripting. It's programless. But none of the identity management systems really go out there and look at the third level and that is we have all these mobile devices now, right? Bring your own device to work. We need to be able to manage those devices as well and be able to manage that as part of the ecosystem, your identity ecosystem for your employees, contractors and vendors. Add to that cloud applications like Google, Salesforce, Oracle on Demand. A lot of people are also having to deal with cloud applications. Most identity management solutions don't go beyond the borders of your internal applications. So what we've done at avatir is we kind of sit in the middle and and provide centralized management and auditing and control and risk mitigation across all of this. So I have a couple video vignettes that I'd like to share with you guys. These are customers that had existing identity and access management systems in place and then found Avatir and swapped out the existing solutions. All right, so the first case study here is a company called Intuitive Surgical. There are about 2,000 employees. They spend about six weeks with us, one and a half FTEs to manage the system. SAP client, SAP on the back end, tons of roles. I think they have NetSuite and Salesforce, a combination of both NetSuite and Salesforce. So we'll talk a little bit about this customer. They're growing very fast. So here we go.

In the heart of the Silicon Valley, Intuitive Surgical is the global technology leader in robotic assisted minimally invasive surgery. Its Da Vinci system enables surgeons to perform complex procedures such as heart valve and cancer surgery. Like many companies, Intuitive Surgical has an extremely busy IT staff. To keep up with their workload, they needed to reduce the time they spent performing routine tasks.

We use metrics to gauge our ticket counts and where our tickets are coming from. In the help desk, we realized that approximately 30% of our tickets that were coming in on a yearly basis were for password resets. So when you divide that out amongst the technicians, if a technician is spending 30% of their time doing password resets, there should be an automated solution available for that.

As they looked at streamlining IT processes, Intuitive searched for a solution that would minimize their password related account maintenance.

We first bought Password Station from Avatier and we brought it in and it was a very easy rollout. It took us three or four days to get it into the system and we were up and running with the proof of concept to be able to change passwords from a user endpoint at will. So after using PasswordStation for a while, we realized the benefits from it. It freed up our technicians to be able to do other work and we wanted to start using Avatier's account setup, role creation, user management tools as well as the termination tools. Since we already had Avatier's existing infrastructure in house, it was very easy for them to come in and turn this on for us and get us started in creating privileges and roles that define what a user gets when they're onboarded.

Intuitive Surgical implemented Avatier's identity management suite. The software sits on a server between their HRSAP and Active Directory. HR enters a new employee's information and Avatier's identity management suite detects the information and makes the appropriate entries in Active Directory and the custom application.

So Avatar has really benefited us and in that it's freed up our IT support technicians from having to do tasks like password resets and user account setups and allows them to go and do other types of work. We've gone from an average of 1 and a half to 3 hours average for user account creation. And setup across all our systems to under five minutes for any given user in the company. For full access and account setup.

Avatr helped intuitive surgical automate routine IT processes freeing their staff for other tasks. What can they do for you? Avatier Agile efficient identity management.

That particular customer very interesting. They make a DaVinci device that is like a miniature robot. And they had tons of salespeople that they needed to be able to set up automatically. And they turned to our solution and leveraged the whole SAP integration. This next customer that we have here, AJ Gallagher is a large reinsurance company. So they sit in the middle between insurance companies and the customers. 12,000 employees about nine months. They have one FTE managing the system. So let's listen to Philip Irby.

What I need to worry about is my end users, the business, how we get people into our business quicker.

Arthur J. Gallagher is a global insurance brokerage headquartered outside Chicago, Illinois. Business to business AJ Gallagher has about 400 locations worldwide. Gallagher serves a variety of industry. Energy, shipping, construction and environmental.

We have five major divisions over the course of the last five years each of these divisions had their own help desk. They've had their own components where they did all of their own it. Part of our strategy was to centralize and build out shared services. One of those strategy components was a global service desk.

The global service desk fields calls domestically and internationally across all divisions.

My desire around having a dot net platform brought in avatir. We pitted one of the larger identity management vendors up against avatier and we said we have four major systems we want you to connect to, provision and remove users.

Ames from avatr automates daily operational processes such as user provisioning and deprovisioning, account management, self service, password reset and strong password enforcement.

The other provider was unable to connect to any systems. After one week with avatier we had provisioned and removed users from all four systems. Gallagher one's a vision that I had around creating a single interface for all the employees of Gallagher so that they could come in, gather the data that they needed, do their job, access the systems that they needed via single sign on request. Access to systems via avatr, reset their password, work within the cognos and financial information that we have all within one interface. Instead of having this disparate group of interfaces where nobody really knew where to go.

With a track record providing advanced user provisioning products to thousands of organizations. Avatir draws on first hand knowledge improving the user experience.

With avatr you have a ground up identity management system. It's very intuitive and very easy to use. We Launched Password Station 11 2011. Within three weeks we had 9,000 people enrolled. Our password reset calls to the global service desk dropped dramatically. The on site project support and then the developers themselves as we worked with them on customizations couldn't be better. I don't have a relationship like this with any other product vendor currently. If I could have more relationships like this, I'd be far more successful.

Last customer that we're going to see a video vignette on is somebody. I think you guys have all enjoyed their products or maybe too much yesterday or last night. But we have Miller Coors here. Ryan Ward, head of information IT security. He's also now an avatr employee. So he's right here. He'll be able to answer some questions about this particular rollout. 9,000 users, three months, one FTE big, big SAP customer. So we'll go ahead and we'll go through this video as well.

In 2008, Miller Coors entered a joint venture to create the second largest beer company in America, Miller Coors. With 7.5 billion in annual sales, the company employs around 9,000 people and outsources another 4,000. In addition, Miller Coors has a large network of distributors and managing those relationships is a key part of staying competitive.

Coming out of the joint venture between Miller and Coors, we had a number of consolidation issues that we had to deal with. Multiple systems, different directories. People were logging into the CORS systems and people trying to log into the Miller systems and then vice versa. And they didn't know which accounts to use, what passwords to use with that. So the main concern was really how do we get those accounts to be synced so people can log in successfully.

Miller Coors turned to avatr, the developer of aim. The solution automates daily operational processes such as user provisioning and deprovisioning, account management, self service, password reset and strong password enforcement.

As the head of information security at MillerCoors, it's my goal to ultimately secure our systems, make sure we're meeting compliance needs. Avatir is helping me do that. We are currently at about 30 different connectors. That includes SAP Systems and AIX servers, multiple Active Directory domains, SQL servers, Oracle servers, DB2 databases. It is covering just about every application and system we have in place. Security has definitely improved. I mean, first of all, it's unified our password scheme so that we have everyone synced across their accounts. The biggest improvement though is definitely around provisioning and deprovisioning. So we have extreme confidence now that when someone leaves the the Company, their account is being terminated obviously with distributors, they're the ones who order the beer and pay our bills. So we really needed to make sure that they had a single face to Miller Coors versus Miller and Coors. To enable that capability, we engaged avatier and basically came up with a single front end for the extranet environment. And that front end from AVATR actually enforced the security so we could stop sharing accounts, we could stop people from having weak passwords. So it was a huge win. And that project was actually delivered in about three months time. When we looked at the implementation cost and the time to actually deploy Avatir, the other estimates came in at about 400 man days of effort where Avatr came in at about 100, 150 man days of effort to actually implement the solution. Now that AVATR has been deployed and we are eliminating those other solutions, we've actually reduced our headcount by two people just in supporting our identity and access management solutions. Improve the operations of the solution as well as increase security at the same time.

The AIM suite from avatr complete, proven, fast, efficient. While the competition develops, AVATR configures.

That's really what an identity and access management system is supposed to do. It's supposed to reduce the workload so you can repurpose those people and use them to work on other tasks. Our largest Customer is the U.S. air Force. We work with their global help desk. It was about two years ago in Orlando that they saw our solution and adopted it. We're looking at a projected annual savings of 173 million. They have a million user identities, 900,000 groups, Active Directory groups, 62,000 code scans. This software has been through the mill to get onto this network and it's one of the two products in the world that's on the approved products list for the US Air Force AFNET right now. So we've definitely worked a lot to make this product very scalable and very secure. So with that I'd like to get into mobile identity management with an IT store and talk a little bit about that and what that means to us. Role based access control. How many of you have heard of role based access control? Can we see? Good. How many of you are currently trying to define all the roles for your environment so you could set up a role based access control matrix? Okay, so this next button right here, you guys aren't going to like. Our back is dead. That process that you're going through is an arcane process. Useful, but arcane. I used to work at Chevron as soon as we defined our roles, the next day my boss would say, nelson, you're reporting to this person for a special project. And I needed additional access. That's the reality of the world which we live in, is our access of our employees are constantly changing based on daily tasks that are being assigned to them. RBAC is still very useful for accounts like sales accounts, where you may have a high turnover, or if you're Marriott, maybe the front desk people or the valet attendants or the housekeeping people do an RBAC role that makes a lot of sense. Give them all the access that they need. But in most cases, what AVATR promotes is something called a birthright role, which is a minimally invasive role for a given department or division or location. So it gives them the core access that they need. And then we talk about how we get them the rest of the access. So this is why I need you to think like this, guys. I need you to forget everything that you know about identity and access management. So we're going to erase your minds right now. You have to start fresh to come on this journey with me as we talk about where we're taking identity and access management. So we say you cannot manage what you cannot see. Okay, think about what we just said there. You all are managing IT departments right now. You have access to different applications, you have assets, you have all of this information. A lot of you don't have a business service catalog. And if you do have a business service catalog, I guarantee that it's not hooked up to actually do the work. So it might just be there to look up things and define things. Well, that's not the purpose of a business service catalog. The purpose of a business service catalog is to actually define everything and then use it. You're halfway there. You guys are building a store. If you have a business service catalog, we think it is run like a store. If you walk into a grocery store or to Home Depot and you walk down an aisle, electrical aisle. If you need help with electrical, you walk down that aisle and you try to find someone in the electrical department the same way with IT guys. You don't go down lawn and garden or down lumber aisle if you need help with electrical. If I need help with SAP, I'm going to walk to an SAP expert. If I need help with SAP, HR or finance, I may try to find a sub expert within that application. That's how it is run. But you can't see it. So I challenge you all and I ask you this question. How many of your parents or Friends can order stuff online. Can I see a show of hands on Amazon.com? almost everyone, not your friends, that can't order online. All right, there we go. He's a little tired. He was sleeping. Sorry about that. All right, how many of your children or your children's friends can order from Apple App Store? Almost everybody. Right. Maybe too much. Right. So we say, well, why can't you build your IT department like a store? Why can't we allow our employees to order what they need from a store, an IT store? And that's the demo that I'd like to give to you right now. So we have time for a very small demo. It's about five minutes or so. This is our main suite. You guys are looking at the main suite. We're going to show you one product, and that's Identity Enforcer, which turns your IT department into an IT store. But there's a lot more to what we do. We allow people to request groups. We have an access validation tool that allows people to validate the access that they have. We have a tool that will automatically force the access based on rules. We have Password Station that's being used by Starbucks Worldwide and Marriott and dhl. Great customers. And then we have some new technology we're developing around risk intelligence. And it's really about helping IT people get the resources and the money they need when problems start to happen in their IT environment. All right, so let me click on Identity Enforcer. This is going to take you into our main screen here. What I did was I simplified the interface. We only have a few things here. You notice that I can move icons around, like proxy, my authority. I can also close this. I can make your screen look like however I want that screen to look like based on the department or division that's going to be running this application. And notice that I have a lot of icons turned off, so there's a lot of capabilities that you have. But today I just want to focus on selecting a user, which we did. Lucy Smith. And I'm logged in as Demo Admin. And we're going to walk into the store. When we walk into the store, we're walking into Home Depot. But I want you to realize that when I walk into the store, if I know you're part of the finance department or if I know you're a painter, I just show you the painting aisles at Home Depot. I hide all the other aisles, right? So just like in it, if I know you're SAP Finance, I'm going to hide everything else. And just show you the SAP finance aisles. So let's go down this aisle. What we're looking at is a business service catalog. You can see here's my badges. I have my badge policy here. It's a hyperlink I can click on. What do I do if I lose my badge? So you can start to link in and define your environment. You can see here I have computer equipment. Notice that I can change the view here. So I can make it very app store like to where it just has the icon or I can look at it with the information. I can also go to a row type of format and browse through all my different applications. So what we believe is, we believe you can set up a store for your customers and for your employees, vendors, contractors, and give them the birthright roles instead of the RBAC roles. You can give them RBAC roles for specific functions within the organization, but then allow the manager or allow the end user to go shopping for additional access. So in the case of this person, we're going to go into mobile devices and we have Lucy Smith. We're going to give her an iPhone. So I'm going to click on iPhone here. And when I do, there should be a number one in the cart. And you can see over here that we allow budgeting. She has an unlimited budget. But if I wanted to, I can assign a $2,000 budget to her and and allow her to go pick for assets that we approve in our store. When it goes over the 2000, then her manager will be notified that she's spending over her budget. That would never happen, though. We know people would stay within their budgets. So if I go down here and I click on Active Directory users and computers, this is Active Directory. If I click over there, I'm going to show you a mixed metaphor. You can obviously arrange your environment by countries and then have items underneath each of the countries. But I want to show you what we did for the Air Force. So for the US Air Force, we have major commands. And in this major command, this is one of the major commands, Air Combat Command out of Langley. If I click on this, under this we have the bases. So here's Langley Air Force Base. There's Shaw. And here, if I click on a map of Langley Air Force Base, it's going to open that map up and you can see it just shows you exactly where Langley is. So you can start to build an intelligent view of your identity and access management environment. I even have the portal to Langley here. But what the customer typically would do is click on the actual base and then go request access that they want. So they may want access to SharePoint. So they just click on that. And now this goes into the cart. What we've done is we put the workflow is built into the fabric of your identity access management store. So as you select items, we use the store ownership to figure out who is the workflow. We also use that same ownership for access validation. That's a very important key. So let's go approve these two items. We'll come into the store and notice with this Apple iPhone, we have a form here and we see how much it costs. We can see who the owner is. The iPhone's used for salespeople. I can come in here and click on the form and say, I want to get the 64 bit, 64 gig, excuse me, iPhone. I want 500 domestic minutes. I want to send it to my house. So these web forms are all built also without having to use any HTML programming, although we can save it in HTML so you can modify it. So now I can type in my justification. And notice. I can also select a range they need SharePoint. I could say they only need this for the summer. And now I can click on submit. So what happens is we're pretty much we've submitted this technology, these two requests. There's also other capabilities that we can do. Users can request changing the mailbox size. So does anyone ever get that request? I want a larger mailbox or I need to move my mailbox to another server. All of that can be requested now. Move home, share, move mailbox, move ou change account expiration date. If you have an account that's expiring and you want to extend it another 30 days, you can request that. Now everything starts to move to a request. So what I've done here is I want to show you how this might look like in the future if it integrates with the tablet device or an Apple iOS device. So here we have a desktop. In the desktop, we have an avatar application. It's approver application. And you notice that there's 89 items there to be approved. So if I come in here and I refresh this, You can see the number of items. Here you have items like access request, move ou, delete users, et cetera. We went from 42 to 44 items. And if I click on this, I've been push notified that there's something in my inbox that I need to approve. And here we have Lucy Smith that we just added. I can click on that and now I can see what it is that Lucy's requesting. And there you see her Apple iPhone. You can also see that this is needed for work. You see the description, you can see the start date. You can also see the workflow approvers down here under workflow M. Jones and Steve J. So the email's been sent to M. Jones already, he hasn't responded. You can also see down here the actual workflow, excuse me, work form for the iPhone. So that's where we have the 64 gig device at. And T all that information is there up at the top. What I can do is I can approve or deny this. I can skip an approver as a global workflow administrator, I could cancel the request or I could send a reminder so we have lots of capabilities. I'm going to go ahead and approve this request, Give it to her. And then I'll hit approve and that item will get approved and then we can move on to the SharePoint request as well. So in the future what we see is being able to integrate your workflow approvals, your access validation, all the different access that you need with your mobile devices. So people can approve this while they're at lunch, while they're at work, while they're maybe on their way home on a train or mass transit. So that's how we're looking at identity and access management being integrated into the future. So let's go back to our presentation here and we'll talk a little bit about what else we see in the future. In the future we see identity and access management moving to a multi cloud environment. Not just putting it out into the cloud, but making sure it's redundant in multiple clouds. We see identity and access management offered as a service, so you can buy this as you need it, as you consume it, so it will not be heavy infrastructure to deploy. We also are very big on promoting identity and access management to the mobile devices. Everything that you have, Androids, iPads, Windows devices, anything that's going to be mobile, we believe it's moving that way. Also we believe single sign on and federation is not going to be a technology that you buy. It's going to be integrated into your store. So your IT store, you saw how you could request access. Well, wouldn't it be great if I click on a button and and automatically logs me into Salesforce or into NetSuite or into Google Apps? In the future we believe that's all going to be integrated. Steve Jobs simple can be harder than complex. You have to work hard to get your thinking clean, to make it simple. But it's worth it in the end because once you're there, you can move mountains. And that's really the key idea behind what Steve did with the post PC device. And that's what he called his iPhones and his iPads. Everything was beyond the laptop, beyond your workstations and your desktops. At avatir we're doing the same thing for identity and access management. We're moving beyond the post identity and access management. As a matter of fact, we believe in very few years identity and access management we will be dead. We believe it's going to be replaced with the request system. What you're looking at with the avatier Store is a huge request system. The first problem that we're solving is identity and access management along with asset request. Right? If I need a badge, if I need a key, if I need a uniform, that can all be requested through this system and that gives you the accountability in the workflow and the approval process so that not just one of you is on the hook for giving access to somebody incorrectly. Two person security is the key. And that's what we saw at the U.S. air Force. And we believe that that's how identity and access management systems will be run in the future. We believe there will be a trusted identity fabric and vendors won't be providing full blown solutions as we're showing you today from avatir, but they'll be providing more dashboards and, and the dashboard from each vendor will be customized and it will integrate with all the other vendors technology. But the dashboard is what's going to give you the risk mitigation, the identity intelligence so that you really bubble everything up to the top so that your CIOs and CEOs and CFOs know what your risk exposure is in your network based on what the identity and access management systems are telling them. Again, I want to end on you can't manage what you can't see. Define your store, make it visible, make sure everyone can see it. That's what I task you all to do when you leave here. You can start with your business service catalog but eventually integrate that into a fully closed loop process in a system. The best identity and access management solution is an operating one. Again, thank you all for your time.