Posted 1:42 PM (0) comments

Another one bites the dust

Well, that might be too strong, but another veteran independent Identity vendor has been acquired. M-Tech announced today that Hitachi had acquired a majority interest in the Calgary, Alberta firm.

M-Tech owns a large segment of the provisioning business in Canada, especially government (federal and provincial) provisioning. But beyond provisioning, M-Tech (now officially called Hitachi-ID) offered the full panoply of the Identity suite - password management, authentication and authorization, role management, audit and entitlement, etc. It'll be interesting to see how long it takes Hitachi to digest the acquisition (I don't think it will be very long) as well as how this will change the playing field (especially in Asia) for Sun, IBM and the others in this space. It could get very interesting.

Labels: acquisition, enterprise

Posted 9:01 AM (2) comments

Cisco gets entitled - updated

Cisco Systems announced this morning a definitive agreement to acquire entitlement management leader Securent, Inc.

I've disagreed with Securent CEO Rajiv Gupta on some issues, notably the use of role management in identity and entitlement systems, but I can't disagree about this move - it makes a good deal of sense from Securent's perspective.

Entitlements, usually linked to applications and the rights and privileges users have within those applications (as opposed to standard operating system rights to access the application), should also be linked to the field of Network Access Control - NAC (which Cisco calls Network Admission Control). From that point of view its also a good move on Cisco's part.

Whether or not it advances Identity Management at all, though, is open to question. Cisco, certainly, has a view of identity that's very much at odds with other major technology vendors. As a hardware company, it tends to focus on the platform, not the user. It's important to remember that all those "things" in the network have identity, but not at the expense of the people using those things. By the same token, Securent might be thought of as focusing too narrowly on the rules and not seeing the users who the rules are built to support.

I don't think this signals a round of acquisition activity for entitlement management companies, but only time will tell about that. In the meantime, keep working on your Role Management rollout.

UPDATE: As someone pointed out to me, Securent will join Cisco's "Collaboration Software Group" which, as far as I can tell, is the group responsible for WebEx and not much else. The group is headed by Don Proctor, formerly Senior Vice President of the Voice Technology Group, a remarkably unsuccessful branch of the networking powerhouse. In looking around the Cisco web site, in fact, they seem more of a candidate to become a Securent client rather than an acquirer - unless John Thompson Chambers (thanks, Ian!) wants to keep the technology all to himself!

Labels: acquisition, entitlement, roles, security

Posted 1:04 PM (0) comments

Journalistic ethics

Larry Barrett, at Internet News, jumped the gun on the announcement that Oracle had acquired Bridgestream. While the deal has been rumored for a couple of weeks (and actually was signed off on over two weeks ago), the lawyers had held off on the announcement to be sure all the Ts were crossed and all the Is were dotted. Official announcement should come on Tuesday, Sept. 4.

Barrett has done a great disservice to those of us who try to practice ethical journalism by actually abiding by embargo dates so that we can thoroughly research the story before it breaks. It is a big story, but there's nothing about it which requires breaking a confidence. I'll have more to say once it's official.

Labels: acquisition, bridgestream, journalism, oracle

Posted 3:31 PM (0) comments

Oracle to buy BridgeStream?

Dan Primack, over at PEHUB, threw out a rumor the other day that Oracle was about to acquire BridgeStream, the role definition and management company. I've followed the privately held San Francisco startup for the past couple of years, and even just last summer believed that acquisition wasn't in the cards just yet:

"With some preaching a top-down approach of creating roles based on business rules and practices while others advocate a bottoms up approach emphasizing audits and data mining of what people actually do, there's no definitive "best practices" for role creation. While it seems obvious that, eventually, a synthesis of these methods will emerge as the standard way to create and manage roles, there's still enough diversity in the marketplace that the big identity management vendors aren't willing to bet on the final outcome. Instead, they'll partner with many different role creation companies. That means that folks like Bridgestream, Eurekify, Trusted Network Technologies, BHOLD, Blackbird, Engiweb, Prodigen, SecurIT, and Vaau will maintain their independence for now with only the remote possibility that should any of them founder with customers their investors might seek to sell out at fire sale prices."

But I think I can give a fair amount of credence to Primack's rumor for two reasons:

1) Oracle is still on an acquisition roll, and getting deeper into roles makes sense for them;
2) Role management needs to be intimately connected to the IdM suite of products, something that simply parternering with an independent role management company doesn't give a major vendor.

Look for this to become official over the next week or so...

Labels: acquisition, bridgestream, oracle, RBAC, roles