identity and cloud cybersecurity today mean a lot more than has traditionally been understood in these technology disciplines. we will see how the technological and legal shifts that have taken place have major implications not just for IAM and cybersecurity, but also for the discipline traditionally known as customer relationship management, or CRM.

1. Consumer-Centric Identity Management
From Identity Management to Identity Relationship Management. The changing relationship
between IAM, CRM and Cybersecurity.
14 March 2016 16:00 AEST, 8:00 CET, 7:00 GMT
KuppingerCole Webinar
Ivan Niccolai
Lead Analyst
KuppingerCole
in@kuppingercole.com

2. KuppingerCole About us
© KuppingerCole
by KuppingerCole
Research Services Advisory Services Events
Enterprise IT Research, Advisory, Decision
Support and Networking for IT Professionals

3. © KuppingerCole 3
KuppingerCole Events
http://www.id-conf.com

4. Some Guidelines for the Webinar
You are muted centrally. You don‘t have to mute/unmute yourself
– we control the mute/unmute features
The Questions and Answers Session will be at the end. You can enter
questions anytime, using the Questions feature in the GoToWebinar
Control Panel.
We will record the Webinar – the podcast recording will be
available tomorrow.
© KuppingerCole

5. Webinar Outline
© KuppingerCole 5
• Traditional Identity and Access Management (IAM) and Cybersecurity
• Customer-Focused Identity management: more than just external IAM
• IAM + CRM = Identity Relationship Management (IRM): users, devices, things
• Multiple identities, identity providers, attribute providers and contexts
• Conclusions
Questions and Answers (Q & A)
Part 1
Ivan Niccolai
Lead Analyst
KuppingerCole
Part 2

6. © KuppingerCole 6
Traditional IAM
• Employee identity lifecycle
management
• Management of the relationship
between a user and a single
organisation
• Customer identities
• Seen simply as employees with
different access permissions
• External IAM stack often a mere
duplication of the employee IAM
systems with higher performance
requirements

7. • Cyber Security defined in analogy to
Conventional Security
• Cyber Security is possible
• Security Breaches can be prevented with just enough
efforts
• Perimeter “protection”
• Enterprise systems traditionally on premises
• Firewalls
• Protection of on-premises-IT through network
segmentation
• The „bad guys“ are shut out
• Endpoint “protection”
• Endpoint device lockdown (group policy)
• Group Policy (definition), a tried and proven way to anger
and annoy business users
• Clearly defined attack surface
© KuppingerCole 7
Traditional Cyber Security

8. Identity Management (IAM) and Customer Relationship Management (CRM)
•(Digital) good and services
•Extension of traditional offerings into the digital space
•New products, new services
•Internet scale, not enterprise scale
•New types of identities: customers, subscribers, prospective customers, community
•New types of relationships to manage in the enterprise: users, devices, things
Post-Perimeter Cybersecurity
•Distributed and decentralised deployments: on-premise, cloud, hybrid
•3rd Service delivery agreements: SaaS, PaaS, IaaS, managed services, outsourcing
•Service delivery channels: web, mobile, IoT
•Managing data protection laws and compliance across: partners, suppliers, service providers
Customer Expectations
•User expectations shaped by internet-born (and mostly free) consumer services: Google, Facebook, Twitter, Paypal
•Users demand a Seamless, Easy, Intelligent, Secure experience
© KuppingerCole 8
Innovation in the Age of Digital Transformation

9. „The CRM don’t see their
system in the context of
IAM even while it’s the
biggest identity store in
most companies“
Martin Kuppinger
KuppingerCole- Blog
http://blogs.kuppingercole.com/kuppinger/2007/12/07/t
he-cio-agenda-%E2%80%93-the-four-key-initiatives/
© KuppingerCole 9
Customers moving into the scope of IAM
2007 2016
„In the digital economy,
our personal information
is the New Money to pay
for services. “
Omri Ben-Shahar
Forbes.com
http://www.forbes.com/sites/omribenshahar/2016/04/0
1/privacy-is-the-new-money-thanks-to-big-data/

10. The New Scope of Cybersecurity
© KuppingerCole 10
Cloud Computing
(Deployment Models)
Social Computing
(User and
relationship types)
Mobile Computing
(Devices)
Internal Users
Partner
Customers
Leads, Prospects
Desktop Computers
Notebooks
Personal Computers
Tablets
Smartphones
Traditional
Cybersecurity Focus
Today‘s
Cybersecurity Focus
Public Cloud
Hybrid Cloud
Private Cloud
Outsourcing
On-Premise

11. Traditional IAM
•Enterprise scope
•On-boarding, e.g. via HR
•Full identity lifecycle
•Secure Authentication
•Access to the right protected
resources
•Audit and Compliance
IDaaS
•Enterprise Scope
+ extended enterprise (e.g.
partners, supply chain)
•On-boarding, e.g. via HR or trust
via federation
•Full identity lifecycle for “own”
identities
•Secure Authentication
•Access to the right protected
resources
•Audit and compliance
CIM / CIAM / IRM
•Internet scope
•C = Customer !
•Registration, Purchase,
Subscription
•Secure authentication
•Access to the right protected
resources
•Audit and compliance
•Serve the customer / subscriber
•Gain insight for the company /
service provider (as complete as
possible)
© KuppingerCole 11
Scaling both the Purpose and Scope of Identity Management

12. © KuppingerCole 12
Connected and related
Organizations
People
TabletSmartphone
NotebookSmart watch
Wearables Smart home
Smart meter Connected vehicles
arepartof
actonbehalfofcommunicate
communicate

13. © KuppingerCole 13
More than one identity

14. Customer Information
•On-Boarding
•Social
•Behaviour
•Preferences
•Location
•Devices and Things
Identity Relationships
•between
•Organizations
•People
•Apps
•Things
•Services
•Account Linking
•Preferences and "Likes”
•Behavioural data
•Location data
•Health data
Business Enablement
•Serving the customer
•Creating targeted profiles
•Recommendations
•Ad Serving
•No-nonsense email
marketing
•Direct Customer
Interaction, eg. push
messages
•Long-term business
transformation
© KuppingerCole 14
Redefining Customer Relationship Management
New ways to
deal with
customers
Foundation
for business
Foundation
for business
decisions
Big Data KYC
Long-term
customer
relationships

15. Consumer
Identity
Base data
(Registration,
Subscription,
Purchase)
Behavioural data
(Likes, Shares,
Purchases,
Comments,
Reviews)
Context data
(Location, Time,
Device, Origin)
Social data
(Unified view
across various
personae)
Existing CRM data
External
knowledge (Credit
rating scores)
© KuppingerCole 15
Achieving a complete picture

16. Evolution of IAM as a basis for Digital
Innovation
•Customer satisfaction (Usability, Ease of use,
Intuitiveness)
•Time to market
Adequate data model for customer
identities
•Dynamic and adaptable
•Store “what is needed” for enabling business today
and tomorrow (e.g. Social, Historical, Preferences,
Context data
© KuppingerCole 16
Customer Identity and Access Management
Adequate scalability
• Number of entries
• Number and type of attributes per individual
entry
• Number of accesses at a given time (Shopping
before christmas, Social media during national or
global events)
Integration
• Access to Identity and Authorization data from all
customer-facing systems
• Seemless integration with other Identity
Providers ("inbound")
• Standardized access ("outbound", e.g. OAuth,
SAML, OpenID connect, FIDO, LDAP)
• API access for access to full provided
functionality from backend systems

17. Adequate Security: „Adaptive authentication“
• Identity as the perimeter
• Customer protection in a highly hostile environment
• Context-based authentication
• Risk-based authentication and authorization
• Multifactor Authentication
Platform security
• Cloud Security
• Strong and reliable security features built into all layers of CIAM-Systems (e.g. Storage, APIs, Transport,
Authentication, Authorization, UI)
Data Protection
• National Legislations
• Individual Data Protection Laws
• Upcoming European General Data Protection Regulation (GDPR, Spring 2018)
© KuppingerCole 17
Security and Data Protection

18. Extraterritorial effect
•Extends its scope of application to non-EU controllers or processors,
where the processing activities are related to:
•offering of goods or services to individuals located in the EU;
•the monitoring of their behaviour
•'offering goods or services' is not limited to offerings that require a
payment from the individuals.
Legal Basis for Data Processing
•Individual's consent
•Purpose limitation principle.
Rights of individuals
•Notice obligations.
•Right to erasure and to be forgotten
•Right to restriction of processing.
•Right to data portability.
Automated Decision-Making, Including Profiling
•Profiling: automated processing of personal data
•Decisions based solely on automated processing, that produce legal
effects or significantly affect individuals require suitable safeguards
European General Data
Protection Regulation
© KuppingerCole 18
EU General Data Protection Regulation (Some highlights)
http://www.bna.com/final-european-union-n57982067329/

19. Finding the right balance
©
KuppingerC
Business
Enablement
Privacy and
Security
Privacy
Compliance to
regulations
Reputational risks
Data Protection
Agility
Evolving business
models
User Experience
Satisfying market
needs
User Trust
•Providing data to commercial platforms is a deliberate act
•Exchanging data against value
•User needs to be in control, able to manage and revoke consent
•Risk-based authentication and authorization
Privacy, Security and Data Protection as key
components
•Unique selling proposition
•Fine-grained policies for access to user data
•Easy and trustworthy self-service workflows
•Privacy by design and by default: Evaluation of privacy policies
consistently embedded into the CIAM.
•Data Protection by design and by default: Implementation of
upcoming requirements now, to be ready for day one.
•Security by design.

20. Any Questions?
Use the GoToMeeting question feature to submit
questions for discussion
© KuppingerCole 20
Questions and Answers (Q & A)

21. © KuppingerCole 21
KuppingerCole Events
http://www.id-conf.com

22. The Future of Information Security – Today.
sales@kuppingercole.com
© KuppingerCole
KuppingerCole Headquarters
Sonnenberger Strasse 16
65193 Wiesbaden
Germany
Phone: +49 (211) 2370 77-0
Fax: +49 (211) 2370 77-11
E-mail: info@kuppingercole.com
KuppingerCole Analysts Ltd
c/o JPC Financial Limited
2nd Floor, Lynton House,
Station Approach,
Woking, Surrey. GU22 7PY
Phone: +44 (207) 101 0675
E-mail: info@kuppingercole.com
KuppingerCole (Asia Pacific) Pte Ltd
1002 #03-1433
Toa Payoh Ind Pk
Singapore 319074
Tel: +65 6255 5839
E-Mail: apac@kuppingercole.com
KuppingerCole North America
8 Faneuil Hall Marketplace
Boston MA 02109
United States
Phone: +1 (617) 973-6423
E-mail: info@kuppingercole.com