SAP pairs GRC with Identity Management

by Lawrence Dietz

SAP AG has announced the immediate availability of new GRC web services that enable the seamless integration of identity management software solutions with SAP GRC Access Control. Based on open standards and built on the SAP NetWeaver platform, these new web services open up the full capabilities of SAP GRC Access Control, allowing identity management software vendors to tightly integrate their respective solutions, providing customers with a single set of tools to manage user identities, enforce corporate security policies and ensure compliance with regulatory mandates.

SAP, together with leading identity management software providers including IBM and Sun Microsystems, is responding to the challenges faced by CFOs and CIOs in proving to auditors that they are effectively controlling their financial and IT-related risks by combining automated, end-to-end compliance controls with the full range of identity management functionality. Integration efforts by IBM and Sun are already well underway to link IBM Tivoli Identity Manager and Sun Java System Identity Manager with SAP GRC Access Control, bringing together critical compliance capabilities—including segregation of duties enforcement, risk analysis and remediation, compliant user provisioning, role management, audit and reporting—with key identity management functionality, such as user provisioning, authorization and authentication, password management and directory services.

SAP is also using its new web services to integrate its SAP NetWeaver Identity Management component, created following SAP's acquisition of identity management software provider MaXware earlier this year, with SAP GRC Access Control to provide an end-to-end solution for compliant provisioning across heterogeneous IT environments. The provision of open interfaces to link SAP products with those of third-party software providers continues SAP's open partner strategy and preserves its customers' freedom to build and deploy solutions that best fit their needs, using both SAP and non-SAP components. The new Web services from SAP are available immediately as part of SAP GRC Access Control.

This announcement appears to signal an agreement for "peaceful coexistence" among several large and powerful software vendors. We applaud the notion of tight integration of identity management with applications as a logical and progressive step in transparency of identity validation prior to application execution. It is also interesting to note that Governance, Risk and Compliance can be thought of as a hub connecting the various outlying applications. As such, the GRC application itself becomes highly sensitive for its information content and as a potential target of electronic discovery in litigation.

Customers already employing GRC products from SAP and who have, or are considering, IDM products from IBM and Sun should benefit from this announcement. The "détente" effect of these alliances is also significant and we believe it is indicative of the competition and segmentation that end-user organizations can expect from large vendors in the future.

www.it-analysis.com/