research report catalogue · 2017-05-12 · research report catalogue may 2017 abstract through our...

RESEARCHREPORT

CATALOGUEMay2017

ABSTRACTThrough our in-depth reports, TechVision Research provides early perspectives on key technology trends which help our clients stay ahead of the disruptive technology challenges they’ll face. Our research agenda uncovers key technology inflection points and defines their impact by applying technical depth, pragmatic business experience, and rigorous analysis. This catalogue summarizes our current research focus covering critical technology areas impacting the enterprise. For more information please contact:[email protected]

©2017TechVisionResearch–Allrightsreserved 2

TableofContents

Blockchain...........................................................................................................................................4PublishedResearch......................................................................................................................................4

BlockchainEnterpriseLevelSet................................................................................................................4Blockchain-basedIdentityManagement.................................................................................................4BlockchainLevelSetForBankingExecutives...........................................................................................5

UpcomingResearch......................................................................................................................................5Blockchain2.0:SmartContracts..............................................................................................................5

DataArchitectureandGovernance....................................................................................................6PublishedResearch......................................................................................................................................6

Data–TheFundamentalsAreBroken.....................................................................................................6FixingtheFundamentals—TheBusinessBlueprint..................................................................................6TheFutureofInformationSharing...........................................................................................................7TechVisionCrossTalkReport:IdentityandDataGovernance..................................................................7TheRiseofMachineLearning:ManagingtheOpportunities,HandlingtheThreats(New)....................8

UpcomingResearch......................................................................................................................................9FixingtheFundamentals–DataStrategy.................................................................................................9FixingtheFundamentals-DataAssetManagement...............................................................................9FixingtheFundamentals–EnterpriseFoundationalData.....................................................................10FixingtheFundamentals–DataDesignPractice....................................................................................10

PrivacyandDataProtection.............................................................................................................11PublishedResearch....................................................................................................................................11

EnterprisePrivacyGuidelinesinaChangingRegulatoryEnvironment..................................................11PrivacyBeyondCompliance...................................................................................................................12TheNewEuropeanPrivacyandDataProtectionRegulation—ComplianceorConsequences...............13EnterpriseInformationProtection.........................................................................................................13

NextGenerationEnterpriseIT&Innovation...................................................................................14PublishedResearch....................................................................................................................................14

TheEndofEnterpriseArchitectureandITasWeKnowIT.....................................................................14HowDoWeAccelerateEnterpriseInnovationinaCultureofRiskAversion?........................................15AnITOrganizationalStructurefortheFuture........................................................................................15WhyLargeTechnicalProgramsFailandHowtoMitigateRisk(New)...................................................16

IdentityManagementandSecurity..................................................................................................16PublishedResearch....................................................................................................................................16

TheFutureofIdentityManagement......................................................................................................16Blockchain-basedIdentityManagement...............................................................................................17PuttingIdentityintoContext:NextGenerationIAM..............................................................................17OpportunitiesinEuropewithElectronicIdentificationandTrustServices.............................................18TechVisionCrossTalkReport:IdentityandDataGovernance................................................................18GettingtoKnowYourCustomers:TheEmergenceofCIAM...................................................................19MachineLearningandArtificialIntelligenceonBigDataforCybersecurity(New)...............................20

UpcomingResearch....................................................................................................................................20IdentityofThings(IDoT).........................................................................................................................20TheCloudificationofIdentity—IDaaSMarketOverview........................................................................21Banking,IdentityandtheRegulators(New)..........................................................................................21


IdentityGovernanceAdministration:TheJourneytothePeople-centric,Business-orientedFutureofAccessControl(New).............................................................................................................................22

InternetofThings.............................................................................................................................23PublishedResearch....................................................................................................................................23

InternetofThingsasaSecurityRiskAmplifierandRiskMitigationStrategies......................................23UpcomingResearch....................................................................................................................................23

EnterpriseIoTRealityCheck...................................................................................................................23IdentityofThings(IDoT).........................................................................................................................24UnlockingtheValueofIoTtotheEnterprise.........................................................................................24

ArtificialIntelligence/MachineLearning........................................................................................25PublishedResearch....................................................................................................................................25

TheRiseofMachineLearning:ManagingtheOpportunities,HandlingtheThreats(New)..................25MachineLearningandArtificialIntelligenceonBigDataforCybersecurity(new)................................25

AboutTechVision..............................................................................................................................27


BlockchainPublishedResearchBlockchainEnterpriseLevelSet

By:GaryRowe,PrincipalConsultingAnalystThisreportprovidesguidanceforenterpriseleadersastothebusinessvalueandtimingofblockchain,ordistributedledgertechnology.Ourgoalinthisreportistoseparatethehypefromrealityandprovideourenterpriseclientswithanswerstothewhat,when,whoandwhyquestionssurroundingthisspace.Blockchaincanbethoughtofasatoolorrecordingmechanismtosupportcommerce,smartcontracts,andothersimilarbusinesslogand“ledger”functions.Itcanbethoughtofasaprotocolofdistributed,verifiablevalueexchange.BlockchainisbestknownasthetechnologybehindBitcoinandisusedasadecentralizedmeansofverifyingandrecordingBitcointransactions.ThefocusofthisreportistheapplicationofblockchainbeyondBitcoinfortheenterprise.Thisseminalreportisthefirstofaseriesofblockchain-relatedresearchreportsanditsetsthefoundationfororganizationstogetthebasicsofblockchainright,whileprovidingacontextforbalancinginvestment,opportunityandrisk.Thisreportwillfocusspecificallyonblockchainintheenterpriseandprovidesaroadmapfororganizationstoconsiderinresearching,piloting,deployingand,ultimatelyscalingusageofblockchain.Weincludeasetofpracticalstepsfororganizationstoconsiderastheywalkthefinelinebetweenbeingpreparedforatsunamiandimmediatelysellingtheircoastalpropertyandmovingtothemountains.

Blockchain-basedIdentityManagement

By:DougSimmonsandGaryRowe,PrincipalConsultingAnalystsThisisthesecondofourseriesofblockchain-relatedresearchreportsanditsetsafoundationfororganizationstounderstandhowblockchainordistributedledgerscanfitwithinanidentitymanagementecosystem.Theconvergenceofidentitymanagementandblockchainprovidesanopportunitytolookatblockchain-basedidentitymanagementfromtwoprimaryperspectives;firstfromanidentitymanagement-centricviewandsecond,fromtheperspectiveofhowblockchainhasevolvedtosupportabroadrangeofidentitymanagementusecases,includingpeople,applicationsanddevices.Thisreportfocusesonanext-generationidentityecosystemthatprovideseachpersonasinglesetofidentitycredentials,availableforuseacrossallelectronicservicesencompassinggovernment,consumer,andcorporateentities(i.e.,BringYourOwnIdentity,orBYOI).Blockchainhasthepotentialtobeavaluablepartofthisecosystembyenablingtherecordinganddistributionoftrustedidentitiesandassociatedinformationwithoutrequiringrelianceonaspecificcentralizedthird-partyauthority.


BlockchainLevelSetForBankingExecutives

By: RhomaiosRam,PrincipalConsultingAnalystOverthelastfewyears,therehasbeenalotofblockchainhype,butmuchofthethinkingisfromtheperspectiveofatechnologylookingforausecase.Thisreportisfromtheperspectiveofaglobalbankingexecutiveevaluatingandleveragingtechnologytoaddressspecificbusinessgoals.Thefocusisontheapplicabilityofblockchaintoimprovetheefficiencyandeffectivenessofbankingserviceswhilemaintainingregulatorycompliance.ThepragmaticexperienceofrunningbothEuropeantransactionbankingandProductManagementatDeutscheBank,andsubsequentlydevelopingtheirdigitalbankingstrategyincludinganassessmentofblockchainandotherdisruptivetechnologiesisdrawnuponindevelopingthisresearch.Theprimarygoalformostbankersthesedaysisregulatorycompliancecloselyfollowedbycostreduction.Blockchainhasthepotentialtoimpactbothgoals.Blockchainorsomevariationofdistributedledgershavethepotentialtoreducecostandimproveefficiencyintheoperationalandriskaspectsofbankingandatthesametimeimprovethetransparencyandauditabilityrequiredtodemonstratecompliance.Inthisreport,wewilldescribethecurrentbankingprocessesaswellasexpectedchangesoverthenextseveralyears.Banksarebeingdisintermediatedandarefacingincreasingregulatorypressureleadingtotheneedtoconsidersubstantivechanges.Thisreportfocusesonhowblockchainordistributedledgersmayhelpsolverealbankingproblemsandbeintegratedintheexistingbankingworld.Wealsodescribeatimelineandasupportingsetofservicesthatwillbenecessaryfordistributedledgerstobeasignificantelementwithintraditionalbanking.

UpcomingResearchBlockchain2.0:SmartContracts

ByScottDavid,J.D.,LL.M.,PrincipalConsultingAnalystSmartcontractsaresimplysharedprogrammablescriptsthatcanbeexecutedbasedonthetermsofanagreement.Smartcontractscanbenefitfromblockchainsecurity,time-stampsandtransactionverificationwithoutrequiringanintermediary.Thisrepresentstremendousdisruptiveopportunitiesaswellassomemajorchallenges.Aquestionwewilladdressishowsmartcontractswillscaleandhowwilltheymaybeintegratedintoexistinglegalandregulatoryenvironments?Forexample,whathappenswhenapartyinasmartcontracttransactiondisputestheclaim?Technicalproofmaybethere,buthowwillthisbeenforcedandrecognized?Inthisreport,wewilldescribesmartcontracts,theirsynergywithblockchainandsomeofthehurdlesthatmustbenavigatedtoprovideenterpriseswithreal-worldsolutions.We’llexaminewherethetechnologyandacceptanceofthetechnologyistodayandwhereweseeitmovingoverthenextseveralyears.Wewillalsoprovideasetofspecificrecommendationsastohoworganizationscaneffectivelyandefficientlymoveforwardwithblockchain-basedsmartcontractsandbepreparedtoactquicklywhenthetimeisright.


DataArchitectureandGovernancePublishedResearchData–TheFundamentalsAreBroken

By:NoreenKendle,PrincipalConsultingAnalystTheworldhastransitionedfromanindustrialtoaninformationage,wherewehavebecomeextremelydependentoninformationalongwiththedataonwhichitstands.Withtherapidgrowthoftechnology,theworldcontinuestomovefartherawayfrom“hands-on”observation,operations,andmanagementoftherealworldtoutilizingthedatarepresentationoftherealworld.Ourdependencyondatahasgrownexponentially,whileourabilitytoidentify,understand,manage,andutilizedatabecomesmorechallengingovertime.Despiteallthethousandsoftoolsandtechnologiesmarketedas“fixes”forthedataissues,ourdatachallengescontinuetogrow.Ourgrowingdataissuesareonlythesymptomoftheunderlyingproblem–Thefundamentalsofdataarebroken.Inthisreport,wehaveidentifiedthebrokenfundamentalsofdataandfivebasicstepsorganizationscantaketoaddressthesebrokenfundamentals.Theseinclude:establishingthebusinesstodataconnection;usingabusinessblueprint;creatingadataoversightframework;establishinganenterprisedataconstructionpractice;buildingthedataassetmanagementinfrastructure;and,standing-upadataassetmanagementpracticefocusedonenterprisefoundationaldata.Intheend,iforganizationsdonotfixthefundamentals,theywillneverbeabletoeffectivelyclean,identify,integrate,manage,andutilizetheirdataassetsforevenbasicoperations,letalonetakeadvantageofthefullpowerofthoseassetsfortruebusinessintelligence,riskavoidance,predictiveanalytics,artificialintelligence,anddatamonetization.Informationistrulypowerful,butonlyifthedataisright.

FixingtheFundamentals—TheBusinessBlueprint

By:NoreenKendle,PrincipalConsultingAnalystMosteverythinginatypicalorganizationtodayisbasedonitsdatarepresentation:fromrecordingandoperationstopredicting,planning,reporting,aswellasdecision-making.Yetdatachallengeshavebecomeoneofthemostunderestimatedissuesorganizationsfacetoday.TechVisionhasfoundthatmanyorganizationsareinadysfunctionalcycleofdatachaoswheredataistypicallydisjointed,untrustworthy,redundant,large,andcomplex.Historically,datawasbelievedtobeatechnologycomponent,butthatfundamentalunderstandingofdataisflawed.Dataisarepresentationoftherealworld,it’sthings,events,andtheirrelationships.Thus,datatrulyisanimportantbusinessassetandnotatechnologycomponent.Thismisunderstandingofdataisatthecoreofourbrokenfundamentalsofdatathathasledtomanyofourdatachallenges.Inthisreport,weshiftthefocusfromdatasymptomstotherealproblem:thebrokenfundamentalsofdata.Specifically,thisreportaddressesthefirstoffivestepstotake,leveragingaBusinessBlueprinttoeffectivelyestablishasustainablebusinesstodataconnection.


TheFutureofInformationSharing

ByFredCohen,PrincipalConsultingAnalyst

ThetensionbetweensharingandrestrictinginformationhasexistedsinceAdamandEvefirsttastedthatappleintheGardenofEden.Today,thevelocity,volume,variety,andveracityofinformationbeinggeneratedin,about,andbetweenorganizationsismakingthattensiontopofmindtoindividualsandorganizationsofallsorts.Informationsensitivityrangesfromoneextreme(Idon’tcarewhoknows)totheother(Ifthisgetsout,itcouldthreatenmysurvival).Whilemostinformationfallsbetweentheseextremes,understandingandconscientiouslybalancingtheneedforsecrecyandopennessacrossthecontinuumisrequired.Thisreportdiscussestheutilityofinformationbasedonhowwidelyitisknownandthestateofthepresentandlikelyfutureartinfindingthebalancebetweensecrecyandsharing.Specifically,organizationsshouldfocuson:

• Understandingthetypesandimportanceofinformationgathered,produced,stored,transmitted,andshared;

• Usingandsharinginformationeffectivelyandefficientlytosupporttheorganization’scollectiveactions;

• Havingproperprocessesforcontrolanddispositionoftheseinformationassets;• Preventinginformationoverloadcausedby“oversharing”;• Preparingforthebusinessandtechnologychangeswhichcanimpactthebalance

TechVisionCrossTalkReport:IdentityandDataGovernance

ByBillBonney,GaryRoweandNoreenKendle,PrincipalConsultingAnalystsModeratedbyTedRitter,CISSPWhataretheconnectionsbetweenidentityanddataintheenterprise?Whenoneprotectsidentity,theyareultimatelyprotectingdata:datathatisarepresentationoftheidentity.Unfortunately,asdiscussedinthisnewCrossTalkreportbyTechVisionResearchmostorganizationsdon’thavedatamanagementandevenwhentheydohavedatamanagement,theidentitydataisusuallyleftoutofthediscussion.AtTechVisionResearchwecontinuallyseedatamismanagementunderminingallaspectsofthebusinessfunction.AsNoreenKendlehasexperienced“datamess-upisequalopportunityacrossalltypesofdata,includingidentitydata.”Noreengoesontosay,“I’veseencompaniesoverwritebigtextfieldswithidentity-relatedinformationprimarilybecausetheydon’twanttostopandenhancethedatabaseschemaandstructures:thisincludescreditcardnumbers,socialsecuritynumbers,etc.”Obviously,thisisahugeprivacyissuebecausethefieldsarenotidentifiedasidentityfieldsandtheITstaffisoblivioustothesituation.


BillBonneyspeaksfromexperiencebuildinganIdMpracticeashe“agreesthatoverloadingisanissue.”But,asBilllikestopointout,“It’snotjustoverloading,it’smakingassumptionsaboutwhatisinafieldandassumptionsabouthowthefieldisevaluatedandbeforeyouknowityouhavesub-processesbuiltuparoundafalselyvalidatedfield.”Thisestablishesafalsefoundationthateventuallycausestheentiretrustchaintobreak.AsBillstates,“inevitably,someonewillusethedatabasedonhowitwasfirstcreated(thefieldlabelofrecord).”Thisisasymptomofafargreaterproblem.ThereisahugeassumptionmadebyITstaffandtheidentitymanagementtoolstheyusethatthedatafieldsareaccuratelyrepresentingthedatastoredinthefield.Thisjustisn’tso!Giventhisrealityofidentityanddatamismanagementintheenterprise,thisreportfocusesonthefollowingkeyconcerns:• Theevolutionofidentitydataasitsowndomain• Theimpactofsilosonidentitydatamanagement• Thepotentialofvirtualdirectoriesasanidentitydatamanagementapproach• Theimpactofdatareuseonidentityandtheresultingauthenticitydecay• Identitydatagovernance:isbuiltonafoundationofquicksandTherearethingsorganizationscanbedoingtodaytoaddresstheseconcerns.Specifically,thisreportdiscussesafive-stepprogramforidentitydatagovernancebasedupontheteam’sexperienceworkingwithdataandidentityinF1000enterprises.

TheRiseofMachineLearning:ManagingtheOpportunities,HandlingtheThreats(New)ByDavidGoodmanandBillBonney,PrincipalConsultingAnalystsArtificialIntelligencehasgainedmassivetractionoverthelasttwo-threeyearsinthebusinessworldaswellasthroughpopularmedia.Theexpressioncoversawiderangeofapplicationareasandimpactsatamultitudeoflevels.Todayartificialintelligencefortheenterprisetranslatestomachinelearningwhichisabusinessopportunityandincreasinglyanecessityforautomatingcomplexprocesses,themanagementandanalysisofbigdataandasavitalextensiontocybersecuritymeasuressuchasfraudprevention.Whencombinedwithdistributedledgertechnologysuchasblockchain,formachinestoeffectivelyrunahighly-distributed,cloud-basedorganizationwithminimalhumanengagementorinterventionhasthepotentialtogobeyondsciencefictiontoawholenewreality.AsthemediainterestinAIspirals,managersandemployeesare,notsurprisingly,concernedthat‘intelligentmachines’willeventuallyrobthemoftheirjobsastheywillbelessexpensiveandmoreeffectivethantheyare.However,puttingasidethelonger-termpossibilitiesassociatedwithAI,aswithanylearningprocess,therearegenuineconcernsaboutthereliabilityofthematerialfromwhichamachinehasderiveditslearning.Inparallel,thereareunresolvedquestionsregardinganyliabilitiesassociatedwithdecisionsandeventsthatensuebecauseofamachine-learntprocessandhowtheycanberesolved.Wearealongwayfromthenightmarehumanvsmachineconflictsenvisagedinmanymoviesbutthetimehascometoappraisehowwemakethemosteffectiveuseofthetechnologythatisavailabletoustodayandoverthecomingtwo-threeyears.


Thisreportcovers:• Layingthegroundworkforbecomingamoredata-centricorganization• Identifyingprojectswhichcreateproperpredictivemodelsthatsolverealproblems• Creatingadataenvironmentthatistrustworthyenoughforuseinmachinelearning• Creatingtheproperbalanceofmachineandhumandecisionmaking

UpcomingResearchFixingtheFundamentals–DataStrategy

ByNoreenKendle,PrincipalConsultingAnalystTogetanywhereonemustknowwheretheyaregoing.Similarly,adatastrategydefinesthedesiredstateforanorganization’sdataassets–theorganization’sdatavision.Yet,evenwithaformaldatastrategyinhand,manyorganizationsmakelittleprogressachievingthisvision.Mostdatastrategieslackamethodtoachievethedatavision.Thisleadstoacontinuouscycleofdatachaos.ArealisticdatastrategybeginswithaDataOversightFrameworkdefiningthepath,theplanandthedatainfrastructurenecessarytoachievethedatastrategy.Thisreportoutlinestheprocessnecessarytoachievearealistic(realworld)datastrategy,startingwithaDataOversightFramework.Thisreportcovers:• Howtodefineanenterprisedatavisionandknowwhatonelookslike• HowtodevelopaDataOversightFrameworkandtheinfrastructuretosupportit• HowtocombinetheDataOversightFrameworkanddatavisiontoestablishasuccessful,

sustainableanddefensibledatastrategy• ExperiencedefiningandimplementingdatastrategiesatFortune500companies

FixingtheFundamentals-DataAssetManagement

ByNoreenKendle,PrincipalConsultingAnalystAsdiscussedinFixingtheFundamentals–TheBusinessBlueprint,itiscriticalthatorganizationsgetthedataright.However,gettingthedatarightisonlyhalftheformulatofixingthefundamentals,theotherhalfiskeepingthedataright.Asdiscussedinthisgroundbreakingreport,datais“organic”inthatitcontinuestodecomposeanddeteriorateasitages.Aswithanyotherbusinessasset,theorganizationmustmanageitsdataassetsandthisrequiresbuildingaDataAssetManagementstructure.ThisreportdefinesanddiscussesaDataAssetManagementFrameworkasanecessarysteptokeepingthedataright.ADataAssetManagementFrameworkincludesthemethods,processes,andprocedure,andtoolsrequiredtomanagedataasanassetanditutilizesthedatainfrastructuredevelopedfromtheorganization’sBusinessBlueprintanditsdatadesignpractice.Thisreportcovers:


• Establishingthedifferencebetweengettingthedatarightandkeepingitright• ThestepstocreatingaDataAssetManagementFrameworkincludingthetoolsrequiredto

managedataasastrategicbusinessasset• ExamplesofsuccessfulDataAssetManagementFrameworks• Lessons-learnedandbestpracticesestablishingDataAssetManagementFrameworksatFortune

500companiesFixingtheFundamentals–EnterpriseFoundationalData

ByNoreenKendle,PrincipalConsultingAnalystMostpeopleagreethatdataisanimportantbusinessassetandshouldbemanagedassuch.Aswithanyasset,itsvalueisdirectlyproportionaltotherigorthatmustbeappliedtoproperlymanagetheasset.However,alldatadoesnothaveequalvaluetotheorganizationanddeterminingthisvalueisbecomingincreasinglydifficult.Thisisprimarilybecausethedifficultyofunderstanding,governing,managingandfindingthesedataisincreasingexponentiallyasthevolumesoforganizationaldatagrow.Thecostsformostorganizationtoproperlymanageallitsdataisnotpractical.Therefore,organizationsmustdetermineallitsdata’svalueandthenfocusonmanagingitshighestvaluedatafirst.Thisreportdescribesamethodforunderstandinganddeterminingthedifferenttypesofdatawithintheorganization.Thisunderstandingmaybeusedtodifferentiatethelevelofrigornecessarytomanage,govern,architect,secureandutilizethesedata.TheprocessbeginswithidentifyingEnterpriseFoundationalData(EFD)asatypeofdatathatisthecoredataoftheorganization.ThisreportfocusesontheEFDanddescribeshowonemayidentifythistypeofdataandthemethodstomanageandgovernit.Thisistheonlywaytheorganizationmaycost-effectivelymanageitsdataasakeybusinessasset.Thisreportcovers:• Howtoassessthevalueofdatatotheorganizationinthefaceofincreasingdifficultyto

understand,governandmanagedata• Howtotriagedataassetstodeterminethehighestvalueassetstofocusonfirst• Howtoclassifythedifferenttypesofdatawithintheorganizationstartingwithdefiningand

identifyingtheorganization’sEnterpriseFoundationalData(EFD)• Bestpracticesandreal-worldexperienceidentifyingEFDandFortune500companies

FixingtheFundamentals–DataDesignPractice

ByNoreenKendle,PrincipalConsultingAnalystEnterprisesfaceaterribledatadesignsituation:theircurrentdatasystemsareinastatethatisoftentoodifficultandtooexpensivetocorrectorinmanycasesthatisimpossibletochange.AtTechVisionResearchourexperienceshowsthatratherthancontinuallychasingthedatachallengesofexistingsystemsit’softenbetterfortheenterprisetoproactivelyfocusonthearchitectureanddesignoffuturedatasystemswiththegoalofgettingthedatarightinthefirstplace.Thisapproach


requiresachangeintypicaldataarchitectureanddesignapproachesusedtoday.Whenitcomestodatadesign,unlesswechangehowwearedoingthings,wewillcontinuetogetthesameresults.Thereportdefinesanddiscussesaproactivedatadesignpracticethatcoverstheidentification,architecture,design,anddeploymentofdatastructures/systemsthroughouttheorganizationincludingtheorganization’smeta-information.ThisprovenpracticeusestheBusinessBlueprintasthefoundationforalltheorganization’sdataanddatastructurestoformaholisticdatainfrastructuretyingalltheorganizationsdatasystemstogether.Asdiscussedinthisreport,usingtheBusinessBlueprintasthefoundationandapplyingthedatadesignpracticethroughouttheenterpriseestablishesanappropriatedatainfrastructuretoassuredataconsistencygoingforward.ThisdatainfrastructuremaybeutilizedbyDataIntegration,DataAssetManagement,InformationSecurity,andBusinessIntelligencefunctionswithintheorganization.Developingthisdatainfrastructureiscriticalforintegrating,managing,securingandgainingintelligencefromtheorganization’sdataassets.Withouttheproperdatainfrastructure,doingthisisdifficultatbestandmorelikelyit’simpossible.Thisreportcovers:• Howtomakethedecisionwhentocontinuetoinvestinlegacydataarchitectureanddesignand

whentoshiftthefocustofuturedatasystems• Howtochangedatadesignpracticesthatareentrenchedintheorganizationalzeitgeistand

retooltogetthedataright• Howtodevelopaproactivedatadesignpracticecoveringtheidentification,architecture,design

anddeploymentofdatastructures/systems• HowtousetheBusinessBlueprintasthefoundationforachievingenterprise-widedata

consistency• Usingthedatainfrastructureasavehicletointegrate,manage,secureandleveragethe

organization’sdataassets

PrivacyandDataProtectionPublishedResearchEnterprisePrivacyGuidelinesinaChangingRegulatoryEnvironment

ByJillPhillips,J.D.,PrincipalConsultingAnalyst

Facedwithallthedifferentprivacylaws,culturalbackgrounds,businessneedsandexpectations,andcompetingresources,thequestionbeingaddressedinthisreportishowtobuildaprivacyprogramthatdeliversdataprotectiontoallyourcustomers,yourbusinesspartners,andyourworkforce.Thisreportisdesignedtoprovideanexperienced-basedframeworkforbuildingaprivacyprogramorreviewinganexistingprivacyframework.Webreakdownenterpriseprivacyprogramsinseveralstepsandposeasetofquestionstohelpframeyourenterpriseprivacyprogram.


Inleadingprivacyprogramsforthepast15yearsatGeneralMotors,Chevron,andDell,JillPhillipshasdevelopedapragmaticapproachtobuildingandimprovingprivacyprogramsthatwemodelinthisreport.Leveragingthesuccessinbuildingandleadingprivacyprogramsovertheyears,,shehasdistilledsomelessonslearnedintoanoutlinewithfourbasicsteps—areferencearchitectureforbuildingorimprovingaprivacyprogram.

PrivacyBeyondCompliance

ByScottDavid,J.D.,GaryRowe,JillPhillips,J.D.,PrincipalConsultingAnalystsPrivacyisbroken,andpeopleandbusinessesarepayingtheprice.Thecostsofprivacycompliancekeepgoingup,whiletherealbenefitstoindividuals(suchascustomers,employeesandindependentcontractors)keepgoingdown.ThisfoundationalresearchreporthelpsITexecutivesframethealready-too-broad“privacy”discussiontomorecost-effectivelydealwithcompulsoryprivacycomplianceissues.Thisreportexploreshowcompaniesmaygetmaximumleveragefromtheirprivacycompliancecosts,anddelivermorebenefittotheircustomers,partners,shareholdersandemployees.“Privacybeyondcompliance”isaninvitationtoembraceprivacycompliancecostsandeventoincuradditionalcostsinthoseorganizationalsettingswhereanounceofprivacypreventionmaybeworthapoundofsecurityorpotentialliabilitycure.InthepropercircumstancesanROIispossiblethatpotentiallyconvertsprivacyfromanisolatedregulatorycostcenterintoanintegratedprofitcenterforthewell-managedenterprise.Inthisreport,TechVisionResearchexploresthewaysinwhichprivacy-relatedsunkcostscanhelptoimproveoverallenterpriseinformationsystemintegrity.ThisreportsuggeststhattheROIfromprivacyexpensescanbeimprovedbythoughtfulleverageofunavoidableprivacy-relatedcosts,andthereportidentifiesmorethanadozenexamplesofsituationsinwhichprivacy-relatedcostscanbereasonablymanagedasa“leveragedinvestment”towardimprovingsecurityand/ormitigatingotherenterpriserisks.Inthisreport,wealsosuggestthat“privacy”challengesareasymptomoftheunderlyingillnessofenterpriseinformation“leakiness”causedbynetworkcomplexity.Pluggingtheseleaksrequiresexpendituresdirectedtoimprovethereliabilityofboththetechnology,thepeopleandtheprocessesineachenterprisenetworksystem.Webelieveenhancingthis“socio-technical”systemreliabilityyieldsadditionalbenefitsbyimprovingsecurityandmitigatingamultitudeofenterpriserisks.Thisreportcovers:• Therelationshipbetweenprivacy-relatedsunkcostsandoverallenterpriseinformationsystem

integrity• Thevalueoflookingatprivacyissuesthroughthebroaderenterpriserisklens• Theopportunitytoconvertprivacycostsintopositivebusinessoutcomes• Thevalueoffocusingonsocio-technicalsystemreliability• Integratingprivacycostsintotheoverallenterpriseriskplanning


TheNewEuropeanPrivacyandDataProtectionRegulation—ComplianceorConsequences

By:DavidGoodman,D.Phil.,PrincipalConsultingAnalystTheEUwantstobuildasinglemarketfitforthedigitalagebytearingdownregulatorywallsandmovingawayfrom28nationalmarketstooneinwhichthefreemovementofpersons,services,andcapitalisensured.Tocomplicatematters,the15-year-oldSafeHarbouragreementbetweentheEUandtheUSisnolongervalidbecauseitdoesnotoffersufficientprotectiontothefundamentalrightsofEuropeans.UpdatestotherulesrelatingtodataprotectionandprivacyinEuropeaswellastherestoftheworldarelongoverdue.NewEuropeanlegislationwillreplacethecurrentchaosinwhicheachEUMemberStatehasitsownseparatedirectivewithabravenewworldinwhichtherewillbeonelawacrosstheentireEUimplementingstiffpenaltiesforviolations.ThenewlegislativelandscapewillrequireanybusinessoperatinginEuropeincludingUSmultinationalstomakeconsiderablechangestotheirprivacyanddataprotectionpoliciesandstrategieswithinthenexttwoyearsinadvanceofthelegislationcomingintofullforce.ThisdocumentexaminesthecurrentsetofrulesandtheproposedlegislationandwhatthiswillentailforEuropeanandUSbusinessesresponsibleforanydatarelatingtoEUcitizens,withrecommendationsonwhatactionsshouldbetakenassoonaspossibletoensurecomplianceratherthanfacetheconsequences.

EnterpriseInformationProtectionBy:FredCohen,PhD.,PrincipalConsultingAnalystEnterpriseinformationprotectionstartsandendswiththebusiness.Itinvolvesunderstandinghowthebusinessworksandwhyitworksthatway,turningthatunderstandingintoasetofdefineddutiestoprotect,andcarryingoutthosedutiestoaffectreasonableandprudentoperationofthebusiness.Becauseenterpriseshavemanymovingparts,structuringaprotectionprogramrequiresanarchitecturalcontexttobeeffectiveandefficient.Thisreportidentifiesthestructureofsuchanarchitectureandtheelementitnormallycontains.Takingthisasastartingpoint,detailstypicallygetfilledinatincreasinglevelsofdetailasthespecificsoftheneedsoftheenterprisearestructured.Akeythingtounderstandaboutthisarchitectureinspecificandenterpriseinformationprotectioningeneral,isthatitpermeatestheentireenterprise.Theboardandtopmanagementareresponsiblefordefiningthedutiestoprotectbecausetheyunderstandthebusinessandareultimatelyresponsiblefortakingriskstoreaprewards.Todothiswell,therisksandrewardsmustbeunderstoodbythedecision-makers,andnotmerelyoutlinedbysurrogates.Topmanagementisresponsible,allthewaytotheboard,responsibleofanyattempttodelegatetheactivities.Oncedutiesarewelldefinedandriskmanagementdecisionsaremade,operationalresponsibilitymustbecarriedout,andlikeanyothersuchsituation,controlmustbeexercisedresponsiblyortheprotectionprogramandtheenterprisewillgetandremainoutofcontrol.Likeacarwithoutadriver


(orcomputer),itwillcareendowntheroadandeventuallytherewillbeaccidentswithsubstantialconsequences.Evenifanenterpriseoutsourcesallitsinformationtechnology,thearchitecturalrequirementsanddutiestoprotectremainandmustbeactivelypursuedandproperlymanagedtoavoidtheliabilityandthebusinessconsequencesofprotectionfailures.Atfinerlevelsofdetail,theprotectionprograminvolvesmanydifferentelements,butattheendoftheday,thoseelementsultimatelygobacktoprotectingtheutilityofcontenttoassuretheinformationoperationssupportingandenablingbusinessfunctionsmeetthebusinessneeds.

NextGenerationEnterpriseIT&InnovationPublishedResearch

TheEndofEnterpriseArchitectureandITasWeKnowITByJohnMellarsandGaryRowe,PrincipalConsultingAnalystsCorporateITingeneral,andEnterpriseArchitecture(EA)hasnotevolvedwiththetimes.Theproliferationofthecloud,theascentofMillennialstoITleadershippositionsandtheacceleratingpaceoftechnologychangearedrivingtheneedforfundamentallynewapproachestoEAandIT.Enterprisesmustbecomemoredynamicandflexible,whileenablingdisruptiveimprovementsorriskenterpriseITrapidlybecomingirrelevant.Thereisapervasivemovementtothecloudandenterprisesareleveragingtheflexibilityandcostofadvantagesitoffers.SoftwareasaService(SaaS),PlatformasaService(PaaS),andInfrastructureasaService(IaaS)arechangingthewayITworksandtheyofferindependenceatthebusiness-unitlevel;independencethatthreatenstheentiremissionofIT.ITandEAdon’tneedtobeinthemiddleofeverybusinessunittechnologydecision,whichis,ofcourse,whyEAwascreatedinthefirstplace.LegacytechnologygovernancemodelssuchasEAdon’tfullytranslatetothisnewwayofusingcloud-basedservices,rapiddeployment,microservicesandnewmodelsforapplicationdevelopmentoperations.Tounderscorethispoint,vendorsnowcompetebasedonthefunctionsandcapabilitytheyofferlinkedtoorganizationalbusinessrequirements,notbasedonenterpriseITandtechnologygovernancestandards.ThisapproachcompletelysidestepsprocessesestablishedbytheCIOthroughitsITandEAteams.TheresultissignificantorganizationalfrictionandoftenEAspecifically,andIT,ingeneral,areincreasinglyseenbythebusinessunitsas“businessprevention.”ThegoodnewsisthereisastrongfutureforEnterpriseArchitectsandtheCIOteamtosupporttheenterprisemovetowardsanewcloud-basedITservicesmodel.Asdiscussedinthisreport,organizationsshouldbetakingseveralstepsincluding:• Empoweringbusinessunitstousetechnologyasameansofachievingsuccesswithfull

accountabilityfortheresults• Movingtowardsapointwheretheorganizationthinks“CloudFirst”


• PhasingoutEnterpriseArchitecturewithinITascurrentlydefinedgivenbusinessfrictionandchallenges

• RevampingcentralITtoprovideforEnterpriseentityneedssuchasprocurementofservices,security,disasterrecovery,datainterchange,andservicemanagement

• EstablishinganewChiefInnovationTechnicalOfficer(CITO)roletoleadinnovationcentersofexcellencetosupportthebusinesses

WhatisEnterpriseArchitectureinthis“newandchanged”environment?Itiswhatwecallthe“cloudification”ofEA.Asdiscussedinthisgroundbreakingreport,enterprisearchitectsaremorphingintoenterpriseITProductManagers(EIPM).Theconceptisoptimizingthechoiceofproductsandservicesfortheenterprisetooptimizeflexibility,businessutilityandspeedofdeployment.ThisreportdescribesthatpathtowardsthenextgenerationofIT.

HowDoWeAccelerateEnterpriseInnovationinaCultureofRiskAversion?

ByFredCohen,PhD.,PrincipalConsultingAnalystAtTechVisionResearch,webelievethereisafundamentalrequirementforgreaterinnovationtomaintain(orestablish)businessrelevancyforinthemodernenterprise.Butthisisoftendifficultinlargeorganizationsastheyareinnatelyriskaverse.Thisdifficultyleadstoasloweradoptionofchangeandaculturethatisresistanttoinnovation.Butfailuretoinnovatecanleadtostagnationandultimatelyobsolescencethatmaybeunrecoverable.Thisreportdiscussesstrategiesforinnovationthatremovethebarrierstoproductivitywithoutintroducingunduerisktothelargerenterprise.Ofcourse,thereisnoonesizefitsallsolution,sowedescribeaframeworkforevaluatingwhichinnovationstrategiesaremorelikelytobeappropriateindifferentcircumstances.Wealsodescribeinvestmentstrategiesthatmodelappropriateinnovationinvestmentbasedonthewillingnesstoaccommodaterisk,theappetiteforchange,andthecorporatecultureinplay.Acceleratinginnovationisbestdoneusingasystematicapproach,startingwithaboard-leveldecisionaboutthestrategicintentandvalue.Budgetfollowsthisunderstandingandtop-levelbuy-in,andamixedstrategyisthendeveloped.Fromthere,executioninvolvesinstigatingculturalchangesandemployingamixofactivitiesthataremeasuredovertimetoachievethegoalsandadaptasneeded.Wealsodescribebasicguidelinesforinnovationinvestmentthatbalancethedisruptivevalueofinnovationagainstcurrentoperationalandbusinessneeds.

AnITOrganizationalStructurefortheFutureByJohnMellars,PrincipalConsultingAnalyst

“AnITOrganizationalStructurefortheFuture”continuesthediscussionwebeganintheTechVisionreport“EndofEAandITasWeknowIT”andaddresses,inamoredetailedfashion,foundationalconceptsofaproposedorganizationstructure.Inthisreport,weintroducetheroleofBusinessIntegratedDevOps(BIDevOps)teams,intowhichwesuggesttransferringportionsoftheexistingcentralITorganization,thusdissolvingasignificantpercentageofthelegacyITorganizationintothevariousLineofBusinessunits.WealsofurtherelaborateontheroleoftheChiefInnovationTechnologyOfficerthatweintroducedinthepreviousreportanddiscussthestreamlinedcentralITorganizationourCITOwouldbetaskedtolead.


Tobringtheseconceptsforward,weestablishfiveprinciplesforthistransitionanddevelopatlengththereasoning,newroles,andimportantcaveatsfortheorganizationaltransformationweadvocate.WebelievetheresultofthistransitionisamoreagileITcapabilitythatismoreresponsivetothebusiness,yetabletoleveragetheyearsofinstitutionalknowledgeandgroundinginthekeyprocessesresponsibleforthegovernanceofITassets.WebelieveitisimperativethatITisleveragedbythebusiness,andforthebusiness,andwethinkthismodelprovidesanexcellentblueprintforundertakingthetransformationaljourney.

WhyLargeTechnicalProgramsFailandHowtoMitigateRisk(New)

ByJoeTeplitz,PrincipalConsultingAnalystWhydosomanylargetechnicalprogramsfail?Atbest,failuremeansnoeconomicreturn;atworst,itmeanssignificantincreaseinreputational,customer,operational,andbusinessrisk.Often,thefailureissobadthatthebestriskmitigationtechniqueiswritingofftheentireproject.Infinancialservicesorganizations,majorprogramsincludeaverylargeITcomponent.Unfortunately,ITisgenerallyundisciplinedaboutdevelopingandstatingaccuratevalueorpaybackmetricsforitsownprograms.Thislackofdisciplineinjectssignificantriskintotheoverallprogram,evenwhentheprogrammanagementfunctionisindependentofIT.ThisreportinvestigatesItscontributiontoprogramriskandidentifiesthekeyriskfactorsorganizationsmustaddressforprogramsuccess.Foreachriskfactor,thereportidentifiestherisktype,itsimpactonoverallrisk,mitigationstepsandbestpracticestoreducetherisk,aswellaskeymetricsformeasuringthisriskreduction.Thisreportcovers:• Thefundamentalsoflargeprogramfailure• Establishingaccuratevalueorpaybackmechanismsforprograms• Instillingdisciplineintotheprocesstoreducerisk• Keysuccessfactorsandmetricstoachievelargeprogramsuccess

IdentityManagementandSecurityPublishedResearchTheFutureofIdentityManagement

By:GaryRowe,DougSimmons,DavidGoodman,D.Phil.,BillBonney,PrincipalConsultingAnalystsIdentityManagementisatthecoreofthesecureITinfrastructurethateverycompany,governmentagencyandinstituteofhighereducationstrivestoachieve.Itisoneofthemostfundamentalbuildingblocksinsupportofanylevelofcommunication,collaborationorcommercewithinanorganizationoracrosstheInternet.


Despitethedecadesofinvestmentandhardwork,manyorganizationsfacegreateridentitymanagementchallengestodaythantheydid15yearsago.Today,manyorganizationsstrugglewithahodge-podgeofsilo’d,poorlyornon-interoperableIAMfunctionsthatareimpossibletogovernproperlyandarehinderingproperriskmanagement.Thishighlyactionablereportsupportsourclientsastheydevelopfive-yeartechnologyinfrastructureplans.Inthisreport,wemakespecificprojectionsastowherewebelieveIdentityManagementwillbegoingoverthenextfiveyearsandwedescribeamodelforidentityabstractionthatprovidesanextensibleservicesorientedarchitecture.ToprovideourclientswiththemostcomprehensiveviewofIdentityManagement,weaugmentourownexpertisewiththeinsightsofwhatweconsidertobethetopthoughtleadersandindustryexpertstodeliverthemostcomprehensiveperspectiveontheFutureofIdentityManagement.

Blockchain-basedIdentityManagement

By:DougSimmonsandGaryRowe,PrincipalConsultingAnalystsThisisthesecondofourseriesofblockchain-relatedresearchreportsanditsetsafoundationfororganizationstounderstandhowblockchainordistributedledgerscanfitwithinanidentitymanagementecosystem.Theconvergenceofidentitymanagementandblockchainprovidesanopportunitytolookatblockchain-basedidentitymanagementfromtwoprimaryperspectives;firstfromanidentitymanagement-centricviewandsecond,fromtheperspectiveofhowblockchainhasevolvedtosupportabroadrangeofidentitymanagementusecases,includingpeople,applicationsanddevices.Thisreportfocusesonanext-generationidentityecosystemthatprovideseachpersonasinglesetofidentitycredentials,availableforuseacrossallelectronicservicesencompassinggovernment,consumer,andcorporateentities(i.e.,BringYourOwnIdentity,orBYOI).Blockchainhasthepotentialtobeavaluablepartofthisecosystembyenablingtherecordinganddistributionoftrustedidentitiesandassociatedinformationwithoutrequiringrelianceonaspecificcentralizedthird-partyauthority.

PuttingIdentityintoContext:NextGenerationIAM

By:DavidGoodman,D.Phil,PrincipalConsultingAnalystIdentityandaccessmanagement(IAM)hasmaturedfromitsrootsinbasicauthentication,authorization,andprovisioningtothepointwherecontextandrelationshiphaverapidlybecomeessentialfeaturesindeliveringonthepromiseofIAM.Asthecornerstoneofenterprisesecurity,context-basedidentitymanagementishowrisksandthreatsareassessedandmanaged,aspartofanoverallbusinessdigitaltransformationthatalsoincludesamoresophisticatedapproachtomarketingandbrandloyalty.Therearemanydriversforthisurgency,amongwhicharetheproliferationofCRMinformation,securityandIoTdataaswellassocialmediabusinessesthatarebuiltoninformationsharing.Inadditiontowhichtheinformationstoredatscaleinthecloudissomuchgreaterthanwhatanysingleorganizationhas.Withoutsomeformofcontextualization,thesemassivedatasourcesdon’teasilyintegratewithtraditionalIAMdata,whichlimitsitsusefulnessandtheabilitytobuildapplicationsthattakeadvantageoftheoverallproliferationofinformation.


Almosteverycloud-andpremise-basedidentityvendoraswellasmostsecurityvendorsTechVisionResearchhasinterviewedareeithercommittedtoorarealreadyinvestingheavilyincontext-and/orrelationship-basedidentitymanagement.Simplyput,anidentitywithcontext,evenminimalcontext,isfarmorevaluableandusefultoanorganizationthanrawidentityinformation.Inthisreport,wedigdeeptoclearlydefinewhatthisis,whothemajorplayersare,theimpactoninfrastructuretechnologies,thefuturedirectionandprescriptiverecommendationsandnextstepforTechVisionResearchclients.Thisreportcovers:• Therealityofcontext-basedIAMandthevaluepropositionfortheenterprise• Thecontext-basedidentitymanagementecosystem:todayandtomorrow• TechVisionResearch’sshortlistofcontext-basedIAMvendors• Tenstepsanenterpriseshouldtaketobestleveragecontext-basedidentitymanagement

OpportunitiesinEuropewithElectronicIdentificationandTrustServices

By:DavidGoodman,D.Phil.,PrincipalConsultingAnalystTheworldwidefragmentationofelectronicidentitieshascaughttheattentionofmanygovernments,whicharetakingacloserlookatdevelopingamoreunifiedapproach.Asregulationsemerge,EuropeisleadingthewaythroughtheadoptionoftheElectronicIdentificationandTrustServices(eIDAS)Regulation.Overthecomingtwoyears,asdifferentaspectsoftheregulationcomeintoforce,eIDASwillhavetremendousimpactsonmostaspectsofelectronicbusinesstransactionsinEuropewhichpresentsopportunitiesforcostsavings,efficiencies,andcompetitiveadvantagebothforEuropeancompaniesaswellasUSmultinationalsoperatinginEurope.ThisdocumentdetailsthenewlegislationandprovidesanillustrationfromthebankingandfinancecommunityoutliningtheopportunitiesandobstaclesfacingthisindustrysectoralongsideTechVisionResearchGuidance.WealsoprovideadditionalmaterialexplainingthebackgroundtothecurrentinitiativesfrombothEuropeanandUSperspectives.

TechVisionCrossTalkReport:IdentityandDataGovernance

ByBillBonney,GaryRoweandNoreenKendle,PrincipalConsultingAnalystsModeratedbyTedRitter,CISSPWhataretheconnectionsbetweenidentityanddataintheenterprise?Whenoneprotectsidentity,theyarereallyprotectingdata:datathatisarepresentationoftheidentity.Unfortunately,asdiscussedinthisnewCrossTalkreportbyTechVisionResearchmostorganizationsdon’thavedatamanagementandevenwhentheydohavedatamanagement,theidentitydataisusuallyleftoutofthediscussion.


AtTechVisionResearchwecontinuallyseedatamismanagementunderminingallaspectsofthebusinessfunction.AsNoreenKendlehasexperienced“datamess-upisequalopportunityacrossalltypesofdata,includingidentitydata.”Noreengoesontosay,“I’veseencompaniesoverwritebigtextfieldswithidentity-relatedinformationprimarilybecausetheydon’twanttostopandenhancethedatabaseschemaandstructures:thisincludescreditcardnumbers,socialsecuritynumbers,etc.”Obviously,thisisahugeprivacyissuebecausethefieldsarenotidentifiedasidentityfieldsandtheITstaffisoblivioustothesituation.BillBonneyspeaksfromexperiencebuildinganIdMpracticeashe“agreesthatoverloadingisanissue.”But,asBilllikestopointout,“It’snotjustoverloading,it’smakingassumptionsaboutwhatisinafieldandassumptionsabouthowthefieldisevaluatedandbeforeyouknowityouhavesub-processesbuiltuparoundafalselyvalidatedfield.”Thisestablishesafalsefoundationthateventuallycausestheentiretrustchaintobreak.AsBillstates,“inevitably,someonewillusethedatabasedonhowitwasfirstcreated(thefieldlabelofrecord).”Thisisasymptomofafargreaterproblem.ThereisahugeassumptionmadebyITstaffandtheidentitymanagementtoolstheyusethatthedatafieldsareaccuratelyrepresentingthedatastoredinthefield.Thisjustisn’tso!Giventhisrealityofidentityanddatamismanagementintheenterprise,thisreportfocusesonthefollowingkeyconcerns:• Theevolutionofidentitydataasitsowndomain• Theimpactofsilosonidentitydatamanagement• Thepotentialofvirtualdirectoriesasanidentitydatamanagementapproach• Theimpactofdatareuseonidentityandtheresultingauthenticitydecay• Identitydatagovernance:isbuiltonafoundationofquicksandTherearethingsorganizationscanbedoingtodaytoaddresstheseconcerns.Specifically,thisreportdiscussesafive-stepprogramforidentitydatagovernancebasedupontheteam’sexperienceworkingwithdataandidentityinF1000enterprises.

GettingtoKnowYourCustomers:TheEmergenceofCIAMBy:DavidGoodman,D.Phil.,PrincipalConsultingAnalyst

Tenyearsago,identityandaccessmanagement(IAM)solutionswererarelydeployedbeyondthecompanyfirewall,providingpermissionsandaccessrightstoenterpriseresourcestoemployeesandcontractors.Whenavailable,themanagementofcustomerandpartneraccesstoagenerallylimitedsetofresourceswasoftenpoorlycoordinated.Today,however,averydifferentsocial,technologyandbusinessenvironmentdemandsthatenterprisesmaketheircustomers’onlineexperienceassleekandpersonalizedaspossible.Andtodothis,enterprisesareembracinganewbreedofconsumerorcustomeridentityandaccessmanagement(CIAM)solutionsfromtheirIAMvendors.

TheinvestmentandcommitmenttoCIAMarebeingdrivenbyanever-increasingsophisticationofcustomerexpectationintermsofa‘joined-up’userexperienceandreal-timeavailabilityofrelevantresourcesavailableanywhere,anytimeandfromanydevice.Alongsidetheneedtoprotectthe‘disappearingperimeter’withadequatesecurityismeasuredtheneedtoaddresscompetitive


advantageandmaintaincustomerloyalty.Boostingtransparencybetweenmarketingandlinesofbusinesshasthepotentialtodeepenthecustomerrelationship.

Inthisreport,weinvestigatethisemergingtrend,whatthemajorplayersaredoing,andwhatshouldbethenextstepsforTechVisionResearchclients.Thisreportcovers:• TheCIAMvaluepropositionandbusinessrationalefortheenterprise• GettingthebalancerightbetweenenterpriseIAM(EIAM)andCIAM• TechVisionResearch’sshortlistofCIAMvendors• FivestepsanenterpriseshouldtaketobestleverageCIAM

MachineLearningandArtificialIntelligenceonBigDataforCybersecurity(New)

By:FredCohen,PrincipalConsultingAnalyst

Theuseofmachinelearningandartificialintelligenceforcyber-securityarenothingnew.Buttheavailabilityoflargerdatasetsandtheevolutionoftechniquesapplicabletobigdatahaveproducedanewgenerationofsystemsthatimproveefficiencyandutility.Theneedforfargreaterscalebroughtaboutbythedramaticincreaseinthenumberofusers,uses,andsystemsinvolved,hasdriventhedevelopmentofmachinelearningandartificialintelligenceforcyber-security.Thebasictechnologicalchangesinvolvemathematicalalgorithmsthatexaminelargedatasetscontainingknownbadandknowngoodsamples.Thesemethodscreateequationsthatclusterknown“good”and“bad”samplesanddifferentiatethemfromeachother,thenapplythosesameequationstonewsamplestoclassifythemas“good”or“bad”.Thiscanthenbeappliedtoanyofawiderangeofproblems,includingmanyofthoseofcyber-security.Theenterprisebenefitsoftheseemergingtechnologiesareeconomiesofscale,efficiencyoflabor,anddetectioninareasnotpreviouslyaddressed.Thisreportdiscusses;(1)thebasicsofthesetechniques,(2)thewordsusedtodescribethemandwhatthosewordsmean,(3)thelimitations,benefits,andcostsofthesetechniques,and(4)theirapplicationtoCybersecuritytodayandintothefuture.Itthendiscussesproducttypesemerginginthemarketsandthecurrentandlikelyfutureutilityofapplyingtheseproducttypestoenterprises.Inthisreport,weinvestigatethisemergingtrend,andwhatshouldbethenextstepsforTechVisionResearchclients.

UpcomingResearchIdentityofThings(IDoT)

ByBillBonneyandGaryRowe,PrincipalConsultingAnalystsTechVisionidentifiedtheInternetofThings(IoT)asamajortrendimpactingIAMinourFutureofIdentityManagementresearchreport.ThisreportprovidesmuchdeeperassessmentofhowidentitymanagementsystemsshouldembraceanddirectlysupportIoT-associatedidentity.TheIdentityofThingsshouldbeamajorconsiderationformostenterpriseidentityprogramsandthegoalofthisreportistobetterprepareourclientstonavigatethisdynamiclandscape.


Thisreportcovers:• Scale:IoTintroducesfargreaterobjectstobemanaged• Security:IoTintroducesnewchallengesinidentifyingeasilycompromised“dumb”devicesnew

threatvectorsthatmustbeassessedandmitigated• Privacy:majorconcernsinexposingpotentiallysensitivedata• Context:whilethefocusofIDoTisdeviceidentity,theseidentitiestobeassociatedwithowners,

vendorsandentitlements• Value:beyondtheoperationaldetailstocreate,enableandmaintainIDoTatscale,thesedevices,

whenleveragedcorrectly,createnewopportunitiestogoin-depthwithcustomerneedsandproductcapabilities/usage

• ProsandconsofdifferentapproachestoIDoTincludingtradeoffsofbuilding/usingaseparateIDoTvs.leveragingexistingIAMsystems

• FuturetrendsinIDoTincludingtheimpactofblockchain-basedproductsandservices• Majorcurrentandexpectedmarketplayers• RecommendationsandtimelineforEnterpriseIT

TheCloudificationofIdentity—IDaaSMarketOverview

By:GaryRowe,PrincipalConsultingAnalystThetimeisrightformostorganizationstoconsidermovingsome,orall,oftheiron-premiseidentitymanagementtoanIdentityasaService(IDaaS)model.Thecombinationofapervasivemovementtothecloud,alargelydisappearingperimeter,theproliferationofIoTdevices,theneedtointegrateexternalidentities,therecognizedvalueofcontextualidentity,themovementtodecentralizedidentityandtherequirementforaflexibleITinfrastructureareallcontributingtothismovementtoIDaaS.ThisreportdescribestheIDaaSvalueproposition,thecurrentstateofIDaaSaswellasthevendorlandscape.Sincemostorganization’sIAMisnottotallycloud-based,we’llexamineco-existenceandmigrationpathsaswellastypicalmigrationplanningtimeframes.We’llalsoconsiderkeyenterpriseIDaaSrequirementsinlightofmajorvendorofferingsandwillincludeourIDaaSvendorshortlistinthisreport.Formostorganizations,itisn’tiftheywillmovetoIDaaS,itiswhenandwe’llprovidearoadmapguidanceforthistransition.

Banking,IdentityandtheRegulators(New)By:DavidGoodmanandRhomaiosRam,PrincipalConsultingAnalystsOverthelastfewyearspolicymakers,serviceprovidersandsoftwarevendorshavecometorealise,dataisabusinessassetthatwouldnotbeoutofplaceonacompanybalancesheet.Itisalsoapparenttoindividualsthatthedataheldaboutthembygovernmentsandbusinesseshasbothvalueandisincreasinglyatriskfrombeingmishandled,deliberatelyorotherwise.Ironically,asthevolumeofonlinesocialandcommercialtransactionsincreasesexponentiallydaybyday,theleveloftrustinsharingpersonaldataonlineisfallingequallyfastduetoconcernsaboutprivacyintrusionsandpotentialconsequencesofidentitytheft.


WiththeemergenceofdataprotectionandrelatedregulationsthatwillgoalongwaytosafeguardingtheprivacyandrightsofindividualsontheInternet,opportunitieswillarisefortrustworthyorganizationstoactasidentityserviceprovidersoridentitybrokers.And,despitethebadpressbankershavereceivedoverthelasttenyears,mostpeoplestillinstinctively-anddemonstrably,albeitoftenthroughgrittedteeth,trustbankstoholdtheirmostvaluablefinancialassets.Sowhynottheirpersonaldataaswell,particularlyasthebanksalreadyhave,andarerequiredtohave,themostuptodatesensitiveinformationabouttheircustomers?Theansweristhatsomeforward-lookingbankshavealreadyrecognizedthepossibilitiesinleveragingthecocktailofregulation,customertrustandcompetitiveadvantage,andhavetakenstepstowardstoadvanceearlyexperiments.However,forthemajorityofbanks,theideasarestilldormantandhavenotconvincedseniormanagementtoexplorefurther.ThisdocumentlooksattheconfluenceofthenewslewofregulationsastheyimpactthebankingcommunityfromaholisticperspectiveanddemonstrateshowthiscanbetransformedintoanewsetofbusinessopportunitiesaswellaswhatshouldbethenextstepsforTechVisionResearchclients.Thisreportcovers:• Theemergingregulatorylandscapeasitimpactsthebanks• Theopportunitiesforbankstobecomeidentityserviceproviders• Sixstepsabankshouldtaketobestleveragethispotential

IdentityGovernanceAdministration:TheJourneytothePeople-centric,Business-orientedFutureofAccessControl(New)

By:VladShapiro,PrincipalConsultingAnalyst

Identity-relatedbusiness(IDM,AM,IAG)hasdevelopedrapidlyinthelast15-20years,andtodayisoneofthehottestandmostdemandedtopicsincurrentinformationsystemsmanagement.Inanutshell,theissueispeoplehavemanyaccessprofilesacrossoneormoreenterprises,andthereisnocentralauthorityempoweredtomakedecisionsaboutgrantingandcontrollingaccessandentitlementstoenterpriseresources,suchasapplications,physicaldevices,andlogicalsystems.Todaycontrolbelongstoresource/applicationadministrators,nottobusinessleadersandpolicymakersofthecompany,whichcreatesconflict,misunderstandingandultimatelysecurityissues.Sinceadministratorsdonothaveenoughinformationaboutrequiredpoliciesandbusinessleadersdonothavetheadequatetoolstoimplementthem,afundamentalconflictarisesthatisnoteasilyresolved.IdentityGovernanceAdministrationwascreatedtoaddressthisconflict.Itdefinesacommonframeworkusedbybusinessandtechnologyorganizationsindevelopingapracticalprogramtomanageallaspectsofgoverningaccesstophysicalandlogicalresources.Inthisreport,wewillshowtheevolutionofIGAfrombeingjustapartofITtoamodernbusiness-orientedframework,includingwhatsolutionsareavailabletoday,futuretrendsandrecommendationsforTechVisionResearchclients.ThisreportwillhelpourclientsbuildandsustainaneffectiveIGAprogram.Thisreportcovers:• HistoryandevolutionofIdentityandAccessGovernance:frompaperformstoIGAplatforms• ResponsibilitieswithinIGAandthefundamentalconflict• MainhistoricalshiftsinIGA:subjectshift,focusshiftandresponsibilityshift


• Business-orientedmodel:description,availablesolutions,andtrends• People-centricapproachinIGApoliciesandgovernance• TechVisionrecommendations

InternetofThingsPublishedResearchInternetofThingsasaSecurityRiskAmplifierandRiskMitigationStrategies

By:BillBonney,ScottDavid,J.D.,PrincipalConsultingAnalystsIfwelookpastthefearandhypeofconnectingautonomousandsemi-autonomousdevicestogetherintheso-called“InternetofThings”orIoT,thereisaseachangeinhowweempowertheworker,enhancetheworkplaceandgotomarket.TheIoTispermanentlychangingbusinessmodelsineveryindustryand,asimportantly,theConnectedWorkerisfirstaConnectedConsumerwhocarriespersonalcommunicationdevicesandamyriadofsensorswiththemalways.ThecombinationofenhancedtrackingthroughRFID(radiofrequencyidentification);monitoringthroughdevice-borne,embedded,andwearablesensors;andautonomousorremotecontrolofadjustablemobiledevicesthatareconnectedto,orshare,anorganization’snetworkisamplifyingthecurrentrisksofexistingITsystemsandcreatingnewrisksthatmustbecataloged,ranked,andaddressed.Thisiswhatweseektounderstandandmanage.Inthisreport,wewillleavetheFUD(fear,uncertainty,anddoubt)aside,ignorethehype,andlookattherealrisksfacingtheenterpriseduetotheexplodinguseofpersonaldevices.

UpcomingResearchEnterpriseIoTRealityCheck

ByBillBonney,PrincipalConsultingAnalystThisreporttakesahigh-level,enterprise-wideviewofthestateofIoTandthemarketsegmentswhereIoTpromisestransformationalchange.Inthisreport,TechVisionResearchdiscussesthekeyIoTenablingtechnologies,theirmaturity,andprovidesguidelinesforwhereweatTechVisionResearchbelieveorganizationsshouldbeontheirIoTjourney.ThisincludesoutliningsignificantareasofenterpriseriskcreatedbyIoTandhighlightingessentialstrategiesforaddressingthoseareasofrisk.Withthecontextdevelopedinthisreport,enterprisedecisionmakerswillunderstandimportantnextstepstheyshouldbetakingdowntheIoTdevelopmentpath.Thisreportcovers:• IdentifyingandclassifyingthedifferentmarketsegmentsmostsusceptibletoIoT’simpact• DefiningtheIoTjourneyfortheenterpriseandwhereweseeenterprisesonthisjourneytoday• DefiningenterpriseIoTriskandstrategiestomitigatetherisk


IdentityofThings(IDoT)

ByBillBonneyandGaryRowe,PrincipalConsultingAnalystsTechVisionidentifiedtheInternetofThings(IoT)asamajortrendimpactingIAMinourFutureofIdentityManagementresearchreport.ThisreportprovidesmuchdeeperassessmentofhowidentitymanagementsystemsshouldembraceanddirectlysupportIoT-associatedidentity.TheIdentityofThingsshouldbeamajorconsiderationformostenterpriseidentityprogramsandthegoalofthisreportistobetterprepareourclientstonavigatethisdynamiclandscape.Thisreportcovers:• Scale:IoTintroducesfargreaterobjectstobemanaged• Security:IoTintroducesnewchallengesinidentifyingeasilycompromised“dumb”devicesnew

threatvectorsthatmustbeassessedandmitigated• Privacy:majorconcernsinexposingpotentiallysensitivedata• Context:whilethefocusofIDoTisdeviceidentity,theseidentitiestobeassociatedwithowners,

vendorsandentitlements• Value:beyondtheoperationaldetailstocreate,enableandmaintainIDoTatscale,thesedevices,

whenleveragedcorrectly,createnewopportunitiestogoin-depthwithcustomerneedsandproductcapabilities/usage

• ProsandconsofdifferentapproachestoIDoTincludingtradeoffsofbuilding/usingaseparateIDoTvs.leveragingexistingIAMsystems

• FuturetrendsinIDoTincludingtheimpactofblockchain-basedproductsandservices• Majorcurrentandexpectedmarketplayers• RecommendationsandtimelineforEnterpriseIT

UnlockingtheValueofIoTtotheEnterprise

ByBillBonney,PrincipalConsultingAnalystThisreportdivesdeeperintothecriticalsuccessfactorsnecessarytounlockthevalueoftheIoTeco-systemsthataredevelopingindifferentmarketsegments.Foreachmarketsegmentcovered,TechVisionResearchexaminesindetailthetransformationaloutcomesthatIoTpromises.Toachievetheseoutcomes,weoutlinethestageseachenterprisemustgothroughtobothdevelopthecapabilitiesnecessaryandproviderealworldguidanceforassessingtheavailabletoolstohelponeachievetheseoutcomes.Thisreportcovers:• DefiningIoTeco-systemsTechVisionResearchseesdevelopingfortheenterprisebasedon

marketsegmentation• OutliningthepotentialtransformationalbenefitsofIoTbymarketsegment• RealworldguidancetoassesstheemergingtoolsforenterpriseIoTimplementation,governance

andriskmitigation.


ArtificialIntelligence/MachineLearningPublishedResearchTheRiseofMachineLearning:ManagingtheOpportunities,HandlingtheThreats(New)

ByDavidGoodmanandBillBonney,PrincipalConsultingAnalystsArtificialIntelligencehasgainedmassivetractionoverthelasttwo-threeyearsinthebusinessworldaswellasthroughpopularmedia.Theexpressioncoversawiderangeofapplicationareasandimpactsatamultitudeoflevels.Todayartificialintelligencefortheenterprisetranslatestomachinelearningwhichisabusinessopportunityandincreasinglyanecessityforautomatingcomplexprocesses,themanagementandanalysisofbigdataandasavitalextensiontocybersecuritymeasuressuchasfraudprevention.Whencombinedwithdistributedledgertechnologysuchasblockchain,formachinestoeffectivelyrunahighly-distributed,cloud-basedorganizationwithminimalhumanengagementorinterventionhasthepotentialtogobeyondsciencefictiontoawholenewreality.AsthemediainterestinAIspirals,managersandemployeesare,notsurprisingly,concernedthat‘intelligentmachines’willeventuallyrobthemoftheirjobsastheywillbelessexpensiveandmoreeffectivethantheyare.However,puttingasidethelonger-termpossibilitiesassociatedwithAI,aswithanylearningprocess,therearegenuineconcernsaboutthereliabilityofthematerialfromwhichamachinehasderiveditslearning.Inparallel,thereareunresolvedquestionsregardinganyliabilitiesassociatedwithdecisionsandeventsthatensuebecauseofamachine-learntprocessandhowtheycanberesolved.Wearealongwayfromthenightmarehumanvsmachineconflictsenvisagedinmanymoviesbutthetimehascometoappraisehowwemakethemosteffectiveuseofthetechnologythatisavailabletoustodayandoverthecomingtwo-threeyears.Thisreportcovers:• Layingthegroundworkforbecomingamoredata-centricorganization• Identifyingprojectswhichcreateproperpredictivemodelsthatsolverealproblems• Creatingadataenvironmentthatistrustworthyenoughforuseinmachinelearning• Creatingtheproperbalanceofmachineandhumandecisionmaking

MachineLearningandArtificialIntelligenceonBigDataforCybersecurity(New)

By:FredCohen,PrincipalConsultingAnalyst

Theuseofmachinelearningandartificialintelligenceforcyber-securityarenothingnew.Buttheavailabilityoflargerdatasetsandtheevolutionoftechniquesapplicabletobigdatahaveproducedanewgenerationofsystemsthatimproveefficiencyandutility.Theneedforfargreaterscalebroughtaboutbythedramaticincreaseinthenumberofusers,uses,andsystemsinvolved,hasdriventhedevelopmentofmachinelearningandartificialintelligenceforcyber-security.Thebasictechnologicalchangesinvolvemathematicalalgorithmsthatexaminelargedatasetscontainingknownbadandknowngoodsamples.Thesemethodscreateequationsthatclusterknown“good”and“bad”samplesanddifferentiatethemfromeachother,thenapplythosesameequationstonewsamplestoclassifythemas“good”or“bad”.Thiscanthenbeappliedtoanyofawiderangeofproblems,includingmanyofthoseofcyber-security.


Theenterprisebenefitsoftheseemergingtechnologiesareeconomiesofscale,efficiencyoflabor,anddetectioninareasnotpreviouslyaddressed.Thisreportdiscusses;(1)thebasicsofthesetechniques,(2)thewordsusedtodescribethemandwhatthosewordsmean,(3)thelimitations,benefits,andcostsofthesetechniques,and(4)theirapplicationtoCybersecuritytodayandintothefuture.Itthendiscussesproducttypesemerginginthemarketsandthecurrentandlikelyfutureutilityofapplyingtheseproducttypestoenterprises.Inthisreport,weinvestigatethisemergingtrend,andwhatshouldbethenextstepsforTechVisionResearchclients.


AboutTechVisionDirectExperience.ActionableResults.GreatValue.Thespeedatwhichtechnologychangesdemandsaresearchcompanythatisnimble,leveragesreal-worldexperiencewithoutsideperspectives,andmakesitsknowledgeavailabletoeveryoneintheenterprise;afirmthatwritesfor,andtakestheperspectiveof,theconsumersoftechnology.ThatfirmisTechVisionResearch.AtTechVisionResearch,wefocusonyoursuccess.Withanunparalleledcombinationofcutting-edgeresearch,high-impactworkshops,andexpertandpragmaticadvice,TechVisionhelpsyouleveragetechnologyto…

• Enabletheenterprisevision• Engagewithdigitallyempoweredcustomers• ExcelattheITfundamentals• Enhancecollaborationacrosstheenterprisevaluechain

Findoutmoreathttp://www.techvisionresearch.com/

research report catalogue · 2017-05-12 · research report catalogue may 2017 abstract through our...

Documents