1
Functional complexity
(now and in the future)
Maarten Stultjens | VP Global Enablement IAM
More About This Author >
Maarten Stultjens | VP Global Enablement IAM
More About This Author >
CIAM platform development isn't just about technical expertise. It requires integrating diverse components, ensuring configuration flexibility, and creating extensive documentation. Furthermore, a future-proof CIAM platform must adapt to evolving customer journeys. This complexity begs the question: can your organization commit to the long-term effort required for a Do-It-Yourself (DIY) CIAM strategy?
What’s at risk when you’re taking the DIY approach
When you start developing a Customer Identity and Access (CIAM) strategy, the Do-It-Yourself approach might look interesting - but there are risks you need to watch out for. Risks involved can range from identifying current and future functional complexity to the time it takes to bring it to market. In this article, I identify and expand upon 5 key risks:
2
Integration complexity
(now and in the future)
3
Specialized expertise
4
Always-on
5
Time to value
1. Functional Complexity — Today and in the Future
CIAM has evolved far beyond simple registration forms and Username/Password logins. It has also evolved beyond just customers, what about partners and third parties? Today's challenges involve:
- Frictionless onboarding: Balancing security with a smooth registration process is crucial.
- Omni-channel logins: Customers expect seamless access from any device or platform with a familiar look and feel.
- Data privacy compliance: What started with the GDPR and CCPA, Data Privacy regulations are popping up in droves in different geographies and they demand robust data protection and compliance.
- Data validation: Matching user account with internal data and a third-party register ensures accuracy.
- BYOI and Third-party identity providers: Integration with government IDs, bank IDs, or social logins is increasingly common.
- Diverse user types: Managing access for consumers, business users, partners, and guests requires flexibility.
- Access delegation: Granting controlled access to specific customer groups or partners necessitates delegation models with invitations and elevation or authorizations by yourself or third-parties.
- Emerging technologies: What about self-sovereign identity and blockchain's role in future CIAM is important.
The Question: Can Your CIAM Keep Up?
These complexities demand a robust CIAM solution. Does your organization possess the expertise to navigate it together with global data privacy regulation compliance? Can your IT infrastructure handle the agility needed to meet evolving business demands?
2. Integration Complexity: Navigating the Standards Maze
For over a decade, the Security Assertion Markup Language (SAML) has been the go-to standard for logins. But with the explosion of devices and processes, the landscape is shifting:
- Evolving Standards: OpenID Connect is now essential for customer access. FIDO is the new authentication standard, and SCIM is crucial for data exchange.
- PKI and UMA: Standards like PKI have staged a comeback. While some may not, like UMA.
- Versioning Mayhem: As standards mature, they introduce versioning challenges.
The Challenge: Choosing Wisely
- Standard Selection: Can you confidently choose the right standards for your needs?
- Tooling Agility: Does your CIAM solution offer ongoing support for these evolving standards? Without this flexibility, your infrastructure might struggle to adapt for the future.
3. Specialized expertise
Building your own CIAM platform might seem feasible with a skilled IT team. But expertise in standards like SAML is just one piece of the puzzle. Here's why developing in-house can be challenging:
- Beyond Functionalities: A robust CIAM requires configurability, seamless integrations, and comprehensive documentation – not just core functionalities.
- Future-Proofing: A 5-10 year lifecycle demands a platform built for adaptability, not just current needs.
- Resource Allocation: Even with the right expertise, devoting internal resources to long-term CIAM development can be difficult due to competing project demands.
- Team Building: Maintaining a dedicated CIAM development team requires long-term commitment, potentially with external expertise needed in a competitive market. Will you be able to find them in this tough labour market, and what are the out-of-pocket costs?
The Question: Is In-House Development Right for You?
Carefully consider the resource constraints and long-term commitment required before embarking on in-house CIAM development. Evaluating these challenges can help you make an informed decision.
4. Always-on: Maintaining your digital Fort Knox
A robust Customer Identity and Access Management (CIAM) system acts as your company's digital front door. Here's what it takes to keep it secure and operational:
- Infrastructure: Do you have the right data center environment, expertise in things like devOps and security, and support.
- Resilience, Scalability and Security: The system must be constantly accessible (always-on) and handle surges in traffic (scalability). It needs to be resilient against cyberattacks.
- Compliance Certifications: Third-party certifications (ISO27001, ISAE 3000) might be necessary.
- Deployment Agility: Frequent updates and configuration changes require a robust DevOps process with minimal downtime.
- 24/7 Monitoring: Continuous monitoring with various tools (probes) is essential to detect and address critical incidents (P1/P2) immediately.
Ask yourself: Are You Equipped?
Does your organization possess the infrastructure (data center), expertise (devOps, security), and support for this demanding role? Can you invest the time and resources to achieve and maintain compliance certifications? Evaluating these factors will help you determine if you have the capabilities to manage a CIAM system effectively.
5. Time to value: Beyond the initial hurdles
While Identity and Access Management (IAM) projects are complex, CIAM adds another layer due to its specific functionalities. Here's why achieving fast time-to-value can be challenging:
- Project Complexity: CIAM projects involve numerous stakeholders and intricate decision-making, leading to lengthy planning phases (months or years) for custom builds.
- Infrastructure Dependency: CIAM often acts as a critical building block for other initiatives, creating pressure for timely delivery.
The Power of Pre-Built Solutions:
- Best Practices & Configuration: Leveraging pre-built solutions with best practices and configurable options accelerates project timelines.
- Vendor Expertise: Utilizing vendor templates and experience translates to operational efficiency and proven stability. Building from scratch doesn't guarantee scalability or reliability.
The Question: Speed vs. Risk?
You don’t have the luxury of big-time failures in the face of your customers. Can your organization afford a custom build with a 6-month+ timeframe and potentially uncertain outcomes? Pre-built solutions with predictable costs and dedicated vendor support offer a faster path to value (potentially in 8 weeks) with minimized risk of major failures.
To summarize
Building your own CIAM solution can be a time-consuming and expensive endeavor, even with internal expertise. The risk of delays and potential shortcomings is significant.
That's why an increasing number of companies across industries are turning to commercial, out-of-the-box CIAM solutions. These pre-built options offer several advantages:
- Faster Time to Value: Reduced planning and development lead to quicker implementation.
- Reduced Costs: Avoid the ongoing expense of in-house development and maintenance.
- Mitigated Risk: Benefit from proven technology and vendor expertise to minimize security vulnerabilities.
Independent Validation: Thales OneWelcome an Overall Leader in CIAM
For an independent perspective, consider the CIAM Leadership Compass from KuppingerCole, a leading industry analyst firm