In Oracle-Sun deal, analysts predict identity management fallout

By SearchSecurity.com staff 20 Apr 2009 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

Reducing all this down to one product in each category -- directory services, provisioning, Web SSO and federation -- is going to be painful for Oracle and the Oracle/Sun customer base. Jonathan Penn Vice President, Forrester Research

It was widely thought that an acquisition by IBM would end Sun's months-long search for a buyer. Oracle, however, surprised the industry by agreeing to pay $9.50 per share for the struggling vendor, known for its Solaris-based servers and Java-based software. The total value of the deal is approximately $5.6 billion when considering Sun's cash and debt.

Oracle expects to turn a quick profit from the acquisition. Oracle President Safra Catz said in a statement that the deal would be "more profitable in per share contribution in the first year than we had planned for the acquisitions of BEA, PeopleSoft and Siebel combined."

Leadership in identity management tools and services
The combined company will be a force to be reckoned with when it comes to identity management. Scott Crawford, research director of security and risk management with Boulder, Colo.-based research firm Enterprise Management Associates Inc., said the deal "brings together two leaders in identity management, but with that leadership comes substantial overlap."

Jonathan Penn, vice president with Cambridge, Mass.-based Forrester Research Inc., said that excluding strong authentication, which neither company has, the combined organization will have as much as 25% of the identity management software market, giving it No. 1 status, outpacing competitors such as IBM, CA Inc., Novell Inc. and Microsoft.

Crawford said Sun established a leadership position in the identity management space primarily with its Directory Services architecture product, as well a strong slate of related products like its Identity Manager role-based user provisioning offering. Strategic acquisitions have also played a role in Sun's success.

Oracle, meanwhile, offers a formidable identity management play of its own, Crawford said, but has built that position on the strength of its database assets and added to it with a string of savvy acquisitions, including Oblix (user management), Thor Technologies (provisioning) and OctetString (virtual directories, or directory-based identity architectures via the database).

TechTarget special report: Oracle buys Sun Learn more about the megadeal in this special report: Oracle buys Sun.

"Really," Crawford said, "in just about the last year, Oracle has moved quite strongly [into] identity, and is now one of the very strong leaders in identity management."

'Painful' for identity management customer base
Oracle's acquisition of Sun, however, was not driven by its identity management synergies, said Ian Glazer, senior analyst at Midvale, Utah.-based research firm Burton Group.

"Clearly IdM wasn't the center of this deal," Glazer said. "If you look at the businesses, there isn't a lot of overlap [between their product portfolios]. In IdM, there's a ton of overlap, but I don't think it was the top-level concern in the deal itself."

That sentiment was echoed by Nick Nikols, Novell's vice president of product management, idenity and security in an interview Tuesday at the 2009 RSA Conference.

"It is an interesting merger because they have almost identical product sets in IdM," Nikols said. "This gives us more opportunity to show our value and help to provide an alternative. With this Sun/Oracle deal, identity management is an afterthought so it extends the timeframe [of which solution they will choose to sell and support in the future] and this provides some uncertainty for the customer."

SearchSecurity.com: To get security news and tips delivered to your inbox, click here to sign up for our free newsletter.

Crawford said eventually Oracle will be forced to "rationalize" its combined identity management product portfolio, and doing so will be extraordinarily messy.

Penn said the products in each vendor's identity management portfolio are not only integrated with each other, but also with numerous other products in the vendors' software stacks.

"There is no easy way to take the 'best-of-breed' approach, e.g., adopt Sun's provisioning product while keeping Oracle's Web SSO product," Penn said. "Reducing all this down to one product in each category -- directory services, provisioning, Web SSO and federation -- is going to be painful for Oracle and the Oracle/Sun customer base."

Crawford agreed that some product portfolio consolidation will likely be inevitable. He added, "That's really the big question on the minds of everyone in the identity space: How will Oracle rationalize the identity portfolio?"

Penn, however, emphasized that customers have no need to panic today. He said Oracle will have the resources to support both product lines for a while, noting that it has continued to support the ERP products of both PeopleSoft and JD Edwards following its 2005 acquisition of PeopleSoft.

"Customers of each should wait patiently to hear from Oracle about its roadmap for integration, which will probably take several months to sort out at a high level," Penn said. "This is an unavoidable issue, but it's a longer-term one, not a reason to start looking elsewhere."

To that end, Penn said IBM, CA, Novell and Microsoft to a lesser extent will undoubtedly be poised to exploit opportunities among Sun's identity management customer base, sowing fear and uncertainty to try to poach customers.

"I don't expect much success with that, especially in this climate," Penn noted. "Customers would be wise to wait to hear Oracle's longer-term IAM strategy and roadmap rather than engage in an expensive swap-out." He noted, however, that some of Sun's new deals might get reopened.

Ultimately, Crawford said, it remains to be seen how competitors like IBM and CA will react. "In terms of direct competition," he said, "IBM and CA will be worried."

Tags: Enterprise User Provisioning Tools,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Enterprise User Provisioning Tools Content-aware IAM: Uniting user access and data rights Is Identity Management as a Service (IDaaS) a good idea? Top tactics for endpoint security How to edit group policy objects to give a user local admin rights Privileged account management critical to data security Making the case for enterprise IAM centralized access control Lesson 3: How to implement secure access Best practices for a privileged access policy to secure user accounts Risk management must include physical-logical security convergence PCI compliance requirement 7: Restrict access

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary AAA server  (SearchSecurity.com) authentication, authorization, and accounting  (SearchSecurity.com) federated identity management  (SearchSecurity.com) logon  (SearchSecurity.com) password synchronization  (SearchSecurity.com) RADIUS  (SearchSecurity.com) role mining  (SearchSecurity.com) user profile  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary