Gartner Identity and Access Management Summit 2018 December 3 - 5 / Las Vegas, NV

This presentation will outline ongoing changes in security operations/policy/organization, technical migrations, shifts in security mindsets, societal changes, and modifications in adversarial tactics that CISOs and their direct reports should monitor. Attendees will learn strategic changes that aren't yet widely recognized but will have broad industry impact and significant potential for disruption. Through 2022, technologies related to these trends will reach a level of maturity that crosses a critical tipping point.

Envisioned in 2011, the BeyondCorp security model leverages identity and context to evaluate trust for access decisions rather than using the corporate network as the perimeter. Join this session to understand what BeyondCorp is, why you should consider it, and how to implement it across your organization to achieve a stronger security posture, anywhere access, and more intuitive end user experiences.

Oft-overlooked impact from changes as a result of a migration to cloud services means a scramble to return controls, oversite & productivity in the way you manage users and groups. If you haven’t started your migration but plan to in the future, learn about strategies to ensure success & compliance. If you have already started or completed your migration, it's time to get your automation & delegation in place to enhance security & productivity.

Authentication has become a critical part of security strategy. In 2016, over 81% of data breaches were perpetrated using compromised credentials. Traditional means of authenticating users are no longer sufficient. We’ll discuss the leading forms of frictionless and secure authentication including biometrics, PKI and behavioral analytics and explore ways to orchestrate these authenticators with risk-based adaptive authentication.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

3M/Deloitte, US Army/Accenture Federal, and NextLabs share their stories on leveraging externalized fine-grained authorization and ABAC to push the envelope on protecting and controlling access to sensitive data. They’ll explain how their ABAC implementations helped them address their data segregation and data leakage challenges – including best practices on using a policy-based platform as the foundation of an enterprise-wide security framework.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Orthodox, credential-based authentication does not scale to the needs of digital business. Here, we discuss how new analytics-centric identity corroboration tools facilitate a CARTA (Continuous Adaptive Risk and Trust Assessment) approach to user authentication. Key issues: - What are the weaknesses of orthodox methods? - How can IAM leaders evaluate and meet user authentication needs? - How will enterprises benefit from taking a strategic CARTA approach?

As we continue to see daily data breaches due to weak credentials, moving away from and killing the password is finally upon us. Join this session to learn how FIDO2 and WebAuthn open authentication standards, in conjunction with YubiKeys, are solving the elimination of passwords at scale. Hear how organizations like Microsoft have implemented these standards for a true passwordless experience and find out how your organization can follow suit.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

EMM suites help organizations with mobile device, application and content management, and containment, but they increasingly interact with IAM systems and provide IAM functions such as certificate management, authentication and single sign-on. In this roundtable, participants will discuss how EMM suites and IAM solutions can play together to achieve organizations' security goals.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

A multi-national bank will share their experience eliminating passwords and implementing strong MFA for Citrix and Microsoft AD environments. The bank will describe the benefits of using Veridium’s platform with mobile biometrics including: · Reducing costs · Simplifying UX while increasing security · Creating consistent login experiences in or out of the office · Branding with integration to the bank’s self-service mobile app

Legacy solutions like passwords & SMS codes are frustrating for users, & they’re not secure. Your app or website can now create user accounts & manage logins with zero taps for the user, boosting conversion rates & user engagement. This works as a simple IAM with no usernames or passwords. If you’re already using an IAM solution, our instant seamless authentication plugs in so you can deliver a frictionless user experience with better security.

In this workshop, we will assess how identity is provisioned to IoT devices and how identity is used to authenticate and authorize access to and from the device. We present a model for the identity of things (IDoT), different constraints and we will look at the current state of the art. You will work through prepared materials and leave with an IDoT design for your most challenging IoT effort.

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

In its 20 year existence, e-signature has become an integral part of B2B/B2C documents and business processes. In this presentation we'll cover how this technology continues to evolve and is now playing an increasingly significant role in organizations' digital business transformation as well as their participation in digital trust ecosystems.

Authentication has become a critical part of security strategy. In 2016, over 81% of data breaches were perpetrated using compromised credentials. Traditional means of authenticating users are no longer sufficient. We’ll discuss the leading forms of frictionless and secure authentication including biometrics, PKI and behavioral analytics and explore ways to orchestrate these authenticators with risk-based adaptive authentication.

This workshop discusses real-world experiences on solving the challenges associated with identifying users and devices in a mobile landscape. It also discusses the convergence of mobility management and Identity management technologies and the implications this poses to the digital workplace. Key Issues: • Do I need to implement mobile identity? • If so, how? • What are the best practices in deploying it?

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Everyone is speaking about passwordless authentication, but how can you prove who you are? Verification of a person's identity is imminent is everday events such as buying alcohol, opening a bank account, going to the airport. An SSO like process across all of these events and locations would enable such an experience. Proving your identity once , developing a level of assurance and then carrying that with you across these authentication points.

Broken algorithms, new hardware attacks, quantum computer breakthrough and the increasing use of PKI requires planning and well-structured processes for managing certificates. In this roundtable, we will discuss PKI, it's bread-and-butter use cases as well as its use within IoT, mobility and DevSecOps.

Witness the future of frictionless authentication as we reveal the results of a behavioral study conducted earlier this year. Experience the magic through case studies, demos and try it yourself. Discover - What people love about truly password-less 2FA. - Why leading organizations are raving about this next gen of authentication. - How you can easily integrate lovable 2FA into your organization's IAM platform for employees, consumers or both.

The early promises of easy, secure and universal authentication through unique personal traits has been unfulfilled for decades, but in the past 10 years we've seen an surge in interest and adoption. Are biometric methods now the way forward for every enterprise? • How does biometric authentication differ from other orthodox methods? • Where is biometric authentication most popular today — and what are the pitfalls? • How do biometric technologies fit in an enterprise identity corroboration strategy?

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

Identity management is arguably the most important discipline required for a successful Microsoft Office 365 deployment. Yet there are so many moving parts. And things change quickly: Best practices 12 months ago are now deprecated. This session will leverage a live Office 365 environment to illustrate the path to Office 365 success — from Conditional Access to Office 365 Groups to Seamless SSO to third-party MFA/IDaaS.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

Security leaders from Microsoft, Fortinet, HARMAN and NIST will candidly share how they balance security, speed, compliance and UX to simplify their IAM strategy and meet their security fears head-on. Walk away with pragmatic insights to modernize your approach to IAM.

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

In this live demonstration environment, we will dig into best practices for user management, SSO, MFA, hybrid architecture and availability. Topics include: Azure AD Connect, Pass-through Authentication, Conditional Access and third-party IDaaS/MFA/federation integration. As this is a limited-attendee format, you will work through prepared materials and leave with checklists that are specific to your organization.

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

In today's digital environment we have more users, more applications, more devices and more relationships to manage than ever before. The ability to effectively govern identities and access controls in this increasingly complex digital environment is reaching beyond human capacity. Advancements in the field of identity analytics promise to help simplify and improve our identity governance and control activities. Identity analytics employee big data, machine-learning and AI techniques that are able to consume and analyze vast amounts of data which allows organizations to detect and respond to risk in a more timely fashion. In this session, peers will have the opportunity to discuss how identity analytics can help improve IAM processes.

In an increasingly mobile and cloud-driven workplace, nobody wants to be tied to a desk. So your security strategy must protect access from boardrooms and bars, cubicles and coffee shops alike. How can you ensure that users and their devices meet the same controls whether they’re outside or inside the network perimeter? Duo uses a zero-trust model, in which users and devices are treated as untrusted until proven otherwise. Join us to learn more.

Attendees will learn how device-based authentication is an important first step in transforming secure customer interactions, both strengthening authentication and enhancing customer trust. Discover how implementing this flexible and transparent solution also creates a path for new consumer-friendly MFA and additional assurance for higher-risk situations.

Multifactor authentication (MFA) is now mainstream, and many organizations are looking for secure, user-friendly and easy-to-integrate implementation options. A new crop of cloud-based MFA services provides support for common authentication use cases, both within the enterprise and in hybrid access scenarios. In this session, we will discuss cloud-based MFA that can balance trust, user experience and cost.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Cloud computing has been around for more than 10 years but Active Directory in many organizations is still unprepared to fully support cloud deployments. This session provides guidance on overcoming these deficiencies and on making AD more agile to better support cloud computing and mobility.

This presentation will outline ongoing changes in security operations/policy/organization, technical migrations, shifts in security mindsets, societal changes, and modifications in adversarial tactics that CISOs and their direct reports should monitor. Attendees will learn strategic changes that aren't yet widely recognized but will have broad industry impact and significant potential for disruption. Through 2022, technologies related to these trends will reach a level of maturity that crosses a critical tipping point.

Hybrid IT environments are powering the digital transformation, but failing to enforce governance and least privilege policies across a multi-cloud environment put an organization at risk. Learn how RapidIdentity makes it possible to holistically and centrally grant, revoke, and time-limit fine-grained access to the cloud applications, infrastructure services, and permissions needed to compete and win in today’s digital marketplace.

Today's advanced security threats require proactive and intelligent automation that can quickly scale with a rapidly changing IT environment. Learn how Oracle's Trust Fabric helps predict, prevent, detect, and respond to the overwhelming number of security events that challenge IT and security operations. Oracle's Trust Fabric is a comprehensive set of integrated solutions designed to help reduce the time required to respond to security threats.

Modern IT environments have three major challenges with traditional identity security products. IT organizations evolved and embraced hybrid IT deployments and cloud services, traditional identity security vendors failed to evolve with them. Organizations are left vulnerable to insider threats and external attackers. Find out if your organization is affected by these three challenges and learn how they can be prevented with OverWatchID.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

Any successful approach to advanced PAM involves continually managing risk by controlling administrative use, assignment and configuration, together with optimizing what’s known as the Principle of Least Privilege (POLP). CEO Tim Keeler shares his experiences in working with clients to help protect over 1M endpoints with Just In Time Administration. Learn how you can bring agentless privilege access management to your organization Just In Time!

Identity management is arguably the most important discipline required for a successful Microsoft Office 365 deployment. Yet there are so many moving parts. And things change quickly: Best practices 12 months ago are now deprecated. This session will leverage a live Office 365 environment to illustrate the path to Office 365 success — from Conditional Access to Office 365 Groups to Seamless SSO to third-party MFA/IDaaS.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

In this live demonstration environment, we will dig into best practices for user management, SSO, MFA, hybrid architecture and availability. Topics include: Azure AD Connect, Pass-through Authentication, Conditional Access and third-party IDaaS/MFA/federation integration. As this is a limited-attendee format, you will work through prepared materials and leave with checklists that are specific to your organization.

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

You've migrated all your software to the cloud except for your security solutions. What now? Join technology leadership from Intuit and Thycotic as they discuss the challenges and opportunities that arise from automating Privileged Account Management and migrating cyber security software to public and private clouds.

Multifactor authentication (MFA) is now mainstream, and many organizations are looking for secure, user-friendly and easy-to-integrate implementation options. A new crop of cloud-based MFA services provides support for common authentication use cases, both within the enterprise and in hybrid access scenarios. In this session, we will discuss cloud-based MFA that can balance trust, user experience and cost.

After ample preparation time in anticipation of the GDPR, Gartner has observed a few misconceptions on privacy as well as a number of key functions for a mature privacy management program. We will address the lessons learned and the necessary capabilities to protect privacy, including the role of security, program ownership, and what the market is, and should be, doing.

Is your organization in need of a Privileged Access Management (PAM) solution? If so, this session will serve as a good primer on the technology. Key issues covered include * Introduction to privileged access management * The PAM maturity model * An overview of PAM tools and when and how to use them

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

In highly regulated industries compliance is an existential mandate, but increasing numbers of entitlements, systems and applications make it difficult to focus on those that present high risk. This session presents how IGA helps HealthEquity highlight entitlements and permissions that need regular scrutiny and oversight. Application onboarding process and policies organize entitlements to focus on exceptions and achieve intelligent compliance.

Digital Risk Management is a discipline that seeks to expand current risk management to incorporate the rapid advances in technology that organizations face today. The roundtable seeks to answer such questions as (1) what does digital risk management add to ‘traditional’ risk management techniques? (2) How can organizations best prepare to absorb these additions quickly and efficiently? (3) How does this change your cyber and physical security practices?

CIAM is key to enabling your digital transformation and the foundation of your customers' digital experiences. In this session, we will discuss trends in new CIAM capabilities and best practices. We will also provide guidance on which features and vendors to consider when making a CIAM vendor short list.

Tangible use cases for a portable and reusable Digital Identity may seem limited but it holds great promise for wide adoption across consumer, business and enterprise use cases, without IT headaches or sacrificing user privacy. Manah Khalil from Verizon believes the technology and building blocks already exist for Digital Identity to unleash a wide range of possible use cases.

After ample preparation time in anticipation of the GDPR, Gartner has observed a few misconceptions on privacy as well as a number of key functions for a mature privacy management program. We will address the lessons learned and the necessary capabilities to protect privacy, including the role of security, program ownership, and what the market is, and should be, doing.

Combining digital identity, sophisticated mobile apps, and powerful analytics changes what’s possible for any user experience. Join Station Digital Media and MicroStrategy, for a discussion on how delivering contextual insights changes operations and workflows as well as drives new opportunities for customer engagement. See how personalized interactions help deliver an exceptional experience for every employee, customer, vendor, and partner!

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

Legacy solutions like passwords & SMS codes are frustrating for users, & they’re not secure. Your app or website can now create user accounts & manage logins with zero taps for the user, boosting conversion rates & user engagement. This works as a simple IAM with no usernames or passwords. If you’re already using an IAM solution, our instant seamless authentication plugs in so you can deliver a frictionless user experience with better security.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

In this session, Gartner will explore how consumer IAM features such as registration, preference management, consent management, and access management help organizations comply with GDPR requirements.

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

In the financial sector a poor customer experience means revenue losses of millions. The transition to a next-generation CIAM platform was THE critical first step to meeting ATB's digital transformation goals. Join ATB as they share their identity transformation story: - Creating a single, cross-organizational view of customer identity - Implementing SSO across all digital properties - Improving multi-factor security & experience

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

Learn how international energy and gas company Shell created a global CIAM architecture that transcends brands, channels, use cases and regions. Shell GM Digital Emerging Technologies / VP Innovation Lead Johan Krebbers will share how his team built a consumer-scale enterprise identity management ecosystem to meet the company’s goals for transformation, insights, privacy and security.

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

This workshop will help IAM leaders develop metrics that can help them to communicate more effectively about the state of their IAM programs and, ultimately, manage those programs better.

As is the case with practically every domain, identity and access management (IAM) has its own jargon that can be difficult for newcomers to understand. This session provides newcomers to IAM with an introduction to the IAM territory and its vocabulary. Key Issues: • What is the definition and purpose of IAM? • How do IAM practitioners think about IAM? • What should newcomers to IAM know before they go?

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

The CIO agenda highlights the changing role of the CIO. Security and risk management leaders must understand CIO priorities and adjust strategy and messaging accordingly. Key issues: • What are the main elements of the CIO agenda? • What are their implications for security and risk management leaders? • What must security and risk management leaders do in response?

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

You’ve made the choice to pursue identity and access management. It’s proven to be an elusive goal. As we all know, IAM is difficult and that when you approach IAM as a project, you’re destined to be disappointed. Join this panel session to learn best practices and hard-won lessons from the battle to create a successful IAM program. Hear how the panelists’ organizations solved their toughest IAM challenges and got IAM right.

Tangible use cases for a portable and reusable Digital Identity may seem limited but it holds great promise for wide adoption across consumer, business and enterprise use cases, without IT headaches or sacrificing user privacy. Manah Khalil from Verizon believes the technology and building blocks already exist for Digital Identity to unleash a wide range of possible use cases.

IAM programs don't gain support without a common organizational goal and direction. Determining that requires more than promoting a shiny new object, it requires salesmanship, collaboration and commitment. After all, the vision is something that is shared. Learn how to structure and communicate a vision and strategy that corresponds to organizational needs and expectations, and that can support the establishment of a new discipline.

This presentation will outline ongoing changes in security operations/policy/organization, technical migrations, shifts in security mindsets, societal changes, and modifications in adversarial tactics that CISOs and their direct reports should monitor. Attendees will learn strategic changes that aren't yet widely recognized but will have broad industry impact and significant potential for disruption. Through 2022, technologies related to these trends will reach a level of maturity that crosses a critical tipping point.

Daily data breaches make some CISO’s and IAM Directors a little concerned with moving to a cloud based service, especially given that GDPR is now in effect. We will look at how shifting back to a private dedicated “cloud” solution for your SSO requirements offers better security and control. We will cover: • Cloud vs. On-Premises Comparison • Security concerns • Affordability of an IDaaS solution

Oft-overlooked impact from changes as a result of a migration to cloud services means a scramble to return controls, oversite & productivity in the way you manage users and groups. If you haven’t started your migration but plan to in the future, learn about strategies to ensure success & compliance. If you have already started or completed your migration, it's time to get your automation & delegation in place to enhance security & productivity.

This session will focus on how organizations can move their entire IGA Program to the cloud as well as providing a vision and strategy to secure your organization. Join us as we profile multiple, successful full-suite IGA cloud deployments across the financial, health care, manufacturing and higher education verticals with specific use cases including password, provisioning as a service, governance, single sign on, compliance, and more!

Although many enterprises already use hundreds of cloud applications, some of their toughest identity challenges reside behind the firewall where aging legacy apps are being managed by rigid, dated on-prem IAM solutions. OneLogin will explore how enterprises can extend the flexibility and superior experience of IDaaS to manage legacy applications together with modern cloud apps in a single, unified solution.

Products and services lacking consideration for privacy represent a clear liability to organizations that process personal information. Over the course of this session, we will outline how to embrace Privacy Engineering and transform your privacy program from a forced to an organic change. We will look at lessons learned from the mad rush to the GDPR and how small, strategic changes to the way you plan, design and acquire can make compliance a natural step in your progression.

Organizations are allocating funds for blockchain without defining use cases, putting security and risk management leaders in a bind. You need to support the adoption of blockchain, but manage the risks that result from relatively unproven tools. Come learn: ● How to trust distributed identity. ● How to trust unknown cryptographic service providers on blockchain and distributed ledgers. ● Recognize the can't-happen-don't-care state is more important than we think.

The speed in which a PAM solution achieves success and provides value relies upon how prepared your enterprise is for the new capability. Cognizant will share lessons learned from working with organizations who have launched successful PAM implementations.

Combining digital identity, sophisticated mobile apps, and powerful analytics changes what’s possible for any user experience. Join Station Digital Media and MicroStrategy, for a discussion on how delivering contextual insights changes operations and workflows as well as drives new opportunities for customer engagement. See how personalized interactions help deliver an exceptional experience for every employee, customer, vendor, and partner!

A multi-national bank will share their experience eliminating passwords and implementing strong MFA for Citrix and Microsoft AD environments. The bank will describe the benefits of using Veridium’s platform with mobile biometrics including: · Reducing costs · Simplifying UX while increasing security · Creating consistent login experiences in or out of the office · Branding with integration to the bank’s self-service mobile app

Digital business challenges the conventions of digital risk and security management. Security and risk management leaders must develop a coherent digital security program based on a clear vision and strategy. This presentation will address: What constitutes an effective vision and strategy? What are the elements of a digital security program?

As identity and access management activities align more with an organization's digital objectives, security and risk management leaders responsible for IAM recognize the need to manage IAM as a program in its own right. This session addresses: * How to justify the IAM program * Establishing program responsibilities * Establishing program governance

For many organizations, deploying a new application means spinning up a new project just to integrate into their existing directory infrastructure. Every acquisition or change in business requirements necessitates potential changes to every application. By virtualizing their directory infrastructure, Transamerica, General Electric and LinkedIn were able to more effectively leverage their existing directories for all their new business initiatives

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

Good information security hygiene is a must, but many organizations lose focus on getting the basics right, leading to an unjustified level of confidence in risk posture. Join us and learn: • What are the key activities, capabilities and practices for organizations? • What are the activities that you can delay or even skip entirely? • Why doing the basics is more important than ever?

IAM programs must deal with a variety of process and technology related opportunities and issues. Coordinating these in order to provide measurable progress and benefits is always a challenge, and may not happen in the optimal or desired order. The challenge to IAM leaders is to fulfill expectations of stakeholders and organize activities to manage dependencies. Use the roadmap to manage outcomes.

In a hyper connected world driven by collaboration and access across clouds, resources and organizational boundaries, it is critical to balance your organization’s need for security and employee productivity, using the right processes and visibility to address the risks. Come learn how Azure Active Directory Identity Governance ensures the right users have the right access to the right resources, and protects, monitors and audits access to critical assets.

This presentation outlines the top 10 security projects, based on a number of criteria: The emerging technologies that support the project are not yet mainstream; the project helps deliver against the CARTA (continuous adaptive risk and trust assessment) approach; and the project has high risk reduction versus resources required as compared to alternatives. Attend this session to get ideas and justification for specific security projects.

Enterprise identities can be prone to attacks if not protected properly. While identity has not been considered a foundation of most security architectures, it is emerging as the key to reducing the risk of a breach. Hear how a former CISO, leaders from Wells Fargo and Adobe are helping organizations by providing best practices and practical guidance for implementing identity-centric security strategies.

Blockchain has become a much-hyped technology with a lot of potential. Yet, with cyberthreats and data breaches, is this technology secure? As Blockchain starts to impact the world, CISOs must understand the security and privacy implications. This session aims to provide a CISOs with a framework that will help them identify and manage risks related to Blockchain.

Digital risk management addresses the changes to traditional IT and operational risk management brought on by major changes from digital transformation— whether cloud-bases services, blockchain, artificial intelligence or the Internet of Things. This presentation explores the risks incurred by IAM professionals as they leverage next-generation digital capabilities.

Buying IAM solutions requires detailed analysis of vendors, solutions and alternatives. Learn to use this five-step approach to structure the evaluation process, derive your shortlist, choose a solution and negotiate the best price.

This workshop will help IAM leaders develop metrics that can help them to communicate more effectively about the state of their IAM programs and, ultimately, manage those programs better.

IAM leaders are confronted with increasingly complex ecosystems. Hybrid solutions must address multiple use cases with a strategy-first approach for long-term success across on-premises, cloud, B2B, B2C and IoT implementations. Learn how to build your IAM program and connect it with GRC and Compliance capabilities to address key business drivers and support your current and future state policies and processes.

In highly regulated industries compliance is an existential mandate, but increasing numbers of entitlements, systems and applications make it difficult to focus on those that present high risk. This session presents how IGA helps HealthEquity highlight entitlements and permissions that need regular scrutiny and oversight. Application onboarding process and policies organize entitlements to focus on exceptions and achieve intelligent compliance.

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

Privacy is considered a human right in most jurisdictions of the world. Yet, with multiple privacy laws globally being strengthened, privacy incidents keep happening. Is there an implied business case to ignore it? Is privacy overrated? Is it dead? Are there benefits to "get it right"? In this analyst debate, we intend to explore the benefits and disadvantages of privacy protection in the employment, government, and commercial interaction environment.

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

Cloud computing has been around for more than 10 years but Active Directory in many organizations is still unprepared to fully support cloud deployments. This session provides guidance on overcoming these deficiencies and on making AD more agile to better support cloud computing and mobility.

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

For many organizations, deploying a new application means spinning up a new project just to integrate into their existing directory infrastructure. Every acquisition or change in business requirements necessitates potential changes to every application. By virtualizing their directory infrastructure, Transamerica, General Electric and LinkedIn were able to more effectively leverage their existing directories for all their new business initiatives

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

Any successful approach to advanced PAM involves continually managing risk by controlling administrative use, assignment and configuration, together with optimizing what’s known as the Principle of Least Privilege (POLP). CEO Tim Keeler shares his experiences in working with clients to help protect over 1M endpoints with Just In Time Administration. Learn how you can bring agentless privilege access management to your organization Just In Time!

Broken algorithms, new hardware attacks, quantum computer breakthrough and the increasing use of PKI requires planning and well-structured processes for managing certificates. In this roundtable, we will discuss PKI, it's bread-and-butter use cases as well as its use within IoT, mobility and DevSecOps.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

Hybrid IT environments are powering the digital transformation, but failing to enforce governance and least privilege policies across a multi-cloud environment put an organization at risk. Learn how RapidIdentity makes it possible to holistically and centrally grant, revoke, and time-limit fine-grained access to the cloud applications, infrastructure services, and permissions needed to compete and win in today’s digital marketplace.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

3M/Deloitte, US Army/Accenture Federal, and NextLabs share their stories on leveraging externalized fine-grained authorization and ABAC to push the envelope on protecting and controlling access to sensitive data. They’ll explain how their ABAC implementations helped them address their data segregation and data leakage challenges – including best practices on using a policy-based platform as the foundation of an enterprise-wide security framework.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

In this workshop, we will assess how identity is provisioned to IoT devices and how identity is used to authenticate and authorize access to and from the device. We present a model for the identity of things (IDoT), different constraints and we will look at the current state of the art. You will work through prepared materials and leave with an IDoT design for your most challenging IoT effort.

For many organizations, deploying a new application means spinning up a new project just to integrate into their existing directory infrastructure. Every acquisition or change in business requirements necessitates potential changes to every application. By virtualizing their directory infrastructure, Transamerica, General Electric and LinkedIn were able to more effectively leverage their existing directories for all their new business initiatives

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

Identity management is arguably the most important discipline required for a successful Microsoft Office 365 deployment. Yet there are so many moving parts. And things change quickly: Best practices 12 months ago are now deprecated. This session will leverage a live Office 365 environment to illustrate the path to Office 365 success — from Conditional Access to Office 365 Groups to Seamless SSO to third-party MFA/IDaaS.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

Security leaders from Microsoft, Fortinet, HARMAN and NIST will candidly share how they balance security, speed, compliance and UX to simplify their IAM strategy and meet their security fears head-on. Walk away with pragmatic insights to modernize your approach to IAM.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Intuitive approaches to role management at an enterprise scale lead to the adoption of simplistic models that are usually ineffective and often counterproductive. IAM leaders should use Gartner's two-layer enterprise role framework to organize and scope role management across an entire organization with their IGA solutions. Key issues include: 1) Why is role management so difficult at an enterprise scale? 2) How should IAM leaders be thinking about enterprise role management? 3) What are the essential elements of a two-layer enterprise role management framework?

Envisioned in 2011, the BeyondCorp security model leverages identity and context to evaluate trust for access decisions rather than using the corporate network as the perimeter. Join this session to understand what BeyondCorp is, why you should consider it, and how to implement it across your organization to achieve a stronger security posture, anywhere access, and more intuitive end user experiences.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

Cloud computing has been around for more than 10 years but Active Directory in many organizations is still unprepared to fully support cloud deployments. This session provides guidance on overcoming these deficiencies and on making AD more agile to better support cloud computing and mobility.

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Daily data breaches make some CISO’s and IAM Directors a little concerned with moving to a cloud based service, especially given that GDPR is now in effect. We will look at how shifting back to a private dedicated “cloud” solution for your SSO requirements offers better security and control. We will cover: • Cloud vs. On-Premises Comparison • Security concerns • Affordability of an IDaaS solution

This session will focus on how organizations can move their entire IGA Program to the cloud as well as providing a vision and strategy to secure your organization. Join us as we profile multiple, successful full-suite IGA cloud deployments across the financial, health care, manufacturing and higher education verticals with specific use cases including password, provisioning as a service, governance, single sign on, compliance, and more!

Gartner predicts that by 2022, API abuses will be the most-frequent attack vector resulting in data breaches for enterprise applications. Learn about the best practices to design and execute an effective API security strategy, including the complimentary roles of an Identity Provider and an API gateway.

Although many enterprises already use hundreds of cloud applications, some of their toughest identity challenges reside behind the firewall where aging legacy apps are being managed by rigid, dated on-prem IAM solutions. OneLogin will explore how enterprises can extend the flexibility and superior experience of IDaaS to manage legacy applications together with modern cloud apps in a single, unified solution.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

EMM suites help organizations with mobile device, application and content management, and containment, but they increasingly interact with IAM systems and provide IAM functions such as certificate management, authentication and single sign-on. In this roundtable, participants will discuss how EMM suites and IAM solutions can play together to achieve organizations' security goals.

Today's advanced security threats require proactive and intelligent automation that can quickly scale with a rapidly changing IT environment. Learn how Oracle's Trust Fabric helps predict, prevent, detect, and respond to the overwhelming number of security events that challenge IT and security operations. Oracle's Trust Fabric is a comprehensive set of integrated solutions designed to help reduce the time required to respond to security threats.

Azure Active Directory empowers organizations to manage and secure identities for employees, partners, and customers to access the applications and services they need via a common identity across on-premises and cloud directories. Come get an overview of our capabilities and demos and learn about the latest investments in identity protection, conditional access, single sign-on, hybrid identity environments, managing partner and customer access, and password-less authentication.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

Despite the benefits of the cloud, new challenges emerge around managing access across employees, partners, or contractors, and new security risks arise when embracing cloud productivity suites like Office 365. You’ll learn best practices for 1) Securely embracing the cloud, 2) Reducing complexity of managing separate password and authentication policies across on-prem and cloud resources and 3) Providing a consistent and seamless access experience for end users.

Authentication has become a critical part of security strategy. In 2016, over 81% of data breaches were perpetrated using compromised credentials. Traditional means of authenticating users are no longer sufficient. We’ll discuss the leading forms of frictionless and secure authentication including biometrics, PKI and behavioral analytics and explore ways to orchestrate these authenticators with risk-based adaptive authentication.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

In a hyper connected world driven by collaboration and access across clouds, resources and organizational boundaries, it is critical to balance your organization’s need for security and employee productivity, using the right processes and visibility to address the risks. Come learn how Azure Active Directory Identity Governance ensures the right users have the right access to the right resources, and protects, monitors and audits access to critical assets.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

As organizations increase the pace and frequency of application releases, a more agile approach is needed to embed cloud-based identity services into applications. Application developers need self-service and agility, while enterprise IT teams need a platform to provide centralized security and control. Learn how a self-service IDaaS solution can help you overcome both of these challenges and speed up the process for developers and IT to launch and maintain customer applications.

In the financial sector a poor customer experience means revenue losses of millions. The transition to a next-generation CIAM platform was THE critical first step to meeting ATB's digital transformation goals. Join ATB as they share their identity transformation story: - Creating a single, cross-organizational view of customer identity - Implementing SSO across all digital properties - Improving multi-factor security & experience

In this live demonstration environment, we will dig into best practices for user management, SSO, MFA, hybrid architecture and availability. Topics include: Azure AD Connect, Pass-through Authentication, Conditional Access and third-party IDaaS/MFA/federation integration. As this is a limited-attendee format, you will work through prepared materials and leave with checklists that are specific to your organization.

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

As multiple devices, identities, assets and applications proliferate, the CISOs’ ability to manage risk in a rapidly changing environment is critical to protecting key enterprise resources that extend beyond the enterprise boundary. Join Gemalto to hear how an adaptive policy-centric data protection approach offers a powerful framework for protecting the rapidly expanding attack surface of an organization’s critical resources.

Petri Heinälä of Fujitsu and Sami Ahvenniemi of SSH discuss why the approach by current generation of Privileged Access Management solutions just doesn’t work in dynamic and disposable multi-cloud and hybrid environments and what are the better alternatives for DevOpsSec. They also discuss the inevitable unification of IAM and PAM and what might lie ahead in the not-so-distant future with emerging paradigms such as containerization, immutable infrastructure, and serverless computing.

Multifactor authentication (MFA) is now mainstream, and many organizations are looking for secure, user-friendly and easy-to-integrate implementation options. A new crop of cloud-based MFA services provides support for common authentication use cases, both within the enterprise and in hybrid access scenarios. In this session, we will discuss cloud-based MFA that can balance trust, user experience and cost.

As is the case with practically every domain, identity and access management (IAM) has its own jargon that can be difficult for newcomers to understand. This session provides newcomers to IAM with an introduction to the IAM territory and its vocabulary. Key Issues: • What is the definition and purpose of IAM? • How do IAM practitioners think about IAM? • What should newcomers to IAM know before they go?

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

Intuitive approaches to role management at an enterprise scale lead to the adoption of simplistic models that are usually ineffective and often counterproductive. IAM leaders should use Gartner's two-layer enterprise role framework to organize and scope role management across an entire organization with their IGA solutions. Key issues include: 1) Why is role management so difficult at an enterprise scale? 2) How should IAM leaders be thinking about enterprise role management? 3) What are the essential elements of a two-layer enterprise role management framework?

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

IAM programs don't gain support without a common organizational goal and direction. Determining that requires more than promoting a shiny new object, it requires salesmanship, collaboration and commitment. After all, the vision is something that is shared. Learn how to structure and communicate a vision and strategy that corresponds to organizational needs and expectations, and that can support the establishment of a new discipline.

Oft-overlooked impact from changes as a result of a migration to cloud services means a scramble to return controls, oversite & productivity in the way you manage users and groups. If you haven’t started your migration but plan to in the future, learn about strategies to ensure success & compliance. If you have already started or completed your migration, it's time to get your automation & delegation in place to enhance security & productivity.

Hybrid IT environments are powering the digital transformation, but failing to enforce governance and least privilege policies across a multi-cloud environment put an organization at risk. Learn how RapidIdentity makes it possible to holistically and centrally grant, revoke, and time-limit fine-grained access to the cloud applications, infrastructure services, and permissions needed to compete and win in today’s digital marketplace.

Products and services lacking consideration for privacy represent a clear liability to organizations that process personal information. Over the course of this session, we will outline how to embrace Privacy Engineering and transform your privacy program from a forced to an organic change. We will look at lessons learned from the mad rush to the GDPR and how small, strategic changes to the way you plan, design and acquire can make compliance a natural step in your progression.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

Managing bots identity and access has introduced a new set of IGA requirements that stretch the scope of identity governance. Also, cognitive RPA has shown potential to expand automation opportunities in IGA solutions. In this ask-the-analyst session, participants can discuss potential use cases of RPA in IGA and how IGA should adapt to manage bots identity.

As the explosion of data, applications, and human and nonhuman identities impacts organizations, businesses are addressing these challenges to ensure their identity program meets security and compliance requirements. Join us to hear from SailPoint customers from different industries and overseeing identity programs at various stages of maturity. We’ll discuss the strategy of their programs and their thoughts on the evolving identity market.

Today's advanced security threats require proactive and intelligent automation that can quickly scale with a rapidly changing IT environment. Learn how Oracle's Trust Fabric helps predict, prevent, detect, and respond to the overwhelming number of security events that challenge IT and security operations. Oracle's Trust Fabric is a comprehensive set of integrated solutions designed to help reduce the time required to respond to security threats.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

In this workshop, we will assess how identity is provisioned to IoT devices and how identity is used to authenticate and authorize access to and from the device. We present a model for the identity of things (IDoT), different constraints and we will look at the current state of the art. You will work through prepared materials and leave with an IDoT design for your most challenging IoT effort.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

As identity and access management activities align more with an organization's digital objectives, security and risk management leaders responsible for IAM recognize the need to manage IAM as a program in its own right. This session addresses: * How to justify the IAM program * Establishing program responsibilities * Establishing program governance

The University of California - San Francisco (UCSF) had to replace a 20+ year old, mainframe-based identity system, when the platform was phased out. Learn how UCSF addressed the challenges of replacing a system deeply entangled with core business processes, and expanded process automation to prepare for the future.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

IAM programs must deal with a variety of process and technology related opportunities and issues. Coordinating these in order to provide measurable progress and benefits is always a challenge, and may not happen in the optimal or desired order. The challenge to IAM leaders is to fulfill expectations of stakeholders and organize activities to manage dependencies. Use the roadmap to manage outcomes.

In a hyper connected world driven by collaboration and access across clouds, resources and organizational boundaries, it is critical to balance your organization’s need for security and employee productivity, using the right processes and visibility to address the risks. Come learn how Azure Active Directory Identity Governance ensures the right users have the right access to the right resources, and protects, monitors and audits access to critical assets.

In an attempt to counter a proliferation of breaches, organizations tend to secure the endpoint and perimeter, and governments enact compliance regulations, which do little more than add operational costs. As endpoints and perimeters give way, bad actors have free reign. Identity-centric security is the best way to address threats. Identity is the language of security. Speaking it can provide impactful change to an organization’s risk posture.

Blockchain has become a much-hyped technology with a lot of potential. Yet, with cyberthreats and data breaches, is this technology secure? As Blockchain starts to impact the world, CISOs must understand the security and privacy implications. This session aims to provide a CISOs with a framework that will help them identify and manage risks related to Blockchain.

Buying IAM solutions requires detailed analysis of vendors, solutions and alternatives. Learn to use this five-step approach to structure the evaluation process, derive your shortlist, choose a solution and negotiate the best price.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

This workshop will help IAM leaders develop metrics that can help them to communicate more effectively about the state of their IAM programs and, ultimately, manage those programs better.

IAM leaders are confronted with increasingly complex ecosystems. Hybrid solutions must address multiple use cases with a strategy-first approach for long-term success across on-premises, cloud, B2B, B2C and IoT implementations. Learn how to build your IAM program and connect it with GRC and Compliance capabilities to address key business drivers and support your current and future state policies and processes.

In highly regulated industries compliance is an existential mandate, but increasing numbers of entitlements, systems and applications make it difficult to focus on those that present high risk. This session presents how IGA helps HealthEquity highlight entitlements and permissions that need regular scrutiny and oversight. Application onboarding process and policies organize entitlements to focus on exceptions and achieve intelligent compliance.

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

Employee monitoring is one of those topics that most IT leaders don’t like to talk about. Blandishments like “we trust our people” and “we have a culture of openness” are common. Yet, as Mark Twain said, “The difference between a man and a dog is that if you feed a dog and take care of it, it will not bite you.” We examine how employee monitoring contributes not only to prevention and detection of internal malfeasance, but can also be used to safeguard employees and ensure safe working environments.

In today's digital environment we have more users, more applications, more devices and more relationships to manage than ever before. The ability to effectively govern identities and access controls in this increasingly complex digital environment is reaching beyond human capacity. Advancements in the field of identity analytics promise to help simplify and improve our identity governance and control activities. Identity analytics employee big data, machine-learning and AI techniques that are able to consume and analyze vast amounts of data which allows organizations to detect and respond to risk in a more timely fashion. In this session, peers will have the opportunity to discuss how identity analytics can help improve IAM processes.

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

3M/Deloitte, US Army/Accenture Federal, and NextLabs share their stories on leveraging externalized fine-grained authorization and ABAC to push the envelope on protecting and controlling access to sensitive data. They’ll explain how their ABAC implementations helped them address their data segregation and data leakage challenges – including best practices on using a policy-based platform as the foundation of an enterprise-wide security framework.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

After ample preparation time in anticipation of the GDPR, Gartner has observed a few misconceptions on privacy as well as a number of key functions for a mature privacy management program. We will address the lessons learned and the necessary capabilities to protect privacy, including the role of security, program ownership, and what the market is, and should be, doing.

As we continue to see daily data breaches due to weak credentials, moving away from and killing the password is finally upon us. Join this session to learn how FIDO2 and WebAuthn open authentication standards, in conjunction with YubiKeys, are solving the elimination of passwords at scale. Hear how organizations like Microsoft have implemented these standards for a true passwordless experience and find out how your organization can follow suit.

Products and services lacking consideration for privacy represent a clear liability to organizations that process personal information. Over the course of this session, we will outline how to embrace Privacy Engineering and transform your privacy program from a forced to an organic change. We will look at lessons learned from the mad rush to the GDPR and how small, strategic changes to the way you plan, design and acquire can make compliance a natural step in your progression.

Organizations are allocating funds for blockchain without defining use cases, putting security and risk management leaders in a bind. You need to support the adoption of blockchain, but manage the risks that result from relatively unproven tools. Come learn: ● How to trust distributed identity. ● How to trust unknown cryptographic service providers on blockchain and distributed ledgers. ● Recognize the can't-happen-don't-care state is more important than we think.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

Managing bots identity and access has introduced a new set of IGA requirements that stretch the scope of identity governance. Also, cognitive RPA has shown potential to expand automation opportunities in IGA solutions. In this ask-the-analyst session, participants can discuss potential use cases of RPA in IGA and how IGA should adapt to manage bots identity.

EMM suites help organizations with mobile device, application and content management, and containment, but they increasingly interact with IAM systems and provide IAM functions such as certificate management, authentication and single sign-on. In this roundtable, participants will discuss how EMM suites and IAM solutions can play together to achieve organizations' security goals.

In this workshop, we will assess how identity is provisioned to IoT devices and how identity is used to authenticate and authorize access to and from the device. We present a model for the identity of things (IDoT), different constraints and we will look at the current state of the art. You will work through prepared materials and leave with an IDoT design for your most challenging IoT effort.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

Broken algorithms, new hardware attacks, quantum computer breakthrough and the increasing use of PKI requires planning and well-structured processes for managing certificates. In this roundtable, we will discuss PKI, it's bread-and-butter use cases as well as its use within IoT, mobility and DevSecOps.

Blockchain has become a much-hyped technology with a lot of potential. Yet, with cyberthreats and data breaches, is this technology secure? As Blockchain starts to impact the world, CISOs must understand the security and privacy implications. This session aims to provide a CISOs with a framework that will help them identify and manage risks related to Blockchain.

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

Identity management is arguably the most important discipline required for a successful Microsoft Office 365 deployment. Yet there are so many moving parts. And things change quickly: Best practices 12 months ago are now deprecated. This session will leverage a live Office 365 environment to illustrate the path to Office 365 success — from Conditional Access to Office 365 Groups to Seamless SSO to third-party MFA/IDaaS.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

As traditional network perimeters dissolve, organizations must discard the old model of “trust but verify” which relied on well-defined boundaries. Zero Trust mandates a “never trust, always verify, enforce least privilege” approach to privileged access, from inside or outside the network. By implementing least privilege access, organizations minimize the attack surface, reduce risk, complexity and costs for the modern, hybrid enterprise.

As multiple devices, identities, assets and applications proliferate, the CISOs’ ability to manage risk in a rapidly changing environment is critical to protecting key enterprise resources that extend beyond the enterprise boundary. Join Gemalto to hear how an adaptive policy-centric data protection approach offers a powerful framework for protecting the rapidly expanding attack surface of an organization’s critical resources.

IoT devices generate a huge amount of data, which may include sensitive personal data. As regulations and awareness of privacy increase, security leaders require a consistent approach with data security and privacy. What are the concerns with IoT security? What are the legal implications of regional privacy laws such as GDPR? What approaches should be considered when embarking on IoT initiatives?

Multifactor authentication (MFA) is now mainstream, and many organizations are looking for secure, user-friendly and easy-to-integrate implementation options. A new crop of cloud-based MFA services provides support for common authentication use cases, both within the enterprise and in hybrid access scenarios. In this session, we will discuss cloud-based MFA that can balance trust, user experience and cost.

API gateways play a key role in protecting APIs. They mediate identity and access management and provide basic features to reduce risk. This session discusses features to look for and select vendors to consider when choosing API gateways to protect microservices.

Identity cannot be absolutely proven - merely corroborated to fall within transactional risk tolerance. Security and risk management leaders must discard flawed legacy methods and embrace analytics that evaluate multiple positive and negative signals. In this presentation, we will address the following key issues: - Knowledge based authentication is dead, thanks to rampant data compromise and oversharing on social media. - High friction during enrollment leads to abandonment and does not reduce risk. - The convergence between identity proofing and online fraud continues, with the online fraud engine acting as a risk arbitrator not only in authentication but in enrollment.

IAM leaders are confronted with increasingly complex ecosystems. Hybrid solutions must address multiple use cases with a strategy-first approach for long-term success across on-premises, cloud, B2B, B2C and IoT implementations. Learn how to build your IAM program and connect it with GRC and Compliance capabilities to address key business drivers and support your current and future state policies and processes.

As multiple devices, identities, assets and applications proliferate, the CISOs’ ability to manage risk in a rapidly changing environment is critical to protecting key enterprise resources that extend beyond the enterprise boundary. Join Gemalto to hear how an adaptive policy-centric data protection approach offers a powerful framework for protecting the rapidly expanding attack surface of an organization’s critical resources.

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

Intuitive approaches to role management at an enterprise scale lead to the adoption of simplistic models that are usually ineffective and often counterproductive. IAM leaders should use Gartner's two-layer enterprise role framework to organize and scope role management across an entire organization with their IGA solutions. Key issues include: 1) Why is role management so difficult at an enterprise scale? 2) How should IAM leaders be thinking about enterprise role management? 3) What are the essential elements of a two-layer enterprise role management framework?

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Orthodox, credential-based authentication does not scale to the needs of digital business. Here, we discuss how new analytics-centric identity corroboration tools facilitate a CARTA (Continuous Adaptive Risk and Trust Assessment) approach to user authentication. Key issues: - What are the weaknesses of orthodox methods? - How can IAM leaders evaluate and meet user authentication needs? - How will enterprises benefit from taking a strategic CARTA approach?

Managing bots identity and access has introduced a new set of IGA requirements that stretch the scope of identity governance. Also, cognitive RPA has shown potential to expand automation opportunities in IGA solutions. In this ask-the-analyst session, participants can discuss potential use cases of RPA in IGA and how IGA should adapt to manage bots identity.

Organizations thrive in a competitive landscape that includes supporting a transformative marketplace, providing positive user experience, and reducing the threat surface with equal priority. Today, how to implement identity security is debated across the business. Join SecureAuth’s Robert Block and Scripps Health’s Christian Aboujaoude as they discuss the impact these changes have on organizations, and how organizations can prepare to succeed.

Organizations process and store huge volumes of sensitive information. Inadequate controls in IAM processes and technology can lead to breach, involuntary exposure of data, and non-compliance issues. But you cannot correct what you don't know, so the first step is assessment. We'll address the most common questions around designing IAM Assessments, Blueprints & Roadmaps - Why Should We Assess? What Should We Assess? and When Should We Reassess?

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

In an attempt to counter a proliferation of breaches, organizations tend to secure the endpoint and perimeter, and governments enact compliance regulations, which do little more than add operational costs. As endpoints and perimeters give way, bad actors have free reign. Identity-centric security is the best way to address threats. Identity is the language of security. Speaking it can provide impactful change to an organization’s risk posture.

The early promises of easy, secure and universal authentication through unique personal traits has been unfulfilled for decades, but in the past 10 years we've seen an surge in interest and adoption. Are biometric methods now the way forward for every enterprise? • How does biometric authentication differ from other orthodox methods? • Where is biometric authentication most popular today — and what are the pitfalls? • How do biometric technologies fit in an enterprise identity corroboration strategy?

An examination of ongoing and emerging threats in the Cyber Security Threat Landscape and the role leadership will play in strengthening an enterprise to ensure cyber resiliency as espoused by the leader of the FBI’s Silicon Valley cyber security branch. The discussion is supported by current trend and case examination. Plus, guidelines and principles of leadership in the realm of information security will be proffered for consumption and use.

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

Employee monitoring is one of those topics that most IT leaders don’t like to talk about. Blandishments like “we trust our people” and “we have a culture of openness” are common. Yet, as Mark Twain said, “The difference between a man and a dog is that if you feed a dog and take care of it, it will not bite you.” We examine how employee monitoring contributes not only to prevention and detection of internal malfeasance, but can also be used to safeguard employees and ensure safe working environments.

In today's digital environment we have more users, more applications, more devices and more relationships to manage than ever before. The ability to effectively govern identities and access controls in this increasingly complex digital environment is reaching beyond human capacity. Advancements in the field of identity analytics promise to help simplify and improve our identity governance and control activities. Identity analytics employee big data, machine-learning and AI techniques that are able to consume and analyze vast amounts of data which allows organizations to detect and respond to risk in a more timely fashion. In this session, peers will have the opportunity to discuss how identity analytics can help improve IAM processes.

Attendees will learn how device-based authentication is an important first step in transforming secure customer interactions, both strengthening authentication and enhancing customer trust. Discover how implementing this flexible and transparent solution also creates a path for new consumer-friendly MFA and additional assurance for higher-risk situations.

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

Intuitive approaches to role management at an enterprise scale lead to the adoption of simplistic models that are usually ineffective and often counterproductive. IAM leaders should use Gartner's two-layer enterprise role framework to organize and scope role management across an entire organization with their IGA solutions. Key issues include: 1) Why is role management so difficult at an enterprise scale? 2) How should IAM leaders be thinking about enterprise role management? 3) What are the essential elements of a two-layer enterprise role management framework?

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Orthodox, credential-based authentication does not scale to the needs of digital business. Here, we discuss how new analytics-centric identity corroboration tools facilitate a CARTA (Continuous Adaptive Risk and Trust Assessment) approach to user authentication. Key issues: - What are the weaknesses of orthodox methods? - How can IAM leaders evaluate and meet user authentication needs? - How will enterprises benefit from taking a strategic CARTA approach?

Managing bots identity and access has introduced a new set of IGA requirements that stretch the scope of identity governance. Also, cognitive RPA has shown potential to expand automation opportunities in IGA solutions. In this ask-the-analyst session, participants can discuss potential use cases of RPA in IGA and how IGA should adapt to manage bots identity.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

When migrating applications to the cloud, teams may not properly account for IAM, leading to short-term solutions to IAM challenges and misalignment with the organization's overall IAM architecture. This session guides technical professionals on common approaches to IAM in application migrations.

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

Employee monitoring is one of those topics that most IT leaders don’t like to talk about. Blandishments like “we trust our people” and “we have a culture of openness” are common. Yet, as Mark Twain said, “The difference between a man and a dog is that if you feed a dog and take care of it, it will not bite you.” We examine how employee monitoring contributes not only to prevention and detection of internal malfeasance, but can also be used to safeguard employees and ensure safe working environments.

In today's digital environment we have more users, more applications, more devices and more relationships to manage than ever before. The ability to effectively govern identities and access controls in this increasingly complex digital environment is reaching beyond human capacity. Advancements in the field of identity analytics promise to help simplify and improve our identity governance and control activities. Identity analytics employee big data, machine-learning and AI techniques that are able to consume and analyze vast amounts of data which allows organizations to detect and respond to risk in a more timely fashion. In this session, peers will have the opportunity to discuss how identity analytics can help improve IAM processes.

Every organization, regardless of where they reside on the IAM Maturity spectrum, benefits from perpetual access auditing. Our panel, comprised of Deloitte Audit, CISO veterans and IAM solution providers, will delve into how companies with end-to-end IAM solutions, hybrid programs or 100% manual processes leverage perpetual auditing to identify security policy violations, remediate process gaps and control access risks.

IoT devices generate a huge amount of data, which may include sensitive personal data. As regulations and awareness of privacy increase, security leaders require a consistent approach with data security and privacy. What are the concerns with IoT security? What are the legal implications of regional privacy laws such as GDPR? What approaches should be considered when embarking on IoT initiatives?

Identity cannot be absolutely proven - merely corroborated to fall within transactional risk tolerance. Security and risk management leaders must discard flawed legacy methods and embrace analytics that evaluate multiple positive and negative signals. In this presentation, we will address the following key issues: - Knowledge based authentication is dead, thanks to rampant data compromise and oversharing on social media. - High friction during enrollment leads to abandonment and does not reduce risk. - The convergence between identity proofing and online fraud continues, with the online fraud engine acting as a risk arbitrator not only in authentication but in enrollment.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

Security and risk management leaders need to develop security strategies that treat data as a pervasive asset (and liability). New data privacy laws and the continued growth of data breaches are increasing business risks. Data security governance is an emerging risk-based framework that will help plan and orchestrate policies across data security products that are siloed and do not integrate.

Combining digital identity, sophisticated mobile apps, and powerful analytics changes what’s possible for any user experience. Join Station Digital Media and MicroStrategy, for a discussion on how delivering contextual insights changes operations and workflows as well as drives new opportunities for customer engagement. See how personalized interactions help deliver an exceptional experience for every employee, customer, vendor, and partner!

This workshop discusses real-world experiences on solving the challenges associated with identifying users and devices in a mobile landscape. It also discusses the convergence of mobility management and Identity management technologies and the implications this poses to the digital workplace. Key Issues: • Do I need to implement mobile identity? • If so, how? • What are the best practices in deploying it?

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

This presentation will outline ongoing changes in security operations/policy/organization, technical migrations, shifts in security mindsets, societal changes, and modifications in adversarial tactics that CISOs and their direct reports should monitor. Attendees will learn strategic changes that aren't yet widely recognized but will have broad industry impact and significant potential for disruption. Through 2022, technologies related to these trends will reach a level of maturity that crosses a critical tipping point.

EMM suites help organizations with mobile device, application and content management, and containment, but they increasingly interact with IAM systems and provide IAM functions such as certificate management, authentication and single sign-on. In this roundtable, participants will discuss how EMM suites and IAM solutions can play together to achieve organizations' security goals.

Global security management teams in enterprise IT organizations are being challenged to create security frameworks for product teams to provide for operational technologies to manage fleets of devices that are manufactured world and deploy on a global scale. Find out about the challenges and the exciting developments in device identity management that are providing solutions as IT and OT converge.

In this workshop, we will assess how identity is provisioned to IoT devices and how identity is used to authenticate and authorize access to and from the device. We present a model for the identity of things (IDoT), different constraints and we will look at the current state of the art. You will work through prepared materials and leave with an IDoT design for your most challenging IoT effort.

Join this panel of your CISO peers as they discuss their journeys and how they matured their PAM programs. Considering new use cases such as cloud, DevOps and IoT, organizations must transform their static PAM projects into dynamic PAM programs that enable agility, growth and innovation. This interactive panel discussion will be for everyone – from those just beginning their journey to leaders looking to fine tune a sophisticated deployment.

Broken algorithms, new hardware attacks, quantum computer breakthrough and the increasing use of PKI requires planning and well-structured processes for managing certificates. In this roundtable, we will discuss PKI, it's bread-and-butter use cases as well as its use within IoT, mobility and DevSecOps.

Make the most of your summit experience! At the Orientation, you learn about the all the features and activities available, including any last minute updates and additions. Get tips on how to navigate the event, evaluate technologies, make relevant connections with analysts, providers and peers. The Orientation will be immediately followed by an informal Networking Reception, where you can start meeting peers with the same interests, industry, or role …over snacks and refreshments!

The CIO agenda highlights the changing role of the CIO. Security and risk management leaders must understand CIO priorities and adjust strategy and messaging accordingly. Key issues: • What are the main elements of the CIO agenda? • What are their implications for security and risk management leaders? • What must security and risk management leaders do in response?

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

IAM programs don't gain support without a common organizational goal and direction. Determining that requires more than promoting a shiny new object, it requires salesmanship, collaboration and commitment. After all, the vision is something that is shared. Learn how to structure and communicate a vision and strategy that corresponds to organizational needs and expectations, and that can support the establishment of a new discipline.

Organizations are allocating funds for blockchain without defining use cases, putting security and risk management leaders in a bind. You need to support the adoption of blockchain, but manage the risks that result from relatively unproven tools. Come learn: ● How to trust distributed identity. ● How to trust unknown cryptographic service providers on blockchain and distributed ledgers. ● Recognize the can't-happen-don't-care state is more important than we think.

As the explosion of data, applications, and human and nonhuman identities impacts organizations, businesses are addressing these challenges to ensure their identity program meets security and compliance requirements. Join us to hear from SailPoint customers from different industries and overseeing identity programs at various stages of maturity. We’ll discuss the strategy of their programs and their thoughts on the evolving identity market.

Azure Active Directory empowers organizations to manage and secure identities for employees, partners, and customers to access the applications and services they need via a common identity across on-premises and cloud directories. Come get an overview of our capabilities and demos and learn about the latest investments in identity protection, conditional access, single sign-on, hybrid identity environments, managing partner and customer access, and password-less authentication.

Digital business challenges the conventions of digital risk and security management. Security and risk management leaders must develop a coherent digital security program based on a clear vision and strategy. This presentation will address: What constitutes an effective vision and strategy? What are the elements of a digital security program?

As identity and access management activities align more with an organization's digital objectives, security and risk management leaders responsible for IAM recognize the need to manage IAM as a program in its own right. This session addresses: * How to justify the IAM program * Establishing program responsibilities * Establishing program governance

The University of California - San Francisco (UCSF) had to replace a 20+ year old, mainframe-based identity system, when the platform was phased out. Learn how UCSF addressed the challenges of replacing a system deeply entangled with core business processes, and expanded process automation to prepare for the future.

Good information security hygiene is a must, but many organizations lose focus on getting the basics right, leading to an unjustified level of confidence in risk posture. Join us and learn: • What are the key activities, capabilities and practices for organizations? • What are the activities that you can delay or even skip entirely? • Why doing the basics is more important than ever?

IAM programs must deal with a variety of process and technology related opportunities and issues. Coordinating these in order to provide measurable progress and benefits is always a challenge, and may not happen in the optimal or desired order. The challenge to IAM leaders is to fulfill expectations of stakeholders and organize activities to manage dependencies. Use the roadmap to manage outcomes.

This presentation outlines the top 10 security projects, based on a number of criteria: The emerging technologies that support the project are not yet mainstream; the project helps deliver against the CARTA (continuous adaptive risk and trust assessment) approach; and the project has high risk reduction versus resources required as compared to alternatives. Attend this session to get ideas and justification for specific security projects.

Join this luncheon to network with amazing women that are driving technology innovation into and throughout their companies. Regardless of where you are in your professional journey, there is something here for everyone. Build a strong support network to identify programs and resources to help you achieve your personal and professional goals.

Blockchain has become a much-hyped technology with a lot of potential. Yet, with cyberthreats and data breaches, is this technology secure? As Blockchain starts to impact the world, CISOs must understand the security and privacy implications. This session aims to provide a CISOs with a framework that will help them identify and manage risks related to Blockchain.

Buying IAM solutions requires detailed analysis of vendors, solutions and alternatives. Learn to use this five-step approach to structure the evaluation process, derive your shortlist, choose a solution and negotiate the best price.

This workshop will help IAM leaders develop metrics that can help them to communicate more effectively about the state of their IAM programs and, ultimately, manage those programs better.

An examination of ongoing and emerging threats in the Cyber Security Threat Landscape and the role leadership will play in strengthening an enterprise to ensure cyber resiliency as espoused by the leader of the FBI’s Silicon Valley cyber security branch. The discussion is supported by current trend and case examination. Plus, guidelines and principles of leadership in the realm of information security will be proffered for consumption and use.

Privacy is considered a human right in most jurisdictions of the world. Yet, with multiple privacy laws globally being strengthened, privacy incidents keep happening. Is there an implied business case to ignore it? Is privacy overrated? Is it dead? Are there benefits to "get it right"? In this analyst debate, we intend to explore the benefits and disadvantages of privacy protection in the employment, government, and commercial interaction environment.

Security and risk management leaders struggle to hire and retain staff with the right skills, especially in the age of digital business. We discuss the outlook for security talent in digital businesses. What do organizations do to confront this shortage? What can you do to ensure your team's skill sets are developed for a digital world? What does the future of talent look like with technologies such as AI/ML, blockchain, IoT looming?

Employee monitoring is one of those topics that most IT leaders don’t like to talk about. Blandishments like “we trust our people” and “we have a culture of openness” are common. Yet, as Mark Twain said, “The difference between a man and a dog is that if you feed a dog and take care of it, it will not bite you.” We examine how employee monitoring contributes not only to prevention and detection of internal malfeasance, but can also be used to safeguard employees and ensure safe working environments.

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

Organizations thrive in a competitive landscape that includes supporting a transformative marketplace, providing positive user experience, and reducing the threat surface with equal priority. Today, how to implement identity security is debated across the business. Join SecureAuth’s Robert Block and Scripps Health’s Christian Aboujaoude as they discuss the impact these changes have on organizations, and how organizations can prepare to succeed.

Join this panel of your CISO peers as they discuss their journeys and how they matured their PAM programs. Considering new use cases such as cloud, DevOps and IoT, organizations must transform their static PAM projects into dynamic PAM programs that enable agility, growth and innovation. This interactive panel discussion will be for everyone – from those just beginning their journey to leaders looking to fine tune a sophisticated deployment.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

Everyone is speaking about passwordless authentication, but how can you prove who you are? Verification of a person's identity is imminent is everday events such as buying alcohol, opening a bank account, going to the airport. An SSO like process across all of these events and locations would enable such an experience. Proving your identity once , developing a level of assurance and then carrying that with you across these authentication points.

Witness the future of frictionless authentication as we reveal the results of a behavioral study conducted earlier this year. Experience the magic through case studies, demos and try it yourself. Discover - What people love about truly password-less 2FA. - Why leading organizations are raving about this next gen of authentication. - How you can easily integrate lovable 2FA into your organization's IAM platform for employees, consumers or both.

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

As is the case with practically every domain, identity and access management (IAM) has its own jargon that can be difficult for newcomers to understand. This session provides newcomers to IAM with an introduction to the IAM territory and its vocabulary. Key Issues: • What is the definition and purpose of IAM? • How do IAM practitioners think about IAM? • What should newcomers to IAM know before they go?

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

CIAM is key to enabling your digital transformation and the foundation of your customers' digital experiences. In this session, we will discuss trends in new CIAM capabilities and best practices. We will also provide guidance on which features and vendors to consider when making a CIAM vendor short list.

Gartner recommends that organizations follow a program management approach for IAM and has produced a framework to assist organizations with establishing and running their programs. This session will walk attendees through the process of starting an IAM program and developing the artifacts that are necessary to successfully initiate and run a program and drive toward success. Key Issues: 1. Why is it important for organizations to approach IAM as a program? 2. What is the Gartner framework for IAM program management? 3. How should an organization leverage Gartner's IAM program management framework to initiate their programs?

The CIO agenda highlights the changing role of the CIO. Security and risk management leaders must understand CIO priorities and adjust strategy and messaging accordingly. Key issues: • What are the main elements of the CIO agenda? • What are their implications for security and risk management leaders? • What must security and risk management leaders do in response?

IAM is an important component of an overall security and risk management plan and a key enabler of digital business. Attendees will learn how to evolve their IAM approach given current best practices and industry trends. Key issues are: • What are the architectural trends in IAM? • What drivers and best practices are shaping the evolution of IAM in 2018?

Envisioned in 2011, the BeyondCorp security model leverages identity and context to evaluate trust for access decisions rather than using the corporate network as the perimeter. Join this session to understand what BeyondCorp is, why you should consider it, and how to implement it across your organization to achieve a stronger security posture, anywhere access, and more intuitive end user experiences.

IAM programs don't gain support without a common organizational goal and direction. Determining that requires more than promoting a shiny new object, it requires salesmanship, collaboration and commitment. After all, the vision is something that is shared. Learn how to structure and communicate a vision and strategy that corresponds to organizational needs and expectations, and that can support the establishment of a new discipline.

This presentation will outline ongoing changes in security operations/policy/organization, technical migrations, shifts in security mindsets, societal changes, and modifications in adversarial tactics that CISOs and their direct reports should monitor. Attendees will learn strategic changes that aren't yet widely recognized but will have broad industry impact and significant potential for disruption. Through 2022, technologies related to these trends will reach a level of maturity that crosses a critical tipping point.

Products and services lacking consideration for privacy represent a clear liability to organizations that process personal information. Over the course of this session, we will outline how to embrace Privacy Engineering and transform your privacy program from a forced to an organic change. We will look at lessons learned from the mad rush to the GDPR and how small, strategic changes to the way you plan, design and acquire can make compliance a natural step in your progression.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

The speed in which a PAM solution achieves success and provides value relies upon how prepared your enterprise is for the new capability. Cognizant will share lessons learned from working with organizations who have launched successful PAM implementations.

As the explosion of data, applications, and human and nonhuman identities impacts organizations, businesses are addressing these challenges to ensure their identity program meets security and compliance requirements. Join us to hear from SailPoint customers from different industries and overseeing identity programs at various stages of maturity. We’ll discuss the strategy of their programs and their thoughts on the evolving identity market.

Digital business challenges the conventions of digital risk and security management. Security and risk management leaders must develop a coherent digital security program based on a clear vision and strategy. This presentation will address: What constitutes an effective vision and strategy? What are the elements of a digital security program?

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

Digital business opportunity and digital business risk are fundamentally intertwined — zero risk, zero opportunity. The key capability for IAM professionals over the next decade will be to continuously discover, assess and adapt to ever-changing risk and trust levels. We need access management decisions to become continuous and adaptive — enabling real-time decisions that balance risk, trust and opportunity at the speed of digital business.

As identity and access management activities align more with an organization's digital objectives, security and risk management leaders responsible for IAM recognize the need to manage IAM as a program in its own right. This session addresses: * How to justify the IAM program * Establishing program responsibilities * Establishing program governance

The University of California - San Francisco (UCSF) had to replace a 20+ year old, mainframe-based identity system, when the platform was phased out. Learn how UCSF addressed the challenges of replacing a system deeply entangled with core business processes, and expanded process automation to prepare for the future.

Good information security hygiene is a must, but many organizations lose focus on getting the basics right, leading to an unjustified level of confidence in risk posture. Join us and learn: • What are the key activities, capabilities and practices for organizations? • What are the activities that you can delay or even skip entirely? • Why doing the basics is more important than ever?

IAM programs must deal with a variety of process and technology related opportunities and issues. Coordinating these in order to provide measurable progress and benefits is always a challenge, and may not happen in the optimal or desired order. The challenge to IAM leaders is to fulfill expectations of stakeholders and organize activities to manage dependencies. Use the roadmap to manage outcomes.

This presentation outlines the top 10 security projects, based on a number of criteria: The emerging technologies that support the project are not yet mainstream; the project helps deliver against the CARTA (continuous adaptive risk and trust assessment) approach; and the project has high risk reduction versus resources required as compared to alternatives. Attend this session to get ideas and justification for specific security projects.

In an attempt to counter a proliferation of breaches, organizations tend to secure the endpoint and perimeter, and governments enact compliance regulations, which do little more than add operational costs. As endpoints and perimeters give way, bad actors have free reign. Identity-centric security is the best way to address threats. Identity is the language of security. Speaking it can provide impactful change to an organization’s risk posture.

Digital risk management addresses the changes to traditional IT and operational risk management brought on by major changes from digital transformation— whether cloud-bases services, blockchain, artificial intelligence or the Internet of Things. This presentation explores the risks incurred by IAM professionals as they leverage next-generation digital capabilities.

Buying IAM solutions requires detailed analysis of vendors, solutions and alternatives. Learn to use this five-step approach to structure the evaluation process, derive your shortlist, choose a solution and negotiate the best price.

This workshop will help IAM leaders develop metrics that can help them to communicate more effectively about the state of their IAM programs and, ultimately, manage those programs better.

Privacy is considered a human right in most jurisdictions of the world. Yet, with multiple privacy laws globally being strengthened, privacy incidents keep happening. Is there an implied business case to ignore it? Is privacy overrated? Is it dead? Are there benefits to "get it right"? In this analyst debate, we intend to explore the benefits and disadvantages of privacy protection in the employment, government, and commercial interaction environment.

Security and risk management leaders struggle to hire and retain staff with the right skills, especially in the age of digital business. We discuss the outlook for security talent in digital businesses. What do organizations do to confront this shortage? What can you do to ensure your team's skill sets are developed for a digital world? What does the future of talent look like with technologies such as AI/ML, blockchain, IoT looming?

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?

Digital Risk Management is a discipline that seeks to expand current risk management to incorporate the rapid advances in technology that organizations face today. The roundtable seeks to answer such questions as (1) what does digital risk management add to ‘traditional’ risk management techniques? (2) How can organizations best prepare to absorb these additions quickly and efficiently? (3) How does this change your cyber and physical security practices?

Many organizations seek to manage unstructured data with IAM to reduce risk, increase efficiency and simplify compliance. Often, organizations struggle to incorporate unstructured data because it needs some TLC before it can be managed: you need to deal with unique permissions, inconsistent inheritance, overexposed or stale data, and more. Join Varonis to learn how to overcome these issues and make your IAM unstructured data project successful.

Is your organization in need of a Privileged Access Management (PAM) solution? If so, this session will serve as a good primer on the technology. Key issues covered include * Introduction to privileged access management * The PAM maturity model * An overview of PAM tools and when and how to use them

Managing bots identity and access has introduced a new set of IGA requirements that stretch the scope of identity governance. Also, cognitive RPA has shown potential to expand automation opportunities in IGA solutions. In this ask-the-analyst session, participants can discuss potential use cases of RPA in IGA and how IGA should adapt to manage bots identity.

Together IAM and CASBs extend access control beyond the front door. In this session, we discuss how the two relates, integrates and how they rely and leverage each other to take back control of identities, services and data.

The speed in which a PAM solution achieves success and provides value relies upon how prepared your enterprise is for the new capability. Cognizant will share lessons learned from working with organizations who have launched successful PAM implementations.

Establishing Privileged Access Management (PAM) controls is essential to strengthening your security posture. Learn how one organization is taking a programmatic approach to prioritizing risk reduction and improving C-level communications associated with protecting investments in modern infrastructure to support digital transformation.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

Modern IT environments have three major challenges with traditional identity security products. IT organizations evolved and embraced hybrid IT deployments and cloud services, traditional identity security vendors failed to evolve with them. Organizations are left vulnerable to insider threats and external attackers. Find out if your organization is affected by these three challenges and learn how they can be prevented with OverWatchID.

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

Join this panel of your CISO peers as they discuss their journeys and how they matured their PAM programs. Considering new use cases such as cloud, DevOps and IoT, organizations must transform their static PAM projects into dynamic PAM programs that enable agility, growth and innovation. This interactive panel discussion will be for everyone – from those just beginning their journey to leaders looking to fine tune a sophisticated deployment.

(TechDemo) We will evaluate the capabilities of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to provide access control, authentication, SSO, Active Directory services and identity governance for IaaS. Via a custom single page application, we will provide guidance on best approaches for leveraging these capabilities as well as using them to integrate your applications and services across the three IaaS platforms.

Privileged accounts hold the keys to highly sensitive company information, and once these credentials are targeted, they can easily open the gate to a company’s most valuable assets. Most enterprises have implemented some form of Privileged Access Management but many find those initiative fail to live up to expectations. In this session, we'll discuss the common reasons why PAM projects fail to deliver with practical insights gained in the field.

Any successful approach to advanced PAM involves continually managing risk by controlling administrative use, assignment and configuration, together with optimizing what’s known as the Principle of Least Privilege (POLP). CEO Tim Keeler shares his experiences in working with clients to help protect over 1M endpoints with Just In Time Administration. Learn how you can bring agentless privilege access management to your organization Just In Time!

As traditional network perimeters dissolve, organizations must discard the old model of “trust but verify” which relied on well-defined boundaries. Zero Trust mandates a “never trust, always verify, enforce least privilege” approach to privileged access, from inside or outside the network. By implementing least privilege access, organizations minimize the attack surface, reduce risk, complexity and costs for the modern, hybrid enterprise.

In an increasingly mobile and cloud-driven workplace, nobody wants to be tied to a desk. So your security strategy must protect access from boardrooms and bars, cubicles and coffee shops alike. How can you ensure that users and their devices meet the same controls whether they’re outside or inside the network perimeter? Duo uses a zero-trust model, in which users and devices are treated as untrusted until proven otherwise. Join us to learn more.

You've migrated all your software to the cloud except for your security solutions. What now? Join technology leadership from Intuit and Thycotic as they discuss the challenges and opportunities that arise from automating Privileged Account Management and migrating cyber security software to public and private clouds.

Petri Heinälä of Fujitsu and Sami Ahvenniemi of SSH discuss why the approach by current generation of Privileged Access Management solutions just doesn’t work in dynamic and disposable multi-cloud and hybrid environments and what are the better alternatives for DevOpsSec. They also discuss the inevitable unification of IAM and PAM and what might lie ahead in the not-so-distant future with emerging paradigms such as containerization, immutable infrastructure, and serverless computing.

This session gives you an opportunity to ask questions about privileged access management (PAM), successful use cases and requirements needed to make your PAM efforts successful. Attendees should come prepared to ask questions.

Identity governance and administration (IGA) is the largest investment that most IAM programs will make. It is also the highest risk IAM technology to deploy. This tutorial presents a vision for how administering user access is best understood as a quality process, requiring transformation of existing processes to improve the effectiveness of IGA while simplifying deployment of the technology.

Intuitive approaches to role management at an enterprise scale lead to the adoption of simplistic models that are usually ineffective and often counterproductive. IAM leaders should use Gartner's two-layer enterprise role framework to organize and scope role management across an entire organization with their IGA solutions. Key issues include: 1) Why is role management so difficult at an enterprise scale? 2) How should IAM leaders be thinking about enterprise role management? 3) What are the essential elements of a two-layer enterprise role management framework?

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Is your organization in need of a Privileged Access Management (PAM) solution? If so, this session will serve as a good primer on the technology. Key issues covered include * Introduction to privileged access management * The PAM maturity model * An overview of PAM tools and when and how to use them

Digital business opportunity and digital business risk are fundamentally intertwined — zero risk, zero opportunity. The key capability for IAM professionals over the next decade will be to continuously discover, assess and adapt to ever-changing risk and trust levels. We need access management decisions to become continuous and adaptive — enabling real-time decisions that balance risk, trust and opportunity at the speed of digital business.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

IGA deployment initiatives are a potential minefield for many organizations that risk costly delays, difficult integration and lower overall value. Gartner has identified common anti-patterns for IGA adoption that range from the planning phase to the actual deployment and integration. Learn how to identify and avoid these common mistakes and plan for a successful IGA deployment by focusing on value and using Gartner's IGA deployment model. 1. Why Is IGA So Difficult to Get Right? 2. What IGA Deployment Strategy Will Work Best for You? 3. What Best Practices Should You Use When Deploying and Running IGA?

The future of delivering modern IGA services will be in the cloud. Technical professionals dealing with identity solutions should consider cloud-delivered IGA as an alternative to on-premises solutions. In this session we discuss cloud IGA capabilities, their maturity, and deployment patterns to help organizations refactor their IGA architecture for enhanced agility.

Is your organization in need of a Privileged Access Management (PAM) solution? If so, this session will serve as a good primer on the technology. Key issues covered include * Introduction to privileged access management * The PAM maturity model * An overview of PAM tools and when and how to use them

The privileged access threat landscape is growing with a higher risk of enabling cyberattacks and severe consequences. Technical professionals must architect privileged access control capabilities to defend against exploitation scenarios and to resist advance persistent attacks. In this session we discuss how to develop an overarching PAM requirements and architecture strategy.

Identity governance and administration (IGA) systems have been on the market for years, but many IGA deployments are aging and struggle to meet new digital business demands. Organizations must rethink their identity management architecture and adopt next-generation technologies that support cloud, mobile, DevOps, AI, analytics, and cyber-security initiatives. In this session, Gartner will explore IGA technology trends including analytics, cloud delivery, UI modernization, service-based architecture and advanced integrations such as robotic process automation (RPA), privileged access management (PAM), and data access governance (DAG). This session will answer the following questions: What are the major market influencers that are driving innovation in the IGA market? What are the major technology trends? How do I architect an IGA solution that will withstand the digital movement?

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

Orthodox, credential-based authentication does not scale to the needs of digital business. Here, we discuss how new analytics-centric identity corroboration tools facilitate a CARTA (Continuous Adaptive Risk and Trust Assessment) approach to user authentication. Key issues: - What are the weaknesses of orthodox methods? - How can IAM leaders evaluate and meet user authentication needs? - How will enterprises benefit from taking a strategic CARTA approach?

Daily data breaches make some CISO’s and IAM Directors a little concerned with moving to a cloud based service, especially given that GDPR is now in effect. We will look at how shifting back to a private dedicated “cloud” solution for your SSO requirements offers better security and control. We will cover: • Cloud vs. On-Premises Comparison • Security concerns • Affordability of an IDaaS solution

As we continue to see daily data breaches due to weak credentials, moving away from and killing the password is finally upon us. Join this session to learn how FIDO2 and WebAuthn open authentication standards, in conjunction with YubiKeys, are solving the elimination of passwords at scale. Hear how organizations like Microsoft have implemented these standards for a true passwordless experience and find out how your organization can follow suit.

Although many enterprises already use hundreds of cloud applications, some of their toughest identity challenges reside behind the firewall where aging legacy apps are being managed by rigid, dated on-prem IAM solutions. OneLogin will explore how enterprises can extend the flexibility and superior experience of IDaaS to manage legacy applications together with modern cloud apps in a single, unified solution.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

Azure Active Directory empowers organizations to manage and secure identities for employees, partners, and customers to access the applications and services they need via a common identity across on-premises and cloud directories. Come get an overview of our capabilities and demos and learn about the latest investments in identity protection, conditional access, single sign-on, hybrid identity environments, managing partner and customer access, and password-less authentication.

The access management market has evolved beyond supporting traditional web applications, and now there are more choices than ever. Attend this keynote presentation for an overview of the IAM-related Magic Quadrants and Critical Capabilities that have been published in the past year.

A multi-national bank will share their experience eliminating passwords and implementing strong MFA for Citrix and Microsoft AD environments. The bank will describe the benefits of using Veridium’s platform with mobile biometrics including: · Reducing costs · Simplifying UX while increasing security · Creating consistent login experiences in or out of the office · Branding with integration to the bank’s self-service mobile app

Modern IT environments have three major challenges with traditional identity security products. IT organizations evolved and embraced hybrid IT deployments and cloud services, traditional identity security vendors failed to evolve with them. Organizations are left vulnerable to insider threats and external attackers. Find out if your organization is affected by these three challenges and learn how they can be prevented with OverWatchID.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

Organizations thrive in a competitive landscape that includes supporting a transformative marketplace, providing positive user experience, and reducing the threat surface with equal priority. Today, how to implement identity security is debated across the business. Join SecureAuth’s Robert Block and Scripps Health’s Christian Aboujaoude as they discuss the impact these changes have on organizations, and how organizations can prepare to succeed.

This workshop discusses real-world experiences on solving the challenges associated with identifying users and devices in a mobile landscape. It also discusses the convergence of mobility management and Identity management technologies and the implications this poses to the digital workplace. Key Issues: • Do I need to implement mobile identity? • If so, how? • What are the best practices in deploying it?

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

This session will focus on techniques and tools that organizations use to solve problems associated with users having to remember too many passwords and to give them the convenience of SSO.

Everyone is speaking about passwordless authentication, but how can you prove who you are? Verification of a person's identity is imminent is everday events such as buying alcohol, opening a bank account, going to the airport. An SSO like process across all of these events and locations would enable such an experience. Proving your identity once , developing a level of assurance and then carrying that with you across these authentication points.

Witness the future of frictionless authentication as we reveal the results of a behavioral study conducted earlier this year. Experience the magic through case studies, demos and try it yourself. Discover - What people love about truly password-less 2FA. - Why leading organizations are raving about this next gen of authentication. - How you can easily integrate lovable 2FA into your organization's IAM platform for employees, consumers or both.

In this workshop, we will discuss several of the more common authentication and authorization use cases that require OAuth/OIDC and the specific OAuth/OIDC extensions that are needed to properly implement them. We will also provide information on which vendor offerings support some of the newer, the less commonly available OAuth/OIDC extensions.

Security leaders from Microsoft, Fortinet, HARMAN and NIST will candidly share how they balance security, speed, compliance and UX to simplify their IAM strategy and meet their security fears head-on. Walk away with pragmatic insights to modernize your approach to IAM.

In the financial sector a poor customer experience means revenue losses of millions. The transition to a next-generation CIAM platform was THE critical first step to meeting ATB's digital transformation goals. Join ATB as they share their identity transformation story: - Creating a single, cross-organizational view of customer identity - Implementing SSO across all digital properties - Improving multi-factor security & experience

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

In this live demonstration environment, we will dig into best practices for user management, SSO, MFA, hybrid architecture and availability. Topics include: Azure AD Connect, Pass-through Authentication, Conditional Access and third-party IDaaS/MFA/federation integration. As this is a limited-attendee format, you will work through prepared materials and leave with checklists that are specific to your organization.

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

As traditional network perimeters dissolve, organizations must discard the old model of “trust but verify” which relied on well-defined boundaries. Zero Trust mandates a “never trust, always verify, enforce least privilege” approach to privileged access, from inside or outside the network. By implementing least privilege access, organizations minimize the attack surface, reduce risk, complexity and costs for the modern, hybrid enterprise.

In an increasingly mobile and cloud-driven workplace, nobody wants to be tied to a desk. So your security strategy must protect access from boardrooms and bars, cubicles and coffee shops alike. How can you ensure that users and their devices meet the same controls whether they’re outside or inside the network perimeter? Duo uses a zero-trust model, in which users and devices are treated as untrusted until proven otherwise. Join us to learn more.

Attendees will learn the fundamentals of Access Management. For example, the differences between coarse, medium, and fine grained access; what are policy decision, enforcement, and administration points; and what are proxy and agent architectures.

CIAM is key to enabling your digital transformation and the foundation of your customers' digital experiences. In this session, we will discuss trends in new CIAM capabilities and best practices. We will also provide guidance on which features and vendors to consider when making a CIAM vendor short list.

Tangible use cases for a portable and reusable Digital Identity may seem limited but it holds great promise for wide adoption across consumer, business and enterprise use cases, without IT headaches or sacrificing user privacy. Manah Khalil from Verizon believes the technology and building blocks already exist for Digital Identity to unleash a wide range of possible use cases.

Access management provides an abstraction layer to provide consistent authentication, single sign-on and authorization for your applications. Today access management solutions must protect web and native mobile applications, which may be implemented on-premises, or in private and public clouds. They may need to leverage your own managed identities or those federated from partners and third-party providers such as social media sites. This session will help attendees make appropriate access management choices in the face of growing software and cloud market offerings.

Mobility brings constant chaos with users trying to access applications and data from new and potentially unknown devices and locations. This session will cover how this chaos impacts identity and what organizations should be doing as best practices to ensure proper authentication.

Trusted digital identity is critical for enabling digital trust. To take advantage of digital business opportunities, IAM leaders must leverage various trusted digital identity models, including BYOI, to satisfy consumer needs, enabling simple, convenient and secure access. Audience members will learn why noninteroperable digital identities will not scale with the needs of digital business.

This workshop discusses real-world experiences on solving the challenges associated with identifying users and devices in a mobile landscape. It also discusses the convergence of mobility management and Identity management technologies and the implications this poses to the digital workplace. Key Issues: • Do I need to implement mobile identity? • If so, how? • What are the best practices in deploying it?

Decentralized identity and related evolving standards will be disruptive. Proof-of-concept projects have shown the potential benefits such as enhanced privacy, reduced security risk and cost-efficiency. However, there are still gaps and challenges that require more work. This session will demystify decentralized identity architecture, example offerings and current state of the market.

Passwords are a bane. Everyone struggles with multiple passwords. Passwords are notoriously weak, yet attempts to strengthen them only increase people's frustration, while providing little respite from attacks. However, passwords require no new technology and are very familiar, even comforting. And while reducing friction is generally good, can passwordless methods show intent? Join this crossfire session for a thought-provoking discussion among Gartner analysts.

The evolving OAuth 2.0 frameworks and OpenID Connect has been proven hard to master when protecting enterprise applications with authentication and authorization. What's the latest enhancement of the framework and how should native and web apps, as well as services, implement and leverage the framework to balance security, privacy and convenience?

Moving Authentication and Access Management (AM) to the Cloud. As enterprises embrace cloud computing interest in adopting cloud-delivered IAM capabilities increases. But, is IAM as a service (IDaaS) a viable model? This session gives you an opportunity to ask questions such as: Can it support hybrid (cloud and on-premises) biz app architectures? Can AM vendors authentication capabilities displace incumbent tools or is there still a need for standalone authentication solutions?