Identity Management

6 November 2019

Business Design Centre




Session one – IAM for the Modern Enterprise

We explore how IAM can become a key enabler to organisations. Through cross-sector case studies and industry perspectives, we charter key IAM imperatives including accountability, transparency, user experience and managing trust, privileges and entitlements. The early morning session will also explore:

  • The IAM Journey
  • New trends in identity: blockchain
  • Digital Transformation and IAM
  • Identity Programmes around the globe
Conference Chair’s Opening Address
Opening Keynote: Keys to a Successful Access Governance Strategy in an Enterprise

Faisal Syed, Global Head of Access Management, UBS

Identity governance and logical access management, including Joiner/Mover/Leaver controls, have been a core focus for auditors and regulators for the last 10 years, especially in the financial industry. Evolving tools and processes have been required to keep pace with the ever increasingly higher demand from compliance bodies. A view across different industries, and organisations reflects the spectrum of maturity they have when it comes to tackling these problems.

So, what is required to make a successful access governance strategy and programme, in the age of Industry 4.0 – virtual workers (robots), AI, Cloud? IAM and access management are core to any innovation work as security becomes a differentiator for customers. The presentation walks through the basics that are mandatory regardless of the context and covers the future “Big Bets” that I have made.

With an independent perspective of a client, rather than a vendor, real-world experiences and strategies that can be successful are detailed.

Journey Towards Decentralised Identity

Saritha Arunkumar, Security Leader and Master Inventor, IBM Security

The promise of decentralised and self-sovereign identity is very appealing to any organisation looking to reduce costs and risks. But how do you get started? Can we see through the problems of a consumer? As organisations start their journey to cloud, the idea of Identity & Blockchain may seem too futuristic. Moving to cloud-based IAM is the first step in the process, and with the right strategy, the next generation IAM is closer than you think.

Digital transformation in the context of Identity Management

Martin Ingram, Identity & Access Management Product Owner, Royal Bank of Scotland

Organisations must be able to use IDM the right way to survive and thrive in this digital transformation wave. Thus, we will address:

  • What becomes of Identity Management post-Digital?
  • How does the Digital Transformation change how we deliver Identity Management?
  • How can Identity Management deliver on the promise of digital transformation?
Say No to Standing Privileges - Go Credential-less in Privileged Access Management

Sami Ahvenniemi, Chief Customer Officer, SSH.COM

Today’s environments encompass many different privileged user types – both internal and outsourced – and they all need access to dynamic, hybrid servers. Cloud has forced many companies to redesign their application architecture, but many legacy privileged access management (PAM) solutions still try to retrofit yesterday’s paradigms into cloud, for example, by using complex, agent-based installations that take months to finish and attempting to vault permanent credentials that need to be constantly rotated but still remain a constant risk. It is time for PAM solutions that are cloud-borne but on-prem friendly, deployable in a day but scalable and designed for today’s requirements but future-proof.

In this session, you will learn how:

  • Just-in-time (JIT) privileged user authentication along with auto-syncing with IAM/IDM/AD enable access at the speed of business in hybrid & multi-cloud environments (AWS, Azure, GCP)
  • Zero standing privileges (ZSP) with ephemeral certificates and password-less access adhere to strict security standards and reduce the risk of permanent credentials
  • Visibility and session recording into access management traffic helps control 3rd party access in the extended enterprise
Contrasting Public Sector Identity Programmes Around the World

Colin Wallis – Executive Director, Kantara Initiative

With the recent flurry of community engagement initiated by the government in the digital identity space, this presentation overviews the current status of the most relevant efforts in other jurisdictions, so that the audience can take away a holistic ‘compare and contrast’ understanding of government-initiated digital identity programmes globally.

Migrating to a Modern IAM Platform: Long-term Value and Risks

Tim Barber, Senior Vice President, EMEA, ForgeRock

What is the value of replacing a legacy IAM system with a more modern, flexible platform? Why make the investment when everything seems manageable as it is now?

Join this session to learn exactly how much value a modern IAM platform can bring to your organisation, and how much time, money and resources it will save you in the long run.

Legacy IAM vs. Modern IAM – Should you stay, or should you go?

  •  Capabilities comparison
  •  Keeping pace with current market demands
  •  Preview of what a modern IAM deployment looks like
  • Short-term and long-term benefits of modernising IAM
  • Potential roadblocks to consider and how to overcome them
Questions To The Panel Of Speakers
Morning Networking and Refreshments served in the Exhibition Area
Modernize Your Identity Governance to Fit the Digital Transformation

Govind Yadav, Senior Sales Engineer, Omada

Many organisations are challenged by the gap between the rapidly evolving business requirements and their current state of the Identity Governance processes or lack of it.

Identity Governance has come to play a central role in the digital transformation, and it requires the adoption of modern Identity Governance technologies that are more scalable, agile and intelligent to meet the ever-evolving digital business requirements of today.

In this presentation, Govind will introduce a holistic approach using best practice processes to address your organisation’s Identity Governance needs, helping you to navigate the perceived complexity of the IGA domain, avoiding pitfalls and heavy customisations.

Drawing an IAM Roadmap

Tim Purkiss, Senior Identity Management Analyst, University of London

Tim will look at the process, benefits and drawbacks of developing an IAM roadmap for an organisation, with reference to the approach the University of London is taking and the challenges of supporting a “cloud-first” strategy. The talk will cover how to incorporate user, device, and data security principles into the roadmap and how to highlight the business benefits of good IAM so that the roadmap can be turned into tangible improvements to support digital transformation.

The Future of Identity is Here

Stephen Mowll, UK Sales Engineering Manager, SailPoint

Digital transformation has opened up opportunities for greater agility and growth in today’s modern enterprises. However, it’s also introducing challenges. Digital transformation means more users, more apps, and more data – and if not adequately addressed, also involves more risk.

To address this growing risk, SailPoint is once again raising the bar in identity governance through SailPoint Predictive Identity. With the power of AI and machine learning, you can quickly spot risky users, get recommendations on who should have access, and identify low-risk manual and repetitive identity activities ripe for automation, which translates to simpler, speedier and smarter administration.

The Future of Identity is here.

Questions to the Panel of Speakers and Delegates Move to the Seminar Rooms
Seminar Sessions
Networking Lunch Served in the Exhibition Area

Session Two – Benchmarking your IAM Programme for Success

  • Third-party IAM management
  • Real-world success IAM case studies
  • An IAM Roadmap
  • Adaptive authentication analysis in behavioural patterns
  • Risk-based authentication
  • CIAM landscape
  • IAM and PAM integration
Conference Chair’s Afternoon Address
Non-Employees: Sponsor but Never Trust

Jeremy Rohrs, VP Global Channels & Alliances, SecZetta

Today, organisations face a growing challenge to interact with partners and suppliers. On average, non-employees make up 40% of the total workforce, and in some industries, they can be as much as 10x the number of employees. Given the dispersed nature of working with non-employees and that no single department is responsible for defining and managing a centralised process, they wind up being the riskiest people to an organisation. This situation makes companies struggle to control grant and governance access. Without good people’s data, you can’t have good identity and access management. Failure to implement a business process for the complexities of non-employees results in business and IT staff preoccupations. They must deal with manual processes, loss of productivity and an increased likelihood of former non-employees maintaining access to highly sensitive systems or physical locations.

In this presentation, Jeremy will discuss:

  • Understanding the challenges and gaps in most non-employee business processes
  • The inefficiencies and security consequences of not addressing an outdated business process
  • Managing business process and people data effectively to deliver actionable decisions to the organisation
  • The benefits gained from an identity and business process first approach to managing non-employees
Identity Data Types for Access Management: Transforming Identity Management at the BBC

Carlos Trigoso, Lead Architect. Identity & Access Management, BBC

The BBC has a relatively advanced Identity and Access Management programme covering all user types within the corporation’s business ecosystem. Carlos Trigoso will present a compact history of this programme and then will focus on the results obtained in the past three years. The presentation highlights the close correlation and interdependence between Identity Management and Organisational Transformation.

OneLogin Access Management: Leading the Cloud Transformation Drive

Eduardo Helering, Head of Solutions Engineering EMEA,OneLogin

Large Customer Case Study

  • Driving Cloud Adoption
  • Cloud Security
  • Initiating and enabling new digitalization use cases
Questions to the Panel of Speakers
Afternoon Networking and Refreshments served in the Exhibition Area
On the State and Future of Standards Based SSO

Hans Zandbelt, CTO/IAM Architect, OpenID Foundation

This presentation will provide an overview of the current state of standards-based digital identity and Single Sign-On (SSO). We’ll take a look at the market adoption of standards such as SAML and OpenID Connect and discuss the future of those standards and internet identity in general. We’ll highlight protocols, standardisation bodies and certification processes and why these matter to your business.

  • What is the market adoption of open standards for cross-domain SSO?
  • How do identity standards emerge and how do they develop over time?
  • What does the future of standard-based SSO hold?
Insider Threats Have A User Name

Haim Koschitzky, CEO, XPLG

Large Customer Case Study: Audity – Bank – Surecomp SWIFT

The Bangladesh Bank cyber heist took place in February 2016, when thirty-five fraudulent instructions were issued by security hackers via the SWIFT network to illegally transfer close to US $1 billion from the Federal Reserve Bank of New York account belonging to Bangladesh Bank. This cyber-attack on the Bangladesh central bank was not the first attack of its kind. In 2013, the Sonali Bank of Bangladesh was also successfully targeted by hackers who were able to remove US$250,000.

In both cases, the perpetrators were suspected to have been aided by insiders within the targeted banks, who assisted in taking advantage of weaknesses in the banks’ access to the SWIFT global payment network.

Following these incidents and the rising need to control privilege user activity and apply zero trust strategy and control on SWIFT environments. SWIFT published in 2018 and again in 2019, a strict cyber security control requirements to be applied on its global network by all members.

A very large bank deployed Audity on its SWIFT environment to control real time activity of users on both SWIFT and SWIFT connected systems. The goal was to reverse engineer users activity and privileged users operations across all sensitive SWIFT applications.

Within days the Bank identified local users activity left by developers on production environment. By comparing the list of active users to the user list in the bank policies, AD, CyberArk system indicated that these users activity present a very high cyber risk, blocked the local users and fixed the breach. Audity now monitor all user activity and help to reverse engineer users policy from real audit data analytics.

As a result, XPLG Audity and Surecomp partnered to provide built-in audit and control solutions for Surecomp SWIFT integrated trade finance products to help monitor, control and audit privilege user activity.

Questions to the Panel of Speakers
Closing Remarks from the Conference Chair
Conference Closes

Please note:
Whitehall Media reserve the right to change the programme without prior notice.