computerwoche.de

Archiv

Reality Check: Easing the burden of SaaS

05.12.2006
Of all the issues IT will deal with in 2007, from maintaining regulatory compliance to building out SOAs, SaaS (software as a service) could quickly become the new focus of IT. In fact, forget about SaaS vendors' claims that the SaaS model eliminates the need for significant IT oversight; the opposite is actually closer to the truth.

As SaaS enters the mainstream, either by way of pure-play SaaS players such as Salesforce.com or by way of Microsoft, Oracle, or SAP offerings, one critical challenge must be addressed. And that challenge is access and how to manage it, says David Thomas, executive director of the Software and Information Industry Association (SIIA). Fortunately, Thomas says, companies are working behind closed doors to solve the problem. But as is often the case with closed doors, Thomas is not at liberty to talk about the projects or their progress.

I found that Aladdin Knowledge Systems is one of those companies working in stealth mode on SaaS access management. I spoke with Benny Shavi, director of business development at the Tel Aviv, Israel-based company, about the challenges Aladdin and other companies are trying to solve to help make SaaS an enterprise-worthy alternative.

Suppose your company has a payroll of 5,000 or more employees divided into 10 departments and each department uses between four and 10 SaaS applications. IT is dealing with, at the low end, 40 hosting organizations to make sure every user can access SaaS apps at any time from anywhere on any device.

The question is, How will authorization and authentication be handled when a new employee comes on board or an employee is terminated? How do you know that a former employee has been removed from all those systems? How are the passwords managed? Add to this the fact that many SaaS applications are coming in through the back door, department by department, and it's easy to see how managing SaaS access can quickly become an IT nightmare.

HASP (Hardware Against Software Piracy) ID, which Aladdin will make available in the first quarter of 2007, is a firmware token on a USB key fob or smart card with software built around it on the back end. That software can be customized and linked to what Shavi calls Shadow Domain technology. The Shadow Domain feature uses the identical system as LDAP or Microsoft Active Directory, but it is standing in another domain, Shavi says.