2020 Research Themes
Enabling the Digital Enterprise
Launching an ambitious strategy, building a flexible business model and having the right supporting foundation are all essential parts in building and maintaining a successful Digital Enterprise. Organizations need fast execution while carefully managing risk.
The tasks facing managers are both difficult and dangerous; especially for large enterprises with substantive bases of legacy systems and services. As with a crew repeatedly rebuilding and maintaining an airplane in mid-flight, enterprises must execute on their company’s digital transformation program while simultaneously managing their current business.
Early in the journey, the question is typically where to start – which products, services or experiences are most at risk? Later, the questions center on the next phase of the journey, namely, how to make the most of the new technologies and capabilities that are being evaluated or deployed. Finally, building critical mass for this new Digital Enterprise requires thoughtful orchestration of and engagement with internal and external stakeholders.
Securely supporting, scaling and enabling the Digital Enterprise is the foundation for our 2020 research agenda. With Digital thrust upon the world as we deal with COVID-19, this theme is even more impactful, visible and relevant. We’ll now look at core 2020 research themes:
Identity and Access Management (IAM) for the Digital Enterprise
Identity and Access Management needs to evolve to both support the Digital Enterprise and to also be the glue to maintain and govern the legacy world as organizations expand their reach. IAM is the single most important element of the new Digital Enterprise or Digital Transformation program. The scale, relationships, regulatory controls, expansion of objects (like IoT)…necessary for the new Digital Enterprise will require new and improved IAM services. “You can’t govern and secure what you can’t explicitly identify”.
Key areas of coverage include updated IAM reference architectures and extending our IAM reach to include customers, “things”, processes and managing this via improved governance technologies and organizational approaches. We start with the premise that physical perimeters are no longer sufficient as a control plane. With devices and identities increasingly owned by employees/customers, new development models (cloud/microservices) and privacy controls changing the landscape, Identity Management needs to be the new security foundation. This will be a major area of emphasis for TechVision in 2020 as modern/flexible Identity Services are needed to support security, innovation and our new Digital Enterprise.
“Zero Friction/Zero Trust” Security
Security is more important than ever, but not at the expense of customer engagement. Zero Trust was amongst the biggest buzzwords of 2019 and in 2020 and we are expanding this concept to include what TechVision calls “Zero Friction/Zero Trust” security. The Digital Enterprise is all about engagement and cumbersome security measures are counter to this goal. This theme is about achieving a balance; enterprises need robust security, but they also need to pay attention to the user experience. Core to this theme is our zero trust / zero friction posture and overarching reference architecture and strategy supporting the approach. Key areas of focus include:
- Visibility and analytics – Applying AI and Machine Learning to Security
- Automation and orchestration – Automate data gathering, security alert and transaction execution, analytics to provide organizations the ability to implement comprehensive defense-in-depth capabilities based on contextual data and a robust IAM foundation.
- Developing an Enterprise Zero Friction/Zero Trust Security Program, Strategy and Reference Architecture.
Understanding and Applying Emerging Technologies
Emerging and disruptive technologies create massive opportunities but create inefficiency and risk. TechVision will help organizations assess how and when to leverage disruptive, emerging and new technologies. These “disruptors” include categories such as Blockchain, AI/ML, new Internet trust models, IoT, new development approaches and other emerging game-changing technology enterprises should at least have on their radar. Some of these technologies will be applied to specific areas such as Decentralized Identity using Blockchain, the use of AI/ML in achieving “frictionless security” and how DevOps/Microservices/APIs are changing development and opening up business opportunities.
Building an Enterprise Innovation Capability
This will build off our work in 2019 establishing our Innovation Reference Architecture. In 2020 we’ll look at the products, services, approaches and organizational models that will help organizations achieve more sustainable and business-relevant innovation. Building out innovation isn’t just about disruption; it is having a business and technical foundation to enable and broadly systematize innovation.
2020 Research Agenda
Our 2020 Research agenda is enterprise focused, pragmatic and integrates TechVision’s consulting experience and in-depth research/analysis. While this is our current 2020 research plan, we will iterate going forward based on changes in technology, the markets, user requirements and input from our clients. Planned and published reports in 2020 include:
The Future of Identity Management 2020-2025 (Published Q1)
This is an updated version of a report we have produced annually since 2015. This includes TechVision’s Top 12 list of IAM areas of enterprise investment consideration over the next few years based on key future-state requirements, business needs and technology directions. The future of IAM will be driven by the needs of the Digital Enterprise and will have a major impact on key security and identity services.
Graph Databases and Scaling Identity Services (Published Q1)
This report starts by looking at what graph databases are and then evaluates whether this approach has long-term merit as a solid database foundation for IAM solutions in general and enterprise directories in particular. Scaling identity services is critical as organizations extend their reach and we’ll evaluate how graph databases and other approaches can be leveraged in better ways to meet those scaling requirements.
Preparing for CCPA, GDPR and new Data Protection Regulations (Published Q1)
This report looks to demystify the most significant privacy and data protection legislation and to highlight the most essential and challenging requirements. We’ll start with an overview of the current and upcoming privacy regulations and then focus on the California Consumer Protection Act (CCPA) to develop an understanding of the breath, scope and depth of what is involved to be in compliance with the California act.
Can the Industry get to Zero Passwords? (Published Q1)
Distributed Identity, “password-less” authentication and other approaches to reducing or eliminating passwords continue to resonate with individuals and enterprises. 50% of help desk tickets and customer issues are password related. Managing 100s of passwords has gotten out of control, and most of the time when accounts are hacked, they are not guessing your password. This report will objectively assess where the industry is, where it is going, where it should be going and how enterprises should prepare for a Zero or at least a reduced password world.
Integration of Physical and Logical Access Control Systems (Published Q2)
Physical access control systems (PACS) are becoming more integrated with Logical Access Control Systems (LACS) via Identity and Access Management (IAM) deployments. Convergence of PACS and LACS instills harmony between the physical identities of the carbon-based world with the IT-centric, logical representation of everyone and everything in the emerging Digital Enterprise. The current state, expected future state, and specific end-user recommendations are included in this report.
A Modern IT Governance Framework (Published Q2)
The Digital Enterprise requires careful attention to governance. This includes supporting technology, but more importantly how decisions are made, changes are implemented and how this new Digital Foundation is managed. This governance framework includes data governance, identity governance and an overall IT governance foundation for enterprises.
The Path to SD-WAN (Published Q2)
Software Defined Wide Area Networking (SD-WAN) is an application of Software-Defined Networking applied to WAN connectivity. This report will describe how to design and select an SD-WAN solution and leverage experience from recently designing a solution for a large health care provider.
Digital Trust (Published Q2)
The Digital Enterprise will push the limits of Trust and vendors and service providers need to address this fundamental challenge with increased urgency. The Internet was built without a trust layer and this report examines current and future state of scaling trust as the demands and risk increase as organizations become Digital Enterprises. Concepts such as trust frameworks, Trust over IP, the Web of Trust, verifiable claims, self-sovereign identity and initiatives such as Tim Berner Lee’s Inrupt initiative will be possible vehicles to provide consistent, scalable and user-friendly trust.
Business Data; The Foundation for the Digital Enterprise (Published Q2/Early Q3)
This report is designed to help organizations build a solid data foundation so critical in building and maintaining your Digital Enterprise. Getting the data right is an area that is often ignored or overlooked, but we believe this is one of the most important areas any large enterprise focus on. This report describes an approach enterprises can take to “get data right” as they embark upon becoming a Digital Enterprise.
Customer IAM (Expected Q3)
Customer IAM (CIAM) provides a gateway to the customer and is one of the most important elements of any Digital Transformation program. CIAM is often the first “touch point” an organization has with a prospect and is an on-going reflection of a brand. Get CIAM right and you will attract customers, drive revenue and represent your organization in the best light; get it wrong and your business will suffer.
In this report, we provide a foundation for enterprises looking to build an IAM foundation to support the engagement of customers, prospective customers and external stakeholders in the context of business goals. We’ll also release our updated vendor short list as this market has substantially changed over the past few years.
Zero Knowledge Authorization and Authentication (Expected Q3)
This report will investigate interactive methods and approaches for a party to prove to another party (the verifier) that it knows the user and can authenticate and authorize them, without revealing anything about the user. Zero knowledge solutions will become another hot area in the “Zero” security market. Banks, retailers, and other digital companies want to be able to interact with prospects and customers in a secure way while also allowing them to control their privacy.
JIT Authorization (Expected Q3)
This report describes Just in Time (JIT) authorization, BYOI (how do we instantly offer access at acceptable risk levels) and how Just in Time IAM will be used to make streamlined, real-time authorization decisions. Microsoft and others are putting major stakes in the ground in this area. We’ll examine the technology, the vendor landscape, and make recommendations on the way forward.
Architecting, Designing and Implementing an Enterprise API program (Expected Q3)
This is a follow-up document to our report in late 2019 on managing and securing APIs. In this report we’ll look at this in the context of the Digital Enterprise and provide a deeper level of details with respect to the design, implementation and execution of your API program.
Innovation; Matching Methods to Outcomes (Expected Q3)
This report will describe the various tools and techniques that are used to deliver innovative solutions and will provide guidance as to which tools to use when trying to realize particular outcomes such as a new or improved product, business model, or service.
Identity Governance and Administration (IGA) for the New Digital Enterprise (Expected Q3/Q4)
Organizations embracing digital transformation are taking a hard look at Identity Governance and Administration (IGA) programs. Enterprises need a consistent framework for operationally managing and governing their rapidly expanding digital ecosystem and IGA is an important piece. At its core, the goal behind IGA is simple: Ensuring appropriate access, when and where it is needed. IGA combines entitlement discovery, decision-making processes, access review and certification with identity lifecycle and role management.
In this report, we will describe a target state for IGA in the enterprise and a path towards getting there. As part of the path forward, we include our IGA vendor short-list to give our clients a starting point in evaluating provider solutions in this space.
Developing a Zero Trust/Zero Friction Security Program and Reference Architecture (Expected Q3/Q4)
This document will help enterprises define and architect a Zero security framework addressing the five pillars of device trust, user trust, transport trust, application trust, and data trust. This research will set up the overall reference architecture for a Zero security strategy and leverage the frameworks such as NIST, COBIT, HITRUST CSF, ISO/IEC, and others. Note we may break this into two reports; the first describing the strategy and approach to Zero Trust/Zero Friction Security and the second providing the TechVision Reference Architecture.
Digital Enterprise Level-Set and Reference Architecture (Expected Q3-Q4)
The new Digital Enterprise ties in with virtually every piece of our research as this is the journey enterprises are now taking. Note we don’t call it Digital Transformation in that this isn’t an end point (“we’ve transformed”), it is simply the way enterprises conduct business. This means we need to include the business stakeholders more directly than ever and ensure the technology direction and business goals are aligned. This report will better define and help organizations architect the Digital Enterprise with a reference architecture, strategy recommendations, tactical recommendations and a high-level roadmap.
Network Strategies for Blockchain (Expected Q3-Q4)
As organizations start deploying blockchain, they must ensure their network can support the bandwidth and latency requirements globally. Blockchain works well in controlled lab and pilot environments, but many early adopters find the performance when rolled out into production fails to meet business expectations. This report will highlight areas of concern and possible approaches to mitigate risks.
The Digital Future State (Expected Q3-Q4)
TechVision will describe our take on the future Digital Universe that combines thinking from our Digital Enterprise research, our enterprise Innovation work and our consideration of a new Internet trust layer (further covered in our Digital Trust report) and the Semantic Web. We’ll include models such as Tim Berners-Lee’s Inrupt/Solid programs which rethink how web applications store and share personal data, new agent-based models, the impact of AI/ML and other emerging technologies on future-state digital programs.
Developing a Global Privacy Program (Expected Q3-Q4)
Privacy and data protection are escalating in importance as GDPR, CCPA and many other legislative controls are executed globally. In this era of both increased individual concerns about privacy and escalating government penalties, it is time for most organizations to access their privacy program. This report provides a privacy and data protection blueprint.
Zero Trust Networking (Expected Q3-Q4)
This is an updated revision of our 2019 report in this rapidly evolving space. In this report we incorporate the latest thinking including the role of SASE (Secure Access Service Edge) in support of Zero Trust Networking (ZTN). We see rapid progression as networking (including routing) is merging with security (firewalls) to become a single, modular solution. Security is being elevated as the number one driver for network architectures over and above reliability, performance, and cost considerations.
GDPR; 2020-2021 Level Set (Expected Q3-Q4)
TechVision Research provided a level-set report on the General Data Protection Regulation (GDPR) to help enterprises prepare in advance of enforcement date and we’ll now provide an update a few years later. This paper will focus on the current state of GDPR, enterprise strategy recommendations, tactical steps to take and how to factor GDPR into your enterprise privacy and data protection program.
Proactively Addressing the Security Talent Gap (Expected Q3-Q4)
There is a massive global shortage of cybersecurity professionals; and it is even more daunting with the high demand for newer skill sets in areas like SecDevOps, cloud and hybrid security, the use of AI/ML and security frameworks. This report will outline the ways many enterprises are coping with this issue and suggest approaches to get ahead of the security talent gap.
Applying Artificial Intelligence (AI) and Machine Learning (ML) to Security (Expected Q3-Q4)
Consumers and employees want security that isn’t invasive or cumbersome. The use of big data analytics, AI and ML provide a path towards more proactive security that “may” be less burdensome for the users. Virtually every security vendor claims to be leveraging AI, but all applications of AI and ML are not created equal. We’ll describe the approaches, enterprise recommendations and key vendor offerings in this report.
Enterprise Security Framework (Expected Q3-Q4)
This foundational security report will describe how enterprises can systematically approach risk management with documented, agreed-to and understood policies, procedures, and processes that define how information is consistently managed and decisions are made in an organization. The end goal is to, of course decrease risks and security vulnerabilities while increasing confidence internally and externally in the enterprise security posture.
AI and ML; Turning Big Data into Useful Analytics (Expected Q3-Q4)
As IoT devices, customer outreach, social networks, and marketing programs continue to collect massive amounts of data, enterprises will need to leverage Artificial Intelligence, Machine Learning and advanced analytics to turn this data into insights and useful information for the enterprise while maintaining compliance with privacy regulations. This report will examine this space and help enterprises prepare for dealing with the massive amounts of collected data.
Containerization (Expected Q3-Q4)
Containerization is a primary means of efficiently implementing DevOps. This report will provide a level set on Containerization and describe Kubernetes, an approach to container orchestration, and Dockers, the leading open source container. We’ll provide specific enterprise tactical recommendations and strategic considerations.
Developing an Enterprise Blockchain Strategy (Expected Q3-Q4)
TechVision Research has published a variety of research reports that cover Blockchain over the past 4 years, but the massive investments by both vendors and organizations is helping to propel many use cases from experimentation to production—but this varies by the industry, use case, business needs/problems being solved and the maturity of not only Blockchain, but the supporting infrastructure, ecosystems and cultural adaptation. This report will describe key areas of progress and provide a context to help organizations solidify their 2020-2021 plans in this area.
Enterprise Journey to the Cloud (Expected Q3-Q4)
This report will describe and provide a framework for enterprises that are moving from a primarily on-premise IT world to the cloud. This report will include end-user survey data, TechVision’s best practices recommendations, an assessment of the major cloud providers, security considerations and provide hybrid cloud recommendations and considerations.
Master Naming Schemas (Expected Q3-Q4)
Most products, services, applications and means of identifying and securing data and resources have unique naming conventions. Simplifying security policies by creating a common naming schema across the entire OSI stack – to include networks, services, directories, applications, and metadata. This can be critical to achieving more seamless, consistent communication and collaboration.
Reputation Systems (Expected Q3-Q4)
This is an increasingly important area as we extend connections and relationships. Reputation is an element of many systems and services, but we need to better understand how it works, how it can be leveraged by the enterprise and how reputation systems will evolve.
The Future of Work; Social meets the Digital Enterprise (Expected Q 3-Q4)
This report describes key aspects of the future-state work environment and how technology and new social approaches can redefine how work can cost effectively and efficiently support enterprises going forward. This is part technology, part social/cultural and certainly will impact large organizations in substantive ways.