Authorized Personnel Only

Every day, it seems, brings another headline about a high-profile information security breach. From department stores to banks to news media organizations, no company appears immune.

Not surprisingly, companies desperate to stay out of the news and away from hefty fines for violating data privacy laws are lavishing money on security, including identity and access management (IAM) solutions. In fact, market researcher IDC, in Framingham, Mass., estimates that IAM revenues will soar to $5.1 billion by 2010, reflecting a burgeoning need to protect sensitive corporate data.

The term “IAM” encompasses a number of different technologies, all of which aim to ensure that users attempting to access data are who they say they are, and have appropriate permissions. Included under the IAM umbrella are single signon applications (which free employees from having to remember different passwords for different applications), access control systems (which verify user identities), and strong authentication management software (which interacts with biometric fingerprint readers and other so-called “strong” authentication devices). Though it’s the largest companies that suffer the most newsworthy data breaches, mounting threats and legal requirements are driving greater need for such solutions among SMBs too.

For IT firms that serve SMBs, this is a good news, bad news story. Bad news because SMBs typically don’t have a CIO who understands the ins and outs of IAM technology—or has the budget to pay for it. Good news because SMBs need a lot of help coping with security problems, and that spells lucrative service opportunities for channel partners. The key, veteran security VARs say, is to sell into verticals where government regulatory requirements present a clear and present need for IAM solutions, such as healthcare and financial services. Complex and expensive, even entry-level IAM systems often come with five-figure price tags. No one is going to buy this stuff unless they have to.