Midrange Stuff, OS/400 Edition

Application provisioning is often overlooked in the lifecycle of an application. Much is said about developing, using, and eventually migrating a "legacy" application, but the process of signing up new users is not glamorous. However, when a company has numerous systems, each with different ways of managing users, provisioning can become overly complicated. SafeStone Technologies seeks to remove this complexity with AxcessIT Provisioning Manager, which the company just relaunched with a new Java-based universal adapter.

SafeStone, based in the United Kingdom, officially relaunched its two-pronged AxcessIT product line several weeks ago at InfoSecurity Europe 2003, where a man suspected of being the notorious hacker Fluffi Bunni was arrested by Scotland Yard. AxcessIT has been in the final stages of development for over a year, and it has been deployed in several pilot projects, according to a company official. But it wasn't until this release, AxcessIT 2.2, that SafeStone has felt comfortable saying the product is good to go, the official says.

AxcessIT is composed of two products. Provisioning Manager gives new users access to applications and authority to delete old accounts across a variety of platforms. Password Manager provides password reset and synchronization capabilities across the same range of platforms. The two modules can be deployed together or separately, and they use the same underlying code and architecture.

AxcessIT supports native access to OS/400, Windows NT/2000, and Solaris operating systems. With Version 2.2, the company has rolled out a new "universal adapter," which provides users with a general template for supporting applications running on other platforms that support Java, including applications written in-house and applications written for proprietary platforms. SafeStone says it's not difficult to use the universal adapter to integrate AxcessIT with a line of business applications. If a user is not comfortable doing the work himself, SafeStone can do it, or recommend a third party.

SafeStone says both AxcessIT products make companies more efficient by enabling users and supervisors to complete certain business processes that previously required additional help from IT staff. The self-service password reset feature can eliminate an enormous expense. Numerous studies show password reset costs can range from $15 to $30 or more per reset. Traditional account provisioning is also a fairly manual process, involving paperwork, telephone calls, and walking down the hall to deliver forms. Aberdeen Group did a study last year that found companies pay about $160 per year per employee in account provisioning. Aberdeen's figure included password resets.

In many cases, account provisioning comes down to a piece of paper that must be circulated to the administrators of several different platforms for approval, says Todor Christov, SafeStone's AxcessIT product manager. "People go on holiday and get replaced, and suddenly that process is extended by a few weeks," he says. "It can take three to five weeks to get approval. The bigger the company, the slower it is."

Christov, who joined SafeStone several weeks ago, says AxcessIT Provisioning Manager provides "drag and drop" account provisioning that allows an administrator to define a user's role on the screen, to drag that defined role over a user name, and then that user is granted the access privileges defined by that role. There is no limit to the number of roles that AxcessIT Provisioning Manager can handle, but a practical limit for a manager or a supervisor would be 50 to 150 employees, he says. For very large organizations, the software lets managers delegate the authority to create roles and grant users access to other supervisors. In every case, the software's goal is to "give the power to the people who know and understand the business well, who know what roles to give to whom," Christov says.

SafeStone is working to bring new capabilities to Password Manger and Provisioning Manager in the future, including native support for Linux, HP-UX, AIX, and OS/390. The company is also working with IBM's Enterprise Identity Management initiative, which provides a centralized repository that delivers single sign-on capabilities across platform lines. In November 2002 SafeStone committed to supporting the initiative in a future release of its software. SafeStone is also planning to develop four or five additional modules for the AxcessIT line, and to provide tighter integration between AxcessIT and DetectIT, SafeStone's flagship security suite for OS/400 servers.

AxcessIT Provisioning Manager and Password Manager both run on Windows NT/2000 servers, and they support OS/400 V5R1 and higher and use open standards, such as Java and XML. Pricing for both begins at $15,000, which includes a license for 500 users. For more information, go to www.safestone.com.