Forrester

For Security & Risk Professionals

Client Inquiry:How Retailers Handle Login Expiration Time

How do retailer websites handle login expiration? Is it session-based, login-persisted, 30-day cookie, and so on? What is the norm or best practice?

For Security & Risk Professionals

Report:Work With Marketing Pros To Prevent Breaches

How To Protect Your Email Data

In facing security woes such as the Epsilon breach, email marketing professionals have received a wake-up call: Security failures can cost a lot — not just a lot of money but also goodwill with...

• Downloads: 168

For Security & Risk Professionals

Client Inquiry:What Are Our Options For Secure Access Solutions For A Web Interface?

We're looking for secure access solutions for a web interface that will enable some sort of strong authentication but doesn't use a two-factor password token. We're thinking of solutions that allow a...

For Security & Risk Professionals

Blog:Participating In Markets For Portable Identities In The Cloud: What’s The Coin Of Your Realm?

Many IT security pros are moving toward disruptive new authentication and authorization practices to integrate securely with cloud apps at scale. If you’re considering such a move yourself,...

For Security & Risk Professionals

Client Inquiry:What Are The E-Signature Authentication Methods And Mechanisms, And Who Are The Providers?

Our employees are being asked to electronically sign documents from outside our organization. We want to educate these employees on various aspects of the e-signature process. One area is...

For Security & Risk Professionals

Blog:Protecting Internal APIs — Is OAuth Ready For Its Closeup?

Two years ago, the OAuth API protection mechanism was a fairly well-kept secret. It actually won an award at the 2009 European Identity Conference for "best new/improved standard," but most people...

For Security & Risk Professionals

Report:Navigate The Future Of Identity And Access Management

Future Look: The Identity And Access Management Playbook

This report outlines the future look of Forrester's solution for security and risk (S&R) executives working on building an identity and access management strategy for the extended enterprise. We...

• Downloads: 1402
• Rating:

For Security & Risk Professionals

Blog:Two-Step Verification Will End Consensual Impersonation

  A couple of months back, I advocated killing your password policies and applying some other techniques instead to make existing use of passwords more effective (including my hobby horse: take...

For Security & Risk Professionals

Blog:A New Venn Of Access Control For The API Economy

Cloud providers and many federated IAM practitioners are excited about OAuth, a new(ish) security technology on the scene. I’ve written about OAuth in Protecting Enterprise APIs With A Light...

For Security & Risk Professionals

Report:TechRadar™ For Security Pros: Zero Trust Identity Standards, Q3 2012

Road Map: The Identity And Access Management Playbook

This report outlines Forrester's solution to help security and risk (S&R) leaders develop their road map of IAM processes using Forrester's TechRadar™ methodology. The extended enterprise...

• Downloads: 454
• Rating:

For Security & Risk Professionals

Report:Understanding Simple Cloud Identity Management

With The SCIM Specifications, User Provisioning Goes "Zero Trust"

Business owners are jumping on SaaS services to get quicker wins, and CIOs are finding these services attractive for cutting costs as well. Since it's relatively quick and easy to hook up these...

• Downloads: 778

For Security & Risk Professionals

Blog:Fast Cloud Identity Provisioning

Back in July, I wrote about a new RESTful API that cloud providers and provisioning vendors are working on for doing identity provisioning and synching: Simple Cloud Identity Management, or SCIM...

For Security & Risk Professionals

Blog:Cloud-Native Identity Management Is Suddenly Looking Like A Winner

  Doing access management with the help of cloud-based services is a pretty comfortable proposition by now. For more than a decade, we've been doing federated single sign-on to and from apps...

For Security & Risk Professionals

Blog:Make A Resolution: Kill Your P@55W0rD Policies

It has finally become hip not just to predict the demise of passwords, but to call for their elimination. The recent Wired article makes an eloquent case about the vulnerabilities that even...

For Security & Risk Professionals

Report:Identify And Influence Identity Stakeholders

Stakeholder Needs: The Identity And Access Management Playbook

This report outlines the stakeholder needs of the Identity And Access Management playbook. Forrester has identified lack of IT executive buy-in and attention as a chronic issue in projects related to...

• Downloads: 376

For Security & Risk Professionals

Report:The "Venn" Of Federated Identity

Portable Identity Gives New Options To Companies, Consumers, And Clouds

Fast-moving cloud and consumer identity trends are driving shifts in how IT professionals control user access and provide personalized service to networked applications. As IT professionals move to...

• Downloads: 963
• Comments: 1

For Security & Risk Professionals

Blog:CardSpace Is Dead. Long Live Back-Channel Access.

Microsoft announced during last week's RSA conference that it would not be shipping Windows CardSpace 2.0. A lot of design imperatives weighed on that one deliverable: security, privacy,...

For Security & Risk Professionals

Blog:What The White House Cybersecurity Proposal Means: Don't Miss Jonathan Penn's Take

If you're in the habit of checking out only the Security & Risk Professionals blog, you might have missed Jonathan's takeaways over on the Vendor Strategy side: What The New White House...

For Security & Risk Professionals

Tool:Maximum Potential Impacts For Each Assurance Level

For Security & Risk Professionals

Client Inquiry:Examples Of Personally Identifiable Information

Q

For Security & Risk Professionals

Client Inquiry:Best Practices In Single Sign-On For eCommerce Sites

We would like to discuss single sign-on and OAuth (like Facebook Connect) for an eCommerce site that has a public user base of roughly 10 million. What are the pros and cons of out-of-box solutions...

For Security & Risk Professionals

Report:Forrester's Data Privacy Heat Map Supplement

To help security and risk professionals navigate the complex landscape of privacy laws around the world, Forrester created a data privacy heat map that highlights the data protection guidelines and...

• Downloads: 78
• Rating:

For Application Development & Delivery Professionals

Report:The Forrester Wave™: API Management Platforms, Q1 2013

Layer 7 And WSO2 Lead This Emerging Field

In Forrester's 15-criteria evaluation of application programming interface (API) management platform vendors, Layer 7 and WSO2 — and their solutions — rose to the top, followed by Intel,...

• Downloads: 522
• Rating:

For Security & Risk Professionals

Report:API Management For Security Pros

Security professionals increasingly must respond to the needs of business owners exploring web application programming interfaces (APIs) as a new channel for recognizing business value. APIs can...

• Downloads: 129

For Security & Risk Professionals

Report:Evolve Your Identity Strategy For The Extended Enterprise

Executive Overview: The Identity And Access Management Playbook

The rapid adoption of mobile devices and cloud services, together with a multitude of new partnerships and customer-facing applications, has "extended" the identity boundary of today's enterprise....

• Downloads: 478