Access Mgm't That Runs On Schedule

Burlington Northern Santa Fe Corp.'s stated goal is to reduce the amount of time it takes to set up user accounts from two days to just minutes.

The railroad realizes, however, that the faster pace won't mean anything if other standards are compromised. So the company sought tools that can manage accounts and access privileges securely and transparently--while keeping up speed.

The railroad had tools in place to address its back-end systems. What it lacked was comprehensive management of its Web applications, said Rick Perry, director of enterprise operations and security.

Burlington Northern turned to Waveset Technologies, a start-up run by former Tivoli Systems executives. Waveset next week will enter the crowded access management market with an application suite, Lighthouse, which offers a more holistic approach to identity and access management than current point products, users and analysts said. Lighthouse provides functions for identity management, self-service resetting of forgotten passwords, tracking dormant accounts and single sign-on to various Web applications. These functions are normally offered piecemeal, said Mark McClain, Waveset's president and cofounder.

Lighthouse helps Burlington Northern automate the setup and management of accounts for its 45,000 employees and maintain service metrics as it increasingly serves customers and partners over the Web.

A key element of Lighthouse is the Virtual Identity Manager. Access control systems generally maintain a database in which user information is replicated for distribution to each of the other platforms that need it. This parallel data needs to be synchronized. Waveset avoids this by using "pointers" to indicate where a particular piece of data was initially stored and is still housed.

IT managers only have to install one resource adapter--the device that collects user information--in each system. So, for example, they don't have to put software on each Windows NT server and instead tap only a single server in the domain. "That simplified their footprint in our environment, making it much easier to support," said Cherry Hanneman, Burlington Northern's manager of enterprise security.

Established vendors of access management, account management and user provisioning are partnering to offer the across-the-board services Waveset promises. Last month Access360, a user-provisioning software vendor, and Netegrity, a provider of access control software for e-businesses, announced plans to integrate products. Another provisioning vendor, Business Layers, has strategic relationships with BMC Software, Netegrity and Securant.

The partnerships force users to link products themselves. What's needed is an integrated one-stop suite, said Bob Lonadier, director of security strategies at IT consultancy The Hurwitz Group.

Lighthouse, available now, starts at $100,000.