Oracle takes on cloud security with Identity Cloud Service

Oracle has begun a big push into cloud security with the local launch of its Identity Cloud Service.

The Oracle Identity Cloud Service is a cloud-native security and identity management platform which integrates with other cloud applications to manage user identities for both cloud and on-premises applications.

The launch heralds the start of a big push into new security services for Oracle as it seeks to capitalise on the changing face of security.

Andy Smith, Oracle senior director of product management, says the old network-centric view of security, with traditional network perimeter solutions such as network firewalls and intrusion prevention and detection, is 'no longer relevant' in a world of mobile access and cloud.

"With the advent of cloud you have users going directly to cloud services from a personal mobile device for example, and not even touching the network anymore, and not going through the network security," Smith says.

He says Oracle believes the future is identity-centric security – or to use the Gartner term, people-centric.

"Being able to tie activity to an identity is really the only thing you can start to cross-correlate across all these services, what device they're coming from. Tying that identity to an endpoint, to a resource and what activity they are doing.

Smith says Oracle's entry into the market is timed to capitalise on the change.

"All the traditional network-centric guys are trying to make this transition to new cloud security solutions and it's the perfect opportunity for Oracle to enter the security space because of the disruption going on.

He says heightened awareness of breaches is driving demand for detective controls in addition to the preventive controls.

"Any security practitioner knows it's not if you're going to get breached, but when. So it's how quickly you can detect and respond.

"We're promoting a model of being able to discover the vulnerabilities you have, being able to add preventive controls to secure and monitoring controls to detect, and add automated response to be able to quickly respond and mitigate those breaches.

Smith says Oracle will bring new cloud security solutions together to cover the discover, secure, monitor and respond sections.

The company's recent acquisition of cloud protection service provider Palerra will provide the company with the detective controls element.

Palerra, which is a cloud access security broker (CASB), monitors users behaviour inside SaaS applications, looking for risky behaviour. The offering will integrate with Oracle's Identity Cloud Service for enforcement purposes.

"So if I see some risky behaviour in SalesForce for example, I could require the user to do two-factor authentication the next time they go in, or terminate their session.

"The interesting thing is having these cloud services working together.

Smith says he believes ultimately it will be 'the big cloud service providers – Microsoft, Oracle and Google' – who offer centralised security across cloud, with customers purchasing the security services as an add-on to SaaS applications.

"You come because you want Office 365 from Microsoft, the Oracle sales cloud. Your identities are going to be in Azure, in the Oracle public cloud, in Google. And one of these cloud service providers is going to be the one offering that centralised security across cloud.

For Oracle the launch also heralds a move into new markets.

"All of these cloud services and identity cloud service in particular, go after a new target for Oracle," Smith says.

"We do a lot of selling direct to the large enterprise customers in the ANZ market, but the new cloud services are a lot easier to consume and you don't need all the implementation etc.

"So it allows us to go after an SMB customer base, through the channel to get there. So it really opens up a new opportunity for us and new channel partners to offer these new services.

Channel-side

With that in mind, Smith says the launch opens up new opportunties for the reseller channel – and the need for new partners who can target the SMB market.

Oracle partners can buy the offering from Oracle on behalf of the customer, or can operate it as a managed service.

Smith says for resellers, Identity Cloud Services will be an easy add-on to other cloud sales.

"A customer signs up for Office 365, they also have SalesForce, they may have an Oracle application or two and they want a single sign on to all those.

"That could be a medium or even a small customer with a couple of cloud services, but they want to centralise their cloud management.

"Where in the past is was a bunch of implementation and things to install Oracle software, now they can buy a service from their favourite channel partner and they don't have to do any of that implementation and set up.

He says while partners won't be making money off implementation services with the new offerings, there is still money to be made.

"We're seeing partners shift to either doing managed services, or adding actual integrations and value added components on top of our cloud services.

The vendor has a cloud marketplace for partners' value added integrations, designed to make those partner services discoverable by customers.

"It's basically a lead capture for our partners. Eventually we'd like to make it into more of an app store where customers can buy directly from partners from the cloud marketplace.