Previous Next

Articles

November 20, 2007

by Elizabeth M. Ferrarini

JonasKarlsson.jpg

 

Ask some executives about their "Second Life experience," and they'll tell you about their plans for retirement. But ask the same question of Dr. Jonas Karlsson, a senior researcher at the Xerox Research Center in Webster, New York, and you'll be mesmerized by his answer. He says, "Second Life brings to life on the Web the virtual worlds created by William Gibson in Neuromancer and  Neal Stephenson in Snow Crash. Similar to multiplayer online games, the Second Life experience, developed and run by Linden Labs, enables people to build a 3D virtual reality community in which everyone creates an identity using an avatar, and interacts with people with more fluid communication, or as if they were living another life."

 

Many companies, such as Xerox and IBM, are looking at both internal and external applications for Second Life. Perhaps the most pervasive applications include employee collaboration, employee training, and product demonstrations.

 

Recently, Karlsson talked with Enterpriseleadership.org about the Second Life research he is doing at Xerox's Research Center, one of  four facilities that comprise the Xerox Innovation Group, which is charted to design Xerox's next generation products, and to test them internally.

 

EL: Given that you are a team leader in the Synthetic Worlds  initiative, why are you fascinated by virtual worlds?

 

JK: I am a computer geek who is enamored by the virtual, immersive environments described by both Gibson and Stevenson. In fact, a lot of terminology that Second Life developers are using comes from these science fiction novels. You can use your imagination to manipulate these environments in ways that you can't do in real life.

 

EL: Can you talk about the evolution of Second Life  technology?

 

JK: At the end of the 1990s, the gaming industry really started to pick up on virtual reality, developing very realistic 3D, multiplayer, role-playing games. Some people now play these games up to 30 hours a week. When you connect people to other people, something really dramatic happens.

 

Second Life provides the same type of environment minus the gaming. Second Life is becoming a platform that allows people to create and to share 3D virtual content with each other.

 

EL: Can you describe your Second Life piece of real estate, called  the Xerox Innovation Island?

 

JK: As part of my Second Life research project, I bought a small island to use for exploration and for others to test their ideas. Right now, it has a research building with meeting rooms and a demonstration space. The rest of the island is still undeveloped.

 

When we did a product launch at Fenway Park in Boston, Massachusetts, we had a parallel event on the island. We built a pavilion with an auditorium and a product display area. We streamed video so that people at Fenway Park could see it. On the island, we had people exploring the product and having a panel discussion with researchers from Xerox PARC, IBM, and other places.

 

EL: What are some of the business applications for Second  Life?

 

JK: Most companies plan to use this technology to communicate with other people. After all, Second Life is a social medium. It provides a more interesting and engaging experience than either the telephone or a Webcast. It's great for bringing together employees in remote locations to see, for example, a product demo. IBM plans to use Second Life to have all new hires participate in a new employee orientation, which will help them to adopt to the IBM culture.

 

Because you know at all times whom is in the Second Life environment, you are free to communicate with anyone and try out new ideas. You can't do this with some collaboration tools.

 

EL: What is the downside to the Second Live experience?

 

JK: At times it becomes difficult to distinguish between things in Second Life, or "inworld," and things outside of Second Life ("out of world"). Once you begin working in your space, you start thinking, "I shouldn't make my job sound like it is not part of the real world." We are trying to come up with other terms to use.

 

EL: Many of the collaboration tools don't require you to create an  avatar. What's the advantage of creating one?

 

JK: My avatar is Point Q. Malaproper. Every Second Life user has to create an account and to create an avatar. The avatar portrays how you want to look to others. People spend a lot of time customizing their avatar.

 

Google documents, Wikis, or blogs don't require an avatar. In some respect, virtual worlds, such as Second Life, are another collaboration tool. When I'm contributing to a Wiki, I don't necessarily know who else is working on it at the same time. In Second Life, you can see everyone's avatar. For example, I can go onto the Xerox Information Island and see people from different parts of Xerox. These are people who I might otherwise have had no contact with.

 

Creating an avatar is the first step in interacting with people. There's a real art in how you communicate in Second Life. You need to have the right tools in order to maintain the company. You need to know what makes for acceptable and understandable communications. One of our other Xerox Innovation Group labs is working on these issues.

 

EL: Who supplies the technology behind Second Life?

 

JK: We contracted with Beta Technologies, a metaverse content developer, to build the Xerox Pavillion on the Xerox Information Island. Metaverse is another term for the 3D virtual world. This company created models for our devices, programming them to do various things when we interacted with them.

 

Linden Labs., based in San Francisco, California, runs Second Life on huge server farms. Every user needs to download a client in order to connect to the environment. The client is available for Windows, Macintosh, and Linux Alpha.

 

EL: Since Linden Labs controls the Second Life environment, what kinds of content and or security problems does that present to a company?

 

JK: That's one of the big problems with Second Life for a company like Xerox. The company firewall will block access to the Linden servers for both security and content reasons. However, many companies are trying to figure out how to provide safe and secure access to their Second Life environment.

 

The good new is that Linden Labs has announced an Open Source server, which will enable companies to run their own Second Life server behind the company firewall. This will make everyone happy.

 

EL: What is the competition like for Second Life  products?

 

JK: We're starting to see new competitors every day. For example, Sun Microsystems has announced a platform that will enable companies to build and to host a virtual environment on a server. This platform is based on two of Sun's gaming platforms.

 

There are other systems and platforms on the horizon. The main difference right now is the ease of use. Some systems require you to be an expert in 3D creation tools. If you want to succeed in the Second Life space, you need to make it easy for users to create 3D content.

 

--

 

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

| More
784 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

PeterDrucker.jpg For 16 months before  his death, Elizabeth Haas Edersheim was given unprecedented access to Peter Drucker, widely regarded as the father of modern management. At Drucker's request, Edersheim, a former partner at McKinsey & Company, spoke with him about the development of modern business throughout his life, andI how it continues to grow and change at an ever-increasing rate. Edersheim's book, The Definite Drucker -- Challenges for Tomorrow's  Executives - Final Advice from the Father of Modern Management, captures his visionary management concepts, applies them to the key business risks and opportunities of the coming decades, and imparts his views on current business practices, economic changes, and trends.

 

Enterpriseleadership.org recently sat down with Edersheim to discuss how Peter Drucker might have responded to questions about technology, innovation, and C-level executives. She speaks from the point of view of having read and re-read Drucker's books and spending many hours interviewing him. She says, "He would often surprise everyone with his thinking."

 

EL: Peter Drucker believed that leaders must focus on people, especially what influence the CEO has on his/her people. Some great CEOs, such as Steve Jobs of Apple and Larry Ellison of Oracle, are known to be hard on their employees. What would do you think Peter Drucker would have said about tough CEOs?

 

EE: First of all, the CEO is an American invention modeled after the president of the U.S. There's no comparable thing elsewhere in the world, except the export of the American CEO. In Europe, several senior executives come together as a collaborative team. Each executive reports to a board.

 

The CEO's role is to provide strategic moral and human leadership with the right balance. In the US, you have this challenge to both lead and to create collaboration. Some people are more visionary, but don't create collaboration. Often times, their companies will fail when they leave because they haven't a team underneath them. Jack Welch was hard, but he absolutely had a bench. You need to be attracting the right talent for the team. In other words, are you building successors?

 

It's not bad to be tough on people, but you don't want to be abusive. Because you want to build their strengths and to make their weaknesses irrelevant, you don't want to undermine your confidence in them, and their ability to do what they do well.

 

EL: Peter Drucker was definitely an advocate of innovative technology. How do you think he would've viewed the role of chief information officer in a multi-national company? What advice might he have given to someone in this position?

 

EE: He didn't talk about the CIO. He did spend some time on the CFO. He said the CFO was the least knowledgeable person in the company because s/he always looks backwards. In some ways, the CIO has an opportunity to be the forward engine of an organization, but, on the other hand, the CIO can get caught up in chasing down problems too. The CIO has a huge opportunity for making an organization successful. I think Peter might say, "You need to be looking forward always, and executing against yesterday's requirements."

 

EL: How did Peter Drucker feel about formal best practices such as  Six Sigma or Lean?

 

EE: He often talked about what we can learn from others. As far as Lean and Six Sigma go, Peter worked with the two men who came up with the concepts of Lean and Six Sigma --  W. Edwards Deming and Joseph M. Juran. The Japanese loved all three men.

 

Peter felt that if you get too close inside, you only get cost. You really need to be looking outside and linking with customers. Again, you need this balance. Best practices can help you learn. Pushing things so they are better internally is good, but it's not sufficient. You can't loose sight of other critical areas, such are as your customers' needs. How are you providing them with value?

 

EL: Peter Drucker talked about giving employees some autonomy and allowing them to contribute by asking the question, "What can I contribute?" How do you provide information technology workers with autonomy when they work on very well-defined projects?

 

EE: If you step back for a second, the question is really, how can they find ways to contribute? For example, if the end product is very well defined, there has to be a feedback loop. Ideally, they are part of the definition of the end product. Given how much information is embedded in product, services, and what is done, the IT group might not be part of the definition of that requirement. That doesn't work today.

 

Toyota has its engineers find solutions to problems. In 2003, when Toyota was redesigning the Sienna, the engineers in North American drove across highways in the U.S., high crowns in Canada, and dirt roads in Mexico. Engineers observed there is greater distances between cities in the U.S. Americans need to be able to eat in the car, and load the van at Home Depot. Engineers took this information back and provided feedback about what the design needed to be. The Sienna became the number one minivan in 2004.

 

EL: In The Practice of Management, Peter Drucker talks about the importance of regular face-to-face meetings between managers and their employees. How did he view how technology has, in many cases, replaced face-to-face communication?

 

EE: He talked a lot about the impact of technology on face-to-face communications. He was all about community, but he never walked away from discontinuities and new realities. In one of our conversations, Peter remembered how the kids in the 50s, 60s, and 70s used to come out and play every evening. He said that today, if kids come out at all, they usually have their cellphones or Game Boys with them. They play with electronics, not with each other. He was concerned about their ability to have face time.

 

Email is an important change. It can be a great mechanism. If Steven Hawking was born 20 years earlier, he never could've communicated with us. The new communication mechanism lets one be more inclusive to more people in different kinds of ways. On the other hand, face to face is a human way of exhibiting to someone that they have value. It's a huge way of understanding at a different level. You don't want to abuse it. I have sat in plenty of two-hour meetings when nothing got done. Technology facilitates a different kind of connection, but it doesn't replace face to face.

 

EL: What would Peter Drucker have said about whether or not the U.S.  is falling short with its own global leadership?

 

EE: I asked him the same question. He would've said that we aren't the global leader anymore. We're one of many leaders. Our first challenge is to accept our new role. It creates a different kind of mindset. We need to be investing in the needs of tomorrow so we can create opportunities as a country. We need to be the place where entrepreneurs want to be, and where technology wants to come.

 

EL: What role does information technology play in helping a company  carry out its business strategy to stay competitive?

 

EE: Information isn't in the backroom of a company. It's an integral part of what a company is today: it's part of product, the service, and the way we put things together. It lets people and companies link. It's the connector. I can't imagine a strategy that doesn't embrace an information component. Information lets us do so much more.

 

EL: What are some of the ways an organization can promote  innovation?

 

EE: Innovation is a discipline about how we do everything. That needs to be a formal process. There needs to be a manner or mechanism for letting ideas happen, evaluating them, for picking where we are investing, and allocating resources, and not allocating resources to yesterday's problems all the time. It needs to be an exclusive part of what a company is doing.

 

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

| More
678 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

 

If you want to deploy IT for business value, then you'll need to innovate. That's the mantra of Martin Curley, global director of IT innovation for Intel Corporation, and that's the subject of his book, Deploying IT for Business  Value. Curley is responsible for stimulating, supporting, and nurturing the development of new products, services, and methodologies by Intel's 5,000 IT employees. He also oversees the worldwide Intel Innovation Centres, which enable IT employees to work with Fortune 500 customers and government agencies. He sat down with Enterpriseleadership.org recently to talk about how Intel creates an environment for IT innovators.

 

EL: Martin, we've interviewed dozens of IT executives from Fortune 1000 companies -- you're the first global director of IT innovation that we've interviewed. Can you tell us about your role? If we were to visit an Intel innovation center, what would we see?

 

MC: The primary role I have is around stimulating and creating innovation and creating an environment and set of tools to help our IT organization, and folks actually beyond the boundaries of our IT organization, innovate. My organization also does a lot of building prototypes, trying to drive new products and services across the chasm into production at Intel, so our Intel employees and our customers can get more value from IT. I'd almost say, in fact, that there's a new discipline emerging around IT innovation, which is the intersection of information technology as a discipline, and innovation as a discipline.

 

But if you were to walk into one of the innovation centers -- and we have a network of these worldwide now -- they're not very fancy, they're not high-cost, and you would see Intel IT employees working on some disruptive prototypes -- that might be one activity. You might see some innovation training going on, because there are some emerging tools and techniques that people are just starting to become aware of that can significantly increase the yield of innovation. You might see a customer executive workshop going on -- in our Ireland innovation center, we've hosted more than 20 workshops with various European governments around topics like transforming education or healthcare using IT. You'd certainly see a lot of showcases, and a mixture of sort of soft leadership around emerging practices or the latest Intel products and new usage models associated with those products. So, you'd see a mix of activities

 

EL: Are the people staffing your innovation centers full-time staff? Or, if someone in the IT group had an idea, could they submit that and be involved in developing the idea in an innovation center?

 

MC: We have quite a small team, actually, maintaining the infrastructure and creating the environment. There are a number of different mechanisms that enable IT employees who have a good idea to submit that idea. We have a virtual innovation center, and they can submit it there. We have the concept of an innovation assignment; if someone has a particularly good idea, they're able to take time out of their "day job" and work in the innovation center, to bring that idea to fruition. One employee in Sacramento who had a very interesting idea of using our new Viiv technology in the home for remote power monitoring and more efficient use of air conditioning took an assignment, and worked on a project with some of the local utilities there and tried some new algorithms around air conditioning; it looks like it could add significant value.

 

Or, employees have taken an innovation assignment to work on a specific application that would add value to a particular set of Intel engineering.

 

EL: So, they are rewarded for coming up with innovative ideas, and  there's a support environment for this?

 

MC: Exactly. For innovation to prosper, you need to create a "virtuous circle" around it. If you're trying to change a culture to support innovation, you need to have tools and methodologies in place, and you need to have metrics. Andy Grove, one of our founders, often says, if you can't measure it, you can't manage it. So, you need to have different metrics in place. And then you need incentives, to recognize and reward innovators. We'll have some awards for the person who actually discovers and develops an innovation, but we also have one award for an information catalyst, for somebody who was especially effective in creating an environment that enables or fosters innovation.

 

EL: It's fascinating how that happens -- you have the one guy who has the idea, and the other four who helped to make it happen.

 

MC: You've just hit on an important point: Innovation is a team sport. To use the soccer analogy, it's important to recognize the person who provided the assist for scoring the goal. For every one person that has the idea, perhaps there are eight or nine or more people who are needed to get that idea into production, get it into use.

 

EL: You were most recently Intel's director of IT, People,  Intellectual Capital, and Solutions. What exactly did you do?

 

MC: Five or six years ago, we developed a business plan to help transform the Intel IT organization. And one of the gaps that were identified in the plan was that we weren't managing our global people resource in an integrated fashion -- we had four or five thousand employees across 50 different sites. The role of director of IT, People, Intellectual Capital, and Solutions was created to manage our people as an integrated resource, identifying the future core competencies for the organization and putting curricula in place. We also created an intellectual capital program to encourage IT employees to submit and mention disclosures.

 

Because Intel created this new position and initiatives, our IT organization is probably the fastest growing contributor to intellectual property. Four or five years ago, perhaps we might've had one patent issued, and today, we're doubling the number of patents, or the number of invention disclosures, every 18 months. And I think this past quarter, we had more than 200 invention disclosures submitted and more than 20 patents approved from our IT employees.

 

EL: You have a rich environment that really encourages people to innovate, and I can see the relationship to what you did and what you are doing as a direct line. Well, you know Nicholas Carr, and his book, Does IT Matter? One of the points he made in the book is that so many CIOs are stuck in a situation where they're spending 70, 80 percent of their time just keeping the infrastructure running, the lights and phones and the network. And this causes executive management to wonder, well, we could outsource that function, what is it of value do you really provide? From your perspective, what would you say to a CIO trying to get out of that mode?

 

MC: Nick Carr's book promoted a healthy debate within the IT profession in terms of whether IT can add value. I firmly believe that IT can add competitive advantage, and in some cases, competitive necessity, and some of Nick Carr's premises are based around the view of IT as a utility.

 

I think it is very important that a CIO look at the IT value chain and understand where the spend is. I wouldn't contest Nick Carr's point that 70 to 80 percent of the spend is in keeping the lights on, and I think the CIO needs to work really diligently to see how that spend can be reduced. One way would be to deploy new technology; for example, remote management technology. A higher-leverage activity that the CIO could take on is using the concept of design for assembly, which is used extensively in the automobile or consumer electronics industries: As you're designing solutions or cars or whatever, you're designing for the lowest operating costs. So if the CIO can inculcate the strategy that when solutions are developed, they're developed for lowest TCO, that would ultimately help.

 

I think the job of the CIO is to not just to optimize the operation, and make sure service-level commits are met, but to try to take spending out of operations and move it up the value chain into solutions delivery and particularly into innovation. We've seen evidence, some internal and some external, that you'll get a higher return on your dollar if you invest in the innovation space rather than the operations space. There are some role models -- Dell for example, and WalMart -- these are companies where IT really is a competitive advantage, and I think the CIOs there have been really successful in terms of trying to minimize the operations spend and invest in innovations that add value to the business.

 

EL: Let's talk about using IT as a competitive advantage; how do you go about doing that, what are some ideas around that that would be useful to other CIOs?

 

MC: We're starting to see a pattern emerge around IT innovation as a process; we see that there are at least six things that have to be in place for an innovation to be successful. The first one is that there is actually a problem or opportunity that needs to be fixed or to be addressed and someone actually has a vision as to how that can be achieved. One example would be Westminster Wireless City -- the CEO there had a vision of how wireless technology could potentially transform the city of London, but he really didn't know how to bring his vision about. He worked with his own IT department and with some support from one of the Intel innovation centers to build a prototype that eventually ran to a working implementation.

 

But most innovations don't come from "blue-sky thinking"; they come from addressing a specific problem or a potential opportunity. Necessity is the mother of invention, as the saying goes. Typically then, an IT solution has to be associated with fixing a problem or seizing an opportunity, and very often, a business case has to be there. IT went from irrational optimism before the dot.com crash to irrational pessimism, and today there's a modicum of normality coming back to IT investments, but a business case is a prerequisite.

 

And then there are three vectors where the most difficulty are. As IT professionals, we naturally think of technical risk and the IT solutions. But with every IT investment, there's an associated business investment. There may be a business process change that needs to happen, there may be an organizational change that needs to happen, and the last vector is perhaps the most difficult -- very often a customer change is required, or even a societal change. Many of the innovations that are being introduced today are touching many parts of society, and society's willingness and ability to adopt an innovation are really crucial to the innovation being successful.

 

EL: So then the question might be, how do you measure the relative  value of IT innovation to profit?

 

MC: This is something the whole profession has wrestled with. One solution that we find quite effective is what we call the "value dials." We identify the critical business variables at Intel and maintain a list of those, and the monetary value of driving a change in each of them. When we are developing a value proposition for a particular innovation, instead of having a very "wooly" statement -- "This application might improve supply chain flexibility"-- we'll actually hard code into the value proposition that, for example, the goal of this project, which will improve supply chain flexibility, will be to reduce our days of inventory by one day and achieve a one percent market share increase in a particular market.

 

EL: Ah -- put some real teeth into it.

 

MC: Absolutely; and we then know the direct value of reducing the days of inventory by a day, or improving our market share by one percent, and that gives us the numbers that form the business case. And then the IT organization or the project team and the business team work together to do the best they can to realize that result. And by measuring that, we can see if the solution or project actually delivered what it set out to achieve?

 

EL: Does Intel have a budget for IT innovation, or is it parceled out  of everyone else's existing budget?

 

MC: We do have a budget, and just to recognize that innovation happens everywhere, we have a small part of the budget that is centrally managed, and that part of the budget is to help stimulate and capitalize and create an environment for innovation, and also to do research, we have a central research group that is working on some specific agenda. And then the remainder of the innovation budget is split out amongst our various organizations within the IT organization -- innovation is happening everywhere, and what we are trying to do is to do more innovation more effectively and increase the return on innovation by catalyzing and better supporting innovation.

 

EL: Tell us about some of the innovation projects that you've worked  on at Intel.

 

MC: One example of innovation at Intel is of a particular solution under development called Miramar. One of the challenges that companies like Intel face globally is collaborating with employees in different parts of the world and in different time zones. Miramar is an emerging application that we developed to try to provide a solution to that. We have a vision called "better than being there" -- that you could actually have a remote meeting experience that is actually better than physically being in the room with somebody through computer mediation. Miramar is in its early days, but today, we have on employees' desktops we have 3D immersive environments where they can better organize and better locate and better connect information.

 

EL: To what degree does IT organization carry over to the external,  product side?

 

MC: Quite a bit; our primary focus is internal, to help the IT organization be more innovative and develop more solutions, but we see an increasing pull on both sides working with our product divisions to give them ideas and help them build new features into the products, and we have done a lot more work with Intel's customers than we originally would've expected to, with, for example, European governments; we will very often work with our sales team and with your fortune 500 execs on exec workshops looking at specific problems and how an innovative solution might be able to help. There is a significant crossover.

 

EL: Do you see any disruptive innovations that could change IT within the next five years? I'm curious about your views of the use of RFID or WiMax, in particular, are people coming up with ideas on how to use that kind of technology?

 

MC: Yes indeed, and I think the pace of change in terms of new and disruptive technology emergence is happening much faster than any of us could potentially could have conceived of. I'm sure if you held this interview in a year's time, there are things that will be quite commonplace in our vocabulary that we don't know about today. But you mentioned two specifics, RFID and WiMax. Within Intel and the innovation centers, for example, RFID, we've been involved in projects in a hospital in Korea in neonatal care, where the mother and baby have RFID tags to avoid mixups, and in a hospital in Milan, we've been using RFID working with the hospital and a system integrator to make sure that blood transfusions don't get mixed up. So, RFID in some industries is becoming pervasive; some other industries, it's going to take more time for it to proliferate. WiMax is a hugely exciting technology; it really is the classic disruptive technology and moving very fast. I think in a year's time, if you'd have this interview, I think WiMax will start to widely diffuse, with a 10x degree of deployment of WiMax compared to today; certainly, the economics are staggering compared to putting fiber in the ground, but as happen normally with new technologies, you'll get hype. Gartner has that very famous "hype curve." I think there is a hype around WiMax. However we have been trialing it at the Ireland innovation center and innovation center in the UK, and the performance is very good. We're actually using it in production, we have construction going on of a new factory, and many of the suppliers that are working with us are connected via WiMax, and their internet access is very effective and probably a tenth of the cost of a conventional connection, so WiMax is very exciting and is actually very real.

 

EL: Well, Martin, thank you for taking some time to talk with us  today, and talking about your program and your people!

 

--

 

Elizabeth M. Ferrarini is a consultant for the Swive Group, an IT consultancy based in Boston,  Massachusetts.

| More
473 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

NicoleFontayne.gif

 

If you really want to want to see how IT can make a difference in peoples' lives, you may want to think about becoming a public sector CIO. That's what Nicole Fontayne did when she left her post at a major insurance company and became CIO for the City of Detroit. She quickly earned a reputation for not only improving operations, but creating award-winning initiatives.

 

In 1999, Fontayne took a big leap by becoming CIO of Broward County, the second largest county in Florida and the 15th most populous county in the U.S. Her key charter consists of overseeing a technology agency to support the Broward Board of Commissioners' agenda to improve services and to bring new services to 1.6 million citizens. She transformed Broward's once outdated IT services organization into a leading provider of e-government services. Organizations such as Gartner Group, the National Association of Counties, and CIO magazine have recognized Fontayne's ability to translate IT into  business value and into solid return on investment.

 

Recently, Enterpriseleadership.org spoke with Fontayne about her responsibilities as CIO of Broward County. Here's what she had to say:

 

EL: Can you describe how your group is organized and what types of  responsibilities it has?

 

NF: I'm responsible for setting the overall strategic direction for IT in Broward County, Florida. I work with two policy councils to make sure IT aligns with the Board of County Commissioners' goals and objectives.

 

We have a federated IT structure. The central IT organization has 200 people who handle applications development and maintenance, and enterprise systems maintenance. Our core competency focuses on developing small- to medium-size Web applications. We also have about 120 people who work in seven of our 83 agencies.

 

We provide contract support when necessary; our network infrastructure includes all county-wide communications. However, we have a dotted line to overseeing communications for traffic engineering, aviation, and Port Everglades, and we're responsible for ensuring that public meetings are broadcast or Webcast.

 

Our project management office monitors and participates in the legislative arena. We have full responsibility to approve our $24 million operating budget, and we have a $75 million capital budget.

 

EL: What is your governance structure like?

 

NF: The IT policy committee sits at the top. It consists of the CEO, the purpose heads, and the administrator, which is me. I bring policy issues and major initiatives to the group. We meet quarterly to talk about county-wide policies, and we have other meetings about how IT is supporting the business. For example, recent topics have included reviewing IT initiatives for licensing and permitting, and looking at how the Board of County Commissioners can continue to expand its vision for one stop, e-commerce services.

 

Below the IT policy committee, we have several advisory groups. For example, our budget advisory group receives all of the capital IT requests and makes recommendations to the policy council for funding of those requests. We've been using a portfolio that has public outreach, transformation, and then foundation type of projects. That has been very effective. We meet when we first receive the budget requests and then later when we have Board direction for how to spend capital outlay. Next, the IT policy council reviews the recommendations, makes any adjustments, and then funds them without any change once the budget runs through the legislative process.

 

EL: You've spent most of your IT career in the private sector. What are some of the reasons a corporate CIO might want to seek a career in the public sector?

 

NF: You can really see how your work contributes to the community at large, as well as to the local economy. For example, we play a very large role in supporting first responders during an emergency. We have to make sure our disaster recovery and business continuity programs really work. As a result, we can really make a difference.

 

EL: What are some of the challenges of being a public sector  CIO?

 

NF: I'm fortunate to have a very supportive Board that looks for major e-commerce initiatives. We've had consistent budget goals over the years, and if we have any budget reduction, it will be one across the board to reduce the general tax levy.

 

On the other hand, things here can move more slowly than what we've come to enjoy in the private sector. The Board's due diligence at times can go further than necessary, because it has to balance taxes and other public funds. But, this is a large jurisdiction, and I always have a plate full of interesting projects to engage in. So, I don't mind if some projects move a little slower through the political process.

 

EL: When you took the job, what changes did you have to make  immediately to the infrastructure?

 

NF: We began a basic upgrade and replacement of key communications equipment, such as servers. We made sure we had standard systems, and current release levels for all of systems software. Many employees' IT skills had fallen short, causing an uptime problem, so we had to invest in a lot of formal training for them. We also took measures to stabilize the environment. For example, we replaced power supplies that cannot be interrupted in many of our buildings.

 

We needed to establish better disaster recovery plans, and we contracted with SunGard to help us with them. We now have extensive DR plans in IT, as well as in the business. We also put business continuity plans in place. We exercise all of these plans twice a year -- good thing we do. In 2005, Hurricane Wilma hit Broward County very hard. Because we remained operational, we could support many of the cities, as well as support FEMA, the Department of Emergency Management, and others needing to respond to citizens.

 

EL: In 2006, you received a CIO magazine 100 award for your leadership skills. Can you talk about how some of the initiatives you've spearheaded have benefited Broward County?

 

NF: The CIO magazine award involved our ability to improve and to increase licensing for hazardous types of materials. In Broward County, we have a lot of regulations concerning the Everglades. The system we put in place has enabled the county to increase licensing revenues, to expedite permits for local businesses, and to aggregate permit violations. Looking at it another way, the system has played a key role in preserving the environment and supporting economic development.

 

We've been responsible for all the online financial systems to collect monies and to follow up. We're now processing in excess of $200 million a year. We've been able to increase our ability to manage and to process real estate property transactions by going to digital processing. While we've had a 40 percent increase in these transactions, we didn’t need to increase staff.

 

Most jurisdictions require some type of a system for small and disadvantaged businesses, but we didn't have a system for this. The system we developed is completely integrated into our financials and purchasing. It has increased the registration and the certification by 400 percent. This system has enabled the Board to meet its goal of building and certifying small to medium-size businesses in this community.

 

EL: Any other initiatives you've been involved with?

 

NF: When problems come up, we have to support the various supervisors. For example, several years ago, we had to help the supervisor of elections with the process of opening, managing, and closing the polls. After several smaller storms, we realized that we didn't have an effective damage assessment program. That's another system we developed. All of these programs have received awards from various entities.

 

EL: What new technologies are you considering?

 

NF: We've been introducing wireless technology for county government, as well as for citizens. We have a couple of hotspots in Fort Lauderdale, at the Hollywood airport, and downtown, and our installation of a fiber WAN in the country will enable us to widen the cloud. We might be able to expand the free wireless services across the county.

 

We've put in VoIP for new buildings or where we needed to replace obsolete equipment, and we've seen a $500,000 improvement in our telecom costs. The fiber WAN will drive down our telecom costs even further. By working with the Broward School Board and some other entities, we can provide our schools with advanced technology services, such as video cameras in school buses and on mass transit buses. We've equipped county inspectors and social workers with hand-held devices, so they don't have to go the office every day.

 

EL: What formal best practices do you have in place or are  considering?

 

NF: We're using a Rational unified process for applications development, and Microsoft has recognized our Active Directory migration as a national benchmark for infrastructure management.

 

We're following the IT Infrastructure Library's service support framework for our help desk, change management, and configuration management. ITIL seemed to be easier to adapt than going with CobIT. Several people in our agencies have either been exposed to ITIL or are foundation certified in ITIL. That's another reason why we liked it.

 

EL: Are you involved in any professional IT  organizations?

 

NF: I'm on the advisory council of a local organization called IT Women. We focus on developing women within IT by placing emphasis on career building, team building, leadership skills, and building and maintaining a budget. We have monthly meetings with speakers who are experts in the areas I've mentioned. We also mentor female students who are considering careers in IT.

 

--

 

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

| More
731 Views 0 Comments 0 References Permalink Tags: article, best_practices, broward_county, governance, innovation, it_management, nicole_fontayne, strategy

JonBeyman.jpg

 

In 2000, when Jon Beyman became chief of operations and technology at Lehman Brothers, the global investment firm, he set out to deliver on the company's mission statement: to drive productivity, enabling the firm to generate superior returns. Even the catastrophic events of September 11, 2001, propelled Beyman, along with his heroic IT staff, to make sure the company could resume trading within days. For more than six years, Beyman made his IT staff of 4,000 at Lehman Brothers delivered the services the business needed, and did it at a reasonable cost. In fact, cost containment of IT expenses became the underpinning of Beyman's leadership style.

 

In 2006, Beyman left the investment firm to spend more time with his family  and to pursue some personal interests.

 

Recently, enterpriseleadership.org spoke with Beyman about how his staff rebuilt Lehman Brothers' infrastructure following 9/11, what types of cost controls he put in place, and why the need for them. Here's what he had to say:

 

EL: Where were you on September 11, 2001?

 

JB: I was standing on the Lehman Brother's London trading floor when the first plane hit the first tower of the World Trade Center. We had offices on the 38th through 40th floors of Tower One in the World Trade Center, and across the street at the World Financial Center.

 

EL: How did you start the monumental rebuilding task of rebuilding  after 9/11?

 

JB: We started to rebuild our trading floors immediately after the event took place. We moved more than 4,000 employees into a Jersey City facility that had a data center and space for 1,500 employees. None of these people had PCs. We ordered more than $100 million worth of networking and computer equipment directly from the vendors without any formal paperwork. I was on the telephone with CEOs from Sun, Cisco, EMC, and Compaq.

 

We relied on everyone's unbelievable imitative to put Humpty Dumpty together again. On Thursday, September 13, we were able to trade in the bond markets. The following Monday when the New York Stock Exchange opened, we were able to trade that day.

 

I didn't worry for months after getting back my cost controls. I focused on  how to keep the firm going.

 

EL: What did you come away with from this situation?

 

JB: We thought we had built this unbelievably resilient IT infrastructure. Now, we had to take disaster recovery to an entirely new level of seriousness than we ever had before. We built additional trading floors in Jersey City, so if a disaster strikes again, traders in NYC can go to these unused floors. The telephone system even enables traders to connect directly with customers.

 

EL: Outsourcing of Lehman Brothers' telecom expense was a big  priority for you. Why?

 

JB: We had more than $100 million worth of telecom equipment, including 20,000 phones in NYC for 8,000 employees. We also had a lot of complicated ring-downs and point-to-point circuits, and we had an impossible time tracking all of the cell phones and Blackberries we gave to employees. Our power pricing was based on individual deals.

 

No one works on Wall Street to look at phone bills, which is a tedious process to manage. You need to know what's on your bills, what type of equipment you have, and what your contract says. I knew we weren't going to do a good job of tracking all of these things accurately. I believe that telecom companies rarely give you a completely accurate bill.

 

I outsourced our telecom expense management to TNT. If TNT finds an overcharge or an inaccuracy on one of our bills, then it gets a certain percentage of each dollar it collects or it saves us. TNT also negotiates all of the telecom contracts, seeing what the telcos would accept. From 2001 to 2006, TNT saved Lehman Brothers in excess of $35 million.

 

Lehman Brothers has a reputation on Wall Street for being one of most cost conscious and hardest drivers of saving money. The strategy to outsource our telecom management to TNT aligned well this strategy. We were able to offer the best telecom services for the lowest cost.

 

EL: How would you rate how well other companies handle their telecom  expenses?

 

JB: Most companies don't have a good handle on their telecom expenses. To begin with, most companies don't have the experts in-house who can negotiate telecom deals and who can track telecom expenses accurately. Besides, a lot of IT organizations don't want to handle telecom. They have more interesting and value-add work they'd rather be doing than telecom.

 

If you want to handle telecom expense management in-house, you're going to spend a lot of money for the right personnel and processes. You also need to be committed to understanding your telecom expenses. That's why it makes sense for a global company to outsource this task.

 

EL: How did you drive innovation at Lehman Brothers?

 

JB: You can waste a lot of money trying to innovate, especially if you do it wrong. My innovation philosophy was simple: to make sure every dollar we spent generated some sort of return. To this end, I made the IT staff understand what both perpetual returns and absolute returns were, and how we deployed all resources. I also made sure that the business units, the people footing the IT bills, really understood what they wanted, how much it cost, and what they could expect for a return.

 

I hired the smartest and most creative IT people I could find, and I paid them well. They had the freedom to work on a variety of business problems. I also made sure that we had some really smart people managing projects tightly and getting every dollar they could out of them.

 

Technology enabled us to be innovative about the way we solved business  problems.

 

EL: Can you describe the theme of your chapter in the book,  Managing the Technology Team? 

 

JB: IT organizations get knocked because they spend money badly and without accountability. My chapter, called "Sunlight the Great Purifier," talks about making IT processes transparent and making sure people understand how money is spent and are held accountable for those expenditures. The title is from Chief Justice Brandeis's famous line, "Sunlight is more like a disinfectant, and electric light is the best policeman."

 

EL: What type of a governance model did you have at Lehman  Brothers?

 

JB: Our large projects went very smoothly because of lots of reporting, design reviews, and health checks. We handled small projects very well, too. When it came to medium-size projects, we were always at the mercy of the project manager's competence to handle technical issues, to resolve budget problems, and to deal effectively with staff. Without a lot of transparency and accountability, you don't find out how bad things will turn out until the project manager fails to deliver.

 

I made sure everyone had a common language, and a common framework for understanding what things needed to be done. The project management office did health checks. Senior people from the infrastructure group did design reviews. We had peer reviews on various types of technology.

 

EL: Looking back, what would you have done differently as  CIO?

 

JB: Not much. I had several multi-year projects that I accomplished. I made sure the yearly projects got done on time and within budget. I worked hard to improve IT cost controls and the relationship between IT and the business unit. Perhaps I could've done more in this area. Sure, I did question the way some transactions turned out.

 

EL: How are you spending your free time?

 

JB: I've been taking history courses at Columbia University and teaching a course called, "The Management of Technology" for the University of Connecticut's MBA program. I'm also on the board of a charity, DonorsChoose, to fund public school projects.

 

EL: Do you plan to return to IT?

 

JB: Now that my non-compete agreement with Lehman Brothers is over, I'm free to look at a variety of opportunities. I'm looking forward to a period of exploration. That's all I'm going to say on the subject.

 

--

 

Elizabeth M. Ferrarini is a free-lance technology and  business writer from Boston, Massachusetts. You can reach her at elizabethferrarini@yahoo.com.

| More
3,454 Views 0 Comments 0 References Permalink Tags: article, it_management, jon_beyman, lehman_brothers, security

ReikRead.jpg

 

In the 1990s, RFID burst on the scene and was hailed as a new technology that would help reshape the global supply chain. It promised tighter inventory controls, shorter time to market for products, and cost savings for retailers. When Wal-Mart and the U.S. Department of Defense mandated that suppliers use RFID technology, rapid adoption seemed assured. Yet, adoption has not been rapid, and the buzz about RFID has quieted. Has the early fervor for RFID cooled, or has more been going on behind the scenes? Enterpriseleadership.org recently spoke with Reik Read, of Robert W. Baird & Company, about the state of RFID: What's going on now, and what's to come. Here's what he had to say ...

 

EL: Can you tell us about yourself and about R. W. Baird &  Co.?

 

RR: Robert W. Baird & Co. is an international financial services firm. We were founded in 1919, and for many years were owned by Northwestern Mutual, a large life insurer also located in Milwaukee. In 2004, Baird actually bought itself out. We're now fully employee-owned, and we've got a nice track record in a number of areas. FORTUNE, for the last four years, has ranked Baird as one of the "100 Best Companies to Work For." The quality of our research also consistently earns Baird top rankings in a number of prestigious surveys including The Wall Street Journal and Forbes. So, we're small, but we've got lots to be proud of. I've been covering the auto-ID space for Baird for about ten years. That includes companies -- historically, Zebra, Intermec, Symbol, when they were public. We've also spent a lot of time studying the RFID space.

 

EL: Enterpriseleadership.org interviewed some early proponents of RFID who were very enthusiastic about that technology. But it seems that adoption of RFID has not been as fast as was predicted. Why is that?

 

RR: When you're referring to the Wal-Mart mandates and the associated UHF technology, I think what's happened is that standards needed to be developed. And beyond the standards, equipment needs to be developed, and people need to write software solutions. End users need to learn about the technology, and they need to share implementation plans. Certainly, you need to develop a business case so you can justify the investment in that technology, and along with that, the pricing needs to drop. All of those things together have probably created more of a headwind than people had expected with RFID. There was a belief out there, if you go back to 2003, when Wal-Mart mandated use of the technology, that if Wal-Mart was mandating it, RFID adoption would happen fast.

 

I  also think that Wal-Mart itself has recognized that they've not been able to put in the infrastructure as rapidly as they had hoped and probably not in quite as many stores as they had hoped. All of those things have accumulated to slow down adoption versus what we were thinking four or five years ago.

 

EL: Another big entity that was trying to spur adoption of RFID was the Department of Defense. How is the rate of RFID adoption in the government sector?

 

RR: The DOD has had to deal with many of the same issues I cited about Wal-Mart. But, a lot of those issues, by the way, are being resolved. We've had the Generation 2 standard out there since late 2004, equipment since early 2006. Equipment has been developed for the last couple of years, so now we are really on second or third iterations of Generation 2 equipment. That equipment is starting to work fairly well; the issue's no longer with tags and readers being able to communicate with each other because they communicate with each other effectively. Now, it's a matter of writing the software for certain sets of applications, the ability to tag more and more SKUs, the ability to perform all of the necessary tasks, to understand and generate a better ROI. As a result of all of those factors, I think the DOD has come to believe that RFID will provide some very good things, but, it's very hard for them right now because budget dollars are scarce. We're at war, and those dollars are being diverted elsewhere.

 

At some point in the future, we will scale back operations in Iraq and in Afghanistan, and at that point, there probably will be better opportunities for RFID deployment within the DOD.

 

EL: You mentioned that one of the big sticking points for adoption has been a lack of compatible standards for RFID. There are a number of software companies offering competing RFID solutions, but are some standards emerging, and do you see more cooperation developing on standards?

 

RR: Yes, absolutely. Historically, prior to Wal-Mart's and the DOD's mandates, there really wasn't much in the way of standards development. ISO had a few loose standards with respect to some of the various RFID technologies, but there wasn't a real concerted effort to create them, and the only industry body was the Auto-ID Center at MIT, an academic institution that isn't in a position to really move standards. So, when Wal-Mart and the DOD mandated use of RFID, this, in effect, created enough impetus within the industry to form a body that was specifically designed to create and develop standards: EPCglobal. EPCglobal has done a very good job of getting people within the industry together to foster the standards development process. So, when I talk about the Generation 2 standard at UHF that was developed by EPCglobal, that's now been ISO approved. And they're now trying to create an HF standard with the same protocol as the UHF Gen-2 version so that regardless of what frequency that's used, the protocol will be very similar. By the same token, EPCglobal has done a lot in the way of standardization of how readers work with a network, or different types of software standards. The RFID industry, in general, recognizes that the only way to encourage mass adoption is to have a very clear set of standards that are well developed.

 

EL: Do you see adoption happening more quickly in Europe or Asia than  in the States?

 

RR: I do think it matters a little bit by geography, because adoption's being driven by some different things. For example, in Europe, you now have Metro, a large German retailer, which has done a very good job of testing and understanding this technology, and understanding the benefits that it brings to them. They feel comfortable enough now, not only mandating it as Wal-Mart did, but also, their mandate has teeth in it. As of October 1st of this year, when you're a supplier shipping to one of Metro's 229 Cash and Carry or Real stores in Germany, if you fail to put an RFID tag on your pallet, you'll be basically charged by Metro. That's going to induce a lot of suppliers to ensure that they comply with that mandate. There's been some change in some European regulations that have helped also. The other area that's progressing well with RFID adoption outside the States is South Korea. They've embraced RFID technology.

 

EL: The Europeans seem to be more sensitive to privacy issues in some respects than Americans, and some people are starting to talk about privacy with regards to RFID technology in Europe. Could the Europeans begin to move towards legislation around RFID as they have in some other areas of data gathering?

 

RR: Yes, and I would actually argue that the United States have also been doing so as well. There's been a lot of discussion about privacy within the U.S., and there are a number of privacy groups that have raised concerns out there. And legislation around this has been passed at the state level.

 

For example, in Wisconsin, they've legislated that you cannot put an RFID tag in someone without their knowledge. California has some new legislation moving through its political process. Privacy is an issue that's being looked at by legislators, and I think that the industry really needs to do a better  job of is explaining what RFID is, what it can do, what it can't do, where privacy is not an issue, where it might be an issue, and the steps that they're taking to ensure that privacy exists. In many cases, the technology just doesn't transmit well enough that it could even be read at a far distance. And in a lot of cases, there are safeguards around the technology such as who is, and is not, authorized to read a certain tag. But again, the industry has to do a good job of letting people know that privacy with this type of technology is not an issue.

 

EL: It sounds like things are being addressed more quickly in the  state legislatures than on the federal level right now.

 

RR:  That's correct. There's a caucus within the U.S. senate that looks at RFID, but it seems to me that the federal government is a little bit more deliberate in making sure that they understand the issues. They don't want to dampen the technology before the technology has a chance to move forward. By the same token, everybody wants to make sure that end users can be comfortable, because at the end of the day, if end-users aren't comfortable that their privacy's being protected, they're not going to have the incentive to use the technology.

 

EL: Another factor that might be impeding rapid adoption of RFID is the issue of infrastructure. I mean, buying the readers, getting the systems and the processes in place, and so on. Is that an area of concern?

 

RR: Yes, you're looking at this from a Generation 2, passive-technology standpoint where a lot of suppliers have systems in place that are working today. They do bar coding, they do it well, and their infrastructure is designed around bar coding.

 

There are certainly issues around RFID that need to be resolved, but at the end of the day, what a lot of end-users are going to need is a business-case justification to put RFID in place.

 

Right now, they're saying, if I have all of this technology that's working pretty well, why do I need to change it out with RFID -- which, by the way, is exactly what they did 30 years ago when they started using bar coding.

 

A lot of little things need to go right in terms of better equipment, lower pricing, more software solutions, more people adopting the technology, more SKUs being tagged -- all of those add up to a better ROI for everyone within the supply chain. The benefits of RFID have to outweigh the costs, so there's a business-case justification. But, RFID does have certain attributes that make it very attractive in some cases: you don't need line-of-sight, so reading it can be much more automated than a bar coding process, for example, and that leads to faster read rates and, in a lot of cases, better read rates.

 

Also, there's additional information that you can put on these tags, such as routing instructions or identification -- however you decide you want to use that information can be very, very helpful in tracking inventory more accurately, to reduce stock-outs, and so on. These are the types of things that CIOs would be looking at as business case justification.

 

EL: Even with the challenges to adoption of RFID that we've talked can you give sort of a best guess/forecast about where you see things heading for RFID?

 

RR: Yes, I think it's appropriate to talk a lot about the supply chain and all of the uses of RFID there because it's potentially a very large market. But I think it's also useful to acknowledge that there are a lot of areas that hold potential for RFID that are not in the supply chain. Another use for RFID that's really catching on is contactless payment, for example, where MasterCard and Visa and American Express are increasingly using RFID chips within their credit cards to make payments, much as Mobil has done with their Speedpass. I think there's some good adoption outside of the supply chain.

 

When you look at Generation 2 RFID, I think what you're going to see is increased emphasis on a number of closed-loop asset management solutions. So, for utilities, for example, that have large transformers or other equipment that might be sitting in a yard somewhere, it's much easier and faster  for them to identify that with RFID. In closed-loop manufacturing operations where you have, say, totes running on a conveyor belt that are carrying various types of inventory, a lot of times those totes simply get lost in the process. If you can use RFID, and you're constantly rescanning that tag, you're driving the per-scan cost of that tag way down so it becomes a much better ROI proposition. When you talk to vendors out there, they're spending their time and attention in these asset-management, closed-loop areas where there is some good momentum moving forward right now -- still small, but again, good momentum. You are also seeing a good amount of active tag or Real Time Locating System deployments in the asset management area.

 

From a supply chain standpoint, the things that you continue to need to look forward to are what we talked about in the Metro example. They're moving forward with all pallets as of October 1st into these stores. They're talking about extending that into cases in 2008.

 

Wal-Mart has been pretty silent in the last six months or so. In part, that's because they've turned their RFID functions off from IT to their operational group. So, there's some digestion going on there. There's still some infrastructure that they have to get in. But I think what happens is that kind of ebb towards the end of the year. You're going to see Wal-Mart get more aggressive and probably start sending out more letters identifying those suppliers that are not in compliance. And so, those are all things will help to continue the momentum going, and you will see more in the way of solution development, and in the way of the channel getting involved. But, in terms of when we really start to see that big inflection point, that probably won't be in the near term; that is well more than a year out. What you will see are indications that things are moving forward, such as, are you seeing more RFID in contactless payment? Are you seeing more closed-loop solutions? Is the channel getting more involved in RFID? These will all indicate that the technology's moving forward.

| More
1,393 Views 0 Comments 0 References Permalink Tags: article, innovation, it_innovation, it_strategy, r_w_baird, reik_read, strategy

The 21st-century CSO

Posted by Tom Parish Nov 20, 2007

by Deb Radcliff

 

The job description of a hybrid Chief Security Officer (CSO) with responsibility for physical and IT security has been elusive ever since the American Society of Industrial Security formally began defining such a role in 1999 during its national conference in Washington, D.C. Even today, if you ask ten experts, you'll get as many different

opinions -- all of which still fall into one of the same two camps.

 

To the enterprise-centric, it means blended identity and access management systems, maybe even security systems (e.g., cameras, videos, door entry) running over an IP network. But CSOs who've been at this a while say it's much more the convergence of physical and technical security. As such, their hands are just as full, with executive protection, workplace violence, regulatory compliance, supply chain, conflict-of-interest, disaster operations and other risk areas competing for their attention.

 

"People have been talking about the concept of how security interrelates and comes together for some time," says Tim Williams, CSO of Nortel, with a 25-year background in corporate security compliance starting with Proctor Gamble in the 1970s. "What it really boils down to is layers of interdependencies between all our business operations prioritized by what we deem most critical to our operation, which is the intellectual property and capital that comes from our employees."

 

NortelNetworks.jpg

Figure 1. Earnings drivers. Nortel Networks Corporate Security analyzed corporate strategy, the processes, and assets that drive our success and the risks jeopardizing all. Every company will have its own set of earnings drivers and risks to consider when integrating security with enterprise strategy.

 

Where convergence occurs, then, is where interdependencies naturally  arise.

 

On an organizational level, for example, this would mean the guard needs to be trained in data center disaster recovery and understand that physical security in the data center is wound around audit trails, which only approved people have physical access to, says J.P. Callahan, operations security executive, customer data center security, Verizon Business. On a tactical level, convergence occurs when you replace a guard's station with a self-sign-in kiosk that can be watched remotely over the enterprise network.

 

Form Partnerships Now

Such technological convergence is already occurring. By 2007, the physical and IT security convergence market will command global revenues of over $6 billion, exceeding $22 billion by 2010, according to 4A International, a converged security analyst and consultancy firm based in Chicago.

 

"In five years, all of the systems that physical security relies on will be developed by IT companies," says Steve Hunt, President and founder of 4A. "That means that the IT professional, whether he likes it or not, becomes a major influencer in corporate physical security. My advice is not to let it go to your head. Form constructive relationships with your security staff today rather than wait for political battles tomorrow."

 

Such partnerships are critical, agrees Williams. Williams, with a staff of 18, reports to the VP of corporate compliance with what he calls a dotted line to the CIO.

 

"If we've had any level of success here at Nortel it's because of the CIO/CSO relationship and the drive of our CIO to make security part of our culture," Williams says. "I'm joined in my objectives with his objectives to provide a more secure network."

 

Tearing down silos is one of the biggest challenges facing the integrated CSO, says John Pontrelli, CSO of TriWest Healthcare Alliance, a medical services outsourcer for the U.S. government.

 

"My job is to take the hot seat for security, and that includes data on the enterprise network. When I explained that, our CIO was more than happy to defer that risk to me," says Pontrelli, who reports to the COO.

 

To do so means aligning with the CIO in a shared vision of protecting the network and the human capital that represents, he continues, adding, "We've got to have mutual respect, and the ability to work together quickly to support fast-moving business applications."

 

Pontrelli, like Williams, has a long history in converged security. In the mid-1990s, he set up the first combined physical/IT security group at Microsoft, then again at Gore Associates (the company behind Goretex and Teflon), before coming to TriWest in 2003 to do the same. Of his nine reports, four are directly responsible for network event monitoring and access security. And he co-located his physical and technical security staff to stimulate cross-training between the two groups.

 

Hunt praises TriWest as one of the truly converged organizations in a small portfolio of perhaps a dozen Fortune 500 organizations trying to manage the two disciplines under the single title of CSO.

 

At ten years old, TriWest has the advantage of being agile enough to grow up with a convergence mentality, says Pontrelli. Older companies are less nimble, particularly if there've been mergers and acquisitions, taking on average about five to six years to converge security across their organizations.

 

"There's a veritable dearth of awareness about what it's going to take to manage security that utilizes the best of physical and the best of IT security," adds Hunt. "From the IT side, there's little awareness of the politics of regulatory compliance, budgeting, and the business and architectural value of building streamlined systems and functionality."

 

Layers of Accountability

That's why Williams helped to develop the ASIS CSO  Guideline, published in 2004. In the report, Information Technology is identified as one of many risk areas under the responsibility of the CSO. Others, equally important, include human resources and intellectual assets, ethics and reputation, financial assets, IT systems, transportation, distribution and supply chain, legal, regulatory and general counsel, physical and premises, environmental, and health and safety.

 

Also in 2004, Williams developed a roadmap around Nortel's inter-dependencies where shared risk resides, the results of which were published in a Nortel white paper titled "Integrated Enterprise Security," released in 2004.

 

"In our plan, business continuity must have a cross-functional relationship with risk management, finance, and control areas where they move together across the organization," Williams says. "So we assess risk across the organization with an emphasis on business drivers: What are the risks to those drivers and what are the interdependent risks between functions and processes?"

 

SecurityProcessMap.jpg

Figure 2. For integrated security to be most effective, the enterprise will need to map security processes within each discipline and document where different groups have process ownership and cross-functional responsibility.

 

Once this mapping was completed, Nortel had identified who owned what security processes and the cross-functional team members working to support them. Interestingly, Information Security was owner of, or cross-functional partner in, all but three categories.

 

That's because much of corporate risk today is regulation-driven. And technology provides the best means of meeting new regulatory requirements.

 

"Right now, auditors have to go around and visit each business group and look for physical signatures on documents. Why not sign them electronically?" explains Callahan. "You can also answer other questions. Like who was physically in the room when something happened on the computer network?"

 

Logically, we do this very well, he continues. If there's a problem, firewall logs go off and correlate with access and security event management to tie everything together at a time and place. Just like our logical systems, he adds, we need a physical dashboard to manage events at the facilities level.

 

Pontrelli's already converged physical security information gathering into his 21-state enterprise network. Alarm monitoring, door activity, cameras, intrusion detection, and burglar systems for more than 150 sites ride over the corporate IP network.

 

"To me, it's all about data," Pontrelli says. "So if I'm not going to integrate my security systems with my data systems, then why bother?"

 

Falling Through the Cracks

Without integration, he adds, critical information can fall through the cracks and create new risk. As an example, Williams retells the story of how a Nortel client's corporate data center was shut down for hours because a contract security guard mishandled a prank bomb threat and evacuated the data center staff.

 

Another client, he says, kept getting its system hacked by authorized user passwords even after they were reset. Suspicious, corporate security finally observed the dumpster late at night after a janitor recalled "homeless" people near the bin after hours. Turns out the homeless were hackers that were "dumpster diving" for passwords on sticky notes, forms and other slips of paper the employees threw in their garbage cans.

 

Ultimately, that's where physical and IT security most come together: In educating employees, explains Callahan. The Nortel interdependency matrix supports this, with cross-over functionality listed for all risk factors in the category of employee education.

 

So, to prevent the tossing of passwords into the garbage, password protection and shredding policies should be taught together. And if you're teaching them about a new physical/logical security access card, remind them that bad guys can circumvent this security when they "tailgate" close behind an authorized employee into the building, just as easily as they can "shoulder surf" information off their open computer screens by reading over their shoulders.

 

"To ASIS, their vision of the CSO is the single stop for four different risk management disciplines," Pontrelli explains. "Information security, physical security, risk assessment, and business continuity. These are all wrapped into what we call the 21st-Century CSO."

 

It doesn't matter how you get to the job of CSO, continues Pontrelli. It could be the path he and Williams took, as both have military security backgrounds and went corporate with business management degrees and CISSPs. Or it could be CISOs who've trained with ASIS and other security training and membership organizations.

 

That's because the role is not so much about facilities and technology as it is about identifying and managing risk across the organization.

 

"Who's better equipped to handle this, the CISO or the CSO?" asks Williams. "That would depend on the person's business acumen, leadership characteristics and political skills needed to drive the function."

 

Of Note

In February, the Alliance for Enterprise Security Risk Management (AESRM) www.aesrm.org, announced a series of studies it  will release on the matter of convergence at security conferences starting in  June.

 

These conferences will be hosted by the three organizations responsible for the 2005 formation of AESRM to provide guidance on matters of convergence, including integration of technologies, value proposition, international security, and the formation of risk councils. The groups behind AESRM include American Society for Industrial Security or ASIS www.asisonline.org, Information System Audit and Control Association (ISACA) www.isaca.org the Information System Security Association (ISSA) www.issa.org.

 

--

 

Deb Radcliff is an award-winning freelance writer, educator and speaker based in Northern California. She's been covering online crime and security ever since working as researcher on a book about infamous hacker, Kevin Mitnick back in 1995.

| More
934 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

KevinCurtis.jpg

 

Today's enterprise has a ravenous appetite for information, and mandates such as Sarbanes-Oxley require longer retention for even more kinds of data. Standard storage devices are reaching their limits. Enter something entirely new in the storage arena: holographic storage. This new technology promises to store previously unheard-of amounts of data efficiently, and to enable speedy access.

 

Sound too good to be true?

 

Enterpriseleadership.org recently spoke with Kevin Curtis, chief technology officer of InPhase Technologies, a developer of holographic storage, about how it works, how (and why) it was developed, and what it can bring to the enterprise. For both businesses and consumers who need to keep their digital-data houses in good order, holographic storage might just be "the next cool thing."

 

EL: Can you tell us about yourself, and about your company, InPhase  Technologies?

 

KC: I've got a bachelor's, master's, and a Ph.D. from the California Institute of Technology in electrical engineering. I've worked about 17 years in holography and optics at Caltech Northrop and Bell Labs. At Bell Labs I was the project manager for the holographic storage project at Murray Hill; from this group, InPhase was formed in 2000.

 

EL: So, InPhase Technologies was actually a spin-off of Bell Labs,  with the aim of developing holographic storage technology?

 

KC: Yes. We were very focused, and put together a great team at Bell Labs and at InPhase to work on all the technical, and the business and marketing issues.

EL: What is holographic storage, and what are  the benefits it will bring to the enterprise?

 

KC: Holographic storage is similar to an optical disk, like a DVD or a CD, but it's actually designed to go into automation systems. Instead of holding 4.7 gigabytes like a DVD, the first-generation holographic storage disk will hold 300 gigabytes and will transfer it at the rate of 20 megabytes per second. And, that's the first generation: we've actually designed three generations of product going out to 1.6 terabytes on the same disk and it can be read at 120 megabytes per second. The disks are all plastic, there is no metal there, and they've been tested for 50 years archival lifetime. They're very stable, and they can be manufactured inexpensively. So, the primary market for this technology is corporate long-term archival storage, for those who have digital assets that they want to keep for a long time.

 

EL: Could this technology replace the tapes that are being used for  data storage now?

 

KC: Yes; tape systems are really designed for, and the market for them was, backup. Data backed up in this manner is not meant to be kept for very long. Archival storage means storage for seven, or 10, or 50 years. But in the case of the professional video marketplace, for example, or compliance, or medical marketplaces, you're required to keep digital data for very long periods of time. Holographic storage offers a very unique combination of the robustness and random access of an optical disk with capacity that's more akin to tape.

 

EL: What was the genesis of this technology?

 

KC: The concepts behind this technology go back at least to the mid 1960s, and there was a lot of work in this area, including at Bell Labs, in the late 1960s and early 1970s. But there were some fundamental issues that couldn't be addressed then in terms of components and media. In 1994, Bell Labs decided that you could actually buy enough of the drive components to be able to put together a system, and then try to figure out what was needed for media. We've now made tremendous advances in media by developing a unique, two chemistry photopolymer material. We came up with a way of manufacturing the media at a low cost, to multiplex and record holograms at high density, and to enable recovery in a very robust manner. That's the genesis of the basic technology.

EL: Using holographic storage technology, how easy is it to not only gather, but retrieve large quantities of information, quickly?

 

KC: That is one of the advantages of a disk versus a tape: a disk has random access. For completely random access, this disk functions at a speed that's similar to your CD or DVD, around 250 milliseconds. But the technology offers a unique characteristic: inside a rather large body of data -- say about 150 megabytes -- you can have two-millisecond access to data inside a particular field. It's a unique combination. And, you certainly do have random access, and once you get that, you can stream it out continuously at 20 megabytes per second initially, and this speed will be increasing to up to 120 megabytes per second with future generations. The one thing that's unusual, at least for disk, is that those are sustained rates. Often, with CDs and DVDs, and other disks, they spec just the outer track, which spins faster than the inner tracks. And so the actual rate that you see on a CD or DVD is much slower than the actual spec. Our rates of speed are actually continuous, sustained across the entire disk.

 

EL: Can you talk about data security and holographic storage?  Are security issues similar to those for other storage technologies? 

 

KC: Yes, especially for removal of media. This has garnered a lot of attention lately: As the capacity of these media goes up -- whether it's a tape or a disk -- somebody could, potentially, walk out the door with a lot of data. Every company that's in the data storage field is considering encryption. And the format that we've implemented for our device certainly supports and anticipates encryption use.

In addition, the first generation technology, particularly for archive, is worm technology, meaning, write once, read many times. It actually cannot be erased. That's often very important, legally, for record authentication.

 

Compliance and Holographic Storage

EL: Gathering and storing certain data is also required for regulatory compliance. You touched on that when you talked about medical compliance.

 

KC: Yes. Five years ago, archival storage was the ugly stepchild of storage. Now, it's coming front and center as a critical and very rapidly growing issue. That's a real problem, because tapes and other technologies weren't designed for long-term retention. That's where we see a good opportunity for holographic storage to make a difference. Both e-mail and e-mail attachments now have to be kept for a very, very long period of time. Both the medical, and the financial industries, for example, have significant data archival requirements. And, Sarbanes-Oxley is a very significant factor.

 

Our technology's also getting a lot of attention in the professional video space. More and more content is being filmed in high-definition digital format, which increases the difficulty of storing it.

EL: InPhase is currently focusing this technology as it is relevant for the corporate customer. But do you foresee moving more into the consumer market?

 

KC: Absolutely. We actually have two projects to develop holographic consumer products that are being funded by major companies. One product is a holographic, read-only memory, like a CD-ROM or a DVD-ROM. Essentially, it's a very small card that could hold maybe 50 gigabytes that can be replicated very quickly. In optical media, the real advantage of optical storage has been in the ability to quickly replicate the content so that the cost of distribution is very, very low. We've developed a mastering and replication process for holographic that allows us to do the same thing: we can replicate content and distribute it. This could be for games or any sort of video or video content. You can have a very small drive with huge capacity that can be distributed very, very inexpensively.

 

The other project that's being funded by a major company is translating professional recording technology into technology available to consumers -- like the next generation after Blu-ray or HD-DVD -- something we can make very small and inexpensive.

 

EL: What about the cost of your technology?

 

KC: For professional products, we have to do a tremendous amount of testing, and the reliability is really critical. So certainly, that adds cost -- and, this is the first generation. Initially, we're looking at drive prices of $18,000 and media prices for 300 gigabytes of about $180. These compare quite favorably with tape prices, particularly high-end tape prices. Video professionals are used to that. Now, for a small business, that's quite an expensive piece of equipment, but we feel that this is an initial launch price. With volume, our pricing can come down into the small business price range.

EL: Enterpiseleadership.org did an interview some months ago with the chief technology officer from another corporation. We called the interview "The Next Cool Thing," because this CTO talked about certain emergent technologies that he felt would lead to big paradigm shifts. In that spirit, could holographic storage technology be called "the next cool thing"?

 

KC: There are two points to be made here, at least. One is that archiving for both the consumer and professional is now becoming a really significant need. Our technology has some unique attributes that can satisfy this critical need -- that's quite important for business. Also, this is a new approach: storage does not require a spinning disk. There are new consumer formats, particularly for distribution, that can be enabled because of this technology. Very small devices -- 50 gigabytes on something the size of a postage stamp -- can be replicated very, very cheaply. I think that really could enable some very cool consumer applications.

| More
1,753 Views 0 Comments 0 References Permalink Tags: article, chief_technology_officer, cto, it_innovation, it_strategy, strategy

Actions