1 2 3 4 ... 7 Previous Next

Articles

93 Posts tagged with the security tag

by Debby Young

 

Changing the game plan from cutting costs to increasing service.

 

With server virtualization, IT can dynamically provision resources for the corporate computing environment based on anticipated workload cycles, such as normal end-of-the-month spikes caused by payroll processing or increased demand on online ordering resources triggered by a planned promotion. Because virtualization can emulate multiple computer environments on any given server, IT can pool server resources across the enterprise, thus driving down the cost of operation. This just-in-time resource allocation is part of a predictive resource scheduling strategy that optimizes utilization and assures service levels despite fluctuating workloads.

 

"Ultimately, you want to be able to allocate resources based on business priorities," says David Cohen, vice president, research and development for Merrill Lynch. He likens it to the way the electric company distinguishes between hospitals and residences -- during a power outage, hospitals get priority service over the general public. "In a virtualized environment, IT can configure resources to enable mission-critical applications to take precedence over less vital applications when extra processing power is needed," he says.

 

Virtualizing such tasks as data storage and network support can reap similar efficiencies. Depending on its failover configuration, for instance, pooling standby servers alone could save a company upwards of 40 percent on idle infrastructure expenses, floor space, power consumption, and support personnel.

 

THE BOTTOM LINE ON VIRTUALIZATION

For CIOs charged with streamlining underutilized IT environments, virtualization holds the key to significantly driving down infrastructure costs without sacrificing high availability. But more than just a cost-saver, virtualization helps effect business change by enabling IT organizations to:

 

  • Pool server resources
  • Increase server utilization
  • Provision capacity on demand
  • Shorten disaster recovery time

 

In the multitiered application environments endemic to large enterprises, IT tends to overprovision application clusters because need is calculated on the peak requirements of every application. By virtualizing servers, resources within the server cluster can be continually repurposed to meet changing capacity needs. When demand subsides from one application, the resources can be redirected to another application experiencing peak load. Therefore, the cluster can be provisioned closer to average requirements rather than to peak loads, optimizing resource usage and lowering the cost of ownership without compromising service-level agreements. In baseball terms, it's like having a utility player available instead of a specialized backup player for every position.

 

Because virtualization separates applications from the platforms they run on, disaster recovery -- one of today's key business priorities -- is quicker than in traditional IT environments. For instance, with a physical server, if hardware is modified after software is installed, the data restoration might fail because the licensing key no longer recognizes the configuration. "In a virtualized environment, from the operating system's perspective, it's all the same hardware," explains David Boyes, president and chief technologist for the Ashburn, Va.-based R&D company Sine Nomine Associates. "This can take literally hours and days off your disaster recovery time."

 

The Latest Advances

Advances in virtualization technology are occurring on a number of fronts. Foremost is dynamic, orchestrated provisioning -- that is, quickly reallocating servers from one pool of applications to another. This sophisticated process involves reconfiguring server parameters, allocating storage and other resources on the fly to meet the increased work-load demands of another application. VMotion technology from VMware, for example, allows IT architects and administrators to view the server farm as one aggregate computing pool and carve off logical servers to meet peak loads or to test new applications with no perceptible delay in service.

 

VMware is also innovating how memory is managed in virtualized, consolidated environments. With advanced memory management (AMM), IT no longer needs to calculate memory requirements based on the total amount of memory in each of the systems being consolidated. "Because AMM optimizes how the overall system is used, IT can often reduce actual memory requirements by 50 percent or more," explains Brian Byun, VP of software alliances for VMware.

 

In addition, progress is being made in balancing workloads across clusters in the enterprise to meet the service-level agreements for business applications. The goal is to prevent the reallocation of resources without first determining the underlying relevance to the business. For instance, is the spike in transactions in the Web store caused by an increase in purchases, or is it a denial-of-service attack? If it is the former, IT would need to reallocate resources to keep up response times in order to avoid losing sales. If it is the latter, IT would have to throttle back resources and address the attack.

 

Virtualization technology is rapidly gaining adoption. Innovators such as Merrill Lynch are using it to ease the transition to new computing platforms and manage application updates. For instance, when Merrill Lynch rolled out Windows XP across its user base, VMware allowed the company's financial advisors to toggle between Windows NT and Windows 2000 on the same desktop so that there was no disruption in service.

 

Industry experts observe that virtualization will enhance IT's ability to seamlessly integrate with partners that can provide additional resource capacity to handle workload spikes. There may be a slight premium on those resources, but it will cost a company far less than it would to retool the enterprise infrastructure to support peak requirements.

 

--

 

Additional Reading - Sponsor Link:
Seven Requirements for Balancing Control and Agility in the Virtual Environment

| More
581 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Kevin B. Roden

 

According to a number of recent surveys, data protection is a top priority in 2006. As the CIO of a company that's trusted for protecting and storing the world's data, I suggest 10 data protection resolutions for 2006. Many CIOs have taken several, if not all, of the first five resolutions. I encourage you to review all of these, and if any of them is missing from your checklist, to make it a top priority.

 

      1. Define the Recovery Time Objective (RTO) for all of your  applications. The RTO for an application is simply the objective for how quickly you need to have that application's information restored and available after downtime has occurred. For example, for your e-mail system, is the RTO four hours, eight hours, or the next business day?
      2. Define the Recovery Point Objective (RPO) for each  application. The RPO for an application is the objective for how much data you can afford to lose since the last backup. Is it two minutes worth of data, 20 minutes, or hours hours? You then need to estimate the costs to achieve your RTO and RPO for each application.
      3. Classify your data based on its mission criticality. Your business's data should be categorized into groupings of critical, vital, sensitive, and non-critical. The critical grouping would include data that is used in key business processes or must be retained for compliance or legal reasons. Vital data includes information that would cripple the company if lost. Sensitive data is simply data that can be rebuilt easily and is not a unique source of information. Non-critical is just that - data with low security requirements. Determine criticality by meeting with company executives and decide clearly what the priorities are for the business. Then pick the appropriate backup strategy to meet that criticality. Also, be sure to assess where all the data is - both centralized and distributed data residing on remote servers, laptops, and PCs. Ensure the strategy addresses all the information.
      4. Develop a detailed plan on how to restore your applications  depending on the crisis that drives the need for recovery. Think about how to best respond to different kinds of scenarios, from simple scenarios, to the most complex. Of course, you have to test your backup and recovery plans to make sure they actually work; refine your plans based on your tests. Expect to do multiple tests before you get it right, and remember, this is a continuous process. Strive to constantly learn what works best -- and then amend your plans accordingly.
      5. **Make sure you have adequate resources assigned to data protection  at all levels of your organization. If you don't have the right resources and processes in place, than data at the edge of your network is probably at risk. If you are an Iron Mountain customer, you probably have already done the steps above. So where do you go from here? What should you focus on in 2006? Here are 5 resolutions we recommend.
      6. Take an inventory of all your backup data - both onsite and  offsite. Do you have everything you expected to have? Do you have more backed up data than you should? Is all of the data in the right location? Do you have tapes that should be onsite that are offsite, or vice versa? Taking a full inventory can be invaluable; you wouldn't want to discover inventory mishaps during a disruption.
      7. Differentiate between backup data and archived data retention rules,  and make sure they don't conflict with each other. For example, if your email retention policy is to delete all unclassified email after 90 days, but your hold policy for e-mail backup tapes is six months, then you could have a major e-discovery problem. Backup solutions cannot provide easy retrieval or an audit trail. The use of backed-up electronic records as official legal documents for compliance and litigation will lead to considerable time and money spent to restore backup tapes and search for legally relevant material. True digital archiving solutions today offer secure, compliant, and cost-effective, long-term archiving of electronic records. These records are stored in an indexed, searchable format so the organization can access those records whenever they need.
      8. Put the processes in place to encrypt all data that you determine  needs an extra degree of protection. For example, given the risks of theft or loss of confidential data stored on transportable data sources such as backup tapes, it is highly recommended that you encrypt transportable data such as backup tapes or optical platters.
      9. Investigate new technologies to determine whether they may better  address your data protection needs in certain areas. For example, electronic vaulting may be a better solution for your critical applications that demand short RTOs. And advances in tape virtualization technologies are now making the concept of online remote data replication much more affordable than it was the past.
      10. Expand your disaster recovery planning to encompass business  continuity. IT executives tend to focus on just disaster recovery. But disaster recovery planning that relies on another department for how the business processes recover may put your operations at risk. For example, if you had to execute your disaster recovery plan for your call center, you could have all the systems up in running in an alternative location and then discover that the alternative location is not outfitted for employees to go back to work. It makes sense for IT executives to take the lead. Always ensure enough desks and chairs.

        You may already have all of these resolutions covered, but if you don't, I recommend that you address them this year to reduce your company's data protection risks.

 

--

 

Kevin B. Roden joined Iron Mountain as executive vice president and chief information officer in 1999. Previously, Roden was CIO with Fleet Boston Financial, for the banking subsidiary. He has held numerous technology and management positions in a 20-year career at BankBoston, including executive director of U.S. technology

| More
585 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth Ferrarini

 

Most organizations have some sort of an IT help desk staffed by individuals who field calls from users, and then go into firefighting mode to solve users' problems. However, some IT organizations have transformed their inefficient help desk into a proactive, service desk that offers high productivity and efficiency, but at a lower cost than before. Major companies, such as Procter & Gamble and Caterpillar, have accomplished this goal by adopting ITIL initiatives, a standard set of best practices for lowering and improving the quality of IT service delivery.

 

The Role of Service Desk Based on ITIL

A service desk designed according to ITIL initiatives functions as the day-to-day operational interface between the IT organization and its users for achieving the organization's goals. The service desk also becomes the focal point for integrating the five disciplines in ITIL's service support management processes -- incident, problem, configuration, change, and release management. To this end, service desk staff must be able to communicate effectively with users, via a number of different channels, as well as use technology, in order to close the loop on tasks in each of the five ITIL disciplines.

 

How to Get Started

The first step in developing a service desk calls for identifying where you are starting from. Assessment should include a formal review of processes and procedures based on the guidelines in the ITIL Best Practice for Service Support volume. These guidelines will include measuring service performance against targets, identifying strengths and weaknesses, and aligning services with customers' requirements. You need to compare similar operations and benchmarks to gauge improvements.

 

ITIL guidelines call for you to define the key service desk processes, not just what they are, but how they operate, and what affect and significance each process has to your organization. These definitions will encompass the following:

  • Staffing -- quality and number of people
  • Daily operational procedures
  • Incident processes
  • Request handling and workflows
  • Incident monitoring and tracking
  • Escalation and closure
  • Management information
  • Call volumes, workload, performance, and trends

 

The outcome of all this should provide you with a better understanding of user requirements, service level agreements, and the operational level agreements that underpin them.

 

Select the Right Staff

ITIL guidelines place a lot of emphasis on getting the right people from the start or training the staff you already have. A proactive service desk must have a motivated and positive staff. A good staff becomes a service desk most precious asset. So invest in your staff. This effort might mean recruiting new staff and supporting them with training, tools, and resources to be effective. Soft skills, such as good verbal and written communications, hold as much weight as technical or business knowledge. Don't forget to involve the staff with decisions about the service desk.

 

Think Service Always

ITIL guidelines call for thinking service desk. To this end, make sure your organization includes the service desk when it considers new business or new direction. Prepare the service desk to handle a new product, or service, or new users. The service desk needs to be involved from the start and have plenty of time to plan for any changes in priorities and workloads. Staff should help define service processes and priorities. The staff should get involved with transition teams to help ensure smooth running of a new business or a merged organization.

 

User perception of the service ranks alone side of how the was improvement. In some cases, the service desk staff might find it appropriate to work with users to integrate some of their processes with those of the service desk. Such an effort could provide a seamless support environment. For example, an organization might want to incorporate second line support, problem management, and change management facilities into its own service desk operations.

 

Insist on the Appropriate Technology

The ITIL guidelines stress using technology appropriate to meet the organization's required service levels. The service desk needs to maintain or have access to a wide range of information and facilities that can be provided to users. Some of this might include reference material, such as the corporate file storage structure, contract documentation, process definitions and scripts, and frequently asked questions. Some material might have been interactive, such as links to message boards, intranet services, and external Web sites. Some material might be designed to coordinate service and change management capabilities. For example, this material might enable the service desk staff to manage problem resolution or enabling to assess, coordinate, and deliver service more effectively to users.

 

Recent advances in service desk tools have included remote (virtual) desktop, and network and application support. (See Tips for Evaluating Service Desk Tools) Service desk tools now incorporate facilities to identify and to resolve incidents before they affect users. In many cases, the tools can resolve problems without intervention from the service desk staff. When a user needs to contact the service desk, he or she has a range of self-help facilities, such as Web and intranet access, incident logging, incident status reports, and other information can help the individual to resolve the problem. These tools can reduce the need for users to contract the service desk for mundane reasons, and thus free the service desk staff to focus on more pressing tasks.

 

Links between system management and service management tools can provide invaluable insight into the performance of the complete technical infrastructure and can even highlight where attention is required to fix emerging problems. With early warning of failure, missed thresholds, and poor performance, a department manager can decide on the most appropriate actions to eliminate the causes.

 

The most advanced service desks, as described in the ITIL guidelines, also support functions such as inventory management and software distribution. Integration with each vendor's Web site can provide an additional layer of service that be provided seamlessly to users. For example, one such service might include allowing users to order and download upgrades and new software. Vendors might even be prepared to fund part of the project in return for the benefits they receive.

 

Seek Support from Other ITIL Adopters

Never feel that you are alone in carrying out a proactive service desk based on ITIL guidelines. You're not. Seek out IT professionals at other organizations who might have faced similar challenges to you and might be happy to share them with you. Visit these individuals and see how they work. Look at the processes you can adopt and check out businesses in other sectors. Most of all, joint the not-for-profit IT Service Management Forum or itSMF (www.itsmf.com) promotes ITIL through its 8,000 members worldwide. Be prepared to share ideas by attending itSMF seminars and itSMF regional groups.

 

Transforming your help desk into a proactive service might sound like a daunting task. You can lessen the task with careful planning and sensible implementation using ITIL initiatives.

 

Guidelines for Evaluating Service Desk Tools

When it comes to selecting service desk tools, you might want to narrow your search to those process integrated tools that completely support the five disciplines in the ITIL Best Practice for Service Support volume. For example, a service desk tool integrated with change management can reduce disruptions in the IT infrastructure. This type of tool can locate critical components with performance problems, which can help service desk staff solve user problems more quickly.

 

If the service desk tool can expand the concept of service management to include other increasingly important processes, such as capacity planning, then IT department can reuse and integrate the knowledge that is captured in this tool. For example, ITIL guidelines provide a problem-management process where an IT professional spend time investigating the root cause of a problem to prevent the problem from reoccurring. A service desk tool should have the capability to relate incidents to problems so that a service desk staff member can make use of the knowledge that is captured with the problem record for faster resolution. Integration between the service desk tool and the systems management environment can enable planned-outage planning support based on specific service levels.

 

When evaluating service desk tools, consider if the service desk tool dictates how to organize the service goal, or if the service desk can tailor the tool to suit its own way of working. Look for a tool that is based on ITIL's recommendations for the basic organizational structure of the service desk. At the same time, you should be able to tailor the tool so that it can integrate seamlessly with the existing organization infrastructure. Each organization will have unique escalation procedures, notification rules, and approval processes to which the service desk should conform.

 

So, when evaluating service tools, ask yourself these five questions.

  1. Is the tool completely based on ITIL?
  2. Does it have the capability to define and to map IT service and their components?
  3. Out of the box, does it integrate with the following:
    • A confirmation or asset management module?
    • A change management module
    • A workflow management module
    • A service level management module
  4. Does the tool allow you to forward of events being generated by a network or systems monitoring tool and communicating back any status change of the incident recorded in the service desk application.
  5. Can you easily learn to use the tool, navigate with it, and tailor it to your needs?

 

--

 

Additional Reading - Sponsor Links:
Why You Should Take a Holistic Approach to ITIL and Service Support
Streamlining Service Request Processes: A Key to Business Success
Taking the Service Desk to the Next Level


Elizabeth Ferrarini is an IT consultant and freelance writer from Boston, Massachusetts. Elizabeth can be reached at elizabethferrarini@yahoo.com.

| More
824 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy
| More
700 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Malcolm Fry

 

Over the last few years ITIL has become the flavour du jour in the US whereas in Europe it has been part of the main course for quite some time. As someone who spends his time split between Europe and the US I am intrigued by the difference between the two continents I regard to Service Management. Same ingredients but a different recipe. By the way I agree with you that I have now over-cooked the food metaphor.

 

I have often wondered whether the difference lies in the culture of the two continents or is it because ITIL was developed in the UK and has had longer to establish in Europe. Everybody knows that the US and European cultures are different and I am sure that we all have examples so I will let you supply your own example. However the main cultural difference that intrigues me is the attitude towards service.

 

In the US the eagerness to give and receive good service is ingrained in the way of life, although 'Have a nice day, sir' can sometimes grate on the nerves. In general Americans are more outgoing and speak their minds freely whereas Europeans are often more private and keep their opinions and thoughts closely guarded. So when it comes to IT Service it is not surprising the Europeans like etiquette and rules whereas Americans just want to get down to the basics as soon as possible.

 

Europe is also a continent of many cultures as anyone who has travelled around Europe can testify. Imagine a call to a Service Desk in the UK from a customer in Greece about a piece of software developed in Germany that is maintained in France. There are enough cultures here to start an epidemic. It is no surprise therefore to see why defining best practices, complete with a common vocabulary, is important in Europe.

 

Originally ITIL was developed in early 1980's to standardize the UK government data centres, as they were called then. At that time the various data centres in the government agencies had processes that were similar but not the same, for example they all had change control but different ways of managing change, they had a vocabulary with different words, and phrases, meaning the same thing. Ironically this also describes IT around the world.

 

Once the UK government had developed the ITIL best practices they quickly became popular because many of the cultural barriers were immediately removed and a common It language was desperately needed. Very soon Government agencies around Europe started to adopt ITIL and ask for ITIL compliance from suppliers, including IT Service Management software suppliers. Very quickly large software suppliers found themselves losing government contracts because they were not ITIL compliant.

 

This is a key turning point in the story of ITIL because very quickly the large software suppliers needed to get their software ITIL compliant because ITIL was beginning to spread outside of governments. As if not being able to win large government deals was not enough. So the software companies began to make their products ITIL compliant.

 

Meanwhile in the US a different phenomenon was occurring - certification. Not just academic qualifications but certifications from hardware and software vendors to show competency in managing and supporting their products. Suddenly if you weren't certified you were an outsider.

 

So now these two mighty tsunamis began to meet Europeans were being told by vendors that they needed certification and Americans told by the same vendors that they needed to adopt best practices. Common denominator? The vendors. As a result we have a Bridge beginning to appear across the cultural divide. The beauty of ITIL is that for the Europeans it is a best practice that has certification whereas for Americans it is certification that has a best practice.

 

For Europeans ITIL has grown organically and been adopted and pruned accordingly by most organizations. Whereas for Americans ITIL is an introduced species and like all introduced species has caused some problems with the existing IT ecosystem. This has been, to some degree, overcome by the latest refreshed versions of the ITIL books and the involvement of largest American vendors, such as Microsoft, getting involved in some of the newer publications.

 

When I first started visiting the US I was surprised by the number of focused conferences and organizations with numerous chapters, for example the Help Desk Institute has very focused conferences and about 50 chapters. In Europe there are much fewer conferences, possibly because Europeans on average have 4-6 weeks vacation per year, and Europeans do not like attending after work events. Here ITIL has an ace up it's sleeve because the ITSMF, which provides chapters and conferences, perfectly fits the American model so if ITSMF really gets going the we can expect to see ITIL grow very quickly.

 

My experience shows that ITIL fits both cultures perfectly and because it is the public domain is neither expensive or is it restrictive. As a last point be aware of restricted practices, these are developed and owned by a vendor, that are based around ITIL, some are excellent but be careful what you commit to because as I said one of the biggest strengths of ITIL is that it is the public domain.

 

So y'all should adopt ITIL old chap.

 

--

Malcom Fry, a recognized IT industry luminary with over 35 years experience in Information Technology, serves as an independent executive advisor to BMC Software, and Remedy, a BMC Software Company. Malcolm offers an unparalleled breadth of knowledge and experience in IT business and technical issues. Malcolm is the author of four bestselling books on IT service and support, and he has had many other articles and papers published. Technology journalists regularly use Malcolm as a valuable source of information, and he is also the solo performer in a highly successful, bestselling video series made for the Help Desk Institute. He has Masters-level ITIL certification.

| More
225 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Tom Bishop

CIOs and their teams should be asking the same question, "What do we need to do to get the full business value from our Service Management initiatives?" The answer involves making sure the initiatives provide consistent, current, accurate, and secure information. Of course, making that happen will require some effort, but it's time well spent. The first step is to think about how to combine the benefits of IT Infrastructure Library (ITIL®) best  practices with a configuration management database (CMDB).

 

Getting Control

The CMDB can offer IT a heightened level of control over what's happening in their environment. A well-configured CMDB can easily monitor configuration items (CIs) - their location, status, and relationships to each other - and consolidate disparate data sets. It can also provide a single source of accurate information about data in the IT environment. Having this control will strengthen the value of the services that IT provides to the business. For example, a CMDB can offer an accurate picture of available assets and their use. This capability ensures assets are used most effectively, which helps to reduce costs.

 

ITIL best practices for Service Management include Service Support and Service Delivery disciplines, which depend on the process integration and control from the CMDB. These processes, and how they are related to ITIL, are described in the table at the end of this article. ITIL offers strategic guidance for processes that depend on a CMDB. The ITIL standards recommend using a CMDB because it is a core component of mature, predictable, standard IT Service Management processes.

 

ITIL Goals for Configuration Management

As IT Service Management matures within an organization, a CMDB becomes even more business-critical, providing the necessary control of processes and information. ITIL has a number of goals for configuration management, which include:

      • Account for all the IT assets and configurations within the organization and  its services
      • Provide accurate information on configurations and their documentation to  support all other Service Management processes
      • Provide a sound basis for Incident Management, Problem Management, Change  Management, and Release Management
      • Provide verification of the configuration records against the  infrastructure, and correct any exceptions

 

CMDB Integration with ITIL and Automated Processes

As organizations add more ITIL-based automated processes, they must ensure that all components seamlessly integrate into the CMDB. If you follow the ITIL disciplines for Service Management, you will increase your chances of using more mature, repeatable processes.

 

CMDBs are available with ITIL-compatible, preconfigured tools that integrate with supporting applications. This capability lowers the cost to deploy services and increases their effectiveness. For instance, the Service Desk captures events from a variety of different sources. Events are filtered, standardized, and prioritized based on severity, scope of problem, or business impact. This action provides the functionality to open a trouble ticket that the support staff can prioritize, based on the goals and priorities of the ITIL business processes used to filter events. The process is automated and much more repeatable, and eliminates the manual burden typically associated with prioritizing and filtering.

 

Today, many organizations consider the ability to manage assets as the primary step for getting started with configuration management. Using a CMDB for asset management can significantly reduce costs. Without a CMDB, organizations run the risk of over-provisioning because they cannot track which assets are used for which purposes, or which availability and service problems relate to certain types of assets.

 

Enhanced Business Value

The examples below demonstrate how a CMDB provides business value through ITIL best practices. Although each ITIL discipline can be implemented as a standalone function, the CMDB extends the value of each by supplying information that extends and integrates functions.

 

ITIL Service ManagementDiscipline CMDB Business Value
Incident ManagementExtends the value of Incident Management, giving Service Desk technicians access to information about CIs related to incident records. Mean-time-to-restore service is reduced by prioritizing incoming requests, based on business impact or service level agreement, and by providing a broad range of related information needed to quickly restore service.
Problem ManagementExtends the value of Problem Management by linking incidents and problems, and by linking back to various upstream and downstream CIs. Mean-time-to-repair is reduced by optimizing problem control, error control, known errors, and root-cause analysis.
Change ManagementIn conjunction with a service impact model, extends the value of Change Management by relating all change requests to the specific CI affected by the change, as well as all other related CIs. Change requests can then be categorized by impact, which directs routing, communications, and approvals.
Configuration ManagementEnables the consistent, accurate, and cost-effective identification, control, status accounting, and verification of all CIs in the CMDB.
Release ManagementEnables effective and automated Release Management. The CMDB provides accurate information about hardware, software, and current configurations that enable automated software release, as well as back-out procedures and project scheduling.
Service DeskExtends the value of the Service Desk by providing CI details related to each service request. Service levels are improved by reducing errors, reducing manual data collection, and reducing the risk of failure due to changes that impact vital business functions.
Service Level ManagementAllows end-to-end service-level management that is otherwise limited without a CMDB. Detailed information about CIs, their relationships to each other, and their relationships linked back to IT services enables service level agreements (with the business), operating level agreements (with internal IT groups or external service providers), and underpinning contracts (with external service providers).
Capacity ManagementEnables comprehensive business capacity management, service capacity management, and resource capacity management. Information about CIs, their relationships with each other, and their relationship to business functions is a prerequisite for automated capacity management and real-time computing frameworks.
Availability ManagementProvides a central information repository that links availability, reliability, and maintainability for underlying IT components. It then links IT components back to service level agreements, operating level agreements, and underpinning contracts.
Financial ManagementProvides information that is critical to effective financial management of IT. In conjunction with service definitions in a service catalog, CMDB information enables service-based costing frameworks, which are key components of financial management, by linking into the asset management data that holds the financial records, and into the enterprise resource planning (ERP) system holding the fixed asset register.
Continuity ManagementProvides a central repository of information that enables continuity management. The CMDB stores information about the IT assets and configurations that support the key business processes and identify the priority and agreed-upon minimum level of business operation following a major service disruption.

 

Used effectively, the CMDB improves quality of service because all CMDB components and their relationships are clearly understood. The CMDB provides an accurate view of current IT capability, enabling you to quickly discern the status of your entire IT infrastructure and how one interaction impacts another. This ability helps you manage changes more effectively. The knowledge gained through a CMDB, combined with ITIL best practices, provides greater flexibility for the business through an improved understanding of IT Service Support, Service Delivery, and Infrastructure Management. The more information you have, the more flexible your organization can become and the better prepared you are to meet Service Management objectives.

 

--

 

Tom Bishop, Chief Technology Officer of BMC Software, joined BMC in 2005 from VIEO, Inc., where he served as Chief Technology Officer and was named one of the top 25 CTOs by InfoWorld Magazine in 2004. A well-known technology innovator, he holds nine patents in fault tolerant computing and has been involved in leading the development of industry standards such as the Distributed Management Task Force (DMTF) and POSIX.

| More
264 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Jean-Pierre Garbani

 

How Businesses Use Technology: Pushing the Envelope

The IT infrastructure and the corresponding organizational structure exist solely, in any enterprise, for the purpose of supporting the business processes. Over the years, the advance in technology has allowed IT to "push the envelope" of how businesses use technology:

      • The number of business processes that could benefit from IT, from the simple, objective of administrative support has grown to include to more subjective areas such as marketing and sales.
      • The areas of a business process that could benefit from IT support have expanded beyond data processing to provide decision support information, e-business, and so on.

 

Studies have shown [Schneiderman 84, Thadhari 81, Guynes 88] that the key to productivity in interactive applications is a rapid response time. As long as the user and the system keep a compatible pace -- that is they don't have to wait on each other -- productivity increases, cost of work drops, and quality improves.

 

In this environment, the IT management role is to provide not only the functions required by businesses, but to provide them with a satisfactory level of performances. The cost of providing these functions and keeping the user satisfied has to be minimal, or at least competitive with outsourcing providers.

 

The problem of reaching these objectives has multiple aspects:

      • The non-linear growth of user demand
        As long as user functions are confined within a limited number of processes, growth is a linear function with roots that are in the business growth and the corresponding increase in, for example, personnel. When the paradigm shifts from data to information, the growth becomes non-linear since it shifts from a process-based demand to an individual-based demand. The example of "Web Surfing" shows how unpredictable this could be.
      • The lack of suitable management tools
        For a number of years, infrastructure management vendors have provided a number of tools to capture and report component behavior, on the basis that "healthy" components must produce good performances when grouped together. The problem has proved to be more complex, however, and requires a more sophisticated approach.

 

The simplest, most common form has been, in most IT organizations, the creation of a "Fire Brigade." In firefighing mode, through help desk, trouble tickets, and the like, the IT organization basically waits for the user to complain before identifying problems and correcting them. Network and system management tools provide real time information about infrastructure components to the control center function. This leads to several potential problems:

      • Users are experiencing a roller coaster ride in terms of performances, the net result being a lack of confidence in the infrastructure and the IT organization.
      • The costs of constantly "fixing" problems under time pressure is higher than  it should be in a planned mode.
      • The IT management does not have any visibility of the long-term deficiencies of the installed infrastructure and lacks the basic information needed to plan for its evolution.

 

The correct way to go about all this is to bring the IT infrastructure into a really controlled and managed environment. To achieve this, the IT management will have to control two key elements:

      • user expectations in terms of performance, and, of course, costs. This means that, instead of blaming each other for the current results, both parties (users and providers) agree on a certain level of performance and costs.
      • performance of the IT infrastructure has to conform to the agreed upon level. This forces IT to be managed in a "predictive" rather than a "reactive" mode.

 

Improving Infrastructure Management: Shifting Gears

The first step in improving the situation will be to shift from an essentially subjective world to an objective one. By involving the user in the cost/performance trade offs necessary for a certain level of performance, the IT organization can bring user expectations to an objective and realistic level that is accepted by both sides.

 

The Service Level Agreement (SLA) is the instrument resulting from this negotiation. It provides a yardstick by which actual measures of performances can be judged, costs compared, and improvements negotiated.

 

The key to appropriate and sustained performances, and the basis of Service Level Management, clearly resides in IT management's ability to:

      • create, by capturing key metrics, a performance scorecard at component level
      • aggregate it into a user performance scorecard in line with the SLA
      • manage the infrastructure capacity in such a way that the balance is  maintained between cost and performances

 

The success of this enterprise relies on two capabilities:

      • The ability to create component models, which, from metrics captured at the IT infrastructure level yield an exact performance parameter such as service or response time.
      • The ability to aggregate thousands of these parameters into user scorecards.

 

The following figure illustrates how service level management can be  implemented:

BPPM.gif

© Giga Information Group, Inc.

 

The first three layers of the model shown above are the data capture layers. All components of the infrastructure are represented, from hardware or service components such as server and network, to storage components (databases) applications. Different web services, which could be a platform for browser-based applications (a J2EE or .NET platform), or external services used in the performance of an application are also included in the data capture layers.

 

The second layer shows the parameters to be captured. Availability and performance, traffic and response times are pretty straightforward. Increasingly, parameters such as "application accuracy" and "security" become relevant. The content of a Web page, for example, becomes as important as the capacity to deliver it on time. Reacting to security breaches in an infrastructure that is open to the Internet is also a key point.

 

The data captured is reported in real-time in a Network Operation Center (NOC), where it is used in real-time to detect potential problems (alerts, alarms) and to identify their root cause to determine a real-time corrective action. Load balancing, alternative sites, and now utility computing are the types of corrective action available in modern computing infrastructures.

 

The Pivotal Layer

The pivotal layer in this infrastructure management model is the service level management layer. The data capture layers are traditionally component or device-oriented. Also, the functions provided are the traditional functions offered by the network and system management products, either through a framework, a suite of products, or a series of point solutions.

 

At the SLM level, however, the report on infrastructure performance becomes user-oriented instead of device oriented. This is where the different parameters collected are aggregated into end user "scorecards."

 

This demands an aggregation model. Since the link between the business process and the infrastructure is the application, reporting service levels as perceived by the end users requires that models of how the infrastructure supports the application be built, as illustrated in the following figure:

 

BusinessProcess.gif

© Giga Information Group, Inc.

 

Most products available at this level propose a manual aggregation of the components. However, there are currently a number of companies working in infrastructure administration and configuration management that are on the verge of providing an automated way of "discovering" the components of an application and the dependencies between them. This will be a giant step forward in the implementation of SLM.

 

The upper layers of the infrastructure management "stack" are all capitalizing on the ability to build these models. Performance management is the capability to use the model to determine performance bottlenecks in real-time. Capacity planning is the ability to forecast the evolution of infrastructure usage or the impact of new applications and to adjust the infrastructure capacity accordingly.

 

Finally, the business process performance management is an aggregate of all data received from the application models in order to create a view of how IT is serving a business process in terms of efficiency, effectiveness, and costs.

 

Implementing service level management consists essentially in creating management processes within the IT organization that are capable of using the data provided by a number of tools and to convert that data into information. When an infrastructure has been instrumented in such a fashion that it can be controlled in real time from a NOC, a cross-divisional process has to be created within IT Operations to aggregate data in a way that is meaningful to the end user. Once this is done, the process can be capitalized upon to open the door to a complete control of IT performances and costs.

 

--

 

Jean-Pierre Garbani is a vice president of the Computing  Infrastructures and Security group, Forrester Research. His focus is on the  performance and capacity management of IT and Web infrastructure.

| More
305 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

JonasKarlsson.jpg

 

Ask some executives about their "Second Life experience," and they'll tell you about their plans for retirement. But ask the same question of Dr. Jonas Karlsson, a senior researcher at the Xerox Research Center in Webster, New York, and you'll be mesmerized by his answer. He says, "Second Life brings to life on the Web the virtual worlds created by William Gibson in Neuromancer and  Neal Stephenson in Snow Crash. Similar to multiplayer online games, the Second Life experience, developed and run by Linden Labs, enables people to build a 3D virtual reality community in which everyone creates an identity using an avatar, and interacts with people with more fluid communication, or as if they were living another life."

 

Many companies, such as Xerox and IBM, are looking at both internal and external applications for Second Life. Perhaps the most pervasive applications include employee collaboration, employee training, and product demonstrations.

 

Recently, Karlsson talked with Enterpriseleadership.org about the Second Life research he is doing at Xerox's Research Center, one of  four facilities that comprise the Xerox Innovation Group, which is charted to design Xerox's next generation products, and to test them internally.

 

EL: Given that you are a team leader in the Synthetic Worlds  initiative, why are you fascinated by virtual worlds?

 

JK: I am a computer geek who is enamored by the virtual, immersive environments described by both Gibson and Stevenson. In fact, a lot of terminology that Second Life developers are using comes from these science fiction novels. You can use your imagination to manipulate these environments in ways that you can't do in real life.

 

EL: Can you talk about the evolution of Second Life  technology?

 

JK: At the end of the 1990s, the gaming industry really started to pick up on virtual reality, developing very realistic 3D, multiplayer, role-playing games. Some people now play these games up to 30 hours a week. When you connect people to other people, something really dramatic happens.

 

Second Life provides the same type of environment minus the gaming. Second Life is becoming a platform that allows people to create and to share 3D virtual content with each other.

 

EL: Can you describe your Second Life piece of real estate, called  the Xerox Innovation Island?

 

JK: As part of my Second Life research project, I bought a small island to use for exploration and for others to test their ideas. Right now, it has a research building with meeting rooms and a demonstration space. The rest of the island is still undeveloped.

 

When we did a product launch at Fenway Park in Boston, Massachusetts, we had a parallel event on the island. We built a pavilion with an auditorium and a product display area. We streamed video so that people at Fenway Park could see it. On the island, we had people exploring the product and having a panel discussion with researchers from Xerox PARC, IBM, and other places.

 

EL: What are some of the business applications for Second  Life?

 

JK: Most companies plan to use this technology to communicate with other people. After all, Second Life is a social medium. It provides a more interesting and engaging experience than either the telephone or a Webcast. It's great for bringing together employees in remote locations to see, for example, a product demo. IBM plans to use Second Life to have all new hires participate in a new employee orientation, which will help them to adopt to the IBM culture.

 

Because you know at all times whom is in the Second Life environment, you are free to communicate with anyone and try out new ideas. You can't do this with some collaboration tools.

 

EL: What is the downside to the Second Live experience?

 

JK: At times it becomes difficult to distinguish between things in Second Life, or "inworld," and things outside of Second Life ("out of world"). Once you begin working in your space, you start thinking, "I shouldn't make my job sound like it is not part of the real world." We are trying to come up with other terms to use.

 

EL: Many of the collaboration tools don't require you to create an  avatar. What's the advantage of creating one?

 

JK: My avatar is Point Q. Malaproper. Every Second Life user has to create an account and to create an avatar. The avatar portrays how you want to look to others. People spend a lot of time customizing their avatar.

 

Google documents, Wikis, or blogs don't require an avatar. In some respect, virtual worlds, such as Second Life, are another collaboration tool. When I'm contributing to a Wiki, I don't necessarily know who else is working on it at the same time. In Second Life, you can see everyone's avatar. For example, I can go onto the Xerox Information Island and see people from different parts of Xerox. These are people who I might otherwise have had no contact with.

 

Creating an avatar is the first step in interacting with people. There's a real art in how you communicate in Second Life. You need to have the right tools in order to maintain the company. You need to know what makes for acceptable and understandable communications. One of our other Xerox Innovation Group labs is working on these issues.

 

EL: Who supplies the technology behind Second Life?

 

JK: We contracted with Beta Technologies, a metaverse content developer, to build the Xerox Pavillion on the Xerox Information Island. Metaverse is another term for the 3D virtual world. This company created models for our devices, programming them to do various things when we interacted with them.

 

Linden Labs., based in San Francisco, California, runs Second Life on huge server farms. Every user needs to download a client in order to connect to the environment. The client is available for Windows, Macintosh, and Linux Alpha.

 

EL: Since Linden Labs controls the Second Life environment, what kinds of content and or security problems does that present to a company?

 

JK: That's one of the big problems with Second Life for a company like Xerox. The company firewall will block access to the Linden servers for both security and content reasons. However, many companies are trying to figure out how to provide safe and secure access to their Second Life environment.

 

The good new is that Linden Labs has announced an Open Source server, which will enable companies to run their own Second Life server behind the company firewall. This will make everyone happy.

 

EL: What is the competition like for Second Life  products?

 

JK: We're starting to see new competitors every day. For example, Sun Microsystems has announced a platform that will enable companies to build and to host a virtual environment on a server. This platform is based on two of Sun's gaming platforms.

 

There are other systems and platforms on the horizon. The main difference right now is the ease of use. Some systems require you to be an expert in 3D creation tools. If you want to succeed in the Second Life space, you need to make it easy for users to create 3D content.

 

--

 

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

| More
213 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

PeterDrucker.jpg For 16 months before  his death, Elizabeth Haas Edersheim was given unprecedented access to Peter Drucker, widely regarded as the father of modern management. At Drucker's request, Edersheim, a former partner at McKinsey & Company, spoke with him about the development of modern business throughout his life, andI how it continues to grow and change at an ever-increasing rate. Edersheim's book, The Definite Drucker -- Challenges for Tomorrow's  Executives - Final Advice from the Father of Modern Management, captures his visionary management concepts, applies them to the key business risks and opportunities of the coming decades, and imparts his views on current business practices, economic changes, and trends.

 

Enterpriseleadership.org recently sat down with Edersheim to discuss how Peter Drucker might have responded to questions about technology, innovation, and C-level executives. She speaks from the point of view of having read and re-read Drucker's books and spending many hours interviewing him. She says, "He would often surprise everyone with his thinking."

 

EL: Peter Drucker believed that leaders must focus on people, especially what influence the CEO has on his/her people. Some great CEOs, such as Steve Jobs of Apple and Larry Ellison of Oracle, are known to be hard on their employees. What would do you think Peter Drucker would have said about tough CEOs?

 

EE: First of all, the CEO is an American invention modeled after the president of the U.S. There's no comparable thing elsewhere in the world, except the export of the American CEO. In Europe, several senior executives come together as a collaborative team. Each executive reports to a board.

 

The CEO's role is to provide strategic moral and human leadership with the right balance. In the US, you have this challenge to both lead and to create collaboration. Some people are more visionary, but don't create collaboration. Often times, their companies will fail when they leave because they haven't a team underneath them. Jack Welch was hard, but he absolutely had a bench. You need to be attracting the right talent for the team. In other words, are you building successors?

 

It's not bad to be tough on people, but you don't want to be abusive. Because you want to build their strengths and to make their weaknesses irrelevant, you don't want to undermine your confidence in them, and their ability to do what they do well.

 

EL: Peter Drucker was definitely an advocate of innovative technology. How do you think he would've viewed the role of chief information officer in a multi-national company? What advice might he have given to someone in this position?

 

EE: He didn't talk about the CIO. He did spend some time on the CFO. He said the CFO was the least knowledgeable person in the company because s/he always looks backwards. In some ways, the CIO has an opportunity to be the forward engine of an organization, but, on the other hand, the CIO can get caught up in chasing down problems too. The CIO has a huge opportunity for making an organization successful. I think Peter might say, "You need to be looking forward always, and executing against yesterday's requirements."

 

EL: How did Peter Drucker feel about formal best practices such as  Six Sigma or Lean?

 

EE: He often talked about what we can learn from others. As far as Lean and Six Sigma go, Peter worked with the two men who came up with the concepts of Lean and Six Sigma --  W. Edwards Deming and Joseph M. Juran. The Japanese loved all three men.

 

Peter felt that if you get too close inside, you only get cost. You really need to be looking outside and linking with customers. Again, you need this balance. Best practices can help you learn. Pushing things so they are better internally is good, but it's not sufficient. You can't loose sight of other critical areas, such are as your customers' needs. How are you providing them with value?

 

EL: Peter Drucker talked about giving employees some autonomy and allowing them to contribute by asking the question, "What can I contribute?" How do you provide information technology workers with autonomy when they work on very well-defined projects?

 

EE: If you step back for a second, the question is really, how can they find ways to contribute? For example, if the end product is very well defined, there has to be a feedback loop. Ideally, they are part of the definition of the end product. Given how much information is embedded in product, services, and what is done, the IT group might not be part of the definition of that requirement. That doesn't work today.

 

Toyota has its engineers find solutions to problems. In 2003, when Toyota was redesigning the Sienna, the engineers in North American drove across highways in the U.S., high crowns in Canada, and dirt roads in Mexico. Engineers observed there is greater distances between cities in the U.S. Americans need to be able to eat in the car, and load the van at Home Depot. Engineers took this information back and provided feedback about what the design needed to be. The Sienna became the number one minivan in 2004.

 

EL: In The Practice of Management, Peter Drucker talks about the importance of regular face-to-face meetings between managers and their employees. How did he view how technology has, in many cases, replaced face-to-face communication?

 

EE: He talked a lot about the impact of technology on face-to-face communications. He was all about community, but he never walked away from discontinuities and new realities. In one of our conversations, Peter remembered how the kids in the 50s, 60s, and 70s used to come out and play every evening. He said that today, if kids come out at all, they usually have their cellphones or Game Boys with them. They play with electronics, not with each other. He was concerned about their ability to have face time.

 

Email is an important change. It can be a great mechanism. If Steven Hawking was born 20 years earlier, he never could've communicated with us. The new communication mechanism lets one be more inclusive to more people in different kinds of ways. On the other hand, face to face is a human way of exhibiting to someone that they have value. It's a huge way of understanding at a different level. You don't want to abuse it. I have sat in plenty of two-hour meetings when nothing got done. Technology facilitates a different kind of connection, but it doesn't replace face to face.

 

EL: What would Peter Drucker have said about whether or not the U.S.  is falling short with its own global leadership?

 

EE: I asked him the same question. He would've said that we aren't the global leader anymore. We're one of many leaders. Our first challenge is to accept our new role. It creates a different kind of mindset. We need to be investing in the needs of tomorrow so we can create opportunities as a country. We need to be the place where entrepreneurs want to be, and where technology wants to come.

 

EL: What role does information technology play in helping a company  carry out its business strategy to stay competitive?

 

EE: Information isn't in the backroom of a company. It's an integral part of what a company is today: it's part of product, the service, and the way we put things together. It lets people and companies link. It's the connector. I can't imagine a strategy that doesn't embrace an information component. Information lets us do so much more.

 

EL: What are some of the ways an organization can promote  innovation?

 

EE: Innovation is a discipline about how we do everything. That needs to be a formal process. There needs to be a manner or mechanism for letting ideas happen, evaluating them, for picking where we are investing, and allocating resources, and not allocating resources to yesterday's problems all the time. It needs to be an exclusive part of what a company is doing.

 

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

| More
183 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

 

If you want to deploy IT for business value, then you'll need to innovate. That's the mantra of Martin Curley, global director of IT innovation for Intel Corporation, and that's the subject of his book, Deploying IT for Business  Value. Curley is responsible for stimulating, supporting, and nurturing the development of new products, services, and methodologies by Intel's 5,000 IT employees. He also oversees the worldwide Intel Innovation Centres, which enable IT employees to work with Fortune 500 customers and government agencies. He sat down with Enterpriseleadership.org recently to talk about how Intel creates an environment for IT innovators.

 

EL: Martin, we've interviewed dozens of IT executives from Fortune 1000 companies -- you're the first global director of IT innovation that we've interviewed. Can you tell us about your role? If we were to visit an Intel innovation center, what would we see?

 

MC: The primary role I have is around stimulating and creating innovation and creating an environment and set of tools to help our IT organization, and folks actually beyond the boundaries of our IT organization, innovate. My organization also does a lot of building prototypes, trying to drive new products and services across the chasm into production at Intel, so our Intel employees and our customers can get more value from IT. I'd almost say, in fact, that there's a new discipline emerging around IT innovation, which is the intersection of information technology as a discipline, and innovation as a discipline.

 

But if you were to walk into one of the innovation centers -- and we have a network of these worldwide now -- they're not very fancy, they're not high-cost, and you would see Intel IT employees working on some disruptive prototypes -- that might be one activity. You might see some innovation training going on, because there are some emerging tools and techniques that people are just starting to become aware of that can significantly increase the yield of innovation. You might see a customer executive workshop going on -- in our Ireland innovation center, we've hosted more than 20 workshops with various European governments around topics like transforming education or healthcare using IT. You'd certainly see a lot of showcases, and a mixture of sort of soft leadership around emerging practices or the latest Intel products and new usage models associated with those products. So, you'd see a mix of activities

 

EL: Are the people staffing your innovation centers full-time staff? Or, if someone in the IT group had an idea, could they submit that and be involved in developing the idea in an innovation center?

 

MC: We have quite a small team, actually, maintaining the infrastructure and creating the environment. There are a number of different mechanisms that enable IT employees who have a good idea to submit that idea. We have a virtual innovation center, and they can submit it there. We have the concept of an innovation assignment; if someone has a particularly good idea, they're able to take time out of their "day job" and work in the innovation center, to bring that idea to fruition. One employee in Sacramento who had a very interesting idea of using our new Viiv technology in the home for remote power monitoring and more efficient use of air conditioning took an assignment, and worked on a project with some of the local utilities there and tried some new algorithms around air conditioning; it looks like it could add significant value.

 

Or, employees have taken an innovation assignment to work on a specific application that would add value to a particular set of Intel engineering.

 

EL: So, they are rewarded for coming up with innovative ideas, and  there's a support environment for this?

 

MC: Exactly. For innovation to prosper, you need to create a "virtuous circle" around it. If you're trying to change a culture to support innovation, you need to have tools and methodologies in place, and you need to have metrics. Andy Grove, one of our founders, often says, if you can't measure it, you can't manage it. So, you need to have different metrics in place. And then you need incentives, to recognize and reward innovators. We'll have some awards for the person who actually discovers and develops an innovation, but we also have one award for an information catalyst, for somebody who was especially effective in creating an environment that enables or fosters innovation.

 

EL: It's fascinating how that happens -- you have the one guy who has the idea, and the other four who helped to make it happen.

 

MC: You've just hit on an important point: Innovation is a team sport. To use the soccer analogy, it's important to recognize the person who provided the assist for scoring the goal. For every one person that has the idea, perhaps there are eight or nine or more people who are needed to get that idea into production, get it into use.

 

EL: You were most recently Intel's director of IT, People,  Intellectual Capital, and Solutions. What exactly did you do?

 

MC: Five or six years ago, we developed a business plan to help transform the Intel IT organization. And one of the gaps that were identified in the plan was that we weren't managing our global people resource in an integrated fashion -- we had four or five thousand employees across 50 different sites. The role of director of IT, People, Intellectual Capital, and Solutions was created to manage our people as an integrated resource, identifying the future core competencies for the organization and putting curricula in place. We also created an intellectual capital program to encourage IT employees to submit and mention disclosures.

 

Because Intel created this new position and initiatives, our IT organization is probably the fastest growing contributor to intellectual property. Four or five years ago, perhaps we might've had one patent issued, and today, we're doubling the number of patents, or the number of invention disclosures, every 18 months. And I think this past quarter, we had more than 200 invention disclosures submitted and more than 20 patents approved from our IT employees.

 

EL: You have a rich environment that really encourages people to innovate, and I can see the relationship to what you did and what you are doing as a direct line. Well, you know Nicholas Carr, and his book, Does IT Matter? One of the points he made in the book is that so many CIOs are stuck in a situation where they're spending 70, 80 percent of their time just keeping the infrastructure running, the lights and phones and the network. And this causes executive management to wonder, well, we could outsource that function, what is it of value do you really provide? From your perspective, what would you say to a CIO trying to get out of that mode?

 

MC: Nick Carr's book promoted a healthy debate within the IT profession in terms of whether IT can add value. I firmly believe that IT can add competitive advantage, and in some cases, competitive necessity, and some of Nick Carr's premises are based around the view of IT as a utility.

 

I think it is very important that a CIO look at the IT value chain and understand where the spend is. I wouldn't contest Nick Carr's point that 70 to 80 percent of the spend is in keeping the lights on, and I think the CIO needs to work really diligently to see how that spend can be reduced. One way would be to deploy new technology; for example, remote management technology. A higher-leverage activity that the CIO could take on is using the concept of design for assembly, which is used extensively in the automobile or consumer electronics industries: As you're designing solutions or cars or whatever, you're designing for the lowest operating costs. So if the CIO can inculcate the strategy that when solutions are developed, they're developed for lowest TCO, that would ultimately help.

 

I think the job of the CIO is to not just to optimize the operation, and make sure service-level commits are met, but to try to take spending out of operations and move it up the value chain into solutions delivery and particularly into innovation. We've seen evidence, some internal and some external, that you'll get a higher return on your dollar if you invest in the innovation space rather than the operations space. There are some role models -- Dell for example, and WalMart -- these are companies where IT really is a competitive advantage, and I think the CIOs there have been really successful in terms of trying to minimize the operations spend and invest in innovations that add value to the business.

 

EL: Let's talk about using IT as a competitive advantage; how do you go about doing that, what are some ideas around that that would be useful to other CIOs?

 

MC: We're starting to see a pattern emerge around IT innovation as a process; we see that there are at least six things that have to be in place for an innovation to be successful. The first one is that there is actually a problem or opportunity that needs to be fixed or to be addressed and someone actually has a vision as to how that can be achieved. One example would be Westminster Wireless City -- the CEO there had a vision of how wireless technology could potentially transform the city of London, but he really didn't know how to bring his vision about. He worked with his own IT department and with some support from one of the Intel innovation centers to build a prototype that eventually ran to a working implementation.

 

But most innovations don't come from "blue-sky thinking"; they come from addressing a specific problem or a potential opportunity. Necessity is the mother of invention, as the saying goes. Typically then, an IT solution has to be associated with fixing a problem or seizing an opportunity, and very often, a business case has to be there. IT went from irrational optimism before the dot.com crash to irrational pessimism, and today there's a modicum of normality coming back to IT investments, but a business case is a prerequisite.

 

And then there are three vectors where the most difficulty are. As IT professionals, we naturally think of technical risk and the IT solutions. But with every IT investment, there's an associated business investment. There may be a business process change that needs to happen, there may be an organizational change that needs to happen, and the last vector is perhaps the most difficult -- very often a customer change is required, or even a societal change. Many of the innovations that are being introduced today are touching many parts of society, and society's willingness and ability to adopt an innovation are really crucial to the innovation being successful.

 

EL: So then the question might be, how do you measure the relative  value of IT innovation to profit?

 

MC: This is something the whole profession has wrestled with. One solution that we find quite effective is what we call the "value dials." We identify the critical business variables at Intel and maintain a list of those, and the monetary value of driving a change in each of them. When we are developing a value proposition for a particular innovation, instead of having a very "wooly" statement -- "This application might improve supply chain flexibility"-- we'll actually hard code into the value proposition that, for example, the goal of this project, which will improve supply chain flexibility, will be to reduce our days of inventory by one day and achieve a one percent market share increase in a particular market.

 

EL: Ah -- put some real teeth into it.

 

MC: Absolutely; and we then know the direct value of reducing the days of inventory by a day, or improving our market share by one percent, and that gives us the numbers that form the business case. And then the IT organization or the project team and the business team work together to do the best they can to realize that result. And by measuring that, we can see if the solution or project actually delivered what it set out to achieve?

 

EL: Does Intel have a budget for IT innovation, or is it parceled out  of everyone else's existing budget?

 

MC: We do have a budget, and just to recognize that innovation happens everywhere, we have a small part of the budget that is centrally managed, and that part of the budget is to help stimulate and capitalize and create an environment for innovation, and also to do research, we have a central research group that is working on some specific agenda. And then the remainder of the innovation budget is split out amongst our various organizations within the IT organization -- innovation is happening everywhere, and what we are trying to do is to do more innovation more effectively and increase the return on innovation by catalyzing and better supporting innovation.

 

EL: Tell us about some of the innovation projects that you've worked  on at Intel.

 

MC: One example of innovation at Intel is of a particular solution under development called Miramar. One of the challenges that companies like Intel face globally is collaborating with employees in different parts of the world and in different time zones. Miramar is an emerging application that we developed to try to provide a solution to that. We have a vision called "better than being there" -- that you could actually have a remote meeting experience that is actually better than physically being in the room with somebody through computer mediation. Miramar is in its early days, but today, we have on employees' desktops we have 3D immersive environments where they can better organize and better locate and better connect information.

 

EL: To what degree does IT organization carry over to the external,  product side?

 

MC: Quite a bit; our primary focus is internal, to help the IT organization be more innovative and develop more solutions, but we see an increasing pull on both sides working with our product divisions to give them ideas and help them build new features into the products, and we have done a lot more work with Intel's customers than we originally would've expected to, with, for example, European governments; we will very often work with our sales team and with your fortune 500 execs on exec workshops looking at specific problems and how an innovative solution might be able to help. There is a significant crossover.

 

EL: Do you see any disruptive innovations that could change IT within the next five years? I'm curious about your views of the use of RFID or WiMax, in particular, are people coming up with ideas on how to use that kind of technology?

 

MC: Yes indeed, and I think the pace of change in terms of new and disruptive technology emergence is happening much faster than any of us could potentially could have conceived of. I'm sure if you held this interview in a year's time, there are things that will be quite commonplace in our vocabulary that we don't know about today. But you mentioned two specifics, RFID and WiMax. Within Intel and the innovation centers, for example, RFID, we've been involved in projects in a hospital in Korea in neonatal care, where the mother and baby have RFID tags to avoid mixups, and in a hospital in Milan, we've been using RFID working with the hospital and a system integrator to make sure that blood transfusions don't get mixed up. So, RFID in some industries is becoming pervasive; some other industries, it's going to take more time for it to proliferate. WiMax is a hugely exciting technology; it really is the classic disruptive technology and moving very fast. I think in a year's time, if you'd have this interview, I think WiMax will start to widely diffuse, with a 10x degree of deployment of WiMax compared to today; certainly, the economics are staggering compared to putting fiber in the ground, but as happen normally with new technologies, you'll get hype. Gartner has that very famous "hype curve." I think there is a hype around WiMax. However we have been trialing it at the Ireland innovation center and innovation center in the UK, and the performance is very good. We're actually using it in production, we have construction going on of a new factory, and many of the suppliers that are working with us are connected via WiMax, and their internet access is very effective and probably a tenth of the cost of a conventional connection, so WiMax is very exciting and is actually very real.

 

EL: Well, Martin, thank you for taking some time to talk with us  today, and talking about your program and your people!

 

--

 

Elizabeth M. Ferrarini is a consultant for the Swive Group, an IT consultancy based in Boston,  Massachusetts.

| More
189 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

JonBeyman.jpg

 

In 2000, when Jon Beyman became chief of operations and technology at Lehman Brothers, the global investment firm, he set out to deliver on the company's mission statement: to drive productivity, enabling the firm to generate superior returns. Even the catastrophic events of September 11, 2001, propelled Beyman, along with his heroic IT staff, to make sure the company could resume trading within days. For more than six years, Beyman made his IT staff of 4,000 at Lehman Brothers delivered the services the business needed, and did it at a reasonable cost. In fact, cost containment of IT expenses became the underpinning of Beyman's leadership style.

 

In 2006, Beyman left the investment firm to spend more time with his family  and to pursue some personal interests.

 

Recently, enterpriseleadership.org spoke with Beyman about how his staff rebuilt Lehman Brothers' infrastructure following 9/11, what types of cost controls he put in place, and why the need for them. Here's what he had to say:

 

EL: Where were you on September 11, 2001?

 

JB: I was standing on the Lehman Brother's London trading floor when the first plane hit the first tower of the World Trade Center. We had offices on the 38th through 40th floors of Tower One in the World Trade Center, and across the street at the World Financial Center.

 

EL: How did you start the monumental rebuilding task of rebuilding  after 9/11?

 

JB: We started to rebuild our trading floors immediately after the event took place. We moved more than 4,000 employees into a Jersey City facility that had a data center and space for 1,500 employees. None of these people had PCs. We ordered more than $100 million worth of networking and computer equipment directly from the vendors without any formal paperwork. I was on the telephone with CEOs from Sun, Cisco, EMC, and Compaq.

 

We relied on everyone's unbelievable imitative to put Humpty Dumpty together again. On Thursday, September 13, we were able to trade in the bond markets. The following Monday when the New York Stock Exchange opened, we were able to trade that day.

 

I didn't worry for months after getting back my cost controls. I focused on  how to keep the firm going.

 

EL: What did you come away with from this situation?

 

JB: We thought we had built this unbelievably resilient IT infrastructure. Now, we had to take disaster recovery to an entirely new level of seriousness than we ever had before. We built additional trading floors in Jersey City, so if a disaster strikes again, traders in NYC can go to these unused floors. The telephone system even enables traders to connect directly with customers.

 

EL: Outsourcing of Lehman Brothers' telecom expense was a big  priority for you. Why?

 

JB: We had more than $100 million worth of telecom equipment, including 20,000 phones in NYC for 8,000 employees. We also had a lot of complicated ring-downs and point-to-point circuits, and we had an impossible time tracking all of the cell phones and Blackberries we gave to employees. Our power pricing was based on individual deals.

 

No one works on Wall Street to look at phone bills, which is a tedious process to manage. You need to know what's on your bills, what type of equipment you have, and what your contract says. I knew we weren't going to do a good job of tracking all of these things accurately. I believe that telecom companies rarely give you a completely accurate bill.

 

I outsourced our telecom expense management to TNT. If TNT finds an overcharge or an inaccuracy on one of our bills, then it gets a certain percentage of each dollar it collects or it saves us. TNT also negotiates all of the telecom contracts, seeing what the telcos would accept. From 2001 to 2006, TNT saved Lehman Brothers in excess of $35 million.

 

Lehman Brothers has a reputation on Wall Street for being one of most cost conscious and hardest drivers of saving money. The strategy to outsource our telecom management to TNT aligned well this strategy. We were able to offer the best telecom services for the lowest cost.

 

EL: How would you rate how well other companies handle their telecom  expenses?

 

JB: Most companies don't have a good handle on their telecom expenses. To begin with, most companies don't have the experts in-house who can negotiate telecom deals and who can track telecom expenses accurately. Besides, a lot of IT organizations don't want to handle telecom. They have more interesting and value-add work they'd rather be doing than telecom.

 

If you want to handle telecom expense management in-house, you're going to spend a lot of money for the right personnel and processes. You also need to be committed to understanding your telecom expenses. That's why it makes sense for a global company to outsource this task.

 

EL: How did you drive innovation at Lehman Brothers?

 

JB: You can waste a lot of money trying to innovate, especially if you do it wrong. My innovation philosophy was simple: to make sure every dollar we spent generated some sort of return. To this end, I made the IT staff understand what both perpetual returns and absolute returns were, and how we deployed all resources. I also made sure that the business units, the people footing the IT bills, really understood what they wanted, how much it cost, and what they could expect for a return.

 

I hired the smartest and most creative IT people I could find, and I paid them well. They had the freedom to work on a variety of business problems. I also made sure that we had some really smart people managing projects tightly and getting every dollar they could out of them.

 

Technology enabled us to be innovative about the way we solved business  problems.

 

EL: Can you describe the theme of your chapter in the book,  Managing the Technology Team? 

 

JB: IT organizations get knocked because they spend money badly and without accountability. My chapter, called "Sunlight the Great Purifier," talks about making IT processes transparent and making sure people understand how money is spent and are held accountable for those expenditures. The title is from Chief Justice Brandeis's famous line, "Sunlight is more like a disinfectant, and electric light is the best policeman."

 

EL: What type of a governance model did you have at Lehman  Brothers?

 

JB: Our large projects went very smoothly because of lots of reporting, design reviews, and health checks. We handled small projects very well, too. When it came to medium-size projects, we were always at the mercy of the project manager's competence to handle technical issues, to resolve budget problems, and to deal effectively with staff. Without a lot of transparency and accountability, you don't find out how bad things will turn out until the project manager fails to deliver.

 

I made sure everyone had a common language, and a common framework for understanding what things needed to be done. The project management office did health checks. Senior people from the infrastructure group did design reviews. We had peer reviews on various types of technology.

 

EL: Looking back, what would you have done differently as  CIO?

 

JB: Not much. I had several multi-year projects that I accomplished. I made sure the yearly projects got done on time and within budget. I worked hard to improve IT cost controls and the relationship between IT and the business unit. Perhaps I could've done more in this area. Sure, I did question the way some transactions turned out.

 

EL: How are you spending your free time?

 

JB: I've been taking history courses at Columbia University and teaching a course called, "The Management of Technology" for the University of Connecticut's MBA program. I'm also on the board of a charity, DonorsChoose, to fund public school projects.

 

EL: Do you plan to return to IT?

 

JB: Now that my non-compete agreement with Lehman Brothers is over, I'm free to look at a variety of opportunities. I'm looking forward to a period of exploration. That's all I'm going to say on the subject.

 

--

 

Elizabeth M. Ferrarini is a free-lance technology and  business writer from Boston, Massachusetts. You can reach her at elizabethferrarini@yahoo.com.

| More
235 Views 0 Comments 0 References Permalink Tags: article, it_management, jon_beyman, lehman_brothers, security

The 21st-century CSO

Posted by Tom Parish Nov 20, 2007

by Deb Radcliff

 

The job description of a hybrid Chief Security Officer (CSO) with responsibility for physical and IT security has been elusive ever since the American Society of Industrial Security formally began defining such a role in 1999 during its national conference in Washington, D.C. Even today, if you ask ten experts, you'll get as many different

opinions -- all of which still fall into one of the same two camps.

 

To the enterprise-centric, it means blended identity and access management systems, maybe even security systems (e.g., cameras, videos, door entry) running over an IP network. But CSOs who've been at this a while say it's much more the convergence of physical and technical security. As such, their hands are just as full, with executive protection, workplace violence, regulatory compliance, supply chain, conflict-of-interest, disaster operations and other risk areas competing for their attention.

 

"People have been talking about the concept of how security interrelates and comes together for some time," says Tim Williams, CSO of Nortel, with a 25-year background in corporate security compliance starting with Proctor Gamble in the 1970s. "What it really boils down to is layers of interdependencies between all our business operations prioritized by what we deem most critical to our operation, which is the intellectual property and capital that comes from our employees."

 

NortelNetworks.jpg

Figure 1. Earnings drivers. Nortel Networks Corporate Security analyzed corporate strategy, the processes, and assets that drive our success and the risks jeopardizing all. Every company will have its own set of earnings drivers and risks to consider when integrating security with enterprise strategy.

 

Where convergence occurs, then, is where interdependencies naturally  arise.

 

On an organizational level, for example, this would mean the guard needs to be trained in data center disaster recovery and understand that physical security in the data center is wound around audit trails, which only approved people have physical access to, says J.P. Callahan, operations security executive, customer data center security, Verizon Business. On a tactical level, convergence occurs when you replace a guard's station with a self-sign-in kiosk that can be watched remotely over the enterprise network.

 

Form Partnerships Now

Such technological convergence is already occurring. By 2007, the physical and IT security convergence market will command global revenues of over $6 billion, exceeding $22 billion by 2010, according to 4A International, a converged security analyst and consultancy firm based in Chicago.

 

"In five years, all of the systems that physical security relies on will be developed by IT companies," says Steve Hunt, President and founder of 4A. "That means that the IT professional, whether he likes it or not, becomes a major influencer in corporate physical security. My advice is not to let it go to your head. Form constructive relationships with your security staff today rather than wait for political battles tomorrow."

 

Such partnerships are critical, agrees Williams. Williams, with a staff of 18, reports to the VP of corporate compliance with what he calls a dotted line to the CIO.

 

"If we've had any level of success here at Nortel it's because of the CIO/CSO relationship and the drive of our CIO to make security part of our culture," Williams says. "I'm joined in my objectives with his objectives to provide a more secure network."

 

Tearing down silos is one of the biggest challenges facing the integrated CSO, says John Pontrelli, CSO of TriWest Healthcare Alliance, a medical services outsourcer for the U.S. government.

 

"My job is to take the hot seat for security, and that includes data on the enterprise network. When I explained that, our CIO was more than happy to defer that risk to me," says Pontrelli, who reports to the COO.

 

To do so means aligning with the CIO in a shared vision of protecting the network and the human capital that represents, he continues, adding, "We've got to have mutual respect, and the ability to work together quickly to support fast-moving business applications."

 

Pontrelli, like Williams, has a long history in converged security. In the mid-1990s, he set up the first combined physical/IT security group at Microsoft, then again at Gore Associates (the company behind Goretex and Teflon), before coming to TriWest in 2003 to do the same. Of his nine reports, four are directly responsible for network event monitoring and access security. And he co-located his physical and technical security staff to stimulate cross-training between the two groups.

 

Hunt praises TriWest as one of the truly converged organizations in a small portfolio of perhaps a dozen Fortune 500 organizations trying to manage the two disciplines under the single title of CSO.

 

At ten years old, TriWest has the advantage of being agile enough to grow up with a convergence mentality, says Pontrelli. Older companies are less nimble, particularly if there've been mergers and acquisitions, taking on average about five to six years to converge security across their organizations.

 

"There's a veritable dearth of awareness about what it's going to take to manage security that utilizes the best of physical and the best of IT security," adds Hunt. "From the IT side, there's little awareness of the politics of regulatory compliance, budgeting, and the business and architectural value of building streamlined systems and functionality."

 

Layers of Accountability

That's why Williams helped to develop the ASIS CSO  Guideline, published in 2004. In the report, Information Technology is identified as one of many risk areas under the responsibility of the CSO. Others, equally important, include human resources and intellectual assets, ethics and reputation, financial assets, IT systems, transportation, distribution and supply chain, legal, regulatory and general counsel, physical and premises, environmental, and health and safety.

 

Also in 2004, Williams developed a roadmap around Nortel's inter-dependencies where shared risk resides, the results of which were published in a Nortel white paper titled "Integrated Enterprise Security," released in 2004.

 

"In our plan, business continuity must have a cross-functional relationship with risk management, finance, and control areas where they move together across the organization," Williams says. "So we assess risk across the organization with an emphasis on business drivers: What are the risks to those drivers and what are the interdependent risks between functions and processes?"

 

SecurityProcessMap.jpg

Figure 2. For integrated security to be most effective, the enterprise will need to map security processes within each discipline and document where different groups have process ownership and cross-functional responsibility.

 

Once this mapping was completed, Nortel had identified who owned what security processes and the cross-functional team members working to support them. Interestingly, Information Security was owner of, or cross-functional partner in, all but three categories.

 

That's because much of corporate risk today is regulation-driven. And technology provides the best means of meeting new regulatory requirements.

 

"Right now, auditors have to go around and visit each business group and look for physical signatures on documents. Why not sign them electronically?" explains Callahan. "You can also answer other questions. Like who was physically in the room when something happened on the computer network?"

 

Logically, we do this very well, he continues. If there's a problem, firewall logs go off and correlate with access and security event management to tie everything together at a time and place. Just like our logical systems, he adds, we need a physical dashboard to manage events at the facilities level.

 

Pontrelli's already converged physical security information gathering into his 21-state enterprise network. Alarm monitoring, door activity, cameras, intrusion detection, and burglar systems for more than 150 sites ride over the corporate IP network.

 

"To me, it's all about data," Pontrelli says. "So if I'm not going to integrate my security systems with my data systems, then why bother?"

 

Falling Through the Cracks

Without integration, he adds, critical information can fall through the cracks and create new risk. As an example, Williams retells the story of how a Nortel client's corporate data center was shut down for hours because a contract security guard mishandled a prank bomb threat and evacuated the data center staff.

 

Another client, he says, kept getting its system hacked by authorized user passwords even after they were reset. Suspicious, corporate security finally observed the dumpster late at night after a janitor recalled "homeless" people near the bin after hours. Turns out the homeless were hackers that were "dumpster diving" for passwords on sticky notes, forms and other slips of paper the employees threw in their garbage cans.

 

Ultimately, that's where physical and IT security most come together: In educating employees, explains Callahan. The Nortel interdependency matrix supports this, with cross-over functionality listed for all risk factors in the category of employee education.

 

So, to prevent the tossing of passwords into the garbage, password protection and shredding policies should be taught together. And if you're teaching them about a new physical/logical security access card, remind them that bad guys can circumvent this security when they "tailgate" close behind an authorized employee into the building, just as easily as they can "shoulder surf" information off their open computer screens by reading over their shoulders.

 

"To ASIS, their vision of the CSO is the single stop for four different risk management disciplines," Pontrelli explains. "Information security, physical security, risk assessment, and business continuity. These are all wrapped into what we call the 21st-Century CSO."

 

It doesn't matter how you get to the job of CSO, continues Pontrelli. It could be the path he and Williams took, as both have military security backgrounds and went corporate with business management degrees and CISSPs. Or it could be CISOs who've trained with ASIS and other security training and membership organizations.

 

That's because the role is not so much about facilities and technology as it is about identifying and managing risk across the organization.

 

"Who's better equipped to handle this, the CISO or the CSO?" asks Williams. "That would depend on the person's business acumen, leadership characteristics and political skills needed to drive the function."

 

Of Note

In February, the Alliance for Enterprise Security Risk Management (AESRM) www.aesrm.org, announced a series of studies it  will release on the matter of convergence at security conferences starting in  June.

 

These conferences will be hosted by the three organizations responsible for the 2005 formation of AESRM to provide guidance on matters of convergence, including integration of technologies, value proposition, international security, and the formation of risk councils. The groups behind AESRM include American Society for Industrial Security or ASIS www.asisonline.org, Information System Audit and Control Association (ISACA) www.isaca.org the Information System Security Association (ISSA) www.issa.org.

 

--

 

Deb Radcliff is an award-winning freelance writer, educator and speaker based in Northern California. She's been covering online crime and security ever since working as researcher on a book about infamous hacker, Kevin Mitnick back in 1995.

| More
260 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth Ferrarini

 

Each week about a million IT professionals take courses either online or onsite through one of New Horizons Learning Centers. In fact, since 1982, New Horizons has grown to become the largest publicly held IT training company in the world. The company has 255 sites in 50 countries and offers courses in every aspect of IT, ranging from Oracle databases to certification in Linux. New Horizons Worldwide, which had revenues of $500 million in 2004, owns the Learning Centers.

 

Shoukry Tiab, the Learning Centers's CIO, has the daily responsible of making sure that the network infrastructure enables students and the 3,000 instructors to collaborate with each other. Prior to joining the company, he spent 15 years as CIO of a post-secondary education company with 28 nationwide locations.

 

Enterpriseleadership.org sat down with Tiab to discuss the Learning Centers technology initiatives, best practices, and trends in corporate IT training.

 

EL: Can you describe your organization in terms of people, systems,  data centers, and so on.

 

ST: The IT organization consists of 30 employees working in categories such as desktop support, help desk, security, infrastructure and telecommunications, project management, and quality assurance.

 

One of our data centers runs the corporate office, while the other data center houses our enterprise applications for the entire network. Our network supports about one million students and 3,000 instructors and other staff employees. These folks log onto a backoffice application housed at that data center. We can track, book, and deliver our training through the Web. Our platforms include Cisco, Microsoft, and Hewlett Packard (Compaq).

 

EL: What is your IT vision for your organization's  success?

 

ST: Since we support a lot of enterprise applications, the organization's success depends on many factors, such as our workforce efficiency. Our vision focuses on how well we harness advancements in new technologies in areas such as telecommunications, bandwidth, and collaboration tools. Our success also depends on our ability to provide decision makers and the executive team with timely and accurate information.

 

EL: Can you talk about the types of collaboration tools you  use?

 

ST: Centra provides our training platforms. We use some WebEx and a combination of Microsoft products for internal communications and training. For the past four years, we've been using voice over IP (VoIP) for training, but not for our infrastructure. In fact, we've seen a double digit increase in our own training revenues as a result of VoIP.

 

EL: When are you going to move VoIP to the business side of the  house?

 

ST: It's going to blend in without anyone forcing it. Our infrastructure allows us to move to VoIP. The cost of adding equipment and interrupting the normal business process at this time outweigh the benefits we can get from VoIP.

 

EL: Any more innovative technologies you have deployed, either in  your business or in your training programs?

 

ST: Service-oriented architecture will help us to break the gap between the different units in our organization. It all depends on communication and how we do that. We finished a project to roll out Microsoft's SharePoint, a Web portal that allows people to communicate in a non-expansive method. This platform will provide a push-pull technology to allow our data centers and our people in the field to get the information they need when they need it.

 

EL: Your Web site has information on your corporate governance  policies. What forms of governance do you have in place for IT?

 

ST: We just completed our Sarbanes-Oxley audit, which was a roller coaster ride. However, we learned a lot from the experience. It forces organizations to look back at their process and controls, and manage them in a better way. We haven't used software to track the management of internal controls, although we have used some of the common industry standards such as COBIT (Control Objectives for Information and Related Technology) and COSO (Committee of Sponsoring Organizations). They both offer the open standard that is published by the IT Governance Institute.

 

EL: Do you use any quality initiatives such as Six  Sigma?

 

ST: We haven't instituted a complete Six Sigma process, but  we have learned a lot of lessons that are carried out internally.

 

EL: Like what?

 

ST: From a quality assurance perspective, the non-conforming process will definitely yield an off-the-chart negative result for internal operations. One of the Six Sigma lessons we learned is how to bring back a non-conforming process into a framework that can be measured and has expected outcomes you can improve.

 

EL: Where are you seeing demand for corporate technology  training?

 

ST: The need for security training keeps growing. Recently we've seen an added demand for software skills in the healthcare industry. Networking and security training uses a lot of IT resources. Business productivity is our most popular application for training.

 

Companies no longer look at how training shows employees how to use an application. They want to know how to improve their productivity by using a specific applications.

 

EL: What kinds of proprietary applications have you developed for  training that you use in house?

 

ST: We've worked on providing or customizing a learning management system. We also worked on providing the platform for delivering online training by tailoring applications ranging from Centra down to e-labs, which provides students with a live machine over the Web. In other words, we combined all of these things into one point of entry, which tracks where and what students do online, and provides a progress report to both students and their managers.

 

EL: Can students use a thin client on your network?

 

ST: Our system is more about Web access than thin client access. However, our 3,000 employees use thin client access daily. They do have badges they can use to plug in and get to their desktop, as long as they can get to a network that allows a secure connection.

 

EL: How does your job differ from that of CIOs in the corporate  environment?

 

ST: It encompasses enabling business process as well as providing the basic tools for these activities. Service is a big piece. Our business, at any one time, has more customers than most organizations, and the quality of the customer's experience depends on what we do in IT daily. So, unlike some other CIOs, I to know about and handle need the slightest problem the customer has with the network.

 

EL: How do you handle vendor relations?

 

ST: The greatest challenge of acquiring hardware, software, or services is accomplishing the many steps in the process. We want to use vendors who make it easy for us to acquire products. By standardizing on a couple of key vendors -- Microsoft and Cisco -- we've been able to leverage our large company buying power and get what we want from these vendors.

 

EL: Describe a risk you've taken and what was the  outcome?

 

ST: Every day we make decisions that have risk factors. For example, we took a big risk by providing an ASP model to offer all of our services to our franchisees. The outcome has been good. However, since we are hosting the backoffice databases, some franchisees didn't immediately warm up to accessing their daily business tools from us.

 

EL: Where are your cost-cutting, or cost-saving, efforts coming  from?

 

ST: We derive cost savings through process flow automation, as opposed to the application of hardware deployment. Each day, we can get a request, such as, "Can I get an application or a tool that can help me?" Often, the tool doesn't cover the big picture. We need to take the process from A to Z and find how can we make technologies integrate to simplify people's lives. That's where we see the cost savings.

 

Process automation and process-flow automation will become the IT buzzwords by the end of this year. We're no longer trying to hire someone who knows how to install hardware or software. We want a business analyst who understands how we can make the process more effective.

 

--

 

Elizabeth  Ferrarini is a freelance writer and an IT consultant from Boston,  Massachusetts.

| More
290 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

 

Xerox's 50-year history has run the gamut from a that of a leader in disruptive technology, to bad product mixes; from financial turmoil, to financial and market share recovery. In 1959, the company rolled out the first plain paper copier, the 915, and also trademarked the duplicating process as "Xerography." The company's name was changed to Xerox. Other innovations have included the invention of Ethernet, the first laser printer, and the first plain paper FAX machine. During the 1980s, Xerox dabbled in everything from typewriters to personal computers.

 

At the start of the new millennium, however, Xerox found itself in enormous debt and near bankruptcy. It was by carrying out massive "rightsizing" programs such as Lean Six Sigma that this legacy disruptive technologist has reduced its debt from $17 billion to $7.3 billion, and has cut the workforce from 110,000 employees to 55,000 employees. Today the company owes its $15.7 billion annual revenues to a leadership role in digital printing.

 

Since 2002, $600 million of the $1.8 billion reduction in operating costs has come from IT. And in what may be supreme understatement, Patricia Cusick, Xerox's CIO for the past seven years, says of her first two years in the role that it was "an intense period." Enterpriseleadership.org recently sat down with Cusick to talk about the cost cuts, the role of Lean Six Sigma in IT, and the way IT works with the business units.

 

EL: Can you provide an overview of your IT organization?

 

PC: The IT worldwide organization has about 3,500 people -- 1,000 are Xerox employees and the rest, either from EDS, our primary IT supplier, or other contract sources.

Xerox IT employees handle strategic planning for IT and the linkages with the business partners. For example, relationship managers support specific territories within business units, such as sales, or manufacturing. These managers understand the business and the systems requirements, and can provide the appropriate delivery service, whether it's internal or through an outsourcer.

 

At the next level of IT, we have integration folks who work on how applications come together. Our project teams in this area work within different organizational models. Xerox personnel tend to work on proprietary solutions. Project management teams use people with similar skills. Project creation-to-delivery teams comprise people with a range of skills who are drawn from inside the organization and from our outsourcers.

 

EL: Can you talk about how you accomplished the cost cuts in IT?

 

PC: Because the company was near bankruptcy, we were under pressure to cure the company's financial health. Improvements in productivity, starting with the CEO on down, have became a key driver of returning Xerox to profitability. IT played both the role of participant and enabler, finding places to reduce costs through automation. We were successful at making the company lean and more efficient.

 

Cuts in the number of employees and the outsourcing of key functions such as manufacturing reduced the size of the operation IT had to support. Meanwhile, we started to consolidate a whole series of decentralized IT operations across the company. This consolidation and standardization across operations, and improvements in productivity enabled us to drive $600 million of cost out of IT.

 

EL: How does Lean Six Sigma factor into productivity improvements in  IT?

 

PC: Since 2003, we've been developing our Black Belts and training in Lean Six Sigma, and we've been using the Lean Six Sigma tools and the methodology to standardize IT processes. This causes us to focus on how we can reduce costs and meet our productivity goals. For example, the IT people on the business teams focus on how to simplify their processes by getting rid of waste, and automating any manual tasks.

 

Lean Six Sigma has helped us to put better processes around the entire application development flow -- from project requirements to final production. In fact, the applications development process flow is very similar to that of product manufacturing, where Lean Six Sigma has its roots. For example, we have an initiative going on now called "patch progression." When we get a fix from a major supplier, such as Oracle, we identify the environment, make sure it's compatible and tested for integration, and then we promote it to production. Using Lean Six Sigma, we've laid out the individual steps in this process, looking at where there was time lost and how we could simplify that process.

 

EL: What does your governance model for IT include?

 

PC: Our information management board, which I head, meets annually with the executive committee to go over upcoming projects and their budgets. Each quarter, we meet to review project status, budgets, and project deliverables. This process repeats itself down through the various working levels of the organization.

 

EL: How do you ensure that IT delivers on what is promised to the business  units?

 

PC: Our overall lifecycle management process, which we call "time to market," is key to IT's delivery of services. It uses the same type of process we have for our product delivery. The process has all of the same disciplined phases, starting with the business engagement and examining all of the requirements. Each project has a decision team -- a partner from IT and a business owner -- which report to a governance board. For example, the decision team goes through phased exits at each point in the lifecycle. At each point, the team must account for the business case to the board. These steps exist to ensure that we've met our objectives. The entire lifecycle process helps us to keep the alignment with the business units, as well as with the IT project teams.

 

EL: What kinds of training programs do you have to keep IT people on the  ball?

 

PC: We have development efforts across all levels of the organization. We set a specific number of hours each year for each IT employee. We also do extensive e-learning, both within the company and externally. And we do a lot of creative things such as the Lunch and Learn program. Each week, we'll have a program for IT people, such as an overview of Microsoft security updates.

 

EL: What initiatives have IT undertaken to drive product  innovation?

 

PC: We created a remote capability that enables customers' machines to link to us for things such as ordering supplies, doing meter readings, and alerting technical support to a problem. This communication is accomplished entirely over the network; interactive communication with our products has helped to strengthen Xerox's competitive advantage.

 

EL: How do you promote technology careers outside of the company?

 

PC: I'm a member of the Rochester CIO Roundtable, which works with local colleges to promote IT careers. We'll take a few days and go around and talk to students about our roles in IT and the kinds of people we're looking for.

 

EL: What were some of the most challenging assignments you've had as a  CIO?

 

PC: Supporting the CEO, Ann Mulcahey, in her efforts to turn Xerox around and return it to greatness has been both the most challenging task, and most rewarding, of my career. We had to have absolute focus on managing our expense base, changing the profile of the campus, and concentrating on our customers and technology. As for IT, my challenge was to make IT a shared service, while driving cost reduction and being sensitive to the minds and hearts of the people.

 

Another challenge has been to build the credibility of IT people among business partners inside the company. I feel passionate about getting IT people to be involved in how every aspect of the company works together.

 

--

 

Elizabeth M.  Ferrarini is a free-lance technology writer from Boston, Massachusetts.

| More
309 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy

by Elizabeth M. Ferrarini

 

Around 2003, McKesson Pharmaceutical, a $71 billion distributor of pharmaceuticals and a business unit of McKesson Corporation, couldn't take the consistency of its data for granted. The company was suffering from data proliferation brought on by multiple data repositories and reporting systems for order processing, inventory, and finance.

 

Things began to change when Brian Hickie, a 10-year McKesson veteran with experience carrying out and auditing IT systems, was asked to bring together an ERP system and a fledging business intelligence system. For three years, Hickie has been the business lead primarily responsible for the design, implementation, and adoption of one of the largest SAP Business Warehouse implementations in the world.

 

Enterpriseleadership.org recently spoke with Hickie, vice president of business intelligence at McKesson Pharmaceutical, about the challenges of getting the major phase of this business intelligence system off the ground in record time. He has spoken about business intelligence at computer industry conferences and business conferences, such as a recent conference put on by the Economist.

 

EL: What were some of the specific business reasons leading to the  business intelligence initiative?

 

BH: The senior executives knew it could provide good process improvements, gains in productivity, or close the profit leaks. If we had better information in these areas, they also knew we could derive some significant benefits to the bottom line.

 

We knew we needed a business intelligence implementation that integrated data across various applications. We wanted to look at the granular level details and bring all of our legacy systems into one location. Building out the analytics would give us a whole view of the entire process.

 

For example, our legacy warehouse systems contain certain inventory information, such as quantity. Our SAP system does most of the valuation of those inventory quantities. We already had a full picture of the distribution center from a quantity and a pricing perspective. We needed to build a business intelligence system to join these two systems together.

 

EL: What has been the bottom-line payback to the  company?

 

BH: For competitive reasons, I can't provide any dollar amount. Let me put it this way: It was a significant amount, and we've done a good job of hitting that target.

 

EL: Can you give a specific example of a process improvement you  derived from the business intelligence system?

 

BH: For a long time, we were pulling month-old data from our inventory adjustments within our distribution center. It took days to figure out what was happening. With the new solution, we get next-day analytics and can resolve any problems on a just-in-time basis.

 

EL: What are some of the analytical tools end users have in the  business intelligence system?

 

BH: We use the native functionality in the new SAP solution. It's a beefed-up version of an Excel-based tool. A plug-in enables you to do various drilldowns, robust sorts and switches, and characteristic and attribute switching. Each Excel workbook page can be turned into a Web page. It also has a scorecard and dashboard functionality through the Web application. Our financial users are happy with that type of analysis tool because they use Excel all the time.

 

EL: Can you discuss the types of users who benefit from the business  intelligence system?

 

BH: The bulk of our users come from the finance side of the house. However, we've reached out also to the operations people who run our 30 distribution centers, as well as the sales people.

 

EL: Just how much data do you pull off daily?

 

BH: We pull anywhere from 15 million to 20 million records a night out of the transactional systems and load upwards of 30 million to 40 million records a night through our data warehouse solution. On volume, we're one of the largest data warehouses for SAP. Our SAP data warehouse system resides on Oracle in a 10-terabyte data warehouse. We use IBM AIX hardware.

 

EL: You started out having people build their own queries and then  you stopped this procedure. Why?

 

BH: We still have people doing this because we haven't gotten to them yet. Our goal initially was to get as many of our analytical end users running on this solution. Some users were building queries, left and right. The number of queries at one point exploded to 5,000 queries being used by many different people. Then, some people were forgetting about the queries they built -- things got so out of control. We came up with a policy that required deleting the queries that hadn't been used in 90 days.

 

Our discussions with end users made us realize that despite the data dictionary, they didn't have a good understanding of their data. We looked at all of the queries and assessed how they were using them. My team came up with the "master query" concept. We took 700 queries in the cell area and reduced them to 50 queries. End users could now execute everything they needed to do within that master query. It allowed us to eliminate the number of queries that were out there, and also allowed everyone to be on a consistent page when it came to getting results for data. By working at the database level, the application level, and the query level, we were able to tune those queries to run really fast. We've gotten significant performance gains as well.

 

EL: How do you prioritize business intelligence  requests?

 

BH: I prioritize the business intelligence requests, but we also operate in the larger realm of governance. We're currently working with groups of end users to determine what are the highs priorities of things to get done, but the process is by no means perfect.

 

EL: When it came to the business intelligence system, how did you get  on the same page with the ERP folks?

 

BH: That was a challenge. This business intelligence system had been running in parallel with the ERP system, which was the SAP Sales Distribution and Materials Movement Module. The ERP team had been working on our system for several years. Business intelligence was sitting on the fringe, trying to build data warehouses.

 

I was asked to work with the ERP team and bring the two systems together. We had nine months to accomplish this. We had to capture the new data that was coming out of the ERP system and the financial data that existed on our legacy systems. Our goal was to get that data in the lower levels. The ERP team drove what the requirements were for the data provisioning aspect and some initial reporting. My team became more of the subordinate group and listened to what was going on from a transactional perspective and from the perspective of building the data provisioning. It worked very well, despite some cultural and political things. Within seven month, we provisioned the data and built initial analytics.

 

EL: Are you moving towards the Balanced Scorecard?

 

BH: We're moving slowly towards business performance management, such as the Balanced Scorecard. First, we want those folks who are closest to their data to really take the time to understand it. Business intelligence brings data to life in a different realm. As a result, you have to give these folks a chance to explain the issues that may come up from a Balanced Scorecard. We still have a lot to do in process-based analytics before we get there.

 

EL: What are some of your upcoming projects for business  intelligence?

 

BH: We're continuing to build the process-based analytics, but we are looking at operational business intelligence. We want to be able to provision the data more quickly across this environment. We also want to look at the processes and ask ourselves, how quickly can we get the data to end user? We need to address more of our business users.

 

--

 

Elizabeth M.  Ferrarini is a free-lance technology writer based in Boston,  Massachusetts.

| More
304 Views 0 Comments 0 References Permalink Tags: article, best_practices, compliance, governance, innovation, it_management, itil, open_source, security, strategy
1 2 3 4 ... 7 Previous Next

Actions