Top Banner
Managing Operations Chapter 8 Information Systems Management In Practice 7E McNurlin & Sprague PowerPoints prepared by Michael Matthew isiting Lecturer, GACC, Macquarie University – Sydney Austral
79

Managing Operations

Mar 19, 2016

Download

Documents

Skyler

Managing Operations. Chapter 8 Information Systems Management In Practice 7E McNurlin & Sprague. PowerPoints prepared by Michael Matthew Visiting Lecturer, GACC, Macquarie University – Sydney Australia. Chapter 8. The three major operational issues discussed are: - PowerPoint PPT Presentation
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Managing Operations

Managing Operations

Chapter 8Information Systems Management In

Practice 7EMcNurlin & Sprague

PowerPoints prepared by Michael MatthewVisiting Lecturer, GACC, Macquarie University – Sydney Australia

Page 2: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-2

Chapter 8• The three major operational issues discussed are:

– Outsourcing information systems functions– Information security, and – Planning for business continuity

• Due to mergers, the Internet, e-commerce, and the September 11 terrorist attacks, the subject of computer operations has been receiving a lot of attention

• Systems operations are important because, if they are not professionally run (and backed up properly), a computer or network crash could shut down a company’s business for some period of time

• Case examples include Microsoft, ANZ Banking Corporation, Mobil Travel Guide, Eastman Kodak, Honda Motor Company, Exult, Credit Card Fraud, Plymouth Rock Assurance, and Household International

Page 3: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-3

Today’s Lecture• Introduction

• What are Operations– Why Talk About Operations?– Solving Operational Problems– Operational Measures– The Importance of Good Management– What’s New in Operations

• Outsourcing Information Systems Functions– The Driving Forces Behind Outsourcing– Changing Customer-Vendor Relationships– Outsourcing’s History– Managing Outsourcing– Offshoring

Page 4: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-4

Today’s Lecture cont.

• Information Security– The Threats– Security’s Five Pillars– Management Countermeasures– Technical Countermeasures

• Planning for Business Continuity– Using Internal Resources– Using External Resources

Page 5: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-5

• Due to mergers, the Internet, e-commerce, and the September 11 terrorist attacks, the subject of computer operations has been receiving a lot of attention

• Systems operations are important because:

– If they are not professionally run: • A company could suffer a computer or network crash that could

shut down their business for some period of time

• It is not a trivial area, especially as companies become increasingly reliant on networks and computers to run their business

Introduction

Page 6: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-6

• Poorly run IS shops cause IS executives to end up ‘fighting fires’ instead of setting policy

OR

• They find themselves looking for a job!

Introduction cont.

Page 7: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-7

The main change in operations is the shift in viewpoint towards managing operations (Figure 8-1):

• Traditionally – managing inward, i.e.: managing one’s own operations staff

• Today – just as likely to mean managing outward = managing relationships with (external) service providers– Outsourced IT service providers who have taken over the day-to-day

operational work• In some instances

• Back to the future?– Benefits not realised– Unexpected costs - $ and otherwise

Introduction cont.

Page 8: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-8

Page 9: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-9

What Are Operations?Why Talk About Operations?

• A Typical MIS Department Budget:– 33% Systems and Programming

• 70% Maintenance• 30% New Development

– 10% Administration and Training– 57% Operations

• Involve more $$$ than any other part of the IS department

• Very involved (difficult), challenging and rewarding area

Page 10: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-10

What Are Operations? Solving Operational Problems

Operational problems are obvious to the entire company:• Response times are slow• Networks are down• Data isn’t available• Data is wrong

Page 11: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-11

What Are Operations? Solving Operational Problems cont.

• Three strategies to improve operations:1. Buy more equipment2. Continuously fight fires and rearrange

priorities, getting people to solve the problems at hand

3. Continually document and measure what you are doing, to find out the real problems, not just the apparent ones. Then set standards and manage to them = the preferred solution

Page 12: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-12

What Are Operations? Operational Measures

• External: What the customer sees:– System uptime– Response time – Turnaround time – Program failures

• = Customer Satisfaction

• Internal: Of interest to systems people:– Computer usage as % of capacity– Disk storage used – Job queue length etc.

• Problems reported by external measures can be explained by deviations in internal measures

Page 13: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-13

What Are Operations? The Importance of Good Management

• The corporate culture created by IS management must recognize and value good operations

• Skills of an Operations manager = similar to that needed in e.g. a factory– Manager must schedule work to

• meet delivery dates, • monitor performance• respond quickly to problems

• The key to managing operations is the same as in any management job: – Set standards– Then manage to those standards

• By finding an outstanding operations manager

Page 14: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-14

What Are Operations? What’s New in Operations?

• Companies have ‘cleaned their operational house’ – Y2K and the Internet forced this– Now = most in relatively good shape

• More Operations managers are Managing outward – BUT CIOs must not relinquish responsibility for Operations– Ensure their people are properly managing relationships

• Operations are being ‘simplified’– Centralizing applications in one place rather than distribute them on PCs

• Server based computing (Chapter 5)

• Certain operations are being offloaded– e.g. webcasts

Page 15: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-15

MICROSOFTCase Example: Offloading of Operations (Webcast)

• The launch of a new version of Windows operating system was done via – Personal and– Public Internet broadcast– Private webcast – 6,000 OEM system builders in 83 countries

• Webcast by Akamai – >12,000 servers in 66 countries– Specializes in hosting corporate Websites– Giving users in far-flung locations fast downloads of Web content and

streaming media • Private webcast which set a record for:

– Attendance– Global reach– Audience participation

Page 16: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-16

What Are Operations? The Focus of CIOs in Operations is Changing • Their attention used to be focused on

ensuring they had the in-house expertise to keep systems and networks up and tuning

• Their attention is now toward determining where best to perform the various kinds of operations:– In house or with a third party (or permutations

and/or combinations thereof)– Then manage it accordingly

Page 17: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-17

OUTSOURCING INFORMATION SYSTEMS (IS) FUNCTIONS

• Outsourcing means turning over a firm’s computer operations, network operations, or other IT function to a vendor for a specified time

• CIOs are expected to at least to ‘prove’ that their in-house operations are as efficient and effective as if they were outsourced– Shared Services concept– Should outsource what they do not do well

Page 18: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-18

• Focus on core businesses: In the 1980s, this led to huge amount of merger and acquisition activity

• Shareholder value: Companies were “priced” based on their shareholder value, that is, their discounted cash flow, as a result of high-yield bonds that allowed a few people to buy a company and leverage it with debt– Management must stress value, they must consider

outsourcing in all their nonstrategic functions– U.S. driven – other countries have variations on this

pricing (share market) model but the drivers = still $$$• And ‘follow the leader’ / trend?

Outsourcing IS Functions:Driving Forces Behind Outsourcing

Page 19: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-19

• Relationships have expanded from buying professional services, to buying products and transactions, to integrating systems, to outsourcing – the most bundled approach to contracting

• In this evolution:– CIOs have increasingly lost control

• More activities turned over to outsiders– Providers take on more risks

• As they move to (options on) the right of Figure 8-2– Provider’s margins increase

• Again = to the right• Risks also improve: Don’t get “Nothing for nothing!”, and

– Importance of choosing the right provider becomes more important

Outsourcing IS Functions: Changing Customer-Vendor Relationships

Page 20: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-20

Page 21: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-21

• In 1989 only (full) IT outsourcing was available– Essentially began with ‘big-bang’ deals.– The goal was purely financial.– Problems occurred – ‘us VS them’ and culture clash

• Note: ‘Outsourcing’ existed in many other areas and had for years e.g. trucking

• Early 1990s: Transitional outsourcing– Two routes outsourcing legacy systems

• Maintenance of their legacy systems – hence – staff concentrate on building new client server systems

• Client server development to specialists & keep maintenance in-house

• Mid to late ’90s = Best-of-breed outsourcing– Selective outsourcing began– ‘Collaborative outsourcing’ – one company prime contractor and

secondary external service providers

Outsourcing IS Functions: Outsourcing’s History

Page 22: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-22

• Shared services– “in-sourcing” to shared service group-

• Improved efficiencies & • Saved money

• Business process outsourcing– As IT Outsourcing ‘matured’ it became a commodity

service • Profit margins dropped• Competitors rose• Quality Vs. Cost Vs. $$$ Vs. Pressure – not all was ‘happy’

– Higher margins in specialized specific areas• Business process of which IT was a significant component

Outsourcing IS Functions: Outsourcing’s History cont.

Page 23: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-23

Page 24: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-24

ANZCase Example: Business Process Outsourcing

• Australia’s third largest bank has outsourced its procurement function, not to reduce costs, but to gain greater quality purchases and lower ANZ’s annual purchasing spend

• The bank has learned numerous lessons in this world-leading outsourcing deal:

1. Be prepared to change the contract as your environment changes2. Make step changes in technology and processes to save time and money,

focus on having an effective transition3. Do your best to make the outsourced group appear seamless to your

employees4. Focus early on what you want and don’t get sidetracked5. Keep incentive mechanism simple and transparent6. Be able to benchmark performance, and

7. Understand, to a fair degree of detail, the value chain you plan to embrace

Page 25: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-25

• E-business outsourcing– With the arrival of business use of the Internet, outsourcing has

been one way that companies can quickly get Websites up and handling business

– In dot-coms and Internet- based operations• Preferred mode of operation

– Even with the dot-com crash = still a legitimate way to mobilize for e-business

• Allows a company to move fast• Companies can remain flexible• Does not tie up $$$ in computer and networking equipment

– Obsolete?

Outsourcing IS Functions: Outsourcing’s History cont.

Page 26: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-26

• Utility Computing– Also known as on-demand computing, virtual data centers and grid

computing• Idea = computing power can be treated like electricity: You plug in and only

pay for what you use– Numerous vendors, especially IBM, HP and Sun are promoting access

rather than ownership• Selling the idea of turning clients’ fixed IT costs into variable costs

– Important to understand:• The amount of consulting required• The chargeback mechanism (for only paying for use)• The contract terms• Where it could provide benefits etc.

• In 15 years, IT outsourcing has expanded (and changed) significantly

Outsourcing IS Functions: Outsourcing’s History cont.

Page 27: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-27

MOBIL TRAVEL GUIDECase Example: Utility Computing• Illustrates the convergence of e-business and IT

outsourcing into utility computing in a high-need area: its Web site

• Travel guide for North America– Information static and site couldn’t handle the spikes in

demand during e.g. holidays• Wanted to upgrade site but rather than making the

large investment to upgrade its own IT resources = turned to IBM to host and manage the site– No need for upfront investments– No concern re handling peaks

• Saving 35% in maintenance and software costs• Only paying for what it uses of IBM’s world-class,

highly scalable e-business infrastructure

Page 28: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-28

• Managing outsourcing is different from managing internal staff– One reason = it is a joint effort between parties that may not

have the same goals

• Typically, parties establish layers of joint teams.– Top-level team: final word in conflict resolution– Operational team: oversees day-to-day functioning– Joint special purpose teams: created from time to time to solve

pressing issues– Committees: oversee the use of formal change management

procedures– Relationship Manager(s): look after the ‘relationship’

• Skills = different to those of e.g. a data center manager

Managing Outsourcing: 1. Organizational Structure

Page 29: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-29

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing

• First IS outsourcing by a ‘good shop’– “Shocked the IS world”

• Four suppliers (ESPs) – manage portions of IS:

1. Operate data centers and networks2. Manage telecommunications3. PC support4. Voice messaging

Page 30: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-30

• Management structure:1. Management Board

• Meets twice a year, includes senior management from both companies – Focus on strategic issues

2. The Advisory Council• Meets monthly, 15 members- handles technical and

operational issues3. The Supplier and Alliance Management Group

• Manages long term outsourcing relationships & contracts with large IT suppliers

4. The Relationship Manager• Focal point between itself and service provider – ensures

Kodak gets more than just delivery5. Working Groups

Added to deal with specific technology areas.6. Client Surveys

Sent out twice a year to 5,000 internal users

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing cont.

Page 31: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-31

• Kodak needs all these forms of co-ordination for effective supplier management

• Considered a ‘best practice’ outsourcing and relationship model

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing cont.

Page 32: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-32

• The foundations of governing an outsourcing relationship are laid in the (LARGE) contract(s)• Service Level Agreement (SLA)

– Responsibilities, performance requirements, penalties, bonuses

• Another important component of SLAs is metrics. An SLA needs to be measurable to be of use• It is only when trust in one another breaks down that they turn to the contract. (Fig 8-4: Governance rules)

Managing Outsourcing: 2. Governance

Page 33: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-33

Page 34: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-34

• Recommendations to manage day-to-day interactions:– Manage expectations, not staff

• Facilitation becomes the mode of working. Rather than say “do this”, the approach becomes “how can we solve this together”

– Realize that informal ways of working may disappear– Loss of informal ways of working may add rigor– Integration of the two staffs requires explicit actions

• Does not happen naturally• Explicit policies are likely to be needed

– Don’t unduly restrict outsourcing staff access– Joint celebrations– Invite each other to meetings

– The best way to manage day-to-day is communicate frequently• Preferably ‘face to face’!

Managing Outsourcing: 3. Day-to-Day Working

Page 35: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-35

• Topic that is receiving increased attention

• Buying parts and services that go into one’s own products and services

• Assisting one’s suppliers to improve their product and services by generally improving their processes

Managing Outsourcing: 4. Supplier Development

Page 36: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-36

HONDA MOTOR COMPANYCase Example: Supplier Development

• Not an IT related example (manufacturing) but a good one!

• This automobile manufacturer conducted pioneering work in improving suppliers’ capabilities by pairing Honda engineers with a supplier’s engineers to drastically lower the cost of one part supplied to Honda

• The results are like “walking around picking money up off the floor.”

Page 37: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-37

• To round out our discussion of outsourcing, we turn to a topic receiving much attention today: sending work offshore

– Now = a big political issue• Late 1990s – Offshore outsourcing

– Started when labor markets were especially tight due to Y2K– Companies turn to offshore outsourcing because labor costs are lower and there

is ample supply of educated people• Ireland, India, Philippines

• The trickle in the late ’90s has turned into a steady stream of white-collar work going offshore

– Application maintenance and development– Call centers– Customer service– Back office processing– BPO– Claims processing– Etc.

• Manufacturers have faced international competition, whereas service firms have (had?) not

Offshoring

Page 38: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-38

Offshoring cont.

• Offshore outsourcing differs in some unique ways from domestic outsourcing

– Some areas to be considered:1. Offshoring options are broadening2. Both parties need cultural training to bridge

cultural differences• Clients = cultural integration programs• Providers = accent neutralization

Page 39: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-39

Offshoring cont.

• Offshore outsourcing differs from domestic– Some areas to be considered cont.

3. Communication issues need to be addressed from the outset• “Yes”

– Asia = “I hear what you are saying”– West = “I can do what you ask” or “I agree with you”

• Tips– Avoid colloquialisms such as sporting analogies– Use short, concise sentences with common words– Have the provider write a ‘statement of work’ to gauge

understanding– Get all commitments in writing– Include on your team someone who know their culture

• Communication issues continue throughout offshore relationships4. Country laws need to be followed

Page 40: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-40

EXULTCase Example - Offshoring• Provides full-service HR outsourcing to Global 500 companies

– Mature in outsourcing relationships because outsourcing is its primary business

• 2 Indian companies maintain its core HR computer systems (SAP & Peoplesoft)– Chose 2 Vs. 1 to ensure resources could be scaled up as needed

• In choosing the providers used consultants to do the detailed review and content (neoIT) and to structure the contract (TPI)– Aim = for best deal. Needed to understand the Indian market and

its practices. Consultants helped achieve that• Current split of maintenance work

– 70% Indian– 15% provider employees ‘onshore’– 15% Exult ‘onshore’

• Requires us buyers to work within the highly disciplined Indian maintenance processes rather than to try to change them– Applies to all outsourcing!

• Good economic outcomes

Page 41: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-41

Offshoring cont.

• Use Offshoring to Advantage– A major criticism is that it decreases skills and know-

how of its client’s IS organization• This need not be so

• Redefine Services Using Offshoring– Understand customers– Understand demographics– Stay in touch with customers– Offer end-to-end service– Dominate the screen

• As information moves online, companies are vying to control “the screen” = where the information ends up

Page 42: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-42

• Outsourcing has become a strategic alternative for companies– With the pace of change so rapid in IT and e-business, the

only hope of many companies is to tap the expertise of companies that are (paid to be) keeping pace with the changes

• = Their ‘day job’

• Outsourcing does not however mean relinquishing responsibility

• This is serious stuff– Marriage?– Trouble in ‘paradise’?

Outsourcing – The ‘Final Word’

Page 43: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-43

• Used to be an arcane technical topic

• Today even CEOs need to ‘know about it’ due to the importance of electronic information in running their businesses

• Need to understand Internet-based threats and countermeasures and continuously fund security work to protect their businesses

• Since 1996 the Computer Security Institute have conducted an annual survey of US security managers

– Spring 2004 survey report – 2 key findings:1. The unauthorized use of computers is declining2. The most expensive cybercrime was denial of service

Information Security

Page 44: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-44

The Threats

Note: heaps of similarSurveys e.g. KPMG

Page 45: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-45

Page 46: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-46

Information SecurityThe Threats• Threats are numerous• Websites are particularly vulnerable• Political activism is one motivation for

Website defacement• Theft of proprietary information is a major

concern• Financial fraud is still a significant threat

– Especially credit card information– No data of any value should be stored on web

servers

Page 47: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-47

CREDIT CARD FRAUDCase Example: Threats

• In one case, MSNBC reported that a bug in one shopping cart software product used by 4,000 e-commerce sites exposed customer records at those sites– One small e-commerce site did not receive the warning– Within days, cyber criminals charged thousands of dollars

on the credit cards of users of this small site

• In another case, two foreigners stole 56,000 credit card numbers, bank account information, and other personal financial information from U.S. banks– Then tried to extort money from the cardholders and the

banks, threatening to publicize the sensitive information they had unearthed

Page 48: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-48

Information SecurityThe Threats cont.

• Losses are increasing dramatically because companies have rushed into e-commerce, often with applications that do not have security built into the architecture or procedures– People think security can be added later but it really can’t be

bolted on as an afterthought– Best security = designed into applications via checks during

processing and at data transfer points

• It is easier to guard a bank vault than to guard every house in town– That’s why many companies are outsourcing their data

center operations to data center specialists with vault-like security

Page 49: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-49

• Mobile computing and telecommunications increase the possibility for crime– The greater number of network openings provides

opportunities for illegal entry• The rise of e-commerce and e-business put more

communications online to the Internet, which is open to everyone including crackers (evil hackers)

• As the Internet doesn’t (currently?) have intrinsic security protocols this public space is vulnerable

Information SecurityThe Threats cont.

Page 50: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-50

• The ‘hacker community’ (public club?)– ‘True’ Vs. Parasites

• Approaches hackers use:1. Cracking the password2. Tricking someone (social engineering = ‘cute’ term!)3. Network sniffing4. Misusing administrative tools5. Playing middleman6. Denial of service7. Trojan horse8. Viruses9. Spoofing

Information SecurityThe Threats cont.

Page 51: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-51

1. Authentication: verifying the authenticity of users

2. Identification: identifying users to grant them appropriate access

3. Privacy: protecting information from being seen

4. Integrity: keeping information in its original form

5. Nonrepudiation: preventing parties from denying actions they have taken

Information Security :Security’s Five Pillars

Page 52: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-52

• The major problem these days:– Enterprises cannot have both access to information

and airtight security at the same time

• Companies must make tradeoffs between:– Absolute information security and – The efficient flow of information

• Because airtight security is not possible:– Companies need to prioritize their risks and work on

safeguarding against the greatest threats• An example to consider is the case example of one company

from a Gartner Executive Programs report

Information SecurityManagement Countermeasures

Page 53: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-53

• Five major findings from the Computer Crime Survey:

1. Most organizations evaluate the return on their security expenditures

2. Over 80% conduct security audits– Including by ‘outsiders’ e.g. KPMG

3. The percentage reporting cybercrimes to law enforcement declined– Some = worried re

• Damage to stock price / company reputation• Competitors using for their advantage

4. Most do not outsource cybersecurity5. Most respondents view security awareness training

as important

Information SecurityManagement Countermeasures cont.

Page 54: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-54

Page 55: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-55

AN INTERNET SERVICES COMPANYCase Example: Security

• This firm’s starting point in protecting its systems is to deny all access to and from the Internet

• From there, it opens portals only where required, and each opening has a firewall and only permits specific functions

• The security team constantly “checks the locks” by:– Keeping track of the latest bugs found– Staying up to date on the latest security attacks– Subscribing to hacker e-mail lists and bulletin boards– Personally exploring some risks– Logging and monitoring all incoming and outgoing traffic, and – Testing the system monthly from a remote site

• Most importantly, it educates employees and clients as the greatest security precaution

Page 56: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-56

• The trend in computer security is toward defining security policies and then centrally managing and enforcing those policies via security products and services or policy-based management

• E.g. a user authenticates to a network once, and then a “rights based system” gives that user access only to the systems to which the user has been given rights– Establishes basic control of segregation of

duties– The ‘computer’ (system) is the control

Information Security: Technical Countermeasures

Page 57: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-57

Page 58: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-58

Three techniques used by companies to protect themselves

1. Firewalls: Control access between networks• Used to separate intranets and extranets from the

Internet so that only employees and authorized business partners can access

• Implementation– Packet filtering to block “illegal” traffic, which is

defined by the security policy… or– By using a proxy server, which acts as an

intermediary

Information Security: Technical Countermeasures cont.

Page 59: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-59

2. Encryption: to protect against sniffing, messages can be encrypted before being sent e.g. over the Internet• Two classes of encryption methods are used today:

– Secret Key encryption• DES

– Public Key encryption• RSA• Needs public and private key• Incorporated into all major Web browsers and is the basis for

secure socket layer (SSL)• Most individuals don’t have such keys hence B2C applications

are only secure from the consumer to the merchant

Information Security: Technical Countermeasures cont.

Page 60: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-60

Page 61: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-61

Page 62: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-62

Page 63: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-63

Note: The Internet is not secure because, for one thing, none of the TCP/IP protocols authenticate the communicating parties

3. Virtual Private Networks (VPN): maintains data security as it is transmitted by using: – Tunneling: creates a temporary connection

between a remote computer and the CLEC’s or ISP’s local data center. Blocks access to anyone trying to intercept messages sent over that link

– Encryption: scrambles the message before it is sent and decodes it at the receiving end

Information Security: Technical Countermeasures cont.

Page 64: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-64

• Three ways to use VPNs:1. Remote Access VPNs: give remote

employees a way to access an enterprise intranet by dialing a specific ISP

2. Remote Office VPNs: give enterprises a way to create a secure private network with remote offices. The ISP’s VPN equipment encrypts all transactions

3. Extranet VPNs: give enterprises a way to conduct e-business with trading partners

Information Security: Technical Countermeasures cont.

Page 65: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-65

PLYMOUTH ROCK ASSURANCE CORPORATIONCase Example: Use of a VPN (Security)

• This automobile insurance company created an extranet that independent agents could use to transact business with the company

• The most cost-effective approach was to create a DSL-based virtual private network between each agent and PRAC, an offering of a local company

Page 66: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-66

Information Security cont.

• Information security has become an important management topic, and it has no clear-cut answers

• It is too costly to provide all the security a company wants, and performing security checks on packets takes a lot of processor power, which can slow down performance

• Even with world class technical security, management needs to make sure all employees follow security policies because companies are only as safe as their weakest link. In fact, that weakest link could be a supplier or contractor who has secure to a company’s systems, yet has poor security of its own

• Security is as much a human problem as a technical problem• Fines etc. = this is not a ‘victimless crime’• PRACTICE SAFE COMPUTING!!!!!

Page 67: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-67

Planning for Business Continuity• Business continuity is broader than disaster

recovery because it includes:– Safeguarding people during a disaster– Documenting business procedures (instead of

relying on certain employees who may become unavailable), and

– Giving employees the tools and space to handle personal issues first so that they can then concentrate on work

– Where will the work be done?

• In short, it is a business issue, because IT disaster recovery is just one component

Page 68: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-68

Planning for Business ContinuityUsing Internal Resources

• Organizations that rely on internal resources for IT disaster recovery generally see this planning as a normal part of systems planning and development. They use :– Multiple data centers

• Move to have all computing in ‘one location’ = now under question

– Distributed processing– Backup telecommunication facilities– Local area networks

• One LAN can be used to backup servers for other networks

Page 69: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-69

Planning for Business ContinuityUsing External Resources

• Cost Vs. Risk may not justify permanent resources so companies use the services of a disaster recovery firm:– Integrated disaster recovery services– Specialized disaster recovery services– Online and off-line data storage facilities

Page 70: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-70

HOUSEHOLD INTERNATIONALCase Example: Planning for Business Continuity• Typical of a large financial services institution, Household

justified its disaster recovery planning based upon legal and regulatory requirements and the need to maintain uninterrupted customer service

• Company established full time staff to prepare, maintain and test disaster recovery plans

• Comdisco Disaster Recovery Services was relied on as it’s a major supplier of alternate site data processing services in North America

• Heaps of rain in Chicago: large number of disasters declared• Household declared a disaster quickly– it enabled close

relocation

Page 71: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-71

HOUSEHOLD INTERNATIONALCase Example: Planning for Business Continuity cont.

Lessons Learnt:• Consider the risks of a natural disaster in

selecting a data center location• Create a plan to return to the primary site after

a disaster• Do not expect damaged equipment, disks, and

tapes to always be replaced, monitor equipment

• Plan for alternate telecommunications• Test site under full workload conditions• Maintain critical data at the alternate site

Page 72: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-72

Conclusion• The subject of managing computer

operations is, perhaps surprisingly, at an all-time high because of:– The emergence of e-commerce– The increasing use of outsourcing– News-grabbing viruses– Attacks on major websites, and – The terrorists acts on September 11th,

October 12th etc.

Page 73: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-73

Conclusion cont.

• As enterprises increasingly rely on computing and telecom to work closely with others, they open themselves up to more threats by electronic means

• Companies must be increasingly vigilant to outside threats

• In short, the view of operations is shifting from managing inward to managing outward

• It’s ‘essential’ but often ‘forgotten’ and it’s not easy. Key = MANAGEMENT

Page 74: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-74

Part II Discussion Case

MANAGING INFORMATION SECURITY ON A SHOESTRING BUDGET

Page 75: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-75

Page 76: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-76

Page 77: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-77

Page 78: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-78

Page 79: Managing Operations

©2006 Barbara C. McNurlin. Published by Pearson Education.

8-79