INF30020 Information Systems Risk & Security Case Study

1. 2018 OZ PAPER HELP MIA JACKSON [INF30020 Information Systems Risk & Security Case Study]

2. Information Systems Risk & Security Case Study 1.OVERVIEW. AE Kalina Cycle (AEKC) specialises in the production, installation andmaintenance of electricity from waste heat. This is an alternate energy solution for factories in the Australian commercial market. AEKC was established in 2000 just outside Wollongong, New South Wales and although a lot of the region is prone to flooding, this idyllic south coast city remains company headquarters today. Company founders, Peter Williams and John Damon, met while studying Business Information Systems and Engineering at Swinburne University of Technology, however a love of surfing took them to southern NSW where they could ride waves the whole year around. Together they developed the technology (AEKC) for alternate energy through use of waste heat produced in bottling factories, petrochemical plants and cement factories. They have extended this technology to using thermal springs as another source of waste heat. The technology uses inverters (to feed electricity back into the main for these factories and plants. A monitoring system continuously tracks performance and efficiency. Kalina Cycle is a patented technology that requires two patented hardware and software devices (the inverter and the monitor) that are installed alongside the factory electricity meter boxes when customers first buy the technology. AEKC’s unique inverter converts waste water mixed with ammonia into required AC electricity currents at levels of efficiency that cannot be matched by any of the usual energy utility companies. By monitoring usage AEKC can present customers with reports that they can use to optimise their consumption and make cost savings. They can also feed any electricity they create back into the local grid. A connector interfaces with the meter box to feed data, via the Internet, back to AEKC’s data centre. Commercial customers can access reports on any networked device including PC’s, smartphones and tablets. The system reports commercial electricity generation to the electricity supplier that is critical for accurate rebates to be paid from the supplier to the customer. AEKC’s high performing inversion and monitoring solution has made it Australia’s most successful company in its field with a reputation that it needs to be protected. 2.MOBILE SUBBIES AND AN EXPANDING MARKET. While Peter and John are still thecompany’s chiefs, by 2005 they had employed six engineers to build and test prototype systems before updating and OZ PAPER HELP Page 2

3. assembling the final product. Also in 2005, AEKC was incorporated to limit the financial liability of its founders and manage the legal responsibilities of the company, e.g. as this company earns more than 3 million per annum it is bound by the NPP and Australian Privacy legislation. Changes have been swift, components such as the casing, sensors and electronic parts for the final product were initially sourced in Australia, but in 2006 AEKC shifted manufacturing and basic assembly of the system to Guangdong, China. While domestically licensed sub‐contractors can complete distribution and installation of the technology to customers. AEKC head office continues to manage AEKC’s monitoring and reporting systems centrally, at the AEKC data centre, on behalf of its licensed ‘subbies’ and in addition to charging the ‘subbies’ for their license and products, it also charges a service fee to customers for the reporting system. Peter and John decided early on that they did not wish to develop the installation side of the business but recognised the value in retaining the technological advantage and income stream generated by the AEK Cintelligence system. They now focus on research, development and innovationrequired to grow their network, while AEKC’s pool of trusted contractors are instrumental in growing the business by bringing in new customers. Increasingly the ‘subbies’ are accessing AEKC head office from the field on a range of BYOD mobile technologies. Standards: All AEKC products are built to diligently comply with relevant Australianstandards. AEKCs continuous product innovation requires time and energy to meet the requirements of communicating, testing and monitoring quality control for accreditation across standards for alternate energy and it has become proficient in meeting the rigorous demands of reporting by incorporating document management that allows for the reuse of document templates into its enterprise solutions. Competition in the alternate energy space is fierce and, while so far AEKCs has kept ahead of the game, its long term competitive advantage rests on maintaining documents in AEKCs custom made enterprise system, enterAEKC; protecting patented designs; and ensuring a stable uninterrupted OZ PAPER HELP Page 3

4. revenuestream. To this day, John Damon keeps the original designs for AEKC’s technology in pride‐ of‐place, in a wooden filing cabinet at his home office. Confidential design: Between 2007 and 2015 the company has added a full suite ofproducts for installation into apartment buildings based on a new generation wireless technologies. Increasingly, they are working with major construction companies who are installing their systems into apartment complexes as they are built, requiring AEKC to work with, manage and store architectural designs and plans that are often highly confidential. The experience Peter and John gained in the early years has provided them with a good knowledge base about smart, environmental friendly alternate energy monitoring systems and although nowadays the two founders spend very little time on system infrastructure the demands they can make on behalf of prestige clients can still override the opinions of their Board, design engineers and business managers. They see their network of licensed sub‐contractors as the core to a revenue model that allows them to develop new product offerings in a domestic market. Their CFO,however, would prefer a more aggressive market stance of lowering costs to sell to an international market. So far, AEKC has avoided this strategy. 3.IS/IT INFRASTRUCTURE. AEKC is sourcing components from around the world. Most components are standardised and ordered from large online catalogues (containing product specifications ‐ tolerances, test data details and so on) and shipped to Guangdong for assembly. Setting up the supply chain for manufacturing and assembly in China hasn't been easy and most orders are still managed by email. When a special component design is required (such as wifi components for Wi‐Fi stations in an apartment complex) technical ofthe underlying electronic descriptions, detailed OZ PAPER HELP Page 4

5. specifications are couriered to a few selected suppliers so that they can tender for the work and send samples to AEKC. The samples are tested for quality and tolerance before AEKCs Chief Engineer, Alwyn Burn, selects each supplier. Once a supplier is selected, purchase orders are emailed through, along with instructions for delivery to the Guangdong assembler. All operational records associated with the exchange are maintained inenterAEKC. While this business process seems to work, maintaining the information documents, sub‐contractors, contracts, suppliers, customers, orders, invoices and receipts is placing a significant administrative burden on the system. A Wollongong‐based software-company built AEKC’s enterprise system, enterAEKC, almost 15 years ago, but the company no longer exists. Keeping up with changing business demands has required AEKC’s IT department to develop “patches, extensions and workarounds” just to keepenterAEKC running. development means detailed documentation about the system was put to one side and changes made to the system have been dependent on a dedicated Database Administrator and programmer to keep it operating. enterAEKC is becoming a problem for the business, the Accounts reconciliation officer responsible for banking, Tracy Bell, exports and converts data daily, in CSV format, so that she can reconcile accounts and complete banking from ledgers on her own desktop. While she has been asked not to do this work from her laptop, her busy schedule sometimes demands this. Complicating matters, it is not possible to share customer between enterAEKC and the data centre in real‐time, instead this customer information is processed in a nightly batch process. While AEKC has established a secure extranet and VPN for its sub‐contractors, agents and suppliers that allows them to communicate billing and procurement records, IT is trail, of important Rapid transaction records OZ PAPER HELP Page 5

6. constantly having to undertake additional work and activate new scripts for processing the information received through the ‘partnerportal’ just so it can be included in the enterprise system. The problems with enterAEKC have been flagged with the Board of Directors, however they are somewhat ignorant about enterprise systems and see the problem principally as an “ITissue.” They “just want it fixed”, Without an IS/IT manager reporting directly to the Board they remain unaware of any broader implications, issues or opportunities in this space. Recently, their attention has been focussed on the company’s new state‐of ‐the‐art data centre. OZ PAPER HELP Page 6