Managing Operations

Managing Operations Chapter 8 Information Systems Management In Practice 7E McNurlin & Sprague PowerPoints prepared by Michael Matthew Visiting Lecturer, GACC, Macquarie University – Sydney Australia

Chapter 8 • The three major operational issues discussed are: • Outsourcing information systems functions • Information security, and • Planning for business continuity • Due to mergers, the Internet, e-commerce, and the September 11 terrorist attacks, the subject of computer operations has been receiving a lot of attention • Systems operations are important because, if they are not professionally run (and backed up properly), a computer or network crash could shut down a company’s business for some period of time • Case examples include Microsoft, ANZ Banking Corporation, Mobil Travel Guide, Eastman Kodak, Honda Motor Company, Exult, Credit Card Fraud, Plymouth Rock Assurance, and Household International

Today’s Lecture • Introduction • What are Operations • Why Talk About Operations? • Solving Operational Problems • Operational Measures • The Importance of Good Management • What’s New in Operations • Outsourcing Information Systems Functions • The Driving Forces Behind Outsourcing • Changing Customer-Vendor Relationships • Outsourcing’s History • Managing Outsourcing • Offshoring

Today’s Lecture cont. • Information Security • The Threats • Security’s Five Pillars • Management Countermeasures • Technical Countermeasures • Planning for Business Continuity • Using Internal Resources • Using External Resources

Introduction • Due to mergers, the Internet, e-commerce, and the September 11 terrorist attacks, the subject of computer operations has been receiving a lot of attention • Systems operations are important because: • If they are not professionally run: • A company could suffer a computer or network crash that could shut down their business for some period of time • It is not a trivial area, especially as companies become increasingly reliant on networks and computers to run their business

Introduction cont. • Poorly run IS shops cause IS executives to end up ‘fighting fires’ instead of setting policy OR • They find themselves looking for a job!

Introduction cont. The main change in operations is the shift in viewpoint towards managing operations (Figure 8-1): • Traditionally – managing inward, i.e.: managing one’s own operations staff • Today – just as likely to mean managing outward = managing relationships with (external) service providers • Outsourced IT service providers who have taken over the day-to-day operational work • In some instances • Back to the future? • Benefits not realised • Unexpected costs - $ and otherwise

What Are Operations?Why Talk About Operations? • A Typical MIS Department Budget: • 33% Systems and Programming • 70% Maintenance • 30% New Development • 10% Administration and Training • 57% Operations • Involve more $$$ than any other part of the IS department • Very involved (difficult), challenging and rewarding area

What Are Operations?Solving Operational Problems Operational problems are obvious to the entire company: • Response times are slow • Networks are down • Data isn’t available • Datais wrong

What Are Operations?Solving Operational Problems cont. • Three strategies to improve operations: • Buy more equipment • Continuously fight fires and rearrange priorities, getting people to solve the problems at hand • Continually document and measure what you are doing, to find out the real problems, not just the apparent ones. Then set standards and manage to them = the preferred solution

What Are Operations?Operational Measures • External: What the customer sees: • System uptime • Response time • Turnaround time • Program failures • = Customer Satisfaction • Internal: Of interest to systems people: • Computer usage as % of capacity • Disk storage used • Job queue length etc. • Problems reported by external measures can be explained by deviations in internal measures

What Are Operations?The Importance of Good Management • The corporate culture created by IS management must recognize and value good operations • Skills of an Operations manager = similar to that needed in e.g. a factory • Manager must schedule work to • meet delivery dates, • monitor performance • respond quickly to problems • The key to managing operations is the same as in any management job: • Set standards • Then manage to those standards • By finding an outstanding operations manager

What Are Operations?What’s New in Operations? • Companies have ‘cleaned their operational house’ • Y2K and the Internet forced this • Now = most in relatively good shape • More Operations managers are Managing outward – BUT CIOs must not relinquish responsibility for Operations • Ensure their people are properly managing relationships • Operations are being ‘simplified’ • Centralizing applications in one place rather than distribute them on PCs • Server based computing (Chapter 5) • Certain operations are being offloaded • e.g. webcasts

MICROSOFTCase Example: Offloading of Operations (Webcast) • The launch of a new version of Windows operating system was done via • Personal and • Public Internet broadcast • Private webcast – 6,000 OEM system builders in 83 countries • Webcast by Akamai – >12,000 servers in 66 countries • Specializes in hosting corporate Websites • Giving users in far-flung locations fast downloads of Web content and streaming media • Private webcast which set a record for: • Attendance • Global reach • Audience participation

What Are Operations?The Focus of CIOs in Operations is Changing • Their attention used to be focused on ensuring they had the in-house expertise to keep systems and networks up and tuning • Their attention is now toward determining where best to perform the various kinds of operations: • In house or with a third party (or permutations and/or combinations thereof) • Then manage it accordingly

OUTSOURCING INFORMATION SYSTEMS (IS) FUNCTIONS • Outsourcing means turning over a firm’s computer operations, network operations, or other IT function to a vendor for a specified time • CIOs are expected to at least to ‘prove’ that their in-house operations are as efficient and effective as if they were outsourced • Shared Services concept • Should outsource what they do not do well

Outsourcing IS Functions:Driving Forces Behind Outsourcing • Focus on core businesses: In the 1980s, this led to huge amount of merger and acquisition activity • Shareholder value: Companies were “priced” based on their shareholder value, that is, their discounted cash flow, as a result of high-yield bonds that allowed a few people to buy a company and leverage it with debt • Management must stress value, they must consider outsourcing in all their nonstrategic functions • U.S. driven – other countries have variations on this pricing (share market) model but the drivers = still $$$ • And ‘follow the leader’ / trend?

Outsourcing IS Functions:Changing Customer-Vendor Relationships • Relationships have expanded from buying professional services, to buying products and transactions, to integrating systems, to outsourcing – the most bundled approach to contracting • In this evolution: • CIOs have increasingly lost control • More activities turned over to outsiders • Providers take on more risks • As they move to (options on) the right of Figure 8-2 • Provider’s margins increase • Again = to the right • Risks also improve: Don’t get “Nothing for nothing!”, and • Importance of choosing the right provider becomes more important

Outsourcing IS Functions:Outsourcing’s History • In 1989 only (full) IT outsourcing was available • Essentially began with ‘big-bang’ deals. • The goal was purely financial. • Problems occurred – ‘us VS them’ and culture clash • Note: ‘Outsourcing’ existed in many other areas and had for years e.g. trucking • Early 1990s: Transitional outsourcing • Two routes outsourcing legacy systems • Maintenance of their legacy systems – hence – staff concentrate on building new client server systems • Client server development to specialists & keep maintenance in-house • Mid to late ’90s = Best-of-breed outsourcing • Selective outsourcing began • ‘Collaborative outsourcing’ – one company prime contractor and secondary external service providers

Outsourcing IS Functions:Outsourcing’s History cont. • Shared services • “in-sourcing” to shared service group- • Improved efficiencies & • Saved money • Business process outsourcing • As IT Outsourcing ‘matured’ it became a commodity service • Profit margins dropped • Competitors rose • Quality Vs. Cost Vs. $$$ Vs. Pressure – not all was ‘happy’ • Higher margins in specialized specific areas • Business process of which IT was a significant component

ANZCase Example: Business Process Outsourcing • Australia’s third largest bank has outsourced its procurement function, not to reduce costs, but to gain greater quality purchases and lower ANZ’s annual purchasing spend • The bank has learned numerous lessons in this world-leading outsourcing deal: • Be prepared to change the contract as your environment changes • Make step changes in technology and processes to save time and money, focus on having an effective transition • Do your best to make the outsourced group appear seamless to your employees • Focus early on what you want and don’t get sidetracked • Keep incentive mechanism simple and transparent • Be able to benchmark performance, and • Understand, to a fair degree of detail, the value chain you plan to embrace

Outsourcing IS Functions:Outsourcing’s History cont. • E-business outsourcing • With the arrival of business use of the Internet, outsourcing has been one way that companies can quickly get Websites up and handling business • In dot-coms and Internet- based operations • Preferred mode of operation • Even with the dot-com crash = still a legitimate way to mobilize for e-business • Allows a company to move fast • Companies can remain flexible • Does not tie up $$$ in computer and networking equipment • Obsolete?

Outsourcing IS Functions:Outsourcing’s History cont. • Utility Computing • Also known as on-demand computing, virtual data centers and grid computing • Idea = computing power can be treated like electricity: You plug in and only pay for what you use • Numerous vendors, especially IBM, HP and Sun are promoting access rather than ownership • Selling the idea of turning clients’ fixed IT costs into variable costs • Important to understand: • The amount of consulting required • The chargeback mechanism (for only paying for use) • The contract terms • Where it could provide benefits etc. • In 15 years, IT outsourcing has expanded (and changed) significantly

MOBIL TRAVEL GUIDECase Example: Utility Computing • Illustrates the convergence of e-business and IT outsourcing into utility computing in a high-need area: its Web site • Travel guide for North America • Information static and site couldn’t handle the spikes in demand during e.g. holidays • Wanted to upgrade site but rather than making the large investment to upgrade its own IT resources = turned to IBM to host and manage the site • No need for upfront investments • No concern re handling peaks • Saving 35% in maintenance and software costs • Only paying for what it uses of IBM’s world-class, highly scalable e-business infrastructure

Managing Outsourcing:1. Organizational Structure • Managing outsourcing is different from managing internal staff • One reason = it is a joint effort between parties that may not have the same goals • Typically, parties establish layers of joint teams. • Top-level team: final word in conflict resolution • Operational team: oversees day-to-day functioning • Joint special purpose teams: created from time to time to solve pressing issues • Committees: oversee the use of formal change management procedures • Relationship Manager(s): look after the ‘relationship’ • Skills = different to those of e.g. a data center manager

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing • First IS outsourcing by a ‘good shop’ • “Shocked the IS world” • Four suppliers (ESPs) – manage portions of IS: • Operate data centers and networks • Manage telecommunications • PC support • Voice messaging

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing cont. • Management structure: • Management Board • Meets twice a year, includes senior management from both companies – Focus on strategic issues • The Advisory Council • Meets monthly, 15 members- handles technical and operational issues • The Supplier and Alliance Management Group • Manages long term outsourcing relationships & contracts with large IT suppliers • The Relationship Manager • Focal point between itself and service provider – ensures Kodak gets more than just delivery • Working Groups • Added to deal with specific technology areas. • Client Surveys • Sent out twice a year to 5,000 internal users

EASTMAN KODAK COMPANYCase Example: Managing Outsourcing cont. • Kodak needs all these forms of co-ordination for effective supplier management • Considered a ‘best practice’ outsourcing and relationship model

Managing Outsourcing:2. Governance • The foundations of governing an outsourcing relationship are laid in the (LARGE) contract(s) • Service Level Agreement (SLA) • Responsibilities, performance requirements, penalties, bonuses • Another important component of SLAs is metrics. An SLA needs to be measurable to be of use • It is only when trust in one another breaks down that they turn to the contract. (Fig 8-4: Governance rules)

Managing Outsourcing:3. Day-to-Day Working • Recommendations to manage day-to-day interactions: • Manage expectations, not staff • Facilitation becomes the mode of working. Rather than say “do this”, the approach becomes “how can we solve this together” • Realize that informal ways of working may disappear • Loss of informal ways of working may add rigor • Integration of the two staffs requires explicit actions • Does not happen naturally • Explicit policies are likely to be needed • Don’t unduly restrict outsourcing staff access • Joint celebrations • Invite each other to meetings • The best way to manage day-to-day is communicate frequently • Preferably ‘face to face’!

Managing Outsourcing:4. Supplier Development • Topic that is receiving increased attention • Buying parts and services that go into one’s own products and services • Assisting one’s suppliers to improve their product and services by generally improving their processes

HONDA MOTOR COMPANYCase Example: Supplier Development • Not an IT related example (manufacturing) but a good one! • This automobile manufacturer conducted pioneering work in improving suppliers’ capabilities by pairing Honda engineers with a supplier’s engineers to drastically lower the cost of one part supplied to Honda • The results are like “walking around picking money up off the floor.”

Offshoring • To round out our discussion of outsourcing, we turn to a topic receiving much attention today: sending work offshore • Now = a big political issue • Late 1990s – Offshore outsourcing • Started when labor markets were especially tight due to Y2K • Companies turn to offshore outsourcing because labor costs are lower and there is ample supply of educated people • Ireland, India, Philippines • The trickle in the late ’90s has turned into a steady stream of white-collar work going offshore • Application maintenance and development • Call centers • Customer service • Back office processing • BPO • Claims processing • Etc. • Manufacturers have faced international competition, whereas service firms have (had?) not

Offshoring cont. • Offshore outsourcing differs in some unique ways from domestic outsourcing • Some areas to be considered: • Offshoring options are broadening • Both parties need cultural training to bridge cultural differences • Clients = cultural integration programs • Providers = accent neutralization

Offshoring cont. • Offshore outsourcing differs from domestic • Some areas to be considered cont. • Communication issues need to be addressed from the outset • “Yes” • Asia = “I hear what you are saying” • West = “I can do what you ask” or “I agree with you” • Tips • Avoid colloquialisms such as sporting analogies • Use short, concise sentences with common words • Have the provider write a ‘statement of work’ to gauge understanding • Get all commitments in writing • Include on your team someone who know their culture • Communication issues continue throughout offshore relationships • Country laws need to be followed

EXULTCase Example - Offshoring • Provides full-service HR outsourcing to Global 500 companies • Mature in outsourcing relationships because outsourcing is its primary business • 2 Indian companies maintain its core HR computer systems (SAP & Peoplesoft) • Chose 2 Vs. 1 to ensure resources could be scaled up as needed • In choosing the providers used consultants to do the detailed review and content (neoIT) and to structure the contract (TPI) • Aim = for best deal. Needed to understand the Indian market and its practices. Consultants helped achieve that • Current split of maintenance work • 70% Indian • 15% provider employees ‘onshore’ • 15% Exult ‘onshore’ • Requires us buyers to work within the highly disciplined Indian maintenance processes rather than to try to change them • Applies to all outsourcing! • Good economic outcomes

Offshoring cont. • Use Offshoring to Advantage • A major criticism is that it decreases skills and know-how of its client’s IS organization • This need not be so • Redefine Services Using Offshoring • Understand customers • Understand demographics • Stay in touch with customers • Offer end-to-end service • Dominate the screen • As information moves online, companies are vying to control “the screen” = where the information ends up

Outsourcing – The ‘Final Word’ • Outsourcing has become a strategic alternative for companies • With the pace of change so rapid in IT and e-business, the only hope of many companies is to tap the expertise of companies that are (paid to be) keeping pace with the changes • = Their ‘day job’ • Outsourcing does not however mean relinquishing responsibility • This is serious stuff • Marriage? • Trouble in ‘paradise’?

Information Security • Used to be an arcane technical topic • Today even CEOs need to ‘know about it’ due to the importance of electronic information in running their businesses • Need to understand Internet-based threats and countermeasures and continuously fund security work to protect their businesses • Since 1996 the Computer Security Institute have conducted an annual survey of US security managers • Spring 2004 survey report – 2 key findings: • The unauthorized use of computers is declining • The most expensive cybercrime was denial of service

The Threats Note: heaps of similar Surveys e.g. KPMG

Information SecurityThe Threats • Threats are numerous • Websites are particularly vulnerable • Political activism is one motivation for Website defacement • Theft of proprietary information is a major concern • Financial fraud is still a significant threat • Especially credit card information • No data of any value should be stored on web servers

CREDIT CARD FRAUDCase Example: Threats • In one case, MSNBC reported that a bug in one shopping cart software product used by 4,000 e-commerce sites exposed customer records at those sites • One small e-commerce site did not receive the warning • Within days, cyber criminals charged thousands of dollars on the credit cards of users of this small site • In another case, two foreigners stole 56,000 credit card numbers, bank account information, and other personal financial information from U.S. banks • Then tried to extort money from the cardholders and the banks, threatening to publicize the sensitive information they had unearthed

Information SecurityThe Threats cont. • Losses are increasing dramatically because companies have rushed into e-commerce, often with applications that do not have security built into the architecture or procedures • People think security can be added later but it really can’t be bolted on as an afterthought • Best security = designed into applications via checks during processing and at data transfer points • It is easier to guard a bank vault than to guard every house in town • That’s why many companies are outsourcing their data center operations to data center specialists with vault-like security

Information SecurityThe Threats cont. • Mobile computing and telecommunications increase the possibility for crime • The greater number of network openings provides opportunities for illegal entry • The rise of e-commerce and e-business put more communications online to the Internet, which is open to everyone including crackers (evil hackers) • As the Internet doesn’t (currently?) have intrinsic security protocols this public space is vulnerable

Information SecurityThe Threats cont. • The ‘hacker community’ (public club?) • ‘True’ Vs. Parasites • Approaches hackers use: • Cracking the password • Tricking someone (social engineering = ‘cute’ term!) • Network sniffing • Misusing administrative tools • Playing middleman • Denial of service • Trojan horse • Viruses • Spoofing

Managing Operations