January 9th, 2012 | 
Author: In software systems, as in many other areas of business and life, there is the old maxim, “You get what you pay for.” This maxim wisely advises us not to “cheap out” – to try to get by with less than what we need to do the job. It also warns us of the costs and consequences of making such a choice.
Getting by on the cheap may be a bad plan, but paying a premium price is no guarantee that a system will meet expectations. My book, The Tech Advisor, gives numerous examples of paying too much for a system and failing to get the value expected. In fact, the price you pay to get the same approximate value may differ by orders of magnitude! While the book provides many examples, I will highlight a few of the major ones in this blog.
What are some things to look for, when you want to identify what is really cost-effective?
Make sure your new software is really an upgrade.
All too often organizations spend a great deal of money (sometimes millions) on new software that really doesn’t end up working well. To get an idea of this, consider how you sometimes feel as an end-user, when one of your favorite websites undergoes a facelift, and features you rely on are removed or made very difficult to access. You know the company spent a great deal of time and money on it, but why didn’t they ask you what was important?
Why does this happen? For a number of reasons – but here are three likely candidates:
- The system was designed without adequate representation of all the affected constituents, both inside and outside the organization. An example given in the book was some “upgraded” hotel check-in software that caused numerous problems for the desk clerks resulting in long lines at the counters. The needs of neither the desk clerks nor the guests/customers were adequately represented in the development of the system. Managers, designers, and developers can be truly out of touch with the larger community.
- The software was “sold” to the organization by a vendor or even an internal group, but the purchasers did not fully understand what they were getting — and the implications for everyday process and integration with other systems.
- The bait-and-switch tactics of some vendors and consulting companies can also be a problem. The “heavy hitters” show up only at the beginning of the engagement, but most of the system development is left in the hands of junior people who lack experience and knowhow.
Don’t buy what you already have.
Companies sometimes buy new and expensive systems, without realizing that they already own all or most of the capabilities they are seeking. Operating systems and large packages often come bundled with all sorts of powerful tools. The book gives the example of small firms buying expensive document management systems (which in some cases proved to be nothing more than a big headache) when they already owned Microsoft SharePoint as part of their Windows Server.
Today there are many open source products that are very capable and are free of charge. Spend money on what you really need, not on what you don’t. For businesses, the best software investments will usually involve focused attention on what is unique in their processes, rather than on some grand system. If you need to make a cross-country trip, invest in a plane ticket before you start pricing deluxe motor homes.
Watch pricing in product lines and Software-as-a-Service.
The book covers several examples. Price structures may make it likely you will incur upcharges more rapidly than you might think. Perhaps you are a small company that buys the “small business” edition of a product, only to learn that there is a critical feature only available in the “enterprise” edition, which costs considerably more.
Another example was found in a Software-as-a-Service system (SaaS). The product provides two major services and comes with a low entry price and seemingly a generous amount of online disk space. However, most of that disk space is allocated to one service that is likely to remain relatively small; whereas the other service, where very rapid expansion would be anticipated, is allotted less than 5% of the total disk space. Reasonable additional disk space is far more expensive than the initial subscription, and can never be reduced even if you archive off old data.
Sometimes it is very easy to sign up for SaaS software, but the price structure may be buried deep in a website. When it comes to such purchases, it is caveat emptor.
Software product lines and SaaS can offer excellent value, and SaaS promises tremendous boons. However, you must do your due diligence and check prices carefully. Project your needs forward, and compare them to the price structure. There may be price changes and increases, but if the structure appears sensible, given your current and anticipated future needs, that is a positive sign. Once your business makes a commitment, even if it is only to an SaaS system, it is neither trivial nor inexpensive to make a change.
There is no substitute for good technology planning.
Good technology planning will help you find the best value in software for your organization. A tech advisor may be able to help if you don’t have enough expertise in-house. Regardless, be aware that the software vendors will not necessarily tell you all you need to know. The “wow” demonstrations and the glitzy marketing materials may be misleading. You need to learn the rest of the story.
Posted in 
What is Familiar …
Social networking has been embraced in recent years, especially by the young. Sometimes it is used to create or connect communities of friends and families, or of individuals who are like-minded or affiliated. It also provides a very public forum for self-expression. Thoughts and reactions that formerly were private or held in close quarters are now out there for anyone to read. The same goes for sounds and images that average people can easily publish as pictures, music, or videos. Also, the new smart phones make posting on the social media as easy as texting to a friend. Somehow, through the magic of internet search engines, and individuals who spread the word, isolated posts are discovered and can “go viral,” without any formal efforts to publicize or advertise. Of course the conventional media are watching and will in turn publicize whatever is getting attention on the informal channels.
The Arab Spring showed the world how social media, texting, smart phones with built-in photo and video cameras, and worldwide telephony could be the communications backbone of a successful revolution. One of the ways the besieged governments tried to hold onto power was to shut down the communications infrastructure. Ultimately this worked against them, as it proved to the world the repressive nature of the regimes and fueled the disenchantment. Meanwhile, the revolutionaries searched for and found cracks in the armor so they could get their communications out.
These developments are common knowledge for anyone following major trends. However, despite the admitted power of social networking, there are many “old fashioned” people who are uncomfortable with it. They look at the posts and see 99+% trash talk and junk. They don’t understand why anyone would prefer to text, typing on a Lilliputian keyboard, rather than making a phone call (except of course for texting under the table during a business meeting). They may have heard that social media are essential for business networking, but then they dipped a toe into the waters and got limited or no results. They may have heard stories about young people who posted raucous accounts of their college beer bashes, only to have those read by prospective employers. They may also be concerned about the predators who troll the internet for the innocent, the gullible, and the over-exposed.
What You May Have Overlooked …
However, despite all these positives and negatives, there is real power in social networking that many may overlook. The social media are great repositories of sentiment, and this sentiment can be mined and analyzed. What’s more, because the social media are highly dynamic, changes in sentiment can be monitored with virtually no lag time. We are seeing more and more evidence of this in the conventional media, where, for example, some television shows now report on the “pulse of the day” based on monitoring the social media. As we know, the government is also watching, looking for “chatter” that might alert them to nefarious plots.
This is a matter of statistical significance rather than absolute accuracy. Twitter includes a positive and negative sentiment detector in its programming interface. Even if it is only 70% accurate it has analytical value. For example, if a news story about a company or product surfaces, a volume spike in the chat (or lack thereof), and the direction of the sentiment, might give a company useful intelligence in terms of how it should respond. A company can also use such studies to measure the effectiveness of advertising, and the interest in and reactions to various products and features. Despite the margin of error, this information is available well before the sales results come in, and at very least provides another data point to correlate with those results. There are indeed many practical uses for data mining in the social media.
What might make this especially attractive to businesses is they don’t need to use clandestine means to get this information. No hacking is required, just good software programming. Social media are public to a large extent. Yes there are private groups, and endlessly overlapping Venn Diagrams of “linked” individuals and entities, which seem to illustrate the “six degrees of separation.” However, people who want to get their feelings and reactions out, especially about public events, companies, products, and high profile individuals, want to express themselves in a public forum. Most large companies and other entities have presences on social sites, where any user can comment. Twitter also has mechanisms that enable users to flag Tweets as relevant to a specific entity. The sheer volume of social media content in the public forum often guarantees statistical significance, even when the analytical tools have a large margin of error.
The only downside is that the social media represent a skewed demographic, namely, the young with time on their hands or the disenfranchised. Yet they also reflect those who are technologically savvy, and who are willing buyers of technology such as smart phones and trendy automobiles. Many companies target their product offerings to this group. Moreover, the social media are gaining in popularity and are being adopted by a broader demographic. Companies are reaching out on their Facebook Pages and YouTube Channels to wider audiences, even if the tone remains youthful.
These public data can be retrieved and analyzed using specialized software. Not only that, depending on the particular social medium, there are data fields that can be used to refine the intelligence, such as language, internet/hosting source, and geographic coordinates. All in all, there is real power here, and organizations are starting to exploit it.
Russell Kennedy Partners has recently developed software to gather comments and posts from Facebook and YouTube, and Tweets from Twitter, for the purposes of re-use in advertising and market analysis.
Copyright © 2011 Patrick D. Russell
I met Bill Swanson in October, 2009, when he gave a presentation entitled Predictive Analytics at Confab – the annual international conference for the Institute of Management Consultants (IMC). For me, his was the most exciting presentation at the conference. Why? Because it was something totally new (for me) and was highly compelling. What’s more, the conclusions of Predictive Analytics often go against “common sense” and the “obvious” — as Bill demonstrated in his presentation, using specialized audience polling devices.
Predictive Analytics is a new way of making strategic business decisions. Bill is a Management Consultant who specializes in Business Strategy. However, his niche is quite unique. I have had the privilege of meeting many fine management consultants as a Chapter President in IMC (San Diego Chapter). However, Bill is the only one I know who specializes in Predictive Analytics. When I met Bill, he had recently completed an engagement with a midsize company that had been in business for many years, but wanted to improve its performance and productivity. After some initial high-level resistance, the company accepted Bill’s analysis, and went on to have its best years ever (during the Great Recession).
Predictive Analytics is relatively new, but is poised to transform the way strategic business planning is done. It promises to elevate decision-making beyond speculation and guesswork. It can be applied to both internal and external factors, but is especially useful in processing crucial data from outside the organization. It can start with surveys expressly designed to retrieve the most useful data, within what is practical and acceptable, but it also factors in organizational essentials. Mathematical analysis and advanced statistics, supported by specialized software, yield quantitative results predicting the outcomes of hypothetical strategies, and substantiate which ones would yield the best return on investment and under what circumstances. The results are often surprising, and may differ markedly from conclusions based on a more simplistic analysis. Nevertheless these findings repeatedly prove to be accurate, and are now challenging the proverbial “gut instincts” cherished by many executives. The new analytic methodologies are being used more and more by forward-thinking organizations.
Kennedy Information Inc., a watchdog for the management consulting industry, held a conference for the IMC in Chicago in May, 2010. Tom Rodenhauser led the discussion. He predicted that Analytics would change the face of strategy consulting, making some aspects of it a technology-empowered commodity. At the May 2011 conference, Kennedy Information underscored its prediction, and indicated that Analytics was becoming more widely accepted, as business leaders in tough economic times were looking for more objective validation of big decisions.
Bill is both a valued colleague and a friend. He presents to national and international management and strategy conferences several times a year. I invite you to visit the excellent website for his consulting firm, CEO Decisions.
… so Bill concentrates on Strategy and Predictive Analytics, and my sphere is Software Technology and the Tech Advisor — but where do these two specialties meet? There are a number of points of intersection. However, the most important one involves the kinds of decisions faced by midsize and large organizations. They are looking for how to deploy what may amount to many millions of dollars, and are seeking optimal results and strong ROIs. Many such decisions will imply new, or changed, business processes, which in turn are likely to require new business/enterprise software systems, or big changes in existing ones. The Tech Advisor is first and foremost about the planning stages of major systems. The analytics drives the high level, strategic directions. However, the Tech Advisor can flesh out the technical implications and alternatives relevant to the choices under consideration in the analytics. This makes for a powerful give-and-take that brings the alternatives into laser focus — for better decisions and better technologies.
As the Sustainability movement has evolved, there has been a lot of talk in recent years about Green IT. This is not just another case of jumping on the environmentalist bandwagon. Some of those instances amount to relatively small initiatives accompanied by a lot of publicity – “green washing.” When the oil and coal companies are doing it, you have to ask yourself …
Green IT is real. It presents a golden opportunity to improve the environment and our infrastructure, as well as to develop new businesses. By some reports, roughly 8% of all electric power use in the United States is for data centers. Stated simply, the problem is that computers generate a lot of heat and must be cooled in order to function properly. With the continuing rise of the internet, and the burgeoning demand for online shopping, Voice-over-IP, smart phones, video over IP, and the growing usage of “the cloud,” the demand for data center capabilities is expected to rise rapidly. What’s more, the peak demand periods that plague utility companies overlap times of heavy data usage in the middle of the afternoon. Thus the greening of data centers can have a huge positive impact both on greenhouse gas emissions and on the secure operation of the power grid itself.
Recently our team worked with a midsize data center complex. Out of the roughly 75,000 square feet of total floor space, the server room only took up 6,600 square feet. The total electric bill for a recent year was about $535,000, and out of that approximately $375,000 was spent just on the server room. Thus more than two-thirds of this whopping bill went for less than a tenth of the floor space. These numbers may convey to the average person the magnitude of the problem. To make the issue even more convincing, I should point out that this data center was located in a temperate climate where it rarely reached 80 degrees F., was well managed and up-to-date in all its equipment, and had already deployed a number of state-of-the-art energy-saving strategies in software, computer hardware, and air conditioning systems.
Within the last few years a number of technologies have emerged that promise drastic improvements in data center energy demand. A few of these are already becoming widely accepted. The data center problem is being attacked on a number of fronts, and the best results will be achieved by combining solutions.
I will briefly mention some solutions in various areas, and will go into a bit more depth on these and more in subsequent posts.
Computer Hardware
- High efficiency servers. SeaMicro servers can run the same software on ¼ the power and take up 1/6 the space.
- Vitualization and Server Pooling. VMWare, a leader in the field claims up to 80% energy savings by running more “servers” on far fewer physical computers.
- Solid State Drives. Very expensive now, but costs are coming down. They provide more operations/transactions per watt.
Software
- Software-as-a-Service / Multi-Tenancy. In the cloud, many separate business/corporate software accounts can be run on a single computer. SalesForce.com claims that energy costs per transaction are reduced by orders of magnitude.
Advanced Cooling
- Advanced HVAC. Coolerado’s revolutionary designs have documented data center energy savings in the 90% range.
- Ice Systems. Ice Energy takes advantage of low off-peak electric rates to freeze water during the night, and the ice provides cooling during the day.
- Environmental Cooling. Simple, but effective: outside air is pumped in during cold weather. Geothermal cooling is another highly efficient technology.
Advanced Insulation
- Radiant Barriers. Innovative Insulation is a lead provider of this stupendously effective, yet inexpensive form of insulation based on space blanket technology.
Alternative Energy
- Solar, Methane, etc. Alternative energy sources are often very effective when combined with other technologies that drastically reduce power consumption.
- Microturbines, Fuel Cells, etc. Local energy production can be advantageous (Bloom Energy is a well-known player in this field.)
- Grid Management. Data centers can partner with utility companies to bring in technologies to help balance the grid. The utilities may be willing to assume some of the costs of the project.
A final note: Besides the tremendous benefits to the environment and society that data center improvements offer, they can also have a drastic effect on the bottom line. They can be outstanding investments, and a variety of financing options may be available.
Russell Kennedy Partners is proud to partner with a team of experts in various areas of data center energy conservation. We have no financial affiliation with any of companies mentioned here at this time.
Copyright © 2011 Patrick D. Russell
When you are planning an important software system, even in the early stages — and especially in the stages before you talk with consultants and vendors, you should ask some serious questions about what you are trying to do. Do you really have a good vision of the endpoint of your endeavors, what the system will do, what it will look like, and how all the pieces will fit together?
Perhaps the most important facet of your due diligence is the clarity and coherence of your vision. Now, this doesn’t have to be thought through 100% ahead of time. The vision can evolve, but it is important that there be a kernel that grows and becomes more cogent as the planning develops.
As you progress through the planning stages there are a number of questions you should answer as part of the evolution of your vision and your system due diligence. Here are some of those questions, broken into the general categories of Planning, Technology, Quality, and System Viability & Longevity:
Planning
| Productive vs. Wasteful Planning | Are your preliminary requirements gathering and planning sessions correctly focused, or are you wasting time? |
| Complete Project Scoping | Have you really identified all the tasks required, their costs, and business impacts? |
| Community Knowledge | Do the managers, planners, and designers really know what is going on? Can they really speak for the needs of all who will be affected? |
| Collateral Issues Planning | What about system configuration, training, knowledge transfer, maintenance, and future enhancements? These collateral issues and extended planning concerns deserve attention up front, even if they are not fully resolved. |
Technology
| Right Technology for the Job | Is the technology being considered really the best choice? Have you really examined the alternatives? |
| Features, Capabilities, Scalability | Are you getting the features, capabilities, and scalability you need now and will need in the future? |
| Security and Change Control | Security and change control. How have these been addressed? What are the risks in the cloud and software-as-a-service? |
| Data Migration, Synchronization | Loading, migrating, and connecting with data: This challenge is easily underweighted, sometimes by a significant amount. Have you really factored in all you will be up against here? |
| Legacy System Risks | Interfacing with legacy systems. Is the original knowledge and documentation still in-house, or are you facing the task of deciphering a lot of cryptic pieces? |
Quality
| Works for All Users, Customers | Will the system serve all the users? How about the customers? Who will make sure? |
| “Industrial Strength” | How will you know you are getting high quality, “industrial strength” custom work? Glitzy websites and brochures, and touting special methodologies and best practices are not always indicative of quality. |
| Risks of Upgrades | Will your staff and your business be downgraded by a software upgrade? |
System Viability & Longevity
| “Own” the System | Will your organization really “own” the system, or will you remain dependent on the vendor? What are your organizational goals for maintaining the system in-house or outsourcing? |
| Vendor, Platform Risks | What happens if your vendor goes out of business or the platform you bought is discontinued? Can you build “defensively”? |
| System Longevity | Will your new system last for years, even decades? A premium price tag won’t guarantee it. |
Of course these are not the only issues that will demand attention in a software project, but this list is a starting point.
Please contact us with any of your ideas about due diligence for major software projects.
Copyright © 2011 Patrick D. Russell
Backed Into a Corner? Think Again…
Sometimes managers and business leaders feel like they have been backed into a corner. Things are not the way they like, but they don’t believe they can do anything about it – perhaps due to time, money, or the sheer overwhelming nature of the task. However, there may be an expert out there who can surprise you with a straightforward solution that you had no idea was even possible. People often don’t realize that many chronic problems have simple solutions. If nothing else, an expert or a tech advisor can give you some structure and guidelines for what to do when you can afford a solution.
If all your choices seem bad, cast a bigger net; go to a bigger wheel. You may just be looking at the situation with blinders on.
Look for Major Trends That May Affect Your Strategies.
One common mistake we make is to assume that the future will be pretty much like the past has been. We have seen how wrong this can be in the recent financial crisis. Greenspan’s impregnable models just didn’t go back far enough, so he made one wrong choice after another. American car companies overlooked the fact that women entered the workforce en masse in the 1980s. Japan seized the opportunity by building cars that appealed to the working woman. Today our middle class has been devastated, and many young people are living disenfranchised, marginal existences – perhaps with college degrees, lots of school loans, and jobs as department store clerks.
The world has changed and continues to change, and emerging trends may affect your business – tomorrow or five years from now. We don’t have a crystal ball, but we can figure out some of these trends. In the book, The Tech Advisor, we look at some examples of major technology shifts that caught many unprepared, even though industry insiders took them as a given. Sometimes an expert advisor can help bridge this gap, and help business leaders get ahead of the curve. Research studies are another valuable source of information.
The Golden Rule: Don’t Confuse Strategy and Tactics.
Strategy versus tactics is part of a much larger discussion, where there are numerous perspectives and, without a doubt, agendas. Therefore it will only be mentioned here. Generally the idea is thought to have originated as a part of military planning, but it has been adopted in the business world. Strategy involves long-term goals, vision, mission, and identity (“Who are we?” “Toys R Us”), and usually represents long and careful planning. Tactics are methods and means for pursuing a strategy, usually shorter term activities, often combined with other tactics, and easily replaced when better ones are found. However, when a tactic is pursued without a strategy or instead of developing a strategy, it might be a knee-jerk reaction that is less likely to be productive.
During the .Com bubble in the late 1990s, many companies went into merger and acquisition mode. In some cases there was a confusion of tactics for strategy. There were always reasons given, such as business synergies, but often the main reasons were: Wall Street will like it; this will allow us to go public; the stock price will go up; and I’ll get rich. These unfortunately were not tantamount to full-blown strategies that could unify companies. The planning consisted of, buy first, and figure out how to integrate later. While this kind of planning, or lack thereof, affected all layers of the respective corporate cultures, it was often very obvious in the difficulties encountered with the inconsistent computer and software systems that somehow had to be merged. With good planning, there could be a smooth, orderly transition. Otherwise the result was chaos.
Copyright © 2011 Patrick D. Russell
Don’t Overestimate the Flow of Information Up to Management.
We know what rolls downhill, but in organizations information does not roll uphill easily. As a business leader, there may be many things you don’t see and are not even aware of in your organization. These factors will be missing in your plans and calculations. One of the purposes of bringing in a tech advisor is to bring these things to light. (Workflow software that includes management rollups can help bring information through and organize it for analysis.)
When organizations grow they tend to build more layers of bureaucracy. The hierarchical structure may be justified for business reasons, but it does tend to compartmentalize and filter information. People often don’t like to report problems to their superiors, and those who do may be branded as complainers. Some simply don’t know how to bring their reports forward in a constructive way.
Very recently I watched part of an episode of Undercover Boss in which the chief executive of a huge hotel complex spent time behind the check-in desk. The company had recently “upgraded” their computer system. Unlike the old system, which workers liked, the new system was difficult to use (too many windows and clicks), very slow to process, often froze up, and would spit credit cards out onto the floor if the clerks weren’t there to catch them at just the right time. It caused a lot of frustration among the employees, and at busy times the guests ended up waiting in long lines because it took so long to process each party. Prior to his undercover stint, the executive had no idea that this was going on. He knew the computer system had been recently upgraded, but never got any feedback from the primary users or the guests. Armed with the information, he arranged to correct the problems.
Don’t Overestimate Your Internal Confidentiality; Don’t Underestimate How Quickly Word Spreads.
This is the flipside of the last item. Scuttlebutt comes from many sources and can go viral, and when it is negative it can have a devastating effect. Just because the chief executive at the hotel complex hadn’t known about his bad computer system didn’t mean that his customers didn’t know.
Even information held very confidential can be deduced or figured out. Analysts will interpret publically known events. (If a CFO unexpectedly leaves with no explanation, this causes worry and speculation among investors.) Spouses may read each other’s moods and expressions and figure out that something very good or bad is going on. The same goes for families, friends, and acquaintances.
Don’t Forget about the “Silent Majority” – Your Customers
Customers may be your end-users – for example, if you have a web presence for retail sales – in which case it behooves you to make sure that their experiences are easy, reliable, and satisfactory. However, even when your customers don’t interact directly with your system, it can have a very powerful impact on their experiences and how they look upon your business. The hotel guests at the front desk with the undercover boss are a good example.
The Due Diligence Checklist to Be Continued in Part 4.
Don’t Design By Consensus.
Building consensus in a project is important because it gets people on the same page and ensures that they will be ready to participate and contribute. Recalcitrant individuals and groups can damage a project. This can be prevented to a large extent by including representatives from all quarters, and factoring in their needs and concerns.
However, if you have to wait for consensus to make your major design and architecture decisions, you may be waiting a long time. Project experts and mangers can do the most by exercising leadership. Most participants want and need to be heard and have an input on issues relevant to them, but they are not qualified system designers, and won’t commit on major decisions because they don’t understand all the implications. Design by consensus is not an efficient or effective way to build a system.
Know What You Don’t Know – and Get Answers.
Knowing what you don’t know is often more important than knowing what you do know. Sometimes people will admit “I am no expert,” and yet insist on pushing for a particular solution, often against the advice of experts. The experts are not always right. People may have a true instinct or a personal vision, which trumps all the experts. However, other factors and motives may be behind someone who insists on an approach, such as stubbornness, narcissism, cronyism, or nepotism. People may simply be unaware of their limitations, and they just try to make the best of things they don’t understand very well.
It is important to do a self-assessment on one’s knowledge level, and to seek help and support in areas where one falls short. As Benjamin Franklin’s maxim teaches us, “A stitch in time saves nine.” Solicit and take good advice.
Form a Complete Picture of the Challenge.When planning a project, make sure to consider and weigh as best you can all the elements involved, including integration with other systems, data population and connections, risks associated with unknown factors, quality documentation, test and correction procedures, system benchmarks and audits, training, knowledge transfer, maintenance, and upgrades. These elements may seem daunting, even overwhelming, when the project is already large in scope. However, if they are included in the planning, they can generally be handled smoothly in the course of events. Otherwise elements not factored in ahead of time may prove disruptive.
See Blog Entry: Due Diligence System Questions for more information on this topic.
The Due Diligence Checklist to Be Continued in Part 3.
Tech Advisors are first and foremost about due diligence. They can support organizations in doing their due diligence at several different points in a software project. Here is a checklist to help organizations do their own due diligence. The detailed explanations will be covered in other posts.
Make Sure You Understand Pricing.
Watch out for disguised up-charges and price structures designed to trip the buyer into a higher bracket or overage charges quickly.
Make sure that you understand the full costs of a project, and are not leaving out some of the essential pieces in your calculations.
Get Multiple Perspectives for System Design.
A great software system will be built to serve all the users. Be careful not to limit your intelligence to one-pointed managers or “domain experts.” In any organization, as in the army, there are many more privates than lieutenants, and many more lieutenants than generals. Even if a highly paid manager is “more important” than a subordinate worker, when you do the math on the number of workers versus managers, you can see the importance of making a system that serves all.
Honor Your Soft Assets, Your Human Capital.
Different individuals contribute in their own ways, for example, through efforts and diligence, ideas and creativity, knowledge and experience, leadership and consensus-building, specialized skills and competencies, connections and affiliations, and a willingness to offer feedback. The goal is to bring out the greatness in the whole. This means encouraging people to use their unique abilities in support of the overall effort, while minimizing the complaining and dissent that hinders progress.
Don’t Overestimate the Usefulness of Planning Sessions.
Planning sessions may waste valuable time and resources when they lack good structure and leadership, and when they are not guided in the right direction. They are great for building initial consensus and generating high level goals. However, when they try to formalize or do detailed specifications without the benefit of expertise, much of the work may have to be redone and reinterpreted at a later stage.
The Due Diligence Checklist to Be Continued in Part 2.
Copyright © 2011 Patrick D. Russell
Last Sunday Dropbox, a cloud storage site serving approximately 25 million customers, allowed access to anyone’s account for four hours with only a username using any password. This happened because of a software update over the weekend.
See the article in CNNMoney: Dropbox’s password nightmare highlights cloud risks
Because of its many benefits, cloud computing has huge momentum in the industry. Yet for any major organization planning on using the cloud or software-as-a-service, it is caveat emptor as far as security is concerned.
One of the big blessings of the cloud is that: “You don’t have to worry any more about software updates. We will take care of that behind the scenes. You will always be running the very latest version.”
However, this “blessing” is also one of the big curses of the cloud. You don’t have any control over software updates….
In my recent book, The Tech Advisor, this issue is discussed in a section entitled, Poor Understanding of Security and Change Control Issues. The book does not offer the solution to these complex issues, but rather helps the business leader understand what the issues are and to ask the right questions. An excerpt:
An emerging concern is the security of SaaS (software-as-a-service) and cloud software – a sector exhibiting brisk growth. Some industry watchers are worried that these systems may be susceptible and attractive to hackers, and that many of the security questions have yet to be answered.
Change control (management of software updates) is another concern about SaaS that has been put forward by auditing groups. With SaaS, the vendor maintains only one current version. The advantage is that all customers are always using the latest version of the software. However, with traditional enterprise software systems developed and maintained in-house, there are often very rigorous standards and deployment procedures applied to new software versions. Auditors are now concerned that this process in SaaS is opaque to them, and may leave organizations vulnerable in ways they were not before. Continuous software updates without the customary checks and balances of change control feel like quicksand to the auditors, and they are concerned about unwanted side-effects.
Recently I attended a conference on cloud computing in San Diego sponsored by the Association of IT Professionals. The many positives of cloud computing were emphasized, and major companies like Microsoft were confirming their commitments to further these technologies. The presenters mostly argued that as a data store the cloud was quite secure and improving every day. However, there were voices of concern centering on change control, which one presenter characterized as “a lot of hand waving” in its current state.
While the Dropbox incident points out some of the major seismic risks we face with the cloud, lesser incidents are really quite common and familiar to us. How? Common websites are really “in the cloud,” even if they are funded by advertising rather than by our subscriptions. My wife does weather research and has several favorite weather sites. The people running these sites seem to want to give them regular facelifts, and then to tout all their new features and capabilities. However, she often finds that these updates break a lot of things – even front page features you use within a few clicks of entering the site. Invariably these bugs are fixed within a couple of weeks, but they cause frustration in the meantime. Also, sometimes her favorite, easy-to-use features are either removed entirely or made more difficult to access by these facelifts.
These issues with the cloud have precedents in earlier technology transitions. During the mid-1990s, I did a three-week executive briefing for Chevy Chase Bank of Maryland on the new client-server technologies that were coming in. They were a “true blue” IBM shop at the time, and were very reluctant to embrace the new technologies because of change control issues. IBM provided a rigorous develop-test-release protocol for software updates that the bank scrupulously followed. In some of the new client-server software, there could be snippets of code tucked into nooks and crannies, behind graphical elements and so on. From the perspective of a conservative bank maintaining rigorous financial standards, this was virtually unacceptable.
Is there an answer to cloud security and change control issues? While the industry has been working hard on pure data security, and making good progress, it would appear that change control has not had the same degree of attention or progress. Private clouds and hybrid clouds are perhaps beginning to address these issues effectively. Today, many institutions – financial, government, and defense – simply cannot use the cloud for their core activities because of these risks. However, they are also putting pressure on the computing community to come up with answers, because they too want to take full advantage of the cloud’s benefits.
However, there is another area of concern with security hacks. As large conglomerates move more of their activities into the cloud, unprincipled competitors might make use information gathered by teams of hackers in countries where the laws don’t offer strong safeguards. They might pay highly for the information without incurring legal liability. Access to confidential information could give them an undeserved advantage. Thus the stakes have gotten higher.
While there are no easy answers and no simple fixes, our advice to companies considering cloud solutions is to do the best due diligence they can. We will cover more issues with the cloud and have additional recommendations in future blog entries.