![]()
CHAPTER 1: CUTTING EDGE IT
āIf you do what youāve always done, youāll get what youāve always gotten.ā Tony Robbins
Baseline of Capability
Technology enabled organizations may seize opportunity either in exploiting new technology that holds great promise, or delivering on innovation to delight the customer. Perhaps the business opportunity is one involving a new line of business, or an adjustment associated with a move, merger, or acquisition. What happens with IT? Often the IT organizational reality is delayed or underwhelming deployments, and the culprit is an unknown baseline of capability.
A baseline of capability documents existing processes, assets, resources, and skills throughout the IT function in an enterprise. It gathers information pertaining to ITās ability to satisfy the needs of the business in both the short and longer terms, in other words, aids in the alignment of IT with business strategy.
Baseline IT is not just technology that is managed by the IT organization, it includes all IT whether managed locally by business units or in a corporate IT function. In a centralized IT organization, establishing a baseline of capability is a relatively straightforward exercise. In many organizations, IT is not centralized. ābusiness unit IT,ā āsatellite IT,ā and āshadow ITā are euphemisms for IT capabilities managed by the business unit. Often these management practices can make agility for the safe adoption of emerging technology capability more difficult and more risky for the business, not less.
It is a management decision whether to have IT centralized or not depending on what makes the best sense for the enterprise. At the highest level, executive management is accountable for cost management, performance of IT, compliance, and agility of the organization and a devolved IT may be the better approach. This is best handled as deliberate decisionmaking as part of the governance framework for IT, not decision by default.
COBITĀ®ās enabling processes defined in the management domain of Align, Plan, and Organize helps to reach the goal of aligning the IT capability with the business, and sustaining this alignment as business changes. In order for this to be effective, it needs to span all IT, not just the IT that is in the IT organization. Shared IT goals (italicized below) and the business goals they primarily impact are:
- IT agility together with enablement and support of business processes by integrated applications and technology into business processes impacts the business portfolio of competitive products and services.
- Security of information, processing infrastructure, and applications together with IT compliance to internal policies naturally impacts the safeguarding of assets, compliance (external and internal requirements), business service continuity, and availability.
- Optimization of IT assets, resources, and capabilities together with delivery of programs delivering benefits, on time, on budget, and meeting requirements and quality standards impacts stakeholder value of business investments.
- Availability of reliable and useful information for decision making impacts strategic business decision making.
As IT capability ages without keeping pace with business change, it is quite reasonable to expect business goals to be adversely impacted. If IT agility has not kept pace, even with ensuring current baseline maintenance of operating system (OS) releases, the business portfolio may not support competitive products and services. If IT security capability is not kept current to at least a minimal baseline standard of care appropriate to the industry, the business may be actually impaired when it comes to adopting the new functionality it needs to stay competitive. Kludges in the IT systems, workarounds, undocumented patches, and processes that are not understood by all parties will affect the delivery of business benefit from IT, directly impacting IT stakeholder value. Non-availability of information for decision making, either because it is too expensive to store in a readily accessible form, decision support capability is not available, or data is corrupted or simply unavailable in a trusted online format, impacts the businessās ability to make decisions.
The goals and processes that ensure a current and maintained environment with a known baseline capability are critical to successful deployment of new emerging technology. Without a known baseline of capability, decision makers cannot move to the next level or have any idea of where they are. As a result, emerging technology deployments happen sometimes in fits and starts or rollouts are attempted, only to fail.
Intrusion detection systems (IDS) were a notable security technology that had a high failure rate of deployment in early commercial implementations in the late 1990s. The implementation details of IDS were largely unknown by consuming organizations. Organizations, who were able to deploy it well, did so with a clearly understood baseline of capability in IT as well as clear goals for the new capability. Those who ventured into unknown territory experienced great disappointment, and the anticipated value associated with large expenditures of capital and expense on IDS went largely unrealized for years. The graveyard of deployment failures, or crippled deployments, is littered with data center moves, electronic resource management (ERM)systems, customer relationship management (CRM) systems, and human resource (HR) systems; it is little wonder that business management decide they can do better with āshadow ITā (something that the Cloud has made all the easier).
Organizations capable of cutting edge IT know their baseline, and can quickly come to terms with the impact assessment of new technology. With that disclaimer in place, let us examine what others are saying will be the disruptive innovations of the next decade for IT.
Internet of Things
According to Gartner Group, the IoT describes how the Internet will include many items to which sensors and logic have been added to make them traceable, readable, recognizable, and countable via Internet-facing applications. The IoT will include current capabilities like RFID (radio frequency identification) applied more broadly for inventory control, supply chain, and customer applications. IoT will include sensors of every type, including embedded technology such as implanted medical devices to be managed and monitored from the physicianās office, and smart self-healing data centers. Broad adoption of smart phones with cameras have pushed IoT capability to enable geolocation, mapping, and facial recognition applications that have fairly fascinating implications in terms of social media and the boundaries of personal privacy. Near Field Communications (NFC) will enable point-of-sale transactions by waving mobile devices over readers without having to go through the technical steps of setting up the connection first. NFC will enable checkouts at grocery stores, get context information from various venues like ballparks and museums, and share information on a sort of peer-to-peer basis with people in proximity.
NFC will also create opportunity for virtual pickpockets and targeted attacks on individuals. At a DEFCON (defense readiness condition) conference a few years ago, a US Passport with the RFID chip was zip-lined past a garbage container rigged with explosives and an RFID reader. The successful explosion demonstrated effectively that unprotected NFC devices should not be carried through public areas!
IoT impacts many of the control points discussed as part of baseline capability. It will vary as to which IoT application is used, but let us use an example of RFID used for data center inventory and asset management. When a large financial institution implemented RFID for asset management, they were driven to do so to reduce costs associated with IT capital asset inventory. The cost of the periodically required inventory was the diversion of labor that was needed elsewhere in the business, and the cost of handling multiple errors from a manual inventory process. The bank saw the benefit of end-to-end asset management, from the supplier to the data center floor, and ultimately went beyond simple cost reduction for inventory to an RFID-based tracking system from order to invoice, to shipping to billing, to staging to payment. Suppliers benefitted from this management system because they were paid faster. Imagine the reduced cost and distraction during merger and acquisition (M&A) activities when an entire data center asset inventory can be completed in minutes instead of weeks, and be virtually error-free. This is an example of the compelling business benefit of IoT.
IoT could revolutionize the maintenance, repair, and overhaul (MRO) in the aviation and defense, transportation and railroad, oil and chemicals, automotive, and construction industries by tracking parts and tools needed by location, proximity, and inventory. IoT could enable tracking of who used which tool on which maintenance event and when it was done.
IoT entices us to imagine our electronic wallet on our smart phone, and a capability of point-of-sale (POS) at vending machines using just a wave of a mobile phone to make payment. The implications of everything having a tag, of tags being readable by our mobile devices, and the ability to combine the information in the tag with our personal information, shopping habits, geographic location, and proximity to related objects has an attraction similar to the business benefit described in MRO ā and yet it comes with an unarticulated uneasiness that somehow too much information is being collected and we have lost control over our rights to review it for accuracy and to control who shares it with whom.
There is a common thread among the various opportunities in cutting edge IT. They almost all revolve around collecting data, and using it in ways that allow for decision making, marketing, or even more covert purposes. Our ability to control where this information goes depends upon understanding our baseline capability to begin with, and implementing processes (not just legislation or checklist requirements) that are sustainable and continuously improved to ensure IT environments are operating as intended, only as intended, and are doing so in a way that returns value to its owners. This is the value of the integrated framework presented in COBIT 5Ā®with its associated standards, including Generally Accepted Privacy Principles (GAPP).
Mobile Computing
Mobile computing from various devices that has enabled consumers to integrate messaging, voice, and applications has had two major impacts. First, it has been a technology opportunity for companies to rethink their business model. Second, it has led to the consumerization of IT.
Arguably, the introduction of the iPad was a disruptive innovation ā a game changer. The only reason that might be argued is that MicrosoftĀ® introduced a tablet computer much earlier, but the world yawned. I was an early adopter of the Tablet OS at MicrosoftĀ®, and loved being able to use touch computing with a stylus to annotate PowerPointĀ® and WordĀ® documents. When Apple came out with its first iPad, after we got done with the jokes about the name, itās lack of document annotation in the same way as the Windows Tablet OS was initially disappointing. Then the realization hit: the iPad was not a supplement to desktop and laptop computing ā it was a replacement. The model of the app store, of user-driven application choices (up to a half-million as of mid-2012), was a game changer. Instant On with extended battery life became the new bar for end user patience. Touch computing, integration of gesture, search voice, and video had become the new normal literally overnight.
It took a security analysis of the iPad2 for me to be open to the idea that this device was a reasonable replacement within an enterprise business setting for laptops running either WindowsĀ® or OS X. The security management of the mobile platform is the key to its success within the enterprise, and with mobile device management (MDM) together with encryption of the platform, the iPad not only delights consumers, it provides advantages in terms of management and security. At the time of writing, MicrosoftĀ® has had important announcements about Surface tablets that became commercially available in the Fall of 2012 and the final versions of the OS for the Surface RT and Surface Pro.
Whether Apple, GoogleTM, or MicrosoftĀ®, mobile computing is driving business change. Internally, mobility of teleworkers has set new expectations for talent acquisition and retention. Access to information via LAN (local area network)or WAN (wide area network)has put vast and varied resources at associatesā fingertips, from websites, to blogs, corporate data, special subscription information, e-mail, books, music and back-to-your-own-private-information applications.
An example of new business opportunities that arose with the iPad is a service that is a boon for corporate secretary functions supporting a board of directors (BoD). Paperless board meeting services provide a security and control benefit in an outsourced, Cloud-based, mobile application compared to traditional methods of preparing and distributing board materials. By providing the BoD members with personal mobile devices, in this case iPad2, and downloading board meeting materials to them with effective full disk encryption and dedicated secure links, a corporate secretary can save expense and time and deliver smart convenience and document readability to corporate executives. Board members can carry board documents with them for pre-reading without the risk of paper left or discarded in publicly accessible form. Updates can be provided on the fly. For iPads under MDM, password policies, remote data wipe, and location tracking are all data protection benefits.
There are many examples of compelling business opportunities driven by mobile computing (you can Google or Bing them from your smart phone). This particular one raises an interesting challenge for security and control managers because an IT governance process for paperless board meetings requires due diligence on the technical and process controls, not to mention policy issues, for sharing sensitive information on mobile devices over VPN(virtual private network) owned by third parties and in the Cloud. This is not one of those requests where the security or audit manager has the luxury of time, and it is going to be a highly visible request. It makes a case for knowing, in advance, the framework enabling a quick evaluation of new technology opportunities from a technical and process perspective.
Cross-platform Integration
The proliferation of diverse mobile devices is driving the need to address cross-platform issues at the application level. The implications of a constantly evolving set of mobile platforms that contain varied services (e.g. no Adobe Flash on iPads or iPhones) affect application programming models, such as service oriented architectures, coupled with Cloud policies and a strong governance model, to ensure the necessary technology elements and application development/acquisition standards are adhered to. Mobile Web technologies must continue to evolve to keep pace with the explosion in device interfaces, and this creates additional pressure on the teams who have been charged with responsibilities to ensure āno hacks no leaks.ā Application programming āerrorsā that either affect service availability or application and data integrity are growing as the checks and balances for them do not keep pace. Addressing this expanding area of IT is a key cause of concern for security and control professionals through processes and metrics based on the COBIT 5Ā®framework.
Consumerization of IT
The second, and perhaps more important, change affecting business as a result of advances in mobile computing technology is consumerization of IT. Consumerization of IT happens when the end users in the organization have a deep level of discontent with the company-provided end user experience, and push instead to substitute their personally preferred device for the company mandated standard. Consumerization also happens to some degree through the work-from-home workforce, where employees and contractors are to provide their own platform for per...
