Buy vs. Build

To meet an organization’s software system requirements, an alternatives analysis of commercially available solutions (packaged software) should undertaken. A Buy vs. Build Analysis evaluates three potential solutions: packaged software (i.e., buy), custom-built software (i.e., build), and a hybrid approach (in which both custom software and prepackaged components are integrated into the solution).

Option One:  Packaged software, or commercial off-the-shelf (COTS) software, is generally geared toward either a vertical market, in which the system performs a range of business functions for a specific industry (manufacturing, retail, health care, restaurants, etc.), or a horizontal market, in which the system can serve a wide variety of industries (not specific to any industry or business). IF an organization’s requirements are not industry-specific, more generalized software solutions should be considered rather than those targeting businesses with industry-specific needs.

Option Two:  Custom software is developed either for a specific organization or for a function that is not addressed by packaged software, and is generally not targeted to the mass market. It would be specifically designed for the organization’s particular requirements and can be tailored to fit exactly the task order process. Custom software is much more flexible than packaged software and can incorporate specific business processes that do not exist in a packaged solution; further, it can be modified as the organization’s requirements and business practices change.

Option Three: A hybrid software solution is one in which both a COTS system and custom-built software are combined. This approach is viable when a COTS system meets a portion of the requirements and can be effectively integrated as a component of a larger software system. The same limitations and advantages as mentioned above apply, but the COTS application does not need to address all of the requirements. This configuration typically works best when the COTS system addresses system requirements that are fairly common (either across industries or within an industry), such as scheduling or collaboration. Additional integration, licensing, and maintenance costs apply for this arrangement.

Factors to consider in buying:

• Is a COTS system available? How closely does it meet the requirements? What does it cost? How good is it? What has been the experience of others using this software?
• If no COTS system is available that meets the requirements, is a COTS system still the only viable alternative?
• Are the requirements sufficiently defined, facilitating an informed selection of a COTS system?

Factors to consider in building:

• Can outside vendors build the solution? How experienced are they building similar systems and how well do they understand the business processes involved?
• Is this system essential from a strategic standpoint? Does it support a core competency? Are security or competitive secrets a concern?
• Is there a COTS system available that closely meets the requirements?
• Can the necessary technical resources be obtained?

Common factors to consider:

• What level of integration with external systems (Contractor Accounting System and Databases) is required?
• What level of flexibility is necessary in the security model and is it important to have user definable security roles?
• Is a customizable feature set (Reporting, Search, Alerts, UI) a priority?
• How powerful and adaptable do the system’s document management capabilities need to be?

Value, Impact and Management Implications of IT investments

Information technologies are becoming increasingly pervasive in today’s business environment. Because of the emphasis on reducing cost and using technology as a strategic driver, it has never been more important for organizations to make sound decision regarding investments in technology, and leveraging those investments as effectively as possible to achieve strategic goals and objectives. This post explores the issues surrounding the impact of technology investments and the implications on the effective management of those investments from several viewpoints: the alignment of technology with business; IT governance; financial measures; portfolio management; and organizational performance management. The objective of this post is to look at questions concerning investments in technology and the effective utilization of those investments through various constituent elements that comprise the selection and management of investments within the organization.

Impact of Technology Investments

Understanding the value and impact of technology investments and the implication of these investments for the effective management of the IT organization is an important issue. For many years studies in the IT literature have examined the impact of technology investments on various measures of performance and value. While there is general agreement that IT contributes to business value, there are a number of dimensions that firms must carefully consider when deciding how best to obtain and utilize IT resources. It is generally assumed that such investments will lead to gains in both profits and productivity, but an organization may not fully understand the impact of IT capital on business performance and the correlation with shareholder’s return.

IT business value includes such measures as increased productivity and profitability, improved business relationships, the efficient utilization of resources and perhaps competitive advantage. An enhanced understanding of IT investment’s contribution to business value proves a firm with increased confidence in the performance of their IT investments, but understanding this contribution is challenging. The objective of this post is look at the critical factors and key indicators of IT-business alignment, and investigates the relationship between IT investment and organizational performance as well as highlight tools that help managers better evaluate IT expenditures. Understanding how factors such as IT-business alignment, IT governance, financial decision making, portfolio management and organizational performance contribute overall to business value is important when making IT investment decisions and to leveraging those investments as optimally as possible.

A company’s information technology capacities can restrict or increase its ability to respond to market conditions. An organization’s investment in IT infrastructure, processes and projects can involve a complex decision making process. Organizations are investing increasing amounts in IT, and must have measures in place to facilitate understanding of the often complex relationship between IT investment and organizational strategic and economic performance. These firms may benefit from the adoption of an organizational change perspective when assessing the impact of IT investment on company performance. Investment in information technology is steadily increasing, but many firms find it difficult to formally assess the value of IT investments because the latter are often incorporated into broad management initiatives. Organizations need to develop a improved understanding of the dynamic relationship between IT investment and performance at both the organizational and industry level.

Implications of Investments for Effective Management

The financial impact of new IT deployment comes with a big challenge – ensuring that new technology investments are used effectively throughout the organization. A successful technology implementation requires people understand, support and ultimately implement the change. Organizations need to address the key components as change management is integrated into the business. These may include governance, timely and effective decision making at all levels, organization and business process redesign, and measurement and feedback to help protect and maximize organization’s technology investments.

Technology driven organizations are pressed to stay abreast of rapid developments in technology and align their technology investments to business needs. Management need to identify future technology routes and opportunities through the diagnoses of the organization’s strengths and weaknesses and identification of opportunities for improvement. Organizations must balance both short and long term technology objectives through effective portfolio planning while simultaneously stimulating innovation and creativity.

IT represents a large percentage of the budget for organizations, and significant value can be derived from IT investments through the active and effective management of IT investments using a portfolio management approach. Organizations able to position their IT investments as strategic assets are able to exploit the value of those assets and potentially to create a sustainable competitive advantage. A combination of IT investment decision making techniques such as IT governance, project portfolio management and organizational performance management can be used to get a holistic viewpoint of the organization and to evaluate and prioritize project investments. This coupled with a focus on IT-business alignment allow an organization to more effectively manage their information technology investments.

Alignment of IT with Business Strategy

Business strategy is the overall long term positioning and direction of an organization and involves the cautious selection and allocation of resources in order to obtain a competitive advantage. In order to help drive business strategy, IT needs to play a significant role in changes that will ultimately help the organization better align its technology investments with its business needs. IT needs to be made part of the enterprise strategic planning process and collaborate with the business to develop a strategic plan. This plan should align IT with the business strategies through a balanced portfolio of IT project investments that support high value business initiatives with tangible financial benefits. The term “IT alignment” generally refers to the coordination of the IT strategy with the business strategy and the the goals, value proposition, competitive strategies, mission, capabilities of the business strategy IT should align with (DeLisi, 2005). This calls for an organization wide effort with the CEO’s support – business managers should work with the IT executives in strategic planning to formalize a business strategy that aligns IT with business. This alignment of IT with overall business strategy requires continuous effort and needs support from all levels of the organization. How well an organization has aligned its IT processes with businesses strategy may depend on how well the CIO is communicating with C-level colleagues (CIO, 2007) and if its processes offer a customer centric perspective on organizational performance, emphasizing customer satisfaction rather than just financial results (Hammer, 2005).

Rather than focusing solely on new features or technology, organizations should develop a broader strategy that aligns technology changes with business process. Organizational strategy is about how a company orients itself towards the market it operates in, and towards the other competitors in the marketplace. Certainly, new business models, new products or services, cutting edge technologies and innovative business processes can all be a part of that strategy. One concern is the need to understand the complex relationships between IT investments, usage patterns, and the realized value. When organizations prioritize and balance the initiatives associated with organizational strategy as well as ongoing operations, technology will factor in to a significant extent. More organizations are viewing IT as an essential component of their business strategy and undoubtedly technology can be a important contributor to business strategy and operations – but an IT strategy focused to narrowly on technology brings great cost and risk and technology initiatives demand a business justification (Wharton, 2005).

Alignment maturity allows companies to identify opportunities for enhancing the integration between IT and the business. Organizations who attain alignment typically do so by establishing a set of well planned process improvement initiatives that systematically address impediments and go beyond executive level conversation to penetrate the entire IT organization and its culture (Nugent, 2004). Alignment addresses issues such as how well the business and IT are aligned with each other, how do IT relationships within the enterprise diverge, and what can be done to improve and sustain alignment between IT and the business. According to Luftman (2000), there are six business alignment maturity criteria: Communications; Competency/Value Measurements; Governance; Partnership; Scope and Architecture; Skills. Luftman believes that assessing an organization along these dimension will identify specific actions to effectively enable IT to drive business strategy. Organizations must recognize that the level of maturity between technology and business strategy is a key factor in both long and short term success in today’s volatile, competitive and increasingly global marketplace.

IT Governance

One means of achieving alignment between IT and the business and maximizing the value of IT investments is through the deployment of a well developed IT governance framework. Most organizations are looking to develop decision making frameworks and processes to determine how investment decisions should be made and identify where accountability rests for those decisions. Organizations invest millions of dollars each year on IT infrastructure, hardware, software, and services. Understanding the complex relationships between IT strategy, governance mechanism, and investment profiles and the extent they contribute to real business value is an important topic. According to Routh (2008), today’s CIO face significant challenges including inadequate resources to undertake projects they feel would be beneficial to their company and being able to guarantee that expensive IT projects will survive a long development time. CIOs are also fighting the perception of other executives that the CIO is more a technology leader than a strategic business leader. These executive may demonstrate a lack of understanding on the part of other executives about the strategic role that IT could play if they had a better understanding and appreciation of the potential contribution IT could be making to their corporate bottom line. Many of these obstacles can be overcome by instituting effective IT governance.

IT Governance is the organizational structure concerned with how IT strategy aligns with business strategy, ensures that the organization is well positioned to achieve their strategies and goals, and implements effective ways to measure the performance of IT (Schwartz, 2007). Regardless of size, all organizations need a way to ensure that IT sustains the organization’s strategies and objectives. How IT is working overall, what key metrics management needs, and what return IT is giving back to the business from its investment are some key questions an IT governance framework should answer. In addition to these factors, organizations are subject to a host of regulations governing data retention, information confidentiality, financial accountability and disaster recovery. While these do not require an IT governance framework, many organizations have found it to be an effective way to ensure regulatory compliance.

According to the IT Governance Institute (2008), the 5 major focus areas that make up IT governance include:

• Strategic alignment – the relationship between the business and IT
• Value delivery – ensuring the IT department takes the necessary steps to deliver the benefits promised at the start of a project or investment
• Resource management – a way to manage resources more effectively by organizing staff more efficiently
• Risk management – instituting a risk framework that formalizes how IT measures, reports on, accepts and manages risk
• Performance measures – a structure surrounding the measurement of business performance. One well known method involves instituting a Balanced Scorecard, which examines how IT contributes to achieving business objectives

IT is typically an expensive corporate asset and increasingly, board members are being held accountable for knowing where and how effectively the company’s money is being spent (Deloitte, 2006). Many organizations have expressed frustration in measuring the value of IT. An IT Governance framework allows organizations to answer key questions concerning how the company is measuring and managing value from IT, measuring and managing risk in the IT environment, and if the organization’s IT capabilities and investment priorities are consistent with business strategy and business needs.

Actively designing an IT governance framework involves executives leading the initiative by allocating resources, attention, and support to the process. For many organizations, this may be the first time IT governance is designed explicitly. According to Weill and Ross (2004), through their study of hundreds of enterprises, effective IT governance can be distilled into 10 principles:

• Actively design governance – focus on having the fewest number of effective mechanisms possible, the goal of any governance redesign should be to assess, improve, and then consolidate the number of mechanisms.
• Know when to redesign – rethinking the entire governance structure requires that individuals learn new roles and relationships.
• Involve senior managers – CIOs and senior management must be effectively involved in IT governance for success.
• Make choices – effective governance, like effective strategy, requires choices and ineffective governance may be the result of conflicting goals.
• Clarify the exception handling process – exceptions are a mechanisms by which an enterprises can learn and challenge the status quo, particularly IT architecture and infrastructure.
• Provide the right incentives – a well designed IT governance framework stresses the importance of aligning incentive and reward systems to governance arrangements.
• Assign ownership and accountability for IT governance – similar to any major organizational initiatives, IT governance must have an owner and accountabilities.
• Design governance at multiple organizational levels – In large enterprises it is necessary to consider IT governance at multiple levels.
• Provide transparency – the greater the transparency of the governance processes, the the greater the confidence in the governance process will be.
• Implement common mechanisms across key assets – understand how IT governance fits into corporate governance and coordinate investments.

Firms with superior IT governance outperform those who do not given the same strategic objectives. Much in the same manner that corporate governance’s purpose is to ensure sound decisions about all corporate assets, IT governance associates IT decisions with company objectives while monitoring performance and accountability. IT plays a central role in an organization and an integrated governance, risk and compliance solution that establishes the control, risk management and oversight of IT related processes and controls is an important component. An IT governance framework establishes visible, positive oversight of the IT practices, assets and resources, IT governance ensures the proper use of IT resources and demonstrates that risks are managed and corporate objectives are supported.

Portfolio Management

IT investments have been recognized as representing a significant percentage of the budget for organizations. To derive significant value from IT investments, organizations must actively and effectively manage their IT investments using a project portfolio management approach. Project portfolio management is a processes for effectively assessing, selecting and managing a collection of projects within a department or organization. Portfolio management enables organizations to establish recognized processes for measuring and monitoring the value of IT investments, and to formalize the decision making process through a governance framework. One goal of project portfolio management is to achieve alignment between the investments of human resources, technology resources, capital budgets, and operating budgets of a set of projects with organizational objectives (Educause, 2000). At a time when CEOs are demanding that technology investments return value, CIOs must have control over their IT project portfolios. Portfolio management starts with gathering a detailed inventory of all the projects in the organization including name, estimated cost, ROI, business objective, and business benefits. Each project must then be evaluated and projects that match strategic objectives identified. The senior leadership team must examine those projects and separate out the those with questionable business value.

Successful project prioritization necessitates both recurring adjustments based on shifting business demands as well as a means to assess whether projects have delivered the anticipated ROI (Kalin, 2006). An IT steering committee made up of business and IT leaders needs to review project proposals and a strong governance structure is key to making this work. Putting portfolio management in place can drive organizations with immature or nonexistent governance structures to improve or create them.

Project portfolio management facilitates organizational control of IT projects and helps deliver meaningful value to the business. Portfolio management takes a view of a company’s overall IT strategy across the enterprise. Both IT and business leaders examine project proposals and align them with the organization’s strategic objectives. The IT portfolio is managed like a financial portfolio with riskier strategic investments balanced with more conservative investments, and the blend is constantly monitored to assess which projects are on track, which are in need of help, and which should be canceled (Datz, 2003). An effective portfolio management program is intended to maximize the value of IT investments while minimizing the risk, improve communication and alignment between IT and business leaders, encourage business leaders to take responsibility for projects, more efficiently schedule resources, and reduce the number of redundant projects.

One of the central criterion for which projects receive funding is how closely a project aligns with the organization’s short term strategic objectives. An effective evaluation process can detect redundant project proposals up front, eliminate projects with weak business cases early, and fortify alignment between IT and business leaders. Even after evaluating the project inventory, most organizations will still have more projects than they can actually fund and so the project inventory will need to be prioritized and categorized. In today’s environment where IT investments can represent up to half of an organization’s capital investment, projects are examined more closely than ever. The idea behind portfolio management is that ultimately the prioritization process allows the organization to fund the projects that most closely align with its strategic objectives.

Project portfolio management is a formal, disciplined approach to managing IT investments by balancing potential return with investment objectives and risk. A central facet of portfolio management and effective governance is the ability to watch where resources are deployed across the organization, and determine the actual cost of IT initiatives. In addition to providing a centralized view of an organization’s IT projects, an effective portfolio will make simplify the task for CIOs to make sure their IT investments are well balanced in terms of scope, risk and anticipated payoff (Berinato, 2001). Delivering projects that enable business growth and align IT strategies to business goals are a chief priority for CIOs. The benefits that are realized through a thorough evaluation and prioritization process are a substantive reason portfolio management is so powerful. Communication between IT and business leaders improves and portfolio management gives business leaders the ability to understand how IT initiatives impact them. With portfolio management decisions are made based on the best interests of the company and gives business leaders responsibility for IT projects.

Organizational Performance Management

Performance management is composed of activities to ensure that corporate objectives are being achieved consistently in an effective and efficient manner. Performance management can focus on the performance of the entire organization, a single department, a processes and so on. Performance management is a systematic approach in which an organization involves its employees, either individually or in groups, to improve organizational effectiveness in accomplishing organizational mission and goals. Performance management is focused on translating goals into results and should have a long term perspective which emphasizes employee development and continuous process improvement.

An organization’s performance goals can only be realized through its employees and effective performance management ties individual and team behaviors to the company’s business strategies, objectives, and values. For an organization to reach its goals, it is necessary for every employee to understand individual roles and responsibilities for achieving these goals, and there must be a continuous dialog between managers and employees to set performance expectations, monitor progress, and evaluate results. Performance management is a valuable tool for aligning people and strategy across the business and helps organizations make informed, timely decisions. Methods intended to increase organizational performance include business process reengineering, management by objectives, the balanced scorecard and the Baldrige Criteria.

Business Process Reengineering

Business process reengineering (BPR) is a primary method by which organizations become more efficient. Many organizations are being challenged to reduce costs while improving their performance. The goal of business process reengineering is to transform an organization in ways directly affect performance (Carter, 2005).

Davenport (1993) describes a five step approach to the Business Process Reengineering model:

• Develop the business vision and process objectives
• Understand and measure the existing processes
• Identify IT capabilities that should influence BPR
• Design and build a prototype of the new process
• Adapt the organizational structure and governance model

Business process reengineering helps organizations fundamentally shift how their work is done in order to dramatically improve customer service, reduce operational costs, and become more competitive. A major motivation for reengineering has been the continuing development and deployment of sophisticated IT systems and networks and many organizations are using this technology to support innovative business processes instead of refining current ways of working.

Management by Objectives

Management by objectives is intended to increase organizational performance by aligning goals and supporting objectives throughout the organization. Employees get substantial input into identifying their objectives and timelines for completion and includes ongoing monitoring and feedback in the progress in reaching their objectives. This management strategy uses the S.M.A.R.T. goals method – setting objectives that are specific, measurable, achievable, realistic, and time based (Bogue, 2005).

Management by objectives assists in aligning individual efforts of broad teams around the collective objectives of the organization. The management by objectives process begins with the organization defining its objectives. From this process of strategic planning, a set of organizational objectives is generated. Then it is up to individual departments to form objectives which should align and support these organizational objectives. Individual objectives are then created to support theses departmental objectives

Balanced Scorecard

The Balanced Scorecard is a strategic approach and performance management system that enables organizations to translate a company’s vision and strategy into implementation. The Balanced Scorecard works from 4 perspectives: financial, customer, business process, learning and growth. The balanced scorecard is used to used to align business activities to the vision and strategy of the organization, improve internal and external communications, and monitor organizational performance against strategic goals (BSCI, 2008).

Each perspective of the Balanced Scorecard includes objectives, measures of those objectives, target values for those measures, and initiatives, defined as follows:

• Objectives – major objectives to be achieved
• Measures – parameters used to measure progress toward the objective
• Targets – the specific target values for the measures
• Initiatives- action programs to be initiated in order to meet the objectives

The balanced scorecard can be used as a management system to implement strategy at all levels of the organization by clarifying strategy, communicating strategic objectives, and aligning strategic initiatives, and strategic feedback and learning. These functions have made the balanced scorecard an effective management system for strategy implementation and can help IT leaders more closely align IT to corporate strategies and objectives.

Baldrige Criteria

According to the Baldrige National Quality Program (2008), the Baldrige Criteria for Performance Excellence provide a systems perspective for understanding performance management. This criteria reflects validated, leading edge management practices against which an organization can measure itself. Accepted internationally as the model for performance excellence, the criteria express a common language for communication among organizations for sharing best practices.

The Baldrige criteria are a tool for driving continuous improvement which help organizations identify, understand, and manage the factors that determine their success. The criteria are built upon a set of core values and concepts that are embedded in the seven Baldrige categories: Leadership; Strategic Planning; Customer and Market Focus; Measurement, Analysis, and Knowledge Management; Human Resource Focus; Process Management;Business Results. The Baldrige Criteria look at the organization cross functionally and can help organizations ensure that IT investments support overall corporate goals and objectives.

Financial Measures

Both financial and non financial measures are key components in understanding the true value of an IT investment. Although most organizations do not focus exclusively on financial measures, they are important management tools that can be used for investment decision making. The decision to invest in an IT project may be motivated by any number of drivers, but ultimately, project investments are linked to financial objectives. Two of the more common measures used in the decision making process are Total Cost of Ownership and Return on Investment.

Total Cost of Ownership

Total Cost of Ownership (TCO) is a concept which can be used to ensure that associated costs are considered when an organization considers acquiring an asset such as software or hardware. TCO can be described as all costs of owning and operating an asset over time. TCO not only reflects the cost of purchase but also includes all associated costs in the continued use and maintenance of the asset. TCO is an essential understanding of all costs associated with implementing and managing an organization’s technology assets and is ability to quantify the full lifecycle financial impact of deploying information technology. Organizations considering a technology implementation must consider the total cost of ownership and plan accordingly. Elements that factor into the total cost of ownership include strategic planning for technology, training, hardware technical support, software, connectivity and so on.

A separate but complimentary concept is that of Activity Based Costing (ABC). Activity Based Costing is an accounting system that assigns costs to products based on the resources they consume and allows the true cost of a product to be determined with much greater fidelity than is possible with traditional accounting systems (Acton, 2008). The ABC and TCO benchmarking techniques offers superior insight into business processes and service levels helping to improve efficiency and effectiveness (Smith, 2005). They may also identify business process improvements through root cause analyses, translating into cost reductions or service level enhancements.

ROI

What precisely return on investment (ROI) is and how is it used to help make IT investment decisions is a question that IT is being asked more today than ever before. Traditionally, when IT and business leaders discuss the ROI of an IT investment, they were mostly thinking of “financial” benefits. Today, business leaders and technologists also consider the “non financial” benefits of IT investments (RMS, n.d). Financial benefits include the impact on the company’s budget and finances (cost reductions or revenue increases) and non financial benefits include the impact on operations or mission performance and results such as improved customer satisfaction, better information, or shorter cycle times.

IT project selection decisions are based upon the perceived value of the investment and most organizations use one or more “financial metrics” which, along with other non financial measures, are collectively know as ROI.

Financial metrics include:

• Payback Period – the amount of time required for for an organization to recapture the initial the cost of the project.
• Net Present Value – The present value of a series of future net cash flows that will result from an investment, netted against the initial investment.
• Internal Rate of Return – the annualized effective compounded return rate which can be earned on the invested capital, i.e. the yield on the investment.
• Discounted Cash Flows – a method of evaluating the future net cash flows generated by a capital project by discounting them to their present day value.

Non financial benefits, unlike financial returns, may have no widely accepted metrics that can be applied. These non financial benefits are sometimes termed “intangibles” because they are not represented in traditional cost accounting methods, but genuinely make a difference in maximizing the economic potential of the organization. The difficulty most organizations encounter with non financial benefits are the difficulty in figuring out what to measure, and how to measure it. However, ITs potential for producing a positive impact on organizational performance results are irrefutable. New IT systems are complex and potentially risky investments for organizations, and technology investments are fundamentally about overall value creation for the business.

Research into “the changing role of finance executives regarding Information and Communication Technology” (Paul and Tate, 2002) shows that CFOs typically use financial measures to evaluate IT investments. Over 86% CFOs that responded use traditional capital budgeting methods such as Return on Investment, Payback period, Discounted Cash Flow and Internal Rate of Return. CIOs tend to use of these financial methods much less frequently. Of the 456 CIOs and senior IT managers that responded in the research into “the issues and challenges facing senior IT executives” (IDG Research and Getronics, 2002) only 18% indicated using the aforementioned traditional financial measures. For many CIOs, the effects of the investment, like decreased costs and increased productivity, were the primary measure of value. The different results in this research illustrate the challenges in capturing the complete business value of IT investments in an understandable measure.

Conclusion

It is important for organizations to understand the value and impact of technology investments as well what those investments imply for effective management. While it is generally agreed that IT conveys value to the business, there are a number of factors that firms must carefully consider when deciding how best to procure and utilize IT resources. Organizations must fully understand the impact of IT capital on business performance and the correlation with shareholder’s return of IT investment decisions. Organizations must stay ahead of rapid developments in technology and align their technology investments to business needs.

Alignment maturity allows organizations to discover opportunities to enhance the integration between IT and the business through a set of well planned process improvement initiatives that systematically address challenges and penetrate the entire IT organization. One means of achieving alignment and maximizing the value of IT investments is through IT governance. IT plays a key role in an organization and an integrated governance, risk and compliance solution that establishes the control, risk management and oversight of IT related processes and controls and associates IT decisions with company objectives while monitoring performance and accountability is an important component.

Technology constitutes a significant percentage of the budget for organizations, and substantial value can be delivered from IT investments through the active and effective management of IT investments using a portfolio management approach. The main concept behind portfolio management is that the prioritization of projects allows the organization to fund the projects that most closely align with its strategic objectives.

IT strategies and corporate strategies should be closely aligned, and to understand this relationship from an organizational perspective, organizational performance management frameworks and methods are effective tools. Performance management is composed of activities to ensure that corporate objectives are being achieved consistently in an effective and efficient manner. Methods intended to increase organizational performance include business process reengineering, management by objectives, the balanced scorecard and the Baldrige Criteria.

To understand the impact of technology investments on the organization and to measure the contribution these investments make within the firm, a number of financial and non financial methods are typically employed. The decision to invest in an IT initiative may be motivated by any number of factors, but ultimately, project investments are tied to financial objectives. Two of the more common financial measures used in IT project investment decision making are TCO and ROI.

Information technologies are becoming increasingly ubiquitous in the modern business environment. Because of the emphasis on reducing cost and using technology as a strategic driver, it is increasingly important for organizations to make reliable decision regarding investments in technology, and to leverage investments as effectively as possible to achieve strategic goals and objectives. This post explored the issues surrounding the impact of technology investments and the implications for the effective management of those investments from several viewpoints.

References

Acton (2008). Glossary. Retrieved October 29, 2008 from: http://www.consultacton.com/01GetReady/glossary.htm

Berinato, S. (2001). Using Project Portfolio Management to Demonstrate IT Value. CIO.com. Retrieved October 10, 2008 from: http://www.cio.com/article/30560/Using_Project_Portfolio_Management_to_Demonstrate_IT_Value

Bogue R. (2005). Use S.M.A.R.T. goals to launch management by objectives plan. Retrieved October 29, 2008 from: http://articles.techrepublic.com.com/5100-10878_11-5683094.html

BSCI – The Balanced Scorecard Institute (2008). What is the Balanced Scorecard? Retrieved October 28, 2008 from: http://www.balancedscorecard.org/BSCResources/AbouttheBalancedScorecard/tabid/55/Default.aspx

Cardin, L. (2006). Should CIOs Capitalize Or Expense IT Investments? Retrieved September 18, 2008 from:http://i.i.com.com/cnwk.1d/html/itp/Forr051104099900.pdf

Carter, P. (2005). Business Process Reengineering: An Introductory Guide. teamtechnology.co.uk. Retrieved October 29, 2008 from: http://www.teamtechnology.co.uk/business-process-reengineering.html

CIO.com (2007). The RIO of Alignment. Retrieved October, 9 2008 from: http://www.cio.com/article/27969/The_ROI_of_Alignment

Datz, T. (2003). Portfolio Management Done Right. CIO.com. Retrieved October 9, 2008 from: http://www.cio.com/article/31864/Portfolio_Management_Done_Right

Davenport, T.H. (1993). Review of Re-engineering the Corporation, Sloan Management Review, Fall, pp.103-4

DeLisi, P. (2005). IT Alignment Revisited. InformationWeek. Retrieved October 09, 2008 from: http://www.informationweek.com/news/showArticle.jhtml?articleID=164301027

Deloitte Consulting (2006). What the Board Needs to Know about IT: The board’s role in leveraging technology as a strategic resource. Retrieved September 5, 2008 from: http://www.deloitte.com/dtt/cda/doc/content/us_consulting_ti_boardneedknw_181006.pdf

Educause Annual Conference (2000). Making the Most of IT Investments: Project Portfolio Management. Retrieved September 21, 2008 from :http://connect.educause.edu/Library/Abstract/MakingtheMostofITInvestme/37761?time=1221942680

Hammer, M. (2005). The CIO Role: Creating Business-IT Alignment. CIO.com. Retrieved October 5, 2008 from: http://www.cio.com/article/9494/THE_CIO_ROLE_Creating_Business_IT_Alignment

IDG Research & Getronics (2002). “The CIO Agenda: Taking Care Of Business”, CxO Media.

ITGI – IT Governance Institute , (2008). About IT Governance. Retrieved October 28, 2008 from: http://www.itgi.org/template_ITGI.cfm?Section=About_IT_Governance1&Template=/ContentManagement/HTMLDisplay.cfm&ContentID=19657

Kalin, S. (2006). Making IT Portfolio Management a Reality. CIO.com. Retrieved October 9, 2008 from: http://www.cio.com/article/21407/Making_IT_Portfolio_Management_a_Reality

Luftman, J. (2000). Assessing Business-IT Alignment Maturity. Communication for the AIS. Retrieved October, 5, 2008 from : http://www.itu.dk/courses/SBIT/E2008/IT-Business%20Alignment_luftman.pdf

McPartlin, J. (2003). IT Budgets and ROI. CFO.com. Retrieved October 10, 2008 from: http://www.cfo.com/article.cfm/3010907?f=search

Myers, R. (2004). Measuring the Business Benefit of IT. CFO.com. Retrieved October 9, 2008 from: http://www.cfo.com/article.cfm/3220177?f=search

Nugent, M. (2004). The Four Phases of IT/Business Alignment. CIO Update. Retrieved October 9, 2008 from: http://www.cioupdate.com/insights/article.php/3446591

Paul, L.G. & Tate, P. (2002). “CFO Mind Shift: Technology Creates Value”, CFO Publishing Corporation, Boston, MA.

RMS (Resource Management Systems). (n.d.). FAQs: IT Budgeting. Retrieved September 7, 2008 from: http://www.rms.net/lc_faq_other_roi.htm

Routh, R. (2008). IT Governance Tips: Help to Improve Executive Buy-In. CIO.com. Retrieved October 7, 2008 from: http://www.cio.com/article/355413/IT_Governance_Tips_Help_to_Improve_Executive_Buy_In

San José State University (n.d.). An Introduction to Cost Benefit Analysis. Retrieved September 18, 2008 from:http://www.sjsu.edu/faculty/watkins/cba.htm

Schwartz, K. (2007). ABC: An Introduction to IT Governance. CIO.com. Retrieved September 15, 2008 from: http://www.cio.com/article/111700/ABC_An_Introduction_to_IT_Governance?contentId=111700&slug=&

Sewell, M., Marczak, M. (n.d.) Using Cost Analysis in Evaluation. Retrieved September 21, 2008 from:http://ag.arizona.edu/fcs/cyfernet/cyfar/Costben2.htm

Smith, D. (2005). What Does IT Really Cost: Managing Cost with ABC & TCO. Retrieved October 29, 2008 from: http://www.bettermanagement.com/seminars/seminar.aspx?l=12913

Weill, P., Ross, J. (2004). Ten Principles of IT Governance. Harvard Business School. Retrieved October 9, 2008 from: http://hbswk.hbs.edu/archive/4241.html

Wharton School (2005). Why So Many Big IT Investments Do So Little for Shareholder Value. Retrieved September, 5, 2008 from: http://knowledge.wharton.upenn.edu/article.cfm?articleid=1228

Analysis of Software Development Processes

 The process of software development is a critical function in many organization, including my own. Every development effort undertaken adheres to one of three fundamentally incompatible process models: chaotic (ad-hoc, code and fix), heavyweight (waterfall, linear-sequential) and adaptive (agile, incremental and iterative). Within Revolution, several groups have unwisely chosen to develop products under the waterfall process model. Heavyweight software development processes try to plan out a large part of a software project in great detail over a long span of time. Project managers want to see every technical detail because they want to predict every conceivable project milestone. This leads managers to demand a variety of specifications, plans, reports, checkpoints, and schedules. This strategy is only effective as long as there are not any unexpected changes. Traditional methodologies are typically known as “heavy” or “monumental”. These methodologies typically follow what is called and SDLC (Systems Development Life Cycle). The unpopularity of these “heavy” methodologies is a result of the massive effort required throughout the process which slows down the development process and often lead to the failure of the project.

The benefit of incremental, adaptive and lightweight processes such as Agile is its focus on producing value added releases and addressing architectural risk early in the project. This helps the project manager to ensure that the development team is working on those aspects important to the client as well as those that provide the most value to the business and increase the likelihood of delivering the project within the restraints of schedule and budget.

Summary

Software project failure is often devastating to an organization. Missed deadlines and releases containing serious flaws and missing features can mean the end of the project or even financial disaster for a company. It is economics that determine the success of any software project and its value to a company with the amount of money spent on development determining the cost of the asset. The return generated by the product is its value, with the difference between the return and the cost being the “return on investment”.

The Standish Group’s Chaos Report is a landmark study of IT project failure. The Standish Group research shows a staggering 31.1% of projects will be cancelled before completion. Further results indicate that 52.7% of projects will cost over 189% of their original estimates. The cost of these failures and overruns are just the tip of the proverbial iceberg. The lost opportunity costs are not measurable, but could easily be in the trillions of dollars in the United States alone.

The traditional project methodologies, such as the SDLC (Systems Development Life Cycle) approach, that many top corporations use are considered to be bureaucratic or “predictive” in nature, and they have resulted in many unsuccessful projects. These “heavyweight” methodologies are becoming increasingly unpopular. They can be so laborious that design, development and deployment can actually be slowed down.

Agile software development is an increasingly prevalent alternative to traditional, process centric software development processes differentiated by a focus on people, results, minimal methods and maximum collaboration. It is geared towards the high pace and the rapidly changing environments of today’s business projects.

The purpose of this process analysis is to identify how Agile software development can benefit organizations and individuals within that organization from stakeholders and business persons to project managers and engineers, with Revolution being no exception. This benefit will be realized through a deeper understanding of how traditional software development methodologies are not delivering on the promise of creating a framework for the successful delivery of critical software systems and how alternative methodologies can help software initiatives realize their maximum return on investment.

Introduction

With much of the fundamental project infrastructure (scope, priorities, estimates, schedules, risks, etc.) in a constant state of flux, it has never been more important to steer and manage decisions within an overall business context and drive project goals towards business value.

An extreme may occur in traditional software development processes when the planning process is at such a detailed level that the project never really gets started. Once the scope, plan, and objectives are fully defined and agreed upon, the team realizes it used 50% of the time and budget for the project to define the plan. Subsequently, the dates and costs of the plan are obsolete. The team needs to go back and revise the plan again. One realizes this approach does not work because the planning phase never ends and work never begins.

Agile development is a methodology used to describe how to deliver projects on time and budget based on the scope. Given the rapid change in technology and business needs, it is impossible to accurately plan and schedule a multiple month software project up front. This approach offers the necessary planning and control but also the flexibility to accommodate change. 

The scope of this analysis will be limited to an examination of the traditional process to software development and where this approach fails to yield the desired results. This process will be contrasted to an alternative approach known as Agile development . This approach that has been gaining momentum in the software development and business communities, demonstrating success in addressing the shortcomings of a more traditional process.

This process analysis will attempt to demonstrate how Agile development will allow organizations to deliver projects on time and within budget, while simultaneously ensuring greater customer satisfaction.

Research Method – Statistics on IT projects failure rate

Before embarking on a “strategic” project, every organization should be aware of its chances of success. Statistics of IT project failure rate provide a good measure of those chances. The purpose is to make executives undertaking large projects ponder on how to approach this endeavor to maximize their chances of success.

The following surveys provide statistical data about the rate of failure of IT projects.

• The KPMG Canada Survey (1997)
• The Chaos Report (1995)
• The OASIG Survey (1995)

The KPMG Canada Survey (1997)

In April 1997, KPMG Canada sent a survey questionnaire focusing on IT project management issues to Canada’s leading 1,450 public and private sector organizations. The main purpose was to outline the reasons behind the failure of Information Technology projects.

Survey Scope

Out of 1,450 questionnaires sent, 176 were analyzed. Of these, 61 % reported details on a failed IT project.

Key Findings

Over 61 % of the analyzed projects had failed according to the respondents. More than three quarters went over their schedules by 30% or more; more than half exceeded their budgets by a substantial margin. Considering that an estimated $25 billion is spent on IT application development in Canada annually, the survey data indicated that unbudgeted IT project expenditures must run into the billions of dollars.

The Chaos Report (1995)

The Chaos Report was a landmark survey made by the Standish Group. This report is the study of IT project failure and is widely cited when IT project failures are being discussed.

Scope of the Study

The respondents to the Standish Group survey were IT executive managers. The sample included large, medium, and small companies across major industry segments: banking, securities, manufacturing, retail, wholesale, heath care, insurance, services, local, state, and federal organizations. The total sample size was 365 respondents representing 8,380 applications. In addition, The Standish Group conducted focus groups and personal interviews to provide a qualitative context for the survey results.

Key Findings

The Standish Group research showed a staggering 31.1% of projects would be cancelled before they ever get completed. Further results indicated that 52.7% of projects will cost over 189% of their original estimates. Based on this research, The Standish Group estimated that in 1995 American companies and government agencies would spend $81 billion for cancelled software projects and paid an additional $59 billion for software projects that would be completed, but exceeded their original time estimates and projects completed by the largest American companies had only approximately 42% of the originally-proposed features and functions.

The OASIG Study (1995)

This study was undertaken under the auspices of OASIG, a Special Interest Group in the UK concerned with the Organizational Aspects of Information Technology.

Scope of the Study

Information was collected in 1995 in the United Kingdom from a sample of 45 experts employed primarily by Universities or Consultancies. On average they had each over 20 years personal experience representing a cumulative knowledge base of over 900 years. The OASIG drew their opinion from a sample of approximately 14,000 user organizations. 31 of these interviewees (69%) included consultancy work as a major component of their work and 27 (60%) include research; many did both. Their professional areas of expertise covered the domains of management, business, and social science. A small number of those interviewed had a background in engineering.

Key Findings

The IT project success rate quoted revolved around 20-30% based on the most optimistic interviews. Ultimately, 7 out of 10 IT projects “failed” in some respect.

Process Analysis

Traditional software lifecycle development processes grew out of a need to control ever larger development projects, and the difficulties of estimating and managing these efforts to reliably deliver results. These methodologies drew heavily on the principles from engineering such as construction management. As a result, they stressed predictability (one has to plan every last detail of a bridge or building before it is built), and linear development cycles; requirements led to analysis which led to design which in turn led to development . Along with predictability, traditional methodologies inherited a deterministic approach that relied on task breakdown, and was predicated on stability: stable requirements, analysis and stable design. This rigidity was also marked by a tendency towards slavish process “compliance” as a means of project control.

While these methodologies may have worked for some organizations in the past and may still work in some circumstances, for many companies these methodologies only added cost and complexity while providing a false sense of security that management was “doing something” by exhaustively planning, measuring, and controlling. Huge costs were sunk in premature planning, without the rapid iterative development and continuous feedback from customers that we have come to realize are prerequisites for success today.

Waterfall Process Model

The waterfall model emphasizes producing a “correct” design prior to implementation, proceeding through phases in a linear, sequential manner. Appropriate only when requirements can be well understood up front and requirements won’t change.

Agile development has little in common with the waterfall model. In some eyes the waterfall is discredited, but many large scale software development takes place today under this model. The waterfall model is the most predictive of the methodologies, stepping through requirements capture, analysis, design, coding, and testing in a strict, planned sequence. Progress is generally measured in terms of deliverable artifacts – requirement specifications, design documents, test plans, code reviews and the like. The waterfall model can result in a substantial integration effort toward the end of the cycle, a time period typically extending from several months to several years. The size and difficulty of this integration effort is one cause of waterfall project failure. Agile methods, in contrast, produce completely developed features (but a small subset of the total) every few weeks or months. The emphasis is on obtaining a simple but working system early and continually improving it.

Agile Process Model

The Plan, Do Check, Act (Deming) Cycle is the foundation of empirical, continuous improvement methods such as TQM, Six Sigma, Lean Manufacturing and Agile Development. Agile is a nonlinear process characterized by responding to change, adapting based on feedback, focusing on value and being lightweight and incremental, and is appropriate when requirements are not well understood up front and will change.

Agile processes are a system of methods designed to minimize the cost of change, especially in a context where important facts emerge late in a project, or where we are obliged to adapt to important uncontrolled factors. Non Agile processes, by comparison, are ones that seek to achieve efficiency by anticipating, controlling, or eliminating variables so as to eliminate the need for changes and associated costs of changing.

The basic problem is that in a traditional waterfall project, risk remains high throughout the majority of the development lifecycle. It may only be at the coding or integration stage that a problem is uncovered and this can have a major impact on all of the work undertaken thus far. All too often this results in major delays or even outright cancellation of the project. The graph below illustrates this problem :

The graph below illustrates a typical agile software development approach. The x-axis shows time while the y-axis plots the amount of working software and the level of project risk. With an iterative approach the software is developed in stages, with core functionality developed first and additional features added as the product evolves. Since the early emphasis is on putting the technical infrastructure in place, the early iterations produce only limited working functionality. However, the real benefit is that they serve to tackle the project risk much earlier in the lifecycle.

 

Conclusion

Heavyweight methodologies try to plan out a large part of a software project in great detail over a long span of time. Project managers want to see every technical detail because they want to predict every conceivable project milestone. This leads managers to demand a variety of specifications, plans, reports, checkpoints, and schedules. This strategy is only effective as long as there are not any unexpected changes.

Traditional methodologies are typically known as “heavy” or “monumental”. These methodologies typically follow what is called and SDLC (Systems Development Life Cycle). They impose a strong emphasis on process especially upfront planning. Even though they have been around for quite some time, they are not noted for being very successful or popular. The unpopularity of these “heavy” methodologies is a result of the massive effort required throughout the process which can actually slow down development and often lead to the failure of the project.

Today’s Information Technology manager is under ever-increasing pressure to deliver results – in the form of applications that drive improvements to the bottom line – even while IT budgets are being significantly slashed. Business environments continue to change at a rapid pace leaving many IT shops struggling to keep up with the pace of change. These changes have led to an increased interest in agile software development processes for rapid product delivery and flexibility while maintaining quality.

Agile methodologies strive to reduce the cost of change throughout the software development process. For example, rapid iterative planning and development cycles in order to force trade offs and deliver the highest value features as early as possible. In addition, the constant, systemic testing ensures high quality via early defect detection and resolution.

The benefit of lightweight processes such as Agile development is its focus on producing value added releases and addressing architectural risk early in the project. This helps ensure that the finished product meets expectations and that the stakeholders will perceive it to be “a good value.” The project manager can therefore give the client a release of the application much earlier in the project plan than would be possible with a heavyweight methodology. In this way, the project manager ensures that the development team is working on those aspects important to the client and those provide the most value to the business, and increases the likelihood of delivering the project within the constraints of schedule and budget.

Deadlocks

Multithreading requires careful programming. Threads allow a program to do multiple things concurrently. Since the threads created by a program share the same address space, one thread can modify data that is being used by another thread. This is desirable because it facilitates straightforward communication between threads. But this can lead to undesirable conditions if a improperly written program causes one thread to inadvertently overwrite data being used by another thread.

The sharing of a single address space between multiple threads is one of the reasons that multithreaded programming is usually considered to be more difficult and error prone than programming a single threaded application. Multithreading solves problems with throughput and responsiveness, but in doing so it introduces other potential problems as well, such as deadlocks and race conditions.

Deadlocks

A deadlock occurs when each of two threads tries to lock a resource the other has already locked. Neither thread can make any further progress. With any multithreaded application, there is always a risk of deadlock. A set of processes or threads is said to be deadlocked when each is waiting for an condition that only the other can cause. The simplest case of deadlock is where thread “1” holds an exclusive lock on object “a” and is waiting for a lock on object “b”, while thread “2” holds an exclusive lock on object “b” and is waiting for the lock on object “a”. Unless there is some way to break out of waiting for the lock, the deadlocked threads will wait indefinitely. I have illustrated this condition in following simple example.

The first thread holds a lock on “a” and attempts to get a lock on “b”.

lock(a)
{

lock(b)

{

// code

}
}

The second thread has locked “b” and attempts to get a lock on “a”.

lock(b)
{

lock(a)

{

// code

}
}

In .NET and other programming environments, there are methods in the threading classes that provide timeouts to help the programmer detect deadlocks. The following code attempts to acquire a lock on the object “a”. If the lock is not obtained in 500 milliseconds, Monitor.TryEnter returns false.

if (Monitor.TryEnter(a, 500))

{

try

{

// code protected by the Monitor here.

}

finally

{

Monitor.Exit(a);

}

}

else

{

// if the attempt times out, execute this code.

}

Thread Pool

In the thread pool programming pattern, some number of threads are created to perform some number of tasks, typically organized in a queue. As soon as a thread finishes its task, it will request the next pending task from the queue until all tasks have been completed. The thread can then terminate, or sleep until there are new tasks available.

The advantage of using a Thread Pool over creating a new thread for each task, is that thread creation and destruction overhead is minimized, which may result in enhanced performance and improved system stability.

While the thread pool is a powerful mechanism for structuring multithreaded applications, it also has risks. Applications that use thread pools are subject to the same concurrency issues as any other multithreaded application, for example synchronization errors and deadlocks, and a few other risks specific to thread pools as well, such as pool related deadlocks, thread leakage and resource thrashing.

While deadlock is a risk in any multithreaded program, thread pools introduce one more opportunity for deadlocks, where all pool threads are executing tasks that are blocked waiting for the results of another task on the queue, but the other task cannot run because there is no unused thread available.

Race Conditions

A race condition is a problem that can occur when the result of a program is dependant on which of two or more threads first reaches a particular block of code. Running the program numerous times produces different results, and the result of any given execution cannot be predicted.

A simple example of a race condition is incrementing a field. Suppose a class has a private static field that is incremented every time an instance of the class is created, using code such as “counter++”. This operation requires loading the value from “counter” into a register, incrementing the value, and storing it in “counter”.

In a multithreaded application, a thread that has loaded and incremented the value might be preempted by another thread which performs all three steps; when the first thread resumes execution and stores its value, it overwrites “counter” without taking into consideration that the value has changed in the interim. Race conditions typically occur because the programmer did not anticipate the fact that a thread might be preempted at an problematic moment, sometimes allowing another thread to reach a code block first.

C2 Software Architecure

C2 is a architectural software style developed by the Institute for Software Research at the University of California, Irvine. C2 focuses on the construction of flexible and extensible software system by means of a component and message based architecture. A component within this architecture has limited visibility or “substrate independence”; components are assembled in a layered manner, and a component is entirely unknowledgeable of components that exist “beneath” it. This independence has obvious possibilities for promoting the interchangeability and reuse of components across architectures.

Components request services from components “above“ it via message passing, and are not in possession of knowledge of components “below” it (in this architecture, messages are passed “up”, meaning the interface layer is considered to be closer to the “bottom” and the “application” layer is considered to be closer to the top. Request flow upwards and message or notifications flow downwards). The C2 style is characterized as a association of components linked by communication forwarders known as connectors.

Each component has a top and bottom domain which specify the notifications to which a component responds, and the collection of requests it produces up an architecture and the set of notifications that a component produces down an architecture and the collection of requests to which it responds, respectively.

These components may be platform and implementation independent, as there is no assumption of shared memory or address space, which allows composition of these components in a highly distributed, heterogeneous environment.

The benefits of this architectural style according to the ISR include :

Separation of Concerns, the concept that architectural design should be separate from its implementation, arranging and decomposing software into more manageable and understandable pieces; Open Architectures that encourage a modular strategy where there is a clear separation of module design from the implementation mechanisms through which that design materializes; Scalability, understanding operational constraints and the support of multiple levels of component interface granularity; Extensibility, the substitution of components sharing the same interface, limiting component interdependence; Flexibility, the modification of systems architecture by incorporating additional components or reconfiguring existing components prior to or during execution;

Reliability, leveraging existing components that have been carefully designed, implemented, and verified; Cost Reduction, the reduction in the development effort through component reuse and architectural guidance; Understandability, increasing the comprehensibility of complex systems through the use of high level models.

The behavior of each component is part of the architecture in that its behavior can be observed from the viewpoint of another component within the architectural framework . A component is defined by the interface and services provided to other components, not by its internal implementation. The component will specify the assumptions that other elements within the architecture can make about the component.

Connectors enable communication between components by transferring unmodified data from one interface to another interface. A connector may consist of a subsystem of interface components that are responsible for data transformation and transport. The external behavioral abstraction is captured by the architecture and is not concerned with the specifics of its internal representation. .

There are a number of architectural styles elaborated in the Shaw and Garlan text which describe collections of components, the interactions between components and the constraints under which they operate and several of the architectural styles identified in the text are implemented in the C2 style.

The C2 style centers on the system conceptual architecture independent of a defined implementation. Components, connectors and messages can be explicitly represented as objects through data abstraction and object oriented organization. The Java class framework for C2 is an example of this representation. In this class framework components, connectors, messages, notifications and requests are encapsulated as discrete classes. For example, Brick is an abstract base class containing data and behavior that is shared between both the Component class and the Connector class. This class contains abstract methods to send or handle both a Notification or a Request (both of which are super classes of Message).

Although the Java class framework for C2 uses a Vector of Port objects to facilitate communication between instances of Component and Connector, it would be possible to maintain the integrity of the architecture using an event based, implicit invocation model. Depending on the implementation this might be the Observer design pattern commonly used in Java, or possibly C#’s event model based on the use of multicast delegates. Components could then register its methods by subscribing to the events of interest (such as notifications and requests). This would decouple the publisher and subscriber somewhat and allow new components to be added to the system by registering them for event notification.

One of the most important aspect of the C2 architectural style is the concept of layering the components and restricting the direction in which information may be transferred. C2 allows different components and connectors to be utilized, provided they implement the interfaces required by the adjacent layers, resulting in a layered system

C2 is well suited for use in a distributed system. Because components interact via connectors, the components themselves do not need to reside on the same physical machine or network. Services may be employed using a complex chain of mediators and multiple distributed servers, distributing the processes. The C2 style provides for the development of distributed, dynamic applications by focusing on the structured handling of connectors to achieve layer independence.

C2 supports distributed, heterogeneous environments with multiple address spaces, threads of control, and operating system processes. The C2 style is concerned primarily with high level system composition, not a particular component packaging approach; multiple component middleware technologies may be employed for a heterogeneous architecture. The style places no restrictions on implementation languages or the granularity of components and connectors, thus allowing multiple potential interoperability technologies to be employed.

C2 either explicitly requires or implicitly allows several of the architectural styles outlined in the Shaw and Garlan text: Object oriented data abstraction, implicit method invocation by means of an event based model, component layering and distributed, heterogeneous environments. Because of the plasticity of the C2 style, many distinct architectural models may be employed as C2 does not specify any implementation restrictions. A conceptual C2 architecture can be constructed in a multiplicity of dissimilar ways and potential performance concerns or distinctions in functionality can be addressed by separating the architecture from concrete implementation techniques.

Web Services

Web Services are the basic components in a move towards a distributed computing model for the Internet. Standards compliance and the concentration on communication and collaboration amongst people and applications have shaped an environment where Web Services have effectively become the standard for enterprise application integration. Applications are constructed using multiple Web Services from a variety of sources that interoperate notwithstanding their physical location or their underlying implementation.

One of the chief benefit of the Web Services architecture is that it permits program functionality written in different languages and running on different platforms to exchange information in a standards based manner. Web Services make available a simplified mechanism to link applications regardless of the technology or devices they use or their location. They are based on industry standard protocols with widespread vendor support that can leverage the Internet for economical communications leveraging ubiquitous Internet protocols and infrastructure. The loosely coupled messaging method supports numerous connectivity and information sharing scenarios through services that are both self describing and automatically discoverable.

An additional advantage that XML Web Services have over earlier endeavors is that they operate within standard Web protocols—XML, HTTP and TCP/IP. A substantial number of organizations currently have a Web infrastructure and individuals who are knowledgeable and experienced in its operation and maintenance, so the initial learning curve for Web Services adoption is appreciably less than with earlier technologies. By removing the dependence on the underlying implementation it is unnecessary to understand the implementation model. This increase in separation reduces complexity and the costs associated with integration and assembly.

The Web Services platform also signifies a progression over previous distributed component technologies like remote procedure calls , messaging and Web applications. Over the years architects turned to the emergent Web as a possible alternative to the challenges of other conventional technologies. Interoperability has always been a overarching interest for businesses, but it has become a much greater priority across the industry. The two major functions where interoperability is a considerable challenge are Enterprise Application Integration (EAI) and Business-to-Business Integration (B2B).

The Web Services platform defines a straightforward, interoperable, messaging framework on which you can build more sophistication. It does not provide the same level of maturity in important features like security, routing, transactions, and so on as do many preceding distributed system technologies. The justification for this latest distributed computing model is cross programming language and cross platform interoperability. For the first time since distributed computing has been a mainstream concept, Web Services make available a solution based on open standards that can in fact provide interoperability.

Dependence on open, broadly agreed to standards is just a piece of the solution. The solution needs provide a high degree of interoperability and protocol implementations that are easily accessible. Vendors are working together to advance the standards that comprise the Web services stack. This may be due to timing and economics, or possible the Internet’s impact on programming paradigms. Unlike the single vendor implementation requirements that resulted from proprietary distributed computing models, vendors are agreeing that it is in everyone’s advantage to standardize on a distributed computing model with which applications can achieve interoperability supporting multiple connectivity and information sharing scenarios.

SOA

The fundamental theories behind a Service Oriented Architecture (SOA) are becoming an integral component of organizational maturity. SOA is a theoretical architecture that promotes agility, interoperability, and business efficiency amongst packaged services. SOA consists of an array of design principles for developing software systems. By employing such a service centric style, an organization is able to factor into account shared and reusable services based upon automated business processes.

SOA allows disparate applications across a network to exchange information and provides a collaborative environment. This coalition of services is not a product or traditional solution. SOA is a revolutionary approach to business processes and has a tremendous impact on the software development lifecycle (SDLC), accounting and operations as it allows collaboration across departmental boundaries (Manes, 2006).

The fundamental unit captured in this design is the reusable service and is not like other centralized application designs. The functionality of SOA is revealed through well defined interfaces. These interfaces utilizes a standard language and protocol, which is typically reinforced by the use of Web services.

SOA’s primary architectural focus is to provide an enterprise wide business solution by integrating current legacy applications regardless of the operating system or language. SOA provides a cohesive framework by harmonizing an organization’s needs against its capabilities and synchronizing these elements to provide a model collaborative environment. The homogeneous services establish a metadata flow that translates functionality into a commonly referenced business component.

SOA differentiates itself from other approaches, because SOA’s main concern is the business function. This architecture provides access to services and places emphasis on ownership and boundaries. The framework represents the relationships amongst business transactions and interoperability. SOA’s visionary concept facilitates manageable expansion of large enterprise systems. By presenting Internet scalable access, users are able to utilize full services. SOA proves its value by reducing costs and maximizing productivity. With its agility and inherent ability to scale across an enterprise, SOA promotes the creation of a balanced IT service portfolio. The SOA infrastructure is adaptable to an organization’s needs and seeks to provide common semantics and unambiguous resources across an enterprise.

Current State of SOA

In today’s business environment, service oriented SOA has been seen as not just a means to an end for individual problems but as a potentially integral part of the business process that can be focused to the solutions of problems and issues faced during the execution of an entire business process (Bort, 2007). Understanding SOA with this approach increases its versatility within the business environment, allowing for permanent, fast and easy solutions be made available for many of the recurring issues that may arise within a business process. Some of the expectations required of business environments today are speed and accuracy when dealing with existing processes and flexibility to adequately accommodate new software processes without considerable delay or other loss of vital business resource. SOAs provide these benefits by utilizing existing individual areas of an organization as service components within a much larger business process. These services can be intelligently requested and offered under component contracts and service agreements to execute multiple projects in parallel,

with each component providing a service to other components within the architecture to accomplish of an overall effort.

As discussed in the article “Service Oriented Architecture” by Footen and Faust (2007), SOAs implement a functionality-centric architectural design placing much greater emphasis on the utilization of software interfaces (P.68). Many organizations already have software packages that define the existing process previously in place to execute existing functions required for the business goals. However, successfully utilizing these existing packages as part of an SOA infrastructure often poses a problem with compliancy. Footen and Faust discussed this issue and also an easy solution, making use of programmatic interfaces to wrap the existing software; the SOA interfaces will provide the required connection to establish the compliancy required (Footen and Faust, 2007).

The proper integration of an organization’s service oriented function components creates reusability because vendors offering different implementations – but essentially the same service – can be individually wrapped to present the same service interface (Footen and Faust, 2007). The success of an SOA depends on such things as an effective networking system as stated by Julie Bort in her article “SOA made fast and easy”. For effective communication and for an efficient service request and delivery system, proper networking is an essential platform that must be properly implemented. Today’s business environment is such that the need for quick and accurate transfer of information has made very necessary the availability of a good networking system. The implementation and maintenance of SOAs need this platform of an effective network layer to be functional and successful.

Components, Service and Contracts

Components, Service and contracts define the basic elements of an SOA, the composition of each component element, and how the individual components relate to provide the given architecture. A component is defined as a software building block that exposes one or more services to potential requesters (Curbera, 2007). Potential requesters could be other components or final service consumer are the basis of the service model in the SOA. The contract aspect of the architecture defines the external specification of each component defining the functional (i.e. business interface and protocols) and non functional (i.e. data serialization and quality of service protocols) aspects of the components composition. As discussed in Curbera’s article, contracts are designed to support two major goals of service

1. Supports third party use, providing access to different organizational domains and management bodies.

2. Automatic integration between service components.

Given the complicated nature of today’s business process requirements, the use of third party firms as part of business processes has been integrated into the business process, and as such it is essential for an SOA architecture to accommodate this in order to allow for a seamless flow of service across organizational lines.

Information Governance

Given the sensitive nature of today’s business environment with scandals and illegalities within organizations, governance has become a very critical aspect of the entire SOA. It is essential to identify and define policies and best practices necessary for an organization to function efficiently while ensuring that specific laws and guidelines (e.g. Sarbanes-Oxley) are properly acknowledged and adhered to.

The complicated nature of today’s business environment greatly complicates the implementation of governance within this architecture. The functions of business and software processes, people and technology must be well understood and implemented in accordance to the necessary laws and policies affecting the business processes.

Understanding information governance is imperative in executing business in a legally compliant environment. Bob Larrivee discusses information governance in his article “SOA: No Governance needed”. With his definition for information governance,

“a combination of policy, process, people, standards, and review or auditing that is out in place to ensure that corporate information assets are maintained in adherence to regulatory requirements and protected from unauthorized access and distribution.”

This definition encompasses every aspect of the business process and protects the entire system from unauthorized access to information both from within and without the organization. One of the advantages of the SOA infrastructure is the separation of functions, which makes it easy to demarcate access to processes and personnel on a need only basis.

SOA Future State/Industry Adaptation

When trying to develop an enterprise roadmap for an organization it’s important to remember that an SOA is not an “out of the box” solution. An SOA is not a specific product or technology. An SOA is not something an organization buys or builds, and while many vendors promote their products as a complete “SOA platform” that’s an all in one solution, don’t be fooled, no such product truly exists (Manes, 2006). An SOA is something an organization does and it requires a large amount of discipline through a strong governance plan. It is a concept that must be melded into the culture of an organization; a different corporate mindset must be developed where technology is not as important as the culture (Manes). Affecting the transition to SOA will not be simple or immediate. It will involve changes in both IT development and business process planning and management. Phasing in these changes may typically requires several years.

SOA is an approach to capture, define, and expose a collection of services and service components available throughout an organization. It represents a dramatic change in the relationship between the way most organizations do business and IT, with the promise to liberate business from the constraints of existing technology (Manes). This new business approach and methodology is a system design style that enables businesses to increase flexibility, agility and reusability. The basic concept of SOA is that any interface to an application should encapsulate a business service, which will require collaboration across the organization’s lines of business involving many different IT project teams and departments representing many areas of expertise.

Instead of single-use business functions, SOA creates reusable service components. Where traditional business builds monolithic functions, SOA breaks large scale functions down into components that work as “plug and play” services. An effective SOA builds for change by adding, improving, and swapping out services independently. It deploys incrementally rather than all at once, thereby lowering risks and smoothing the bumps in change management. Further, SOA builds services in loosely coupled, networked clusters rather than tightly clustered hierarchical silos or stovepipes. Organizations should create within their Enterprise Architect departments dedicated SOA program teams that are responsible for creating a SOA adoption plan and transition strategy. The table below illustrates key areas to consider when developing your organization’s transition strategy.

Table 1-1: Transition to SOA

AS-IS	TO-BE
Single-use functions	Reusable service components
Function-oriented	Process-oriented
Built to last	Built for change
Big Bang deployment	Incremental deployment
Application silos	Architected clusters
Tightly coupled	Loosely coupled

SOA is an architectural style of design that is defined by a set of design principles, but its concepts are difficult to implement in most preexisting systems. The key is defining the appropriate level and type of services your systems provide (Brandl, 2007). Services can be defined in two ways; they can be fine grained or coarse grained. Fine grained perform small actions such as changing one element of data and coarse grained encapsulate significant business processes. Coarse grained services are the preferred model for SOA applications and reflect major actions such as testing, maintenance, and production. Fine grained services are also often needed and handle detailed information on specific business areas such as personnel and equipment (Brandl).

Overall, SOA maturity has not grown as quickly as expected and many company executives believe their organizations are mature but they are not. Reasons include not fully developing the organization’s enterprise architecture; therefore, SOA includes poor scoping, neglected governance, lack of a true champion, inappropriate tool choices, forgetting security concerns, and lack of strategic planning (Haddad, 2007). Companies that struggle with their SOA efforts typically underestimate SOAs impact on their existing infrastructure, company culture, and modus operandi. Decision makers often fail to make the necessary changes required to move from independent project thinking to horizontal infrastructure thinking (Haddad). What is needed is to eliminate the stovepipes and move towards principles of shared services and applications.

A good idea for implementing SOA is to start small and build within the organization using experienced help. The SOA process isn’t something a sole IT department should embark on alone. A good start is creating a SOA adoption plan and developing the Enterprise roadmap which will sow the seeds of SOA success. Many companies have started laying out such roadmaps and have begun executing against them. One of the most effective ways to prepare the blueprint while educated staff is to provide managers with a clear illustration of how business lines, reusable services, and shared applications can work together on a service infrastructure (Howard, 2007). The Burton group, trusted authority for Fortune 500 and Global 2000 organization on IT infrastructure technologies, has designed a simple model of “what is SOA”. Figure 1 illustrates such a design pattern and helps paint the picture of a new development mindset.

Figure 1: SOA Mindset illustration

The diagram illustrates which application and infrastructure functionality are implemented as shared, reusable services. This requires a shift towards a SOA mindset that can cause changes to project management and budget processes. It also helps build service repository guidelines and establishes a common business model (Haddad). Companies that have achieved SOA success invariably have a track record of disciplined planning, adherence to effective development methodologies, and have established a culture of collaboration and reuse (Haddad).

In the forefront of adopting and using SOA effectively are many of the world’s large retailers. They are often driven by competition to improve the online customer experience and consolidate channels and costs. These large international companies accounted for 86 percent of the estimated $1.2 billion the retail industry spent globally on SOA products and services in 2006 (Courtney, 2007). Experts predict that a vast majority will have moved to the SOA approach by 2012 to help fully develop strategies that will combine online and in-store retail operations (Courtney). Companies will update their SOA strategies to build back-end IT infrastructures based on reusable software and systems to gain a competitive advantage of cost savings. Tighter integration between in-store and online customer databases will reduce inventory, distribution costs, and operations expenses. While many of the large retailers are moving towards major investments in SOA, they are not alone. Many small to medium sized companies are moving in that direction and make up the next big wave of SOA adoption (Courtney).

A good analogy of SOA is to compare it to physical fitness. Like physical fitness and any good workout plan, SOA requires a committed lifestyle change. Success with SOA has much more to do with culture than it has to do with technology. The growth of SOA products and vendors has grown and will continue to grow in the coming year, but it doesn’t matter what type of SOA technology you use. The real choice is how you use the technology, and how you go about designing service oriented systems. In fact, organizations should be careful not to rely too heavily on a single product for SOA, because a product can act like a crutch. Vendors will concentrate on using their product rather than learning and adopting SOA design principles. Just as cross training yields better results in physical fitness, multiple products will yield better results in SOA (Manes). In exercise, it doesn’t really matter which machine you plan to invest in; as long as you use it on a regular basis you will see positive results, SOA is no different. Continuous usage coupled with a change in mindset will produce positive long-term results.

SOA Advantages and Disadvantages

Essentially, SOA is a methodology that encourages sharing of remote application functionality invoked over a network. It is a means by which applications can be built more rapidly and incrementally while requiring fewer lines of custom code. The advantage of SOA is that the marginal cost of building new applications will continue to fall as service reuse rates rise. The obstacle is in the significant initial investment cost. This is due to the fact that adopting an SOA requires organizations rethink many established methods of application modeling, development, integration, deployment and management (Babcock, 2007). Specific benefits of an SOA include more rapid application development times and application consolidation. There are also savings that are difficult to quantify such as improved business adaptability and agility, and improvements in business process consistency across applications sharing common services.

SOA is another way to think about enterprise architecture and requires coupling the architecture with the appropriate enabling technology and standards. Clear enterprise architecture is a critical tool for leveraging IT to transform business and mission operations. Endeavoring to modernize and evolve IT environments without an architecture to guide and restrict investments may result in operations and systems that are redundant, poorly integrated, expensive to maintain, and support corporate objectives ineffectively (Laudon, 2007). SOAs have enormous potential for the increasing the reusability of IT assets and the capacity of the enterprise to respond to changing business requirements. By consolidating and leveraging existing IT systems, SOA presents numerous benefits to today’s organizations. An SOA initiative should encompass the development of a strategic management system that contributes to overall alignment with the organization and an initiative level focus. Organizations can increase their chances of success by implementing a set of activities to manage the formulation and implementation of an SOA strategy.

A primary area of focus for an SOA is not technology, but governance and process. Enterprise architecture and portfolio planning should be leveraged to identify opportunities for establishing services, inventory existing resources and investments, perform functional analysis, prepare business cases and transition plans. Primary strategic management artifacts include a strategy, a performance plan, consideration in budget allocation and investment selection, and regular measurement, evaluation, and progress reporting to adjust the SOA initiative as necessary. An emphasis on promoting SOA awareness, communication, and active participation from all levels within the organization will increase an SOA initiatives chances of success. SOA governance is not necessarily overly complicated, but successful implementations require prudent planning and execution (Datz, 2004). An effective SOA requires the judicious selection of a manageable set of projects with quantifiable business value which can encourage support and funding for sustained growth if successful. A viable SOA project can be identified by isolating functional areas of new development spending, exploring these areas to identify candidate services, and engaging corporate stakeholders to set priorities and gain support for service development.

SOA requires IT and the business to work jointly. Implementing an SOA is undeniably a complex endeavor, as are the associated process changes. Regardless of an enterprise’s size and resources, an SOA implementation should not be considered without a great deal of careful planning (Brandl, 2007). The process should be fact based and place the organization in a position where they can make comfortable, well informed decisions. The process requires that management begin to redefine its business in terms of strategic opportunities. The function of an SOA technology is to support the business processes that support the company’s strategic objectives and means the evaluation and selection process should be based on the company’s strategy and business process model.

At certain companies, SOAs are delegated entirely to the IT department. The IT function is not in a position to assess the business implications of an SOA implementation on strategic objectives. The idea that an SOA is strictly a technology initiative because software is involved is incorrect and one of the primary causes of SOA failure – operating decisions belong with senior management and not IT. For organizations to have a successful SOA implementation, there must be top level management commitment, management must be involved and dedicated, and the process needs to be viewed as a top management priority (Koch, 2006). The organization needs to analyze its current business processes and develop its objectives to align with its business strategy so that SOA implementation can better support organizational strategic and process objectives. The implementation should be led by a senior executive who has the authority to make changes happen and truly integrate an SOA system into day to day business operations.

New trends in the computer industry rely upon SOA as the enabling foundation to build infrastructures across disparate domains of technology and ownership. Many of the cost savings from SOA result from consolidation of silos of redundant application functionality and data within the organization. Fewer software licenses and servers translate into cost savings in operating and capital budgets, and application consolidation onto fewer platforms reduces software lifecycle costs (Informatica, 2008). The power of SOA is in it’s flexibility. An enterprise can adapt it’s particular IT assets to its unique business requirements. However, SOA will impact many aspects of an organization beyond software development and operations and SOA requires a significant upfront investment.

Conclusion

In conclusion, SOAs are an integral part of business processes that focus on speed and accuracy when dealing with existing business processes. An SOA is not a new system but a technology that enables the reuse and flexibility of existing or new business processes. These business processes must be flexible and can accommodate new software processes. SOAs are not just an Information Technology job, as top level management in any organization must be committed in aligning their business process with the governance structure of an SOA. In order for an SOA integration to perform accordingly, management must be willing to change their culture or mindset.

By allowing change to happen an organization has an abundant probability of reusability of IT assets and the capacity of the enterprise to respond to changing business requirements. Considering that an SOA is implemented appropriately the benefits can be very rewarding. There is the flexibility to reuse a business process that may house another functional within an organization. Again, in order to achieve the aforementioned the organization and IT department must be on the same page and willing to change their culture for this new technology known as SOA.

References

Babcock, C. (2007). The SOA Gamble. InformationWeek, (1153), 52, 54. Retrieved January 31, 2008, from ABI/INFORM Global database.

Bort, J. (October 2007). SOA made fast and easy. Network World. 24(41), 49-51. Retrieved from the Business Source Premier database 10th March., 2007

Brandl, D. (2007). SOA explained. Control Engineering, 54(8), 22. Retrieved January 31, 2008, from ABI/INFORM Global database.

Courteny, M.(2007). Retailers rush to buy into SOA. IT Week,11.  Retrieved April 16, 2008, from Research Library database.

Curbera, Francisco (November, 2007). Component Contracts in Service-Oriented Architectures. Broadcast Engineering. 40(11), 74-80. Retrieved from the Academic Search Premier database 10th March., 2007

Datz, T. (2004). What You Need to Know About Service Oriented Architecture. CIO. Retrieved January 31, 2007 from: http://www.cio.com/article/32060/What_You_Need_to_Know_About_Service_Oriented_Architecture/1

Footen, J. and Faust, J. (September, 2007). Service Oriented Architecture. Broadcast Engineering 46(9) 64-71. Retrieved from the Business Source Premier database 10th March., 2007

Haddad, C. (2007). Service Oriented Architecture Templates. Retrieved April 11, 2008, from http://www.burtongroup.com/

Haddad, C. (2007). Business Case for SOA: Strategy and Tactics. Retrieved April 11, 2008, from http://www.burtongroup.com/.

Howard, C. (2007). Building the Business Case for Service Oriented Architecture Investment. Retrieved April 1, 2008, from http://www.burtongroup.com/

Informatica (2008). How to Avoid the Hidden Pitfalls On The Road To SOA: The case for a comprehensive data services framework. Retrieved January 31, 2007 from: http://www.pcworld.com/businesscenter/whitepaper/detail.html?wpid=3095

Koch C. (2006). The Truth About SOA. CIO. Retrieved January 31, 2007 from: http://www.cio.com/article/21975/The_Truth_About_SOA

Larrivee, B (2007). SOA: No Governance Needed. Or Is It?. Library Literature & Information Science 21(5), 24-25. Retrieved from the Business Source Premier database 10th March., 2007

Laudon, K., Laudon, J. (2007). Management Information Systems: Managing the Digital Firm. Pearson Education, Inc. Upper Saddle Brook, NJ.

Manes, A. (2006). Service Oriented Architecture: Developing the Enterprise Roadmap. Retrieved April 1, 2008, from http://www.burtongroup.com/.

Tews, R. (2007). Beyond IT: The business value of SOA. AIIM E – Doc Magazine, 21(5), 14-17. Retrieved January 31, 2008, from ABI/INFORM Global database.

Web 2.0

Web 2.0

The Web is enabling a global revolution and the Internet of today looks quite different from what many organizations envisioned a mere five years ago. We are well into the present era of the Web, referred to commonly as “Web 2.0″. Web 2.0 refers to the philosophy behind an emerging set of Internet based tools. Facets of this stage of the Web include search, social networks, online media (music, video, etc), content aggregation and syndication (XML and RSS), user generated content (Wikis and Blogs), Web mashups and a good deal more (Krasne, 2005).

The use of the Internet is increasingly characterized by the participation and interaction of users who utilize the Internet to communicate and express themselves (Wunsch-Vincent, 2006). This approach is distinguished from “Web 1.0″, in which not many nontechnical users could contribute to the development of the Web and as a result Web 2.0 has created a new architecture of participation (Singel, 2005). Social Networks, Blogs and Wikis are prominent Web 2.0 concepts which use the Internet’s inherent capabilities extensively to create a participative Web (Graham, 2005). Companies are considering embracing Web 2.0, but may be slow to invest in Blogs, Wikis, and many of the other new collaborative technologies that are generating attention.

Social networking is a trend characterized by people linking to each other in some way and essentially allows or encourages a variety of different types of user interaction whether commercial, social or some combination of the two. A Wiki is a type of software which allows users to freely create and edit Web page content using a standard Web browser. Allowing average users to create and edit any page on a Wiki encourages democratic use of the Web and promotes content composition by nontechnical users. A Blog is an online journal where users post thoughts, experiences, comments or news and are often displayed in reverse chronological order. Blogs are typically updated daily and employ software that allows nontechnical people to update and maintain them. A common thread running through Web 2.0 is the emergence of the inherent nature of the Web from under the flawed models imposed on it during the Web 1.0 bubble and the Web’s subsequent democratization.

The participative features that typify Web 2.0 are the result of the advent of several new technologies: XML, AJAX, SOA, and RSS among others.

• XML - eXtensible Markup Language is an emerging standard for defining, representing and dynamically sharing structured information across a network and allows developers to create their own markup tags.

• AJAX - Asynchronous JavaScript and XML is a combination of technologies (JavaScript and XML) that allows the content of a Web page to be updated or changed without the entire page being reloaded.

• SOA - Service Oriented Architecture is a type of architecture whose goal is to achieve a loose connection between integrated systems and defines how two entities interact via services to coordinate a unit of work.

• RSS - Really Simple Syndication is a format for sharing content among different Websites whereby sites syndicate content and users download these feeds through an RSS aggregator

As businesses debate the arguments for and against Web 2.0 technologies such as social networks, Wikis, syndicated feeds and Blogs, a horde of vendors are gambling these Internet tools belong in the workplace, developing a torrent of online digital media and social networking sites and features (LaMonica, 2007). The potential for simplified and more effective collaboration among employees, partners and clients has captured the attention of business managers. Although popular among consumers, these Web 2.0 products must meet special requirements for business use in areas like security, availability, performance, scalability and performance. The human side of this technical transformation finds both individuals and organizations finding innovative and effective ways of connecting through Web 2.0 technology. This paper will discuss several areas that are characteristic of Web 2.0, what relevance they have in a business scenario, and how they might be leveraged to add value in today’s corporate environments.

Social Networking

Social networking has shown itself to be a valuable interactive tool, allowing like minded individuals around the world to communicate and express themselves. As previously mentioned, social networks create interactions that are commercial, social or a combination of the two. Five facets of this interactive network are: moms (CafeMom), students (Facebook), jobseekers (LinkedIn), and presidential campaigns (MySpace). CafeMom is perhaps the most popular Web hub for middle-class women with kids seeking support and friendship (Miller, 2008).

Mom’s and companies host discussions groups about toys, husbands, recipes, kids, etc. Companies see this as an opportunity to directly market their products to the person who makes most of the financial decisions. Marketers crowd the sites with banner ads, games and discussion forums for advertisers, including Kimberly-Clark, Procter and Gamble, Johnson and Johnson, and Best-Buy (Miller, 2008). The addictive nature of this site for moms has proven to be very lucrative. In just 15 months of existence, CafeMom has generated over $5 million in earnings for 2007.

Students must also be aware that colleges are checking social network pages to learn about their students. College administrators are extremely nervous because, “they do not know when a student may post embarrassing images that can dramatically undermine their policies against hazing or other prohibited activates” (Sandomir, 2006). The 2006 photos on badjocks.com implicating the Northwestern girl’s soccer team of hazing is one example of the trend causing school administrators to assume this position.

Job seekers have networking sites dedicated to building professional relationships. LinkedIn is a professional networking site that assists individuals with relationship building. Creating a network of contacts that can provide access to their contacts and so on. The networking relationships built on LinkedIn can help companies find employees, job seekers learn about potential employers, and introduce professions to other professions in their field.

The phenomenon of social networking also extends to the political arena. Presidential candidate Barack Obama was and early adopter of social networking to increase his appeal and exposure to potential voters. His campaign understands that “the percentage of people who say they get most of their news about the election from television dropped from 68 percent during the 2004 race to 60 percent in late 2007, while the percentage of people who reported that they turn primarily to the Internet for news about the presidential candidates more than doubled, from 6 percent in 2004 to 15 percent at the end of 2007 (Webbing, 2008).

Presidential candidate Hillary Clinton has realized the importance of Web 2.0’s ability to reach voters as well, posting behind the scene footage on YouTube providing a more intimate view of her campaign. Although her campaign has stepped up efforts to reach voters on social networks, Senator Obama maintains triple the number of supporters on social networks.

Replacing the traditional use of email or the telephone to communicate, social networks allow individuals to join an online community and share their experiences with thousands in their community with a single key stroke. Users should also be aware of the potential hazards of maintaining a presence on social networks. Companies will view network pages and use the information gained in decision making. A network page is a direct representation of you and your employer.

Wikis

“Wikis assist collaboration and develop thinking using social tagging for storage and retrieval of content as it is being built” (Bricknell, 2008). Companies and universities are beginning to recognize the value of this Web 2.0 capability. Thousands of organizations use Wikis to electronically collaborate, plan meetings, and brainstorm about new products and processes.

James Coyle, a Kent State University doctoral student, conducted a study comparing the work of two groups. The first group interacted face-to-face and the second group used a Wiki as their primary means of interaction. The results of the study showed that there was no appreciable difference in the quality of work from both groups. Proving that Wikis are a viable alternative, student and employees can remain productive when meeting face-to-face is not possible.

Wikis are a living organism that is affected by its environment. Each interaction could considerably change what the Wiki was prior to that particular interaction. In essence, Wikis “harness the wisdom of crowds, serving as virtual commons where participants can wrestle over ideas and information until something approaching consensus – or the truth – emerges” (Morse, 2008).

Blogs

What is Blogging? To some the word Blogging may sound like something you would do in a swamp. Certainly however, if you are connected to the world via the Internet on a frequent basis perhaps this word does not seem so strange.

A Blog can consist of text, images and links to other Web pages and other Blogs. The word Blog is short for “Web log” which is in essence a Web based publication consisting mainly of articles typically listed in reverse chronological order. Blogs are most generally centered on a specific topic of interest to the Bloggers. A Blogger is the person who writes the passages in the Blog and sets the agenda to be discussed which is publicly accessible on the Web. It is a way of instantly publishing the information you wish to convey or discuss. A good Blog is updated on a daily basis or at minimum several times a week. Although Blogs can be posted to the Web manually, a Blogging tool is usually more efficient and such tools are readily available. Some of the more popular ones are pMachine or MovableType for instance. Some refer to Blogging as a new kind of journalism, unfortunately there are no editors to review ones published work. While this may be great for the Bloggers, one must heed caution when it comes to the validity of the content because it is not edited and source information is not verified. On the other hand, this type of medium is appealing to many since they can write what and how they wish without censorship. Blogs will often have links to other Websites, stories or Blogs. One of the benefits which attract people to Blogging is no matter what your interests, you will be able to locate a Blog that shares those interests.

Blogging has become increasingly a mainstream and widely used way of communication over the Internet. Blogging increases a business’s exposure as a result of being search engine friendly and also by allowing those who Blog to have a voice which would otherwise not be heard. ComScore released a report on August 8, 2005 which found that nearly 50 million Americans visited Blogs in the first three months of the year alone. This was up by 45% from the first quarter of 2004 (ComScore).

Blogging is literally enabling companies to share knowledge and expertise with much larger audiences than ever before. Blogs are used to help companies obtain additional visibility through exposure within search engines. Blogging has what is known as a spidering effect. When a company posts a Blog it produces a feed which will automatically ping larger sites which carry the feeds and make them available for syndication (Bruton, 2006). Search engines will spider these sites many times in a day. This spider and ping concept allows for much more exposure than just having a web site; this can enhance visibility for a company, especially if the business is having trouble getting indexed.

The most popular Blogging platform is owned by Google which produces thousands of Blogs (Bruton, 2006). The benefits of Blogging for a business are numerous. Blogging means many things to a business, for example market feedback. These types of Blogs can provide a company with valuable information about what their potential and existing customer base is thinking. Businesses that choose not to exercise this valuable tool are essentially going to be left in the dark in this highly technological world. Many small businesses do not have the time or knowledge on how to set up a website and the cost to hire a web designer or developer is often times not an option early on. For a small business just starting out a Blog can be a good low cost alternative to a web site.

According to Sandy Berger’s (2003) article Life Online Blogging, MIT Media Laboratory created a Website which tracks the diffusion of information throughout the Web Log community called Blogdex. This site is essentially trying to track the popularity of the ideas which are floating around the Blogging community. Blogging can open the door to fresh ideas and concepts. Blogging encourages you to read what people are saying your company, allowing a CEO to either keep things the way they are, or make changes based on the feedback from the Blog log.

Having the capacity at your fingertips to gather important information and enable immediate results regarding perhaps a new product, upgrading an existing product or even doing away with a product only enables companies who use Blogs to gather this type of information easily and swiftly compared to old school snail mail or traditional publishing

Conclusion

Web 2.0 represents a broad range of heavily hyped technologies and recent business model trends, leaving many organizations uncertain as to which will have the most significant impact on their business (Gartner, 2006). Many of the aspects of Web 2.0 are considered either transformational or having a high potential business impact. There is no doubt that envisioning how Web 2.0 may change traditional business models before the fact is difficult. The reality is that most organizations will need to start today in order to benefit from this transformation by reformulating and reinventing their current ways of doing business. This transformation is not something to be undertaken without considerable forethought and as a result will cause many organizations to take their first steps tentatively. Large organizations will often struggle the most with their Web 2.0 strategy as a result of organizational inertia and the lag that comes from changing any very large system. Making a potentially generational change is not only a difficult undertaking, but entails a significant amount of risk and often a considerable investment of time, money and resources.

Organizations will likely have to refocus their business strategies and make conscious and informed decisions on what aspects of Web 2.0 they believe will affect them in the next few years and then move this thinking into strategic action (Hinchcliffe, 2006). There are a large number of people who, although agreeing Web 2.0 is a compelling new movement, are skeptical about its actual business value and question how an organization builds and grows Web 2.0 into a real business advantage. The driving force of “Enterprise Web 2.0″ is putting best practices for creating Web experiences into the hands of business people, Web designers, and users. This allows organizations to make the most of the systems, users, and information already in place and we can already begin to see how early adopters are using it to considerable effect (Hinchcliffe, 2006).

Although there is a great deal of conversation surrounding Web. 2.0, many organizations remain skeptical about tools such as Blogs, Wikis, and online social networks, or they are interested but reluctant to adopt them. There are impediments business technologists are concerned with like security, return on investment, and their staff’s skill in implementing and integrating new Web tools. Reluctant companies ignore the Web 2.0 movement at the risk of their competitiveness. Rich, collaborative software platforms including a myriad of technologies like Wikis, Blogs, integrated search, and unified communications will be standard within a few years. Employees will expect to work that way, and it will be up to IT to deliver (Hoover, 2007). Web 2.0 is a new archetype characterized by business networks whether coworkers, business partners or customers, and easier, faster, contextual organization of and access to information, all with a degree of personalization.

And though Web 2.0 has succeeded in enticing millions of consumers, until now they have not had much to offer the expansive world of business. The technologies behind what is termed Web 2.0 are rapidly evolving beyond the popular conception that it is solely about Wikis and Blogs. (Seeley, 2007). The ideas that drive Web 2.0 undeniably hold great promise for businesses that choose to exploit them and great risk for those that choose to ignore them. Web 2.0 services may well help solve some perplexing problems for corporations that current software has yet to solve and are slowly but surely finding their place in the corporate world. (Hof, 2006). Web 2.0 is a viable paradigm, accepting that the business translation may not be clear. Web 2.0 is still evolving rapidly and many organizations are still trying to learn the business models that surround it and its applicability within the corporation. Organizations willing to accept some of the risks will be well positioned to remain competitive in the future.

Decision Making Process

Because of the increases of computer processing power and storage capabilities, and the near ubiquity of the Internet, there has never been the amount of information available and the access to that information that there is today. While the amount of data stored has grown exponentially, data is not useful unless it is in the form of information. The evolution of computers has allowed us not only to store vast amounts of data, but coalesce this data into meaningful and timely information. Businesses now rely on this information as a crucial part of there operational capability and as a means to create a competitive advantage. Whereas business managers and decision makers of past generation may have only had access to quarterly or monthly information regarding their firm’s performance, today’s managers are able to gain insights into their performance in near real time.  

Modern information systems allow businesses insight into current operations. This insight allows adjustments to be made much more quickly than had been previously possible. An example of this is a retail chain who can now view real time metrics of inventory and can therefore create efficiencies in their supply chain, or gain marketing insight into how rapidly products are moving in its different locations. Information is also much more easily aggregated giving rise to the “executive dashboard” view of the firm’s key performance indicators. This allows executives and managers the ability to monitor the organization’s internal environment with greater ease and accuracy. Consequently, the decision making process has been facilitated through the use of powerful information technology resulting from advances in computing.  

IT Security, Privacy and Ethics

Security has become an imperative issues for many organizations and has been elevated from a separate, technical concern to an enterprise concern. Security is a business requirement that must directly align with strategic goals, enterprise objectives, risk management plans, compliance requirements, and organizational policies. Given that security is a business problem, organizations must actively coordinate, deploy, and direct many of their principal resources and competencies to manage and align security risks with their strategic goals, operational measures, compliance requirements, and systems architecture.

Security needs to be managed horizontally, vertically, and cross functionally throughout the organization as an enterprise issue. Enterprise security management is a concept that encompasses a wide variety of security, management, and process related areas and is viewed as a shared effort that will utilize a broad range of organizational capabilities if it is to be successful. Practicing robust computer security is a persistent requirement and a challenging activity as a result of the technical and environmental complexity of today’s organizations. Adding to this complexity are an increasing list of vulnerabilities and progressively more sophisticated threats to which organizations are subjected day after day.To understand corporate security, the organization must understand what the key assets in the company are – and often the organization’s key asset is information. Information can take many structures, and as a consequence there are a variety of methods of securing information.

Rather than dividing information into categories based on content, organization’s should consider analyzing threats to information based on categories, methods of processing and storing, and its required protection level. There are three information domains which are defined as physical, social/personal, and logical or network and information security must take these into account whether the information is written down, in someone’s head, or on a computer or the network.

The organization must take measures to ensure that the appropriate physical, administrative and technical controls are in place. Physical control is the implementation of security measures in a defined structure used to deter or prevent unauthorized access to sensitive material. Classical security concentrates on physical protection such as buildings, server rooms, access controls etc. Examples of physical controls are:  closed circuit surveillance cameras, motion or thermal alarm systems, security guards, picture IDs , locked and dead bolted steel doors.  Administrative controls define the human factors of security. It involves all levels of personnel within an organization and determines which users have access to what resources and information by such means as: training and awareness, disaster recovery and business continuity plans, personnel recruitment, accounting, and separation strategies, and account provisioning and deprovisioning. Technical controls use technology as a foundation for controlling the access and usage of sensitive data throughout a physical structure and over a network. Technical controls are extensive in scope and encompass such technologies as: encryption, smart cards, network authentication, ACLs (Access Control Lists), and file integrity auditing software.

The measures an organization can take to ensure the security of its IT systems include:

• A risk assessment to determine existing vulnerabilities
• Creation and implementation of security policies
• The organization and governance of information security
• Asset management including inventory and classification of information assets
• Human resources security which encompasses the security aspects for employees joining, moving and leaving an organization
• Physical and environmental security and the protection of the computer facilities
• Communications and operations management including the management of technical security controls in systems and networks
• Access controls including the restriction of access rights to networks, systems, applications, functions and data
• Information systems acquisition, development and maintenance including building security into applications
• Information security incident management by anticipating and responding appropriately to information security breaches
• Business continuity management including protecting, maintaining and recovering business critical processes and systems
• Compliance which ensures conformance with information security policies, standards, laws and regulations

In the information age, raw data has become a precious commodity and the protection of personal information is increasingly important to our sense of privacy. The development of new information and communication technologies has increased exponentially the ability of the government and the private sector to collect, record and mine personal information. The traffic in personal information is enormous and there is almost nothing the commercial and governmental sectors are not eager to find out about us as individuals.

Organizations and IT professionals in particular must be strongly committed to maintaining the privacy of an individual’s personal information and the security of their computer systems. Organizations must be accountable and make every effort to ensure compliance with applicable federal law with respect to the collection, use, and disclosure of personal information. Organizations must have a clear understanding concerning the law and policy issues relating to information privacy and computers, databases, and the Internet and be proactive in ensuring information privacy.

The erosion of information privacy by technology occurs in three ways:

• Increased Access to Information – this is not only attributable to the fact that that previously confidential information is now public, but instead because technology is changing the meaning of “public”. Global computer networks guarantee that “public access” means the entire online world.
• Collection of Information – the capacity of electronic databases to aggregate and distribute otherwise insignificant information allows an extensive profile of an individual to be created.
• Storage of Information – the ubiquity of information technology allows greater amounts of redundant information about individuals to be kept for extended periods of time.

The IT community needs to focus on ways to apply technology to applications that will give consumers better control over their privacy and enable software developers to create privacy aware applications. IT professionals need to focus on innumerable areas concerning information, privacy and security including:

Government surveillance

• The Fourth Amendment
• Sensory enhancement technologies
• Wiretapping
• Computer searches
• ISP records
• The Electronic Communications Privacy Act
• The Foreign Intelligence Surveillance Act
• The USA-Patriot Act

New issues

• Privacy and access to public records
• Government access to personal information
• Airline passenger screening and profiling
• Data mining
• Identity theft
• Consumer privacy
• Financial privacy

Emerging information technologies

• Computer databases
• RFID
• Cookies
• Spyware, Adware and Malware
• Viruses and Worms
• Cyberthreats
• Data mining

In today’s environment, almost every aspect of an individual’s daily life touches data processing systems in some way. And those who use the Internet are constantly being asked for personal and demographic information. All too often, privacy issues related to all this information are not addressed by a secure, consistent methodology. Because of that, individuals stand a good chance of having far more personal information released to 3rd parties than they may be comfortable with. IT professionals need to become aware of the complex issues surrounding information privacy and build solid systems and processes that protect that privacy.

IT Professionals need to act with professional responsibility and integrity, and each individual professional must decide the correct ethical course of action in any given case – ultimately it is up to the individual to decide. Classical and applied ethics focus on competing human values. It may be that ethical inquiry specialized to computing can help engineers shape responsible, rational answers to questions about the quality of the products they are producing. The issue of informed consent has been prominent in the applied ethics of medicine, and this issue may be appropriate to systems engineering as well.

Some of the ethical topics that should be considered by IT professionals include: 

• Understanding of ethics/morality
• Ethics for it professionals and it users
• Computer and Internet crime
• Privacy
• Freedom of expression
• Intellectual property
• Software development
• Employer/employee issues
• The impact of information technology on the quality of life

There are a number of professional codes of conduct that can offer guidance to IT professionals including:

• Association for Computing Machinery (ACM) Code of Ethics and Professional Conduct
• Association of Information Technology Professionals (AITP) Code of Ethics
• Software Engineering Code of Ethics and Professional Practice
• PMI Member Ethical Standards and Member Code of Ethics

Any IT professional responsible for designing, configuring, deploying or managing information systems needs to understand and apply ethics in information security which can include: personal integrity/claims of competence; personal accountability for work; responsibility to employer/client; responsibility to profession; confidentiality of information/privacy; conflict of interest; dignity/worth of people; public safety, health, and welfare; participation in professional societies; increase public knowledge about technology. Computers are a unique technology and as such they raise some unique ethical issues. IT professionals should endeavor to use their special technical knowledge to advance quality of life and feel an ethical obligation to assess social consequences ensuring safe and beneficial us of IT applications. IT professionals need to have a basic respect for the privacy and integrity of individuals, groups, and organizations. Public trust in information technology is dependent upon conscious protection of established cultural and ethical norms of information privacy.