Security: Computer Security for Business Continuity in Healthcare

If you run a Healthcare-realted Business, things changed in the last 6 months...
Ransomware is set to boom [0] and cyber-security is now part of our National Security Plan.
Businesses now have to secure their computers and data just as they secure their premises and goods.

It's not optional, fail to do so and you will go out of business, just when is the question.
Ask yourself this: "If my computers were destroyed, how long could I continue the business? At reduced capacity or at all?", then act accordingly.
i.e. Does anyone around the world see you as a high-value, exploitable target?
Especially those in low-income countries with employment problems: poverty corrupts, not just power or the love of money.

The Internet is defined by its explosive growth: A few For-Profit hackers have noticed Business Ransomware is an ideal way to monetise remote computer attacks & exploits.
The numbers of these attacks will now double every few months as word gets around, new "toolkits" are sold to them and they ramp up their activities.

Every business that can raise $5,000 and relies on its systems and data for daily operations is now in their sights. These people have no morals, ethics or compassion in their work: they want your money and don't care about the damage they cause or the impact of their actions. Appeals to them will fall on deaf ears. Neither believe that a single ransom payment will be the last you'll hear of them. Why would you trust the word of criminals who've already broken in and callously damaged your systems?

Unringing the Bell: Impact of IT systems on Large Business Survival

I've posited that Telstra will be severely challenged within 15 years due to Structural Change within their Industry. They aren't fast or agile enough to adapt to the new world..

What are the factors that will prevent them from adapting? My top two:

• Management Culture
• IT Infrastructure

An underlying problem is that we don't have language or metrics to describe and quantify the many important aspects of management. In Physics and Engineering we have many concepts and terms that are measurable to great precision. The importance of those is shown by the materials revolution over the last 100 years. For a tour de force on the topic, a book that's been in print for 45 years: The New Science of Strong Materials.

Whilst "Management" and descriptions and theories about it has become an increasingly large field of study, we don't have a "Science of Management" with precisely defined and measurable terms.

This is crucially important when ownership (shareholders) and control (managers) is separated. The owners have no nuanced, standardised measures to evaluate the most critical part of the business: management. All we've got is the Accounting Standard Reports provided in Annual Reports. This is far from enough to make informed decisions on a business' future prospects.

I can't detail or quantify the many problems of Telstra's Management Culture, just waive my hands and say "it's the vibe". E.g. they not only don't do Customer Service well, they prioritise short-term cost-savings above good service and seem to go to great lengths to not resolve customer faults, at least in some areas.

Management is about doing what's important consistently well, doing what has to be done well enough and not doing at all the things that don't need to be done. [And avoiding entirely the things that should never be done.]

My Professional expertise is in IT Infrastructure. I hold a contrary view to the mainstream Management view of "IT is a Cost Centre". IT provides automated Business Processes, like employees directly responsible for all the Business Revenues: IT is a Profit Centre, not Cost Centre.

We've already seen businesses failure due to their failed I.T. systems: One.Tel is a shining example.

IT Infrastructure has, for the last two decades at least, constrained business mergers. If I recall correctly, the St. George-Westpac merger was cancelled twice due to "incompatible IT systems". Not sure how they solved that in the end.

Westpac itself is notorious for a decade long project, CS90, that was cancelled in December 1990. It was meant to be the ultimate Banking System (an 'ERP') that IBM would resell around the world for them. It was consuming 5-10% of Westpac's operational revenue.

The $10B Telstra "IT Transformation" under Greg Winn ran for around 5 years with the intention of reducing 1500 systems to 300. It failed to meet its targets and went live in 2009 with the 30% most valuable customers not migrated [from my Case Study evidence, now full of migration errors.]

The point: large businesses are inextricably intertwined with their IT Systems - they are part of the Business DNA and essential to the Business Differentiation: What we do differently that people value.

Too often IT Systems are allowed to "grow like topsy" and are never rationalised or reorganised, presumably because no immediate savings or value can be demonstrated, but mostly because nobody is responsible for everything and ensuring IT Systems are well maintained and suitable.

Leading to "Big Bang" projects like Telstra embracing of off-the-shelf ERP and CRM systems to resolve the mess. Inevitably they find that things are much more complex and intertwined than they knew, not the least because they have no correct, current System Maps and the whole was never designed or planned, it just happened. All of which suggests Management asleep at the wheel.

It will probably take Telstra 10 years to get staff trained, most, not all, data corrected in their new systems and workaround established to cater for what the new systems don't do.

But what will it be left with then? Will those systems be nimble, quick and responsive or big, cumbersome and so hard to change as to be effectively frozen?

Young, small companies start small and add functions as needed: the I.T. equivalent of "greenfields".

They don't carry of a legacy or mindset of "we have to cope with everyone and everything".

This is the commercial advantage small ISP's had over Telstra: no past, no baggage, just simple effective systems.

This will be the problem that Telstra will have to face again in 2020 as Retail Providers using the NBN challenge it. Telstra knows the pain, cost and delay in redoing their I.T. Systems, they won't be going there again anytime soon.

This is a generic and on-going challenge for all successful businesses, including those small, nimble Retail Providers: how to keep I.T. Systems from degrading into an unchangeable morass?

When Data hardens in Organisational Arteries and structures/processes ossify, a major Cardiac event will follow... More of the Same cannot fix the problems, radical rethinking is needed.

In an increasingly automated world, a problem looms for every large business: what happens to the IT Systems when you downsize?

You get to drag the big, bloated corpse of yesterdays organisation along with you. It never gets better with age...

It's easy to lay-off staff and "reorganise", but I've never heard of any organisation looking to make commensurate simplifications to their I.T. systems.

I suspect that Large Business who aren't consciously and deliberately cleaning-up and refreshing their I.T. Systems will ultimately fail due to the complexity, inflexibility and inadequacy of their Legacy Systems.

You can lay off Staff and cut whole Departments, but where do you start with the weeds that permeate your whole organisation and choke the life out of it?

Once built, it seems you can't "Unring the Bell" of legacy I.T. systems, you're stuck with them and they define what you can do, while smaller companies whizz past you on their way to Market Domination and being strangled by their Legacy systems.

---

Jerry Gregoire as CIO of Dell Computers in 1999 talked about how he tackled this problem - and won.
When he joined Dell, there was a massive ERP project underway, "One System To Rule Them All". It was late, over-budget and failing. His first action was to cancel the project and front the board...

Instead, he moved Dell to a new architecture dubbed "G2", based around a message broker.
It reduces the N*N-1 or N-factorial system interface problem to one...

All every system needs to interact with every other system is one 'message broker' interface.
It comes with a cost - you need infrastructure and rule sets to switch the messages. But at least that's a known, computable cost.

Dell Business Strategy Secrets
An ERP Package for You...and You...and You...and Even You

A tablet from Microsoft? It won't save the company.

Update 1: Mary Jo Foley of ZDnet tips a launch of Windows 8 next week at AllThingsSD.

---

From a Forbes blog:

Microsoft’s Windows OS For Tablets Coming Next Week?
May. 27 2011 - 12:11 pm, Agustino Fontevecchia

Quality and Excellence: Two sides of the same coin

Quality is predicated on Caring.
High Performance, also called "Excellence",  first requires people to Care about their results.

They are related through the Feedback Loop of Continuous Improvement, also known as O-O-D-A (Observe, Orient, Decide, Act) and Plan-Do-Check-Act (from W. Edwards Deming).

The Military take OODA another level with After-Action-Reviews or After-Action-Reports (AAR's), a structured approach to acquiring "Lessons Learned".

High Performance has two aspects: work-rate and consistency.
It's not enough to produce identical/consistent goods or results everytime, but you have to do it with speed.

There's an inviolate Quality Dictum:
You can't Check your own work.

For Organisations, this Dictum becomes:
 Objective assessment requires an Independent Expert Body.

From which follows the necessity for an External Auditor:
  Only Independent persons/bodies can check an Organisation and its people/processes for compliance and performance.

For around 80 years, Aviation has separated the roles of Investigation, or Root Cause Analysis, from Regulation, Compliance and Consequences. In the USA the NTSB Investigates and the FAA Regulates. This has led to consistent, demonstrable improvement in both Safety and Performance. Profitability is linked to Marketing, Financial Management and Administration, not just Performance.

All of which leads to the basic Professional Test for individuals:
 "Never Repeat, or allow to be repeated, Known Errors, Faults and Failures".

And the Raison d'être of Professional Associations or Bodies:
 To collect, preserve and disseminate Professional Learnings of Successes, Failures, Discovery and Invention.

Barry Boehm neatly summaries the importance of the Historical Perspective as:

Santayana half-truth: “Those who cannot remember the past are condemned to repeat it”

Don’t remember failures?

• Likely to repeat them

Don’t remember successes?

• Not likely to repeat them

All these statements are about Organisations as Adaptive Control Systems.

To effect change/improvement, there has to be reliable, objective measures of outputs and the means to effect change: Authority, the Right to Direct and Control, the ability to adjust Inputs or Direct work.

Which points the way as to why Outsourcing is often problematic:
  The Feeback Loop is broken because the hirer gives up Control of the Process.

Most Organisations that Outsource critical functions, like I.T., completely divest themselves of all technical capability and, from a multitude of stories, don't contract for effective Quality, Performance or Improvement processes.

They give up both the capability to properly assess Outputs and Processes and Control mechanisms to effect change. Monthly "management reports" aren't quite enough...

Business Metrics and "I.T. Event Horizons"

Is there any reason the "Public Service", as we call paid Government Administration in Australia, isn't the benchmark for good Management and Governance??

Summary: This piece proposes 5 simple metrics that reflect, but are not in themselves pay or performance measures for, management effectiveness and competence:

• Meeting efficiency and effectiveness,
• Time Planning/Use and Task Prioritisation,
• Typing Speed,
• Tool/I.T. Competence: speed and skill in basic PC, Office Tools and Internet tools and tasks, and
• E-mail use (sent, read, completed, in-progress, pending, never resolved, personal, social, other).

---

Death by Success II

There is another, much more frequent "Death by Success" cause, first introduced to me by Jerry Weinberg and Wayne Strider and Elaine Cline (Strider and Cline).

It's the same process that some herbicides use: unconstrained growth.
Monsanto's flagship herbicide Round Up is exactly this sort of agent.

If you are very good at what you do and much sought after, this can lead directly to massive Failure - personally and in business.

Growth is Good, but too much, too fast is a Killer.

The only protection is awareness.
As  Virginia Satir pointed out, "We can't see inside other people's heads, nor can we see ourselves as others see us" (courtesy again of Jerry and "Strider and Cline".)

Typically you need objective, external help is recognising this condition.
Once you have restored Situational Awareness, you can choose your response. Which may be "I'm outa here", Denial or something in between.

There is an alternative form of "Death by Success", which again we see in the Plant Kingdom.

Your initial approach, solution or technique may not Scale-Up or have a fixed Upper-Bound.
E.g. if you sell "factory seconds", there is a limited supply that sets your maximum turnover.
Or selling fragments of the Berlin Wall - at some point the Genuine Article is all gone...

The example in the Plant Kingdom are when tree seedlings 'set' in unsuitable places, like a small pot or within a bottle. Down the road, they will become "root bound", which slows growth, then they'll consume all the nutrients and having converted 'everything' into plant material, die.

That's it for that plant - all of one resource has been exhausted and it's Game Over.

Death by Success

The things you do in the beginning, when you're the minnow-against-the-giants, to start and build a business may not work well when you're successful, when you've become The Giant.

Exactly what leads to Success can eventually lead to your downfall.

You become very good at the things that have gained and seemingly maintained Success.  Every problem and challenge you've met have been solved with your brilliance and individual style.

Why would you ever want or need to vary that approach?

Until something new comes along and it all goes wrong:
  Inevitably in Business and Life, things change (perturbations arise in Control Systems terms).
  Responding with "More of the Same", as in the past, will, at some point, not work.
  If you've grown large, it will take time to fail, you'll have notice "things aren't great".
  Many companies only ever do "More of the Same",  often amping-it-up as results don't appear.
  The results are as predictable are throwing oil on a fire.

Often I mention Sydney Finkelstein's book, "Why Smart Executives Fail" in which Finkelstein describes the results of 6 years of research.  He self-describes as "Steven Roth Professor of Management at the Tuck School of Business at Dartmouth College, where I teach courses on Leadership and Strategy".

In Smart Executives, Finkelstein and his team documents a whole slew of companies (50) that burned bright and collapsed. This book was published in 2003, covering a turbulent period of US and global business, as well as some famous cases going back decades.

The subjects of the research were chosen precisely because they were wildly successful and suffered a notable collapse. Enron and Worldcom are on the list, plus many I.T. companies such as Wang Computers.  The common thread is the collapse was avoidable and predictable.

Would the conclusions, Lessons Learned and "Early Warning Signs" be different post the 2008 GFC (Global Financial Crisis)?  I think not...

Finkelstein lists 7 naive causes of failure:

1. The Executive were Stupid.
2. The Executives couldn't have known What was Coming.
3. It was a Failure to Execute.
4. The Executives weren't trying Hard Enough.
5. The Executives lacked Leadership Ability.
6. The Company lacked the Necessary Resources.
7. The Executives were simply a Bunch of Crooks.

and comments in a para entitled "Failure to understand Failure":

All seven of these standard explanations for why executives fail are clearly insufficient. (Because the companies had demonstrated excellence in becoming highly successful.)

The next 300 pages are his answer. Part I describes "Great Corporate Failures" and Part II their Causes.
This research ends with a positive message, Part III is "Learning from Mistakes":

• Predicting the Future, Early Warning Signs.
• How Smart Executives Learn, Living and Surviving in a World of Mistakes.

His "Seven Habits of Spectacularly Unsuccessful People"  are worth reiterating:

1. They see themselves and their companies as dominating their environments.
2. They identify so completely with the company that there is no clear boundary between their personal interests and their corporation's interests.
3. They think they have All the Answers.
4. They ruthlessly eliminate anyone who isn't 100% behind them.
5. They are consummate company spokespersons, obsessed with the company image.
6. They underestimate major obstacles.
7. They stubbornly rely on what worked for them in the past.

Each of the 11 chapters has 30-50 references.  Although written and published for the general market, this isn't any "Puff piece".

Why Microsoft is being left behind

Paul Budde recently questioned, "Will Microsoft be able to make the jump?"
[04-Apr-2010] For other comments see my pieces "Death by Success" and "Death by Success II".

He quotes the marketing "S-curve" and Summer Players by Carol Velthuis describing company performance and market maturity in seasons of the year.

ICT Productivity and the Failure of Australian Management

Prior Related Posts:
Quantifying the Business Benefits of I.T. Operations
The Triple Whammy - the true cost of I.T. Waste
Force Multipliers - Tools as Physical and Cognitive Amplifiers
I.T. in context

Alan Kohler and Robert Gottleibsen have been writing in "Business Spectator" about the relationship between jobs and Economic Productivity.

They note that the USA has improved productivity in the last year while in Australia it has declined (+4% and -3% respectively).  My take on this is: a gross Failure of Australian Management.

There is solid research/evidence that "ICT" is the single largest contributor to both partial and multi-factor Productivity, and is expected to be so for the next 20 years.  This is an big issue.

Why Yet Another ReOrganisation won't improve the Public Service

The Rt. Hon. Ken Rudd PM has suggested on the News that he'll be seeking to improve the Federal Public Service. There's talk of a special Centre at the ANU to train people up too.

Rudd might end up with a bunch of tests, metrics and new programs & processes, but I can guarantee it won't amount to a hill 'o beans. The one thing known about Bureaucracies is their ability to Resit Change.

Read C. N. Parkinson ("Parkinsons Law" etc) for a view from the 1950's and some definitive economic analysis of the ultimate Bureaucracy: The UK's Ministry of Defence. After WWI, ships and fighting men - the essence of the Navy - declined dramatically. The Bureaucracy 'running' them increased overwhelmingly...

Why? Because the primary purpose of Bureaucracies is themselves, not producing outcomes.

Reactionary or 'Frothing at the Mouth'?

Is my opinion "Forget the Best, Embrace the Rest" over the top, reactionary and irrelevant nonsense?

The State of Practice is beyond criticism - because there is no useful information on it.

Here are 3 questions to ask of Management theory & thought:

• Exactly why "Management is Hard"?
  
  
• What are the tasks of Management?
  i.e. a formal & unequivocal model of the dimensions of action and decision, resources & information required and skills/capability required of individuals and teams.
  
  
• How to quantify the performance of individual Managers and the Management Team?

These are fundamental questions and should at least be definitively outlined in any introductory text or course - but aren't.

Which begs the question: Why aren't they addressed?

Either I'm completely off-track & uniformed or have outlined something of merit.

If this viewpoint is of merit, What then?

Forget the best, embrace the rest

It appears to me that 'Homo Corporatus' (the 'management classes') rejects, seemingly actively, the need for maintaining "Lessons Learned" and adopting in practice the best theories & principles known. The Operant Methodology seems to be:

Forget the best, embrace the rest.

This isn't a little or accidental. It's endemic and universal.

I.T. Strategic Planning Failures

Sue Bushell asked on "LinkedIn": What are the most common failures in strategic IT planning and how are these best avoided? What best practices in strategic planning are most effective?

My answer:

1. There are no I.T. projects - only Business Projects.
Hence changing the premise of your question:
What are the most common business process failures around I.T. solutions?
[A: Make the business run the project and take the rap if it fails.]

2. I.T. is an Industry, not a Profession.
Proof: Professions Learn: repeating Known and avoidable Errors/Mistakes isn't consequence free, as it is within I.T.

3. The complete lack of History in I.T. - both on macro and micro scales.

• Show me any large organisation that can even list all its current projects, which is a necessary starting point for:
  
  
• Formal "Lessons Learned" from projects and operations - known problems are avoided, known effective practices are used.
  
  
• Jerry Weinberg wrote definitive works on Software Quality Management and 35 years ago proved that focusing on Quality results in better code, written far faster & cheaper. And it is much more reliably and consistently produced!
  
  
• Jim Johnson of Standish Group, nearly 15 years ago started definitive research on what proportion of IT Business Projects fail and the causes of failure. This work is fundamental to advancing the Profession - but nobody else studies this field so his results can't be verified or refuted. Nor have organisations or practitioners, by-and-large, acted on this knowledge. People do argue that his results are suspect because other single-shot reports don't agree. But nothing happens to resolve this fundamental issue!
  
  
• Software ReUse is notable in how little it is practiced. Can it be possible that nearly ever problem is completely new? Not in my experience.

4. The fundamental reason IT is used: It's a "cognitive amplifier".
Computing amplifies the effort and output of people, providing results 'Cheaper, Better, Faster'.

On the micro scale, no organisation I've heard of measures this. It's quantitative and should be calculable by any half-reasonable Management Accountant.

On the macro scale, the 'Profession' doesn't have or publish benchmarks on results (i.e. from across many organisations).

5. The 'Profession' doesn't even have a taxonomy of jobs and tasks, let alone any consistent method for evaluating and reporting the competence of, and skill level of, practitioners.

• In a construction project you wouldn't specify "10 vehicles needed", you say "6 5-tonne trucks, 2 utes, a 20-tonne tip-truck and a bobcat".
  
  
• If the profession can't distinguish between the speciality, competence and skill levels of its practitioners, how can the business folk?
  
  
• If project plans don't identify the necessary the precise skills needed - implying some way to assess and rate the 'degree of difficulty' of individual tasks/components - then the right 'resources' can't be applied.
  

6. The almost complete disconnect between research results and practice. Enough said.

7. [Added]. The general capability of the Profession in general and young I.T. practitioners has declined greatly.
Proof: The increasing number of failed projects attempting to replace 'Legacy Systems'.

E.g. The failed A$200M Federal Government ADCNET project. I worked on the original IBM mainframe system, then found myself 15 years later sitting in the same awful basement not 50 feet away, coding it's replacement. The IBM system took 30-35 man-years (in structured assembler), just the second phase of the ADCNET system had a team of 70 for 1-2 years - and was abandoned. The best description of it is the Federal Court Judgment:
GEC Marconi Systems Pty Limited v BHP Information Technology Pty Limited
Federal Court of Australia
12 February 2003 and 14 July 2003
[2003] FCA 50; [2003] FCA 688

8. [Added] Creating Software is a performance discipline.
You have to both know the theory and be able to create good software.
Who are the Great Heros of Open Source? The guys that demonstrate they can code well.

Like Music, Surgery and Architecture, software requires head and hands to do it well.


9. [Added] Design is Everything.
This is what the Bell Labs Computing Research guys understood and what Microsoft doesn't. They invented the most cloned Operating System in the world - Unix, and then went onto build Plan 9, it's replacement 20 years later - with around 20 man-years. It was created portable and scalable, running on 6 different platforms from day 1. Of course it was incredibly small and blindingly fast. Time has shown it was robust and secure as well.

Not an accident that 15 years later Microsoft spent around 25,000 man-years on 'Longhorn', and then threw it all away! (The infamous 'Longhorn Reset' on 23-Sept-2005 by Jim Allchin)
Then spent the same again to create 'Vista' afresh from the 'Windows Server 2003' codebase.

How could Microsoft not understand what was well known 15 years prior, especially as Microsoft ported Unix to Intel in 1985?


There's more, but that will do for now.


"I.T. Governance" may be part of the Solution, but standards like AS8015 are primarily aimed at allocating blame or pushing all responsibility for failure onto I.T. and abnegating from I.T. any successes.

The 'root cause' of all I.T. failures is trivial to identify, but probably exceedingly hard to fix. These days, almost no projects should fail due to technology limitations - only practitioner and management failures.

The 'root cause' is: Business Management.

Yes, there are many problems with I.T. practitioners, but think about it...

Around 1950, Commercial Computing was born.
Some projects worked, in fact succeeded brilliantly: Man went to the moon on the back of that work just 2 decades later.

And then we have the majority or 'ordinary' projects that fail to deliver, are abandoned or under-deliver...

The first time 'management' commissioned a bunch of 'Bright Young Things' to build The Very Best Computer System Ever, they would naturally believe the nerds and their self-confidence.

After that effort failed, what would the rational approach be to the next project?

Not the usual, "do whatever you want and we'll see", but "you didn't do so well last time, how about we try smaller pieces or doing it differently?"

And when lining up for the third go-round, you'd think competent business managers (the ones writing the cheques) would put the brakes on and say "you haven't shown you can deliver results, we have to manage you closely for your own sakes."

"Fool me once, shame on you. Fool me twice, shame on me."

And who's the cause on the third, fifth, hundredth or thousandth repetition?
The people who keep paying for the same 'ol, same 'ol.

I.T. in context

Here are Questions, not Answers...
Things that I'd like to explore and have better answers on.

Most of these questions probably don't have permanent 'answers' - each generation, each culture, each industry has to define and redefine them for their mix of technology, political structure and workplace organisation I suspect.