The New IT Leader

Underlying Risk of Enterprise Mobility

The propagation of smart phones and introduction of solid state devices such as the iPad, coupled with increased bandwidth in LTE networks, mobile computing is becoming a fact of life that IT organizations are going to have to grapple with.  As with many of the technologies that are consumer driven, the integration of these mobile devices often start at the C Suite of a company and quickly proliferate into the rank and file. Consider the ever growing extension of the enterprise into a consumer driven market is a nightmare for risk managers trying to protect a company’s intellectual capital and systems infrastructure. 

Unarguably these devices provide a means for businesses to be more productive and agile, and are a temptation that cannot be avoided.  They also blend work and personal business on a level never before experienced by technology organizations as many of these devices are owned by the employees rather than the company (although that trend is starting to change as some companies are adopting tablet computers as a new standard for portal computing devices rather than deploying laptops).

Being that many of these devices are employee owned, companies also now have to deal with the ramifications of having personal devices access corporate assets.  This introduces an unprecedented level of risk, HR, and legal issues that companies have never have had to deal with before. 

This trend is only going to continue as the computing platform paradigm shifts from computing at a desk to computing available to you wherever you are and whatever you are doing.  In so much that these technologies are being adapted (and thriving in the consumer market), companies need to understand the risks involved with extension of their enterprises beyond the virtual walls of their networks and what to do to mitigate those risks. 

Key risks and mitigation strategies include:

Information Security

Access to e-mail and company contacts area major reason for having a mobile device.  However, there is the ability to use these devices for checking personal e-mail as well as connecting to social media sites (e.g. Facebook, Twitter, Digg, etc.).  Whereas many companies have established policies to protect their laptops from these types of vulnerabilities, mobile devices will also need a similar protective framework.

Mitigation Strategy:

• Mobile policy management – if users are going to use their personal devices to access corporate information, then policy enforcement on those devices is a must (such as  multi-factor authentication, device password lockdown, and data wiping capabilities, etc.).  There are several choices available in the market to help manage these policies to secure information on mobile devices
• Education – ensure that there is mandatory education required for any employee that is using their mobile device to access corporate assets so they understand and acknowledge the risks and their responsibilities for using those devices

Location Sensitive Information

One of the great capabilities of mobile devices is to interact with social media sites and allow them to know your location automatically so you don’t have to provide that information whenever you post to these sites.  However, for companies (especially companies that keep employee locations secret), this is an exposure that needs to be addressed.  Take an armored car service as an example.  If you have an employee who is posting to their Facebook during while working, it would not take long for someone to piece together the patterns of where that employee has been on particular days and map out their regular routes, potentially exposing the employee and the company to theft or other crimes.

Mitigation Strategies:

Education and awareness – like Information Security, education is critical; but awareness of what information employees are posting to social networking sites is also critical.  They need to understand the implications of providing location information especially when they are on the job

Disable location capabilities – on managed mobile devices, push the policy to disable this feature.  For those devices that are not under corporate management, educate employees on the importance of disabling this feature to protect the company and more importantly, the employee

Audits – for highly secure delivery services, regular audits of employee online activities may be necessary to ensure compliance to these policies.  This is a very sensitive issue and should be carefully reviewed by your legal and HR team before implementing

Vulnerabilities from unsecure devices and networks

Given that many of these devices are personal devices, they will likely be synced with home computers or other computers not directly under the security umbrella established by your company.  Further, these devices can connect to open wireless networks such as hotels and coffee shop networks, making them potentially vulnerable to access from others. 

Mitigation Strategies:

Policy enforcement – if the device is being used for accessing corporate information, policies should be pushed to the mobile devices to govern how users get access to corporate information through these networks

Mobile security software – there are multiple vendors available to protect the cell phones from a variety of threats including antivirus, anti-spam, and activity logging

Education – once again, education is a must.  Have users understand the risks of attaching to unsecure networks and be sure they are aware and note any unusual activity while they are connected to those networks

Connectivity into corporate wireless networks

Personal devices connecting into corporate networks expose companies to a variety of risks of unmanaged devices.  Risks include introducing viruses or trojans into the corporate computing environment or unauthorized access to information assets.    

Mitigation Strategies:

Policy enforcement – for devices that have both Wi-Fi and 3G/4G wireless connectivity, ensure that they can only connect to one network at time to ensure no external network tethering can take place

Unauthorized Devices Management – ensure that your wireless network only allows whitelisted devices to connect to your internal network or have the ability to detect new devices connecting to the network.

Education – corporate policies should be in place and communicated to employees to prevent unauthorized devices to connect to the corporate network

Key Social Media Metrics

Social networking affects every company out there, more so if your company works with retail consumers directly.  Understanding how your company represents itself in social media is becoming a bigger part of marketing strategies. 

Go to Facebook and look at two competing retailers (Coke and Pepsi as an example) and see how many people like each one, how the companies have customized their respective walls, and see what people are saying (or not saying).  Beyond Facebook are hundreds of other social media outlets (Twitter, Digg, delicious, etc.) where these two companies are mentioned, raved, bashed, and justified as the king of sodas.  Lest not forget the search engine results that come back on any of those posts.  For these companies, paying attention to what the consumers are saying is helping them (sometimes driving them) in molding their respective product, branding, and marketing strategies.    

While perhaps not particularly as applicable to non-consumer driven companies (would you as a consumer want to know the latest happenings at Union Pacific unless you had direct business dealings with them), more and more interactions are being driven by the consumer, on their terms and in the way they want to receive and manage content.  This is a fundamental shift from the way that companies used to dole out information (everyone come to me if you wanted info or to share), now companies need to reach out to consumers and allow them to respond amongst themselves.

There are stout ramifications to the way companies now address the release of product information to their customers and potential customers, but like any other strategy, success needs to have some way of being gauged.  For social media, a series of metrics is available, some old, some new.  Used as an aggregate, they provide insight into how well a company is doing and helping them understand the demand for their products, services, or brands.   

Here are some of the more relevant metrics.  While not inclusive of all metrics that could be tracked, these make up the bulk of the metrics that companies need to review when gauging the success of their social media campaign performance.

Website Statistics 

Visitors – for the company website or from the various social media outlets, how many visits is your company receiving.  You will want to know about the uniqueness of the visitors and the path they are taking while visiting your sites.  You will also want to capture information about where the visitors are coming from and how they got to your sites as well as search terms used to find your sites. 

Conversion rate – this tells how many total visitors to your site vs. the number of visitors that did something on the site that you wanted them to do (such as register themselves as a contact, or purchase a product or service).  This helps in determining how well your site is helping your customers and potential customers take the next steps with your products and services.    

Bounce rate – as a contradictory measure from conversion, how many visitors just get to the site then leave without further navigation.

Other Site Statistics – other stats you’ll want to look at for your website include average page views (different pages visitors to your sites navigate to) and time on site (how much time does each users spend on the site).  These statistics are compared with conversion rates to help determine if your site is effective in leading your visitors to take action.   

Social Networking Statistics

Number of followers – an obvious one in the respective social media frameworks, but provides a gauge as to interest from consumers to your products or services - see the example above.  You will want to track these for the various social media outlets that your company is actively managing

Mentions – on the social media front, how many mentions is your product or service generating.  It is important to track both positive and negative mentions.  There are several tools that are available to help you determine where your company, product or service is mentioned across the various social media outlets.  This extends to all social media networks, not just the ones your company actively manages. 

Number of interactions – within the various social media outlets that your company is involved in, how many different threads in either your blog, Facebook, Twitter, etc. is being generated by customers or potential customers.  This is a way of determining if any of your mentions (positive or negative) or content has gone viral. 

These metrics can then be integrated with other traditional marketing metrics such as campaign costs / ROI, lead conversion, cross-selling efficiency, and customer retention rates.

The Value of Information Technology

I have been recently working on a book on IT management practices.  During my career, I’ve come across several different ways that IT provides the services needed to drive business value (or not).  In that journey, I was hit with a plethora of management practices and standards that all claimed to be the panacea for the woes of IT service delivery.  I can tell you right now, none of them, as a standalone process framework, ever delivered on those promises.  It was a process medley that ultimately got me and my teams to where they needed to be.

So, I set out to write a book (which actually started out as a white paper on quality assurance) on how to frame up a IT manager’s job – specifically from the viewpoint of an application manager, as they are the closest to driving business value and have the most at stake in the success or failure of the IT services provided to the business.  Needless to say, technology has become an indispensible element in business strategies.  IT managers have to marry the capabilities of technologies to the growing and changing demands of the business and the economy. 

I also wanted to begin blogging about these ideas and get input from the technology community.  I thought I would start off with a topic that at least crosses the minds of IT senior managers – how do I prove out the value of my technology organization to the business. 

Well I can tell you it is not about how much IT costs the business.  Yes, you have to manage to a budget, but that budget is driven from business strategy.  IT is a part of the business strategy. 

Let’s tackle the subject of cost cutting first.  If you are given a mandate to cut costs in your organization, then you have not done enough to provide the value that the business determines it needs to stay competitive in delivering products or services to its customers.  Cost cutting should never be a mandate, but rather a joint strategic decision based on changing business conditions. 

If you were to take that mandate and start cutting costs, you will get into a spiral that is very difficult to recover from.  Instead of a value added function to the business, you now look like a cost center, a line item, yet another cost that put into the line of fire every time a bad quarter is occurring.  It happens – a lot.  And those managers that are caught up in those spirals often find themselves on the back end of a pink slip when, at some point, the business realizes that they are no longer competitive because they have not been able to deliver in a way that their competition has already employed to steal your customers!  

You are going to have to get ahead of this.  Instead of being the passenger on the cost cutting train, you need to help drive the business, to new channels for product and service delivery, to look at budget changes (up or down) against the strategy you and the business have agreed upon mutually. 

Think like a sales person

Strategically aligning the services you provide for the business requires you to have a deep understanding of the business.  If you ever spent time with any decent sales person, they would tell you that in order to effectively sell to a customer, they have to understand their customer’s customer. 

You have to do the same thing.  Ask the question what is the business selling to the customer and what value can you provide that is going to make a real difference in generating revenue streams for the company (or conversely streamline internal operations and reduce costs)? 

If you don’t know the answer to that question, you need to build an understanding of the customer and customer segments your company is targeting.  Spend time on the front lines to see firsthand how revenue is generated.  If you work in retail, spend a day at one of the stores or call centers.  If the company has a field sales force, see if a sales person will allow you to follow them for a day.  Before you go, make sure you understand the products.  Take courses that are available from your company that will help you learn the products and services the business is offering. 

In all of the verticals that I worked in, I have always strived to see the business through the eyes of the business leaders I was supporting.  As an application delivery manager, the best thing I ever did with any company is learn about the products and services we sold and their nuances.   It helped me have a meaningful dialog with the business.  Instead of the business trying to interpret what they are doing to drive requirements, I had discussions with the business on their level.  The venue now focused on approaches to reach and deliver to their customers, some that they had not thought about.  The key here is that I was driving the conversation, but it took me understanding the business to get to that point. 

Communicating the value  

Once you have that relationship with the business, you can go back to the standard IT management tools to help shape, deliver, and service the solution that you are proposing.  At that point, the metrics that flow from the work your team performs can be put in light of the business context.  Here are some examples of how a portfolio review is transformed from IT centric to business centric:

IT Metric	IT Centric	Business Centric
Availability	Sales System availability was X%, or N hours due to  outages related to aged hardware; failures trending upward; hardware needs to be replaced	Sales operations potentially lost N hours opportunity tracking resulting from outages of the Sales System tied aging infrastructure.  Trending shows continued increases in outages without replacing infrastructure, which could further reduce SO’s ability to capture and track opportunities
Capacity	Allocated disk space for the Sales System on the SAN is at 93%	The sales system can only support N more opportunities, contacts, and registered sales
Project Earned Value	The project is running behind at $N behind where it is supposed to be	The realization of XYZ risks has caused the project to be N days late and $N budget, reducing P&L benefit by X% and $N
IT Staffing Levels	N employees, M contractors, at an annual run rate of $X, with Y hours of project backlog	Service level comparison against the staff used to support those levels as well as the outstanding projects that need to be worked.

 

What we’ve done here is delink costs and caste these metrics in a business light.  It’s not about how much IT is costing the business, but the value (and challenges) that IT is bringing to deliver products or services to the market.  The cost viewed as a part of the overall P&L. 

You still need your standard book of metrics, but for the business, it’s about how you present those metrics in a way that makes sense to them.  You cannot make them translate your metrics into their operating environment.  You have to provide them the data in a format and presentation that aligns to their business. 

Remember that value you bring is the impact that your operations has on the viability of the business, not how the operation is managed (while that is important, the business expects you do to that as a part of your job).  What you want to focus on is the value you are bringing to the business so you don’t end up looking like a cost center.  To that end, when you are expressing the benefits of technology, it needs to be either tied directly to a business metric (not an IT metric) or to the business P&L. 

The value you provide will be based on the effectiveness of the business to deliver results.  You are tied to the business – with their metrics, their success, and their failures.