The CIO of the United States Government released a detailed 25 point plan on December 9, 2010 that aims to restructure the federal government IT by creating a "cloud first" policy as well as reducing the number of federal government data centers by 800. While nearly everything in the document has been talked about by the government at one point or another over the last few years, this document really ties it all together and seems to create a path toward an actionable plan.
Two key points that stood out to me were the adoption of a cloud-first policy and the consolidation of data centers.
The section on the "cloud-first" policy talks about a web-based video company (I'm not sure the exact company, but think YouTube or the like) and how it was able to scale from an initial demand of 25,000 customers to 250,000 within three days and ultimately to 20,000 new customers per hour. In contrast the government run cash for clunkers program (officially called Car Allowance and Rebate System) had poorly scalable IT infrastructure and when demand exceeded estimates, the system crashed repeatedly. It took more than a month for architects and developers to stabilize the environments. The document states that cloud technologies are economical, flexible and fast. The plan calls for each federal agency to identify three "must-move" services within the next 3 months, and then actually move all three to the cloud within the next 18 months.
The second initiative that caught my attention (actually the first one in the plan - I'm summarizing out of order), was the goal to eliminate 800 data centers by 2015. The document lays out 3 key steps to do so:
1)Identify program managers at the agencies to lead the consolidation effort
2)Launch a data center consolidation task force
3)Create a publicly available data center dashboard to track the consolidation progress
As I've written about before, data center consolidations can be tricky and I think point number one is going to be the most critical. Strong program managers are essential to the success of the plan. If all goes well, the government can save a lot of money by eliminating so many data centers (I'll leave a discussion about the social effects of the resultant job cuts to someone else).
The entire 25 point plan is worth reading (it's only about 40 pages) and can be found here:25-Point-Implementation-Plan-To-Reform-Federal-IT
I'm glad to see some quality discussion about how the government can adapt IT best practices. Hopefully quality action will follow.
Good Talk,
Tom
Sunday, December 12, 2010
Friday, December 10, 2010
System Access: Adding, Deleting, Maintaining User Profiles
I recently started on a new project at work. I'm in a fairly non-technical role on a technical project. I've been there just over a week now and I finally feel like I understand what's going on, where I fit in, and where the project is headed (for better or worse). What's sad, is that even after 11 days, I can not (officially) log onto my clients computer systems. I have no badge. I've been roaming the building for days, but I officially do not exist.
This is an example of poor access controls. Despite having no log-in of my own, I've spent hours navigating around their network and learning what I need to learn (that might sound hacker-ish....It's not meant to. The project I'm working on uses a SharePoint site and a few other cloud-based tools for tracking an collaboration). Despite having no badge or key card of my own, I spend days navigating around their buildings (plural). This got me thinking today about how IT departments handle access issues. Anyone who works as a consultant regularly deals with getting acclimated to new cities and getting access to new client systems. But, for reasons I don't fully understand, some clients are extremely proficient at the task of managing users and others are not. I've decided it mainly comes down how company leadership balances security policy with a need to get things done.
The utility companies I've worked at are, for good reason, extremely focused on security. It's near impossible to enter a building or log onto a system without a badge or a system profile. Most of the buildings I've been in have gates in the lobby that alarm if you don't swipe your card, they have elevators that require a key card to operate, they have uniformed security in fixed and rotating positions. Additionally the systems are configured so that a user can only be signed in from one location at a time (no sharing of log-ins), that accounts will lock out if the password is entered incorrectly too many times, etc. They can not be accused of being lax on security. At the same time, I've never waited more than a few days for all the access I need. I think in part this is due to the fact that Utilities operate in a regulated environment with tightly controlled costs and margins. Any delays can adversely affect profitability and costs which in turn can annoy powerful regulators.
I can contrast this with a media company I worked at that seemed mostly unconcerned with security. On day one I was handed a plain, unremarkable Kastle card and a form for access to the building. I was told to try to turn the form in by the end of the first week, but that the Kastle card was already active and I had full access to any floors I needed (mind you, my client only had offices on two floors). When I met my client sponsor upstairs (not in the lobby), he gave me a user name and password from a former consultant who had left a few weeks earlier. He said it would get me up and running until my paperwork was processed. The upside is that I was working full-bore on day one. The downside is that IT security was nearly non-existent.I mean, I was using the log-in of a guy who'd been gone for 3 weeks...why did it even still work? These things should be turned off right away.
Then I've worked at government agencies. These guys take security to a whole new level. I had to go to the client site two weeks before my start date to pick up paper work, get finger printed, and sign some forms. Then, on day one I was given a guest pass and an escort. These two things stayed with me for two weeks. I could not carry my own laptop into the building until it was certified as virus/malware free by IT and was given a special tag to denote it as "non-government property". I was required to leave my blackberry in the car because it had a camera (I eventually bought a new one with no camera). Needless to say, for the first couple of weeks my productivity was less than optimal (though my bill rate was pretty good!). Because of the sensitivity of the agency I was working with and the nature of the material I was handling, security was a vastly higher priority than cost or profitability.
What it all comes down to is finding the right balance of security vs profitability for your company. For a highly sensitive government agency, it makes sense that efficiency would take a back seat to security. For a small media company it might be OK to relax a bit on security. And for a utility company, it's probably right that they fall somewhere in between.
A few tips to get up and working as fast as possibly:
1)Start the process and paperwork as soon as possible. If you know weeks ahead of time that you're going to start on XYZ day, call your client and find out what can happen ahead of time. Sometimes providing a name and DOB can really get the ball rolling. Likewise, if you're a buyer, reach out to your consultants and request the necessary information. There is no reason to wait until the consultant is on the ground (charging your company)
2) Do not give out your password. I don't know how my client got the old consultants log-in information, but make sure to protect your own. Change passwords regularly, do not use the same password for everything and never give it out. If you're a buyer, delete access as soon as possible after someone leaves, require password changes frequently, and never encourage password sharing.
3) Grant only the access needed. If someone only needs access to one system, provide only that access. If they only need access to one floor in a building, do not give them access to all the floors. And if you are a consultant (or an employee even), don't attempt to access things you don't need. This will only open you up to liability.
Good Talk,
Tom
This is an example of poor access controls. Despite having no log-in of my own, I've spent hours navigating around their network and learning what I need to learn (that might sound hacker-ish....It's not meant to. The project I'm working on uses a SharePoint site and a few other cloud-based tools for tracking an collaboration). Despite having no badge or key card of my own, I spend days navigating around their buildings (plural). This got me thinking today about how IT departments handle access issues. Anyone who works as a consultant regularly deals with getting acclimated to new cities and getting access to new client systems. But, for reasons I don't fully understand, some clients are extremely proficient at the task of managing users and others are not. I've decided it mainly comes down how company leadership balances security policy with a need to get things done.
The utility companies I've worked at are, for good reason, extremely focused on security. It's near impossible to enter a building or log onto a system without a badge or a system profile. Most of the buildings I've been in have gates in the lobby that alarm if you don't swipe your card, they have elevators that require a key card to operate, they have uniformed security in fixed and rotating positions. Additionally the systems are configured so that a user can only be signed in from one location at a time (no sharing of log-ins), that accounts will lock out if the password is entered incorrectly too many times, etc. They can not be accused of being lax on security. At the same time, I've never waited more than a few days for all the access I need. I think in part this is due to the fact that Utilities operate in a regulated environment with tightly controlled costs and margins. Any delays can adversely affect profitability and costs which in turn can annoy powerful regulators.
I can contrast this with a media company I worked at that seemed mostly unconcerned with security. On day one I was handed a plain, unremarkable Kastle card and a form for access to the building. I was told to try to turn the form in by the end of the first week, but that the Kastle card was already active and I had full access to any floors I needed (mind you, my client only had offices on two floors). When I met my client sponsor upstairs (not in the lobby), he gave me a user name and password from a former consultant who had left a few weeks earlier. He said it would get me up and running until my paperwork was processed. The upside is that I was working full-bore on day one. The downside is that IT security was nearly non-existent.I mean, I was using the log-in of a guy who'd been gone for 3 weeks...why did it even still work? These things should be turned off right away.
Then I've worked at government agencies. These guys take security to a whole new level. I had to go to the client site two weeks before my start date to pick up paper work, get finger printed, and sign some forms. Then, on day one I was given a guest pass and an escort. These two things stayed with me for two weeks. I could not carry my own laptop into the building until it was certified as virus/malware free by IT and was given a special tag to denote it as "non-government property". I was required to leave my blackberry in the car because it had a camera (I eventually bought a new one with no camera). Needless to say, for the first couple of weeks my productivity was less than optimal (though my bill rate was pretty good!). Because of the sensitivity of the agency I was working with and the nature of the material I was handling, security was a vastly higher priority than cost or profitability.
What it all comes down to is finding the right balance of security vs profitability for your company. For a highly sensitive government agency, it makes sense that efficiency would take a back seat to security. For a small media company it might be OK to relax a bit on security. And for a utility company, it's probably right that they fall somewhere in between.
A few tips to get up and working as fast as possibly:
1)Start the process and paperwork as soon as possible. If you know weeks ahead of time that you're going to start on XYZ day, call your client and find out what can happen ahead of time. Sometimes providing a name and DOB can really get the ball rolling. Likewise, if you're a buyer, reach out to your consultants and request the necessary information. There is no reason to wait until the consultant is on the ground (charging your company)
2) Do not give out your password. I don't know how my client got the old consultants log-in information, but make sure to protect your own. Change passwords regularly, do not use the same password for everything and never give it out. If you're a buyer, delete access as soon as possible after someone leaves, require password changes frequently, and never encourage password sharing.
3) Grant only the access needed. If someone only needs access to one system, provide only that access. If they only need access to one floor in a building, do not give them access to all the floors. And if you are a consultant (or an employee even), don't attempt to access things you don't need. This will only open you up to liability.
Good Talk,
Tom
Thursday, December 9, 2010
Vendor Management
When you work in IT it's a fact of life that much of your time will be spent working with vendors and consultants. The field has become extremely specialized and it often makes sense to work with specialists who have years of experience mastering the issue that you are facing for the first time. Oftentimes a group of skilled contractors can design, build, implement, test, or upgrade a system faster and cheaper than a companies own resources could. (There is a reason IBM moved out of making computers and into consulting). It often makes perfect sense to outsource certain problems (in fact, sometimes it's the only way).
However, working with contractors comes with its own set of risks. While you generally get skilled resources who can be on-site and up to speed very quickly, you can end up surrendering a lot of control over the project(s). If seen first hand contractors differ greatly with their clients over how the project should proceed or what the time line needs to be. That's why it is important that, from the very beginning, buyers carefully develop and manage the relationship with the consultants/vendors. There are two primary steps to include in this management process that happen BEFORE the vendor starts working:
1. Vet the Contractor
Oftentimes buyers are far less familiar with the process than the vendors are (a buyer may sign one major IT project in his career, whereas consultants will sign 5-10 every year) and thus they rely heavily on advise from the very people selling them the services. There is nothing necessarily wrong with this - a big part of why companies pay high fees is for the consultative advice. But, a buyer needs to be sure he vets the conclusions of potential vendors with others in the industry.
Despite the promises of the salesman (or saleswoman) you've been talking to for the last 6 weeks, the only thing that matters once the project starts is what the contract (also called a statement of work) says. You may have been told that the company can do XYZ for you, but if you don't write it in, you can rest assured that it's either not getting done or it's going to cost you extra.
Good Talk,
Tom
However, working with contractors comes with its own set of risks. While you generally get skilled resources who can be on-site and up to speed very quickly, you can end up surrendering a lot of control over the project(s). If seen first hand contractors differ greatly with their clients over how the project should proceed or what the time line needs to be. That's why it is important that, from the very beginning, buyers carefully develop and manage the relationship with the consultants/vendors. There are two primary steps to include in this management process that happen BEFORE the vendor starts working:
 |
| Pomerene & Redfield (Courtesy of LOC) |
1. Vet the Contractor
Oftentimes buyers are far less familiar with the process than the vendors are (a buyer may sign one major IT project in his career, whereas consultants will sign 5-10 every year) and thus they rely heavily on advise from the very people selling them the services. There is nothing necessarily wrong with this - a big part of why companies pay high fees is for the consultative advice. But, a buyer needs to be sure he vets the conclusions of potential vendors with others in the industry.
- Ask for references, call (or better yet visit) other clients of the firm you are considering.
- Talk to other consulting firms currently working at your company - You'll get sometimes biased opinions, but at least you'll hear the other side
- Talk to former clients -find out what went well, what went wrong, etc
Despite the promises of the salesman (or saleswoman) you've been talking to for the last 6 weeks, the only thing that matters once the project starts is what the contract (also called a statement of work) says. You may have been told that the company can do XYZ for you, but if you don't write it in, you can rest assured that it's either not getting done or it's going to cost you extra.
- Lay out a specific time line
- Include penalties for non-performance/missed deadlines
- Define scope as clearly as possible - what will the contractors do, what will the client be required to provide for them to do it, what is specifically excluded under the contract?
- Define who ultimately owns what - vendors/consultants defend their Intellectual property/capital rights aggressively. Make sure to spell out what work papers, processes, tools you will own when the project is over.
Good Talk,
Tom
Sunday, December 5, 2010
Data Center Program Management
Data center migration programs require coordination across multiple departs/divisions within a company and can be incredibly complex. Additionally, such programs typically involve millions of dollars and the company's most critical applications. As such it is important that these programs are well thought, well planned, flawlessly executed, and rigorously monitored. Below I offer five tips to help ensure successful program management.
1) Use Tools that Work:
While "one-size fits all" might work well for hats or gloves, it is not a good idea in Data Center Migration program management. I've seen some clients with incredibly over-engineered tools and processes. Others have no standards at all. What's important is not the complexity or simplicity of the tools, it is, rather, to ensure that the tools fit the culture and capabilities of the company and that the meet the data transparency needs of the program. Some companies might be OK with basic excel spreadsheets, but would be overwhelmed by complex, custom built PM tools. Other companies are going to require something more involved and will be comfortable adapting to a new tool. Companies should understand that there are not one-size fits all tools, but only one size fits now tools.
2) Adapt Best Practices
It is critical that any Project Management Office (PMO) adapts as the project moves forward. As more information becomes known and lessons from early successes and failures are learned, the project managers must discard broken processes and ineffective tools, while promoting those that work well. Additionally, and equally as important, the PMO must also search for best practices wherever they exist. We all bring best practices from our own experience, but a great PMO will look outside the company and will look to other departments and programs within the company. A great PMO will get better as the project progresses.
3) Engage Key Leadership
I really probably should put this first, as it is by far the most important factor in project success or failure. I don't mean a strong project manager when I say engaged leadership, I mean the project must have an active executive within the organization who checks on the project regularly, holds the project team accountable for deadlines and goals, and champions the program to others within the company - removing roadblocks and opening avenues for collaboration. Additionally, a engaged executive can often expedite key decisions.
4) Measure, Measure, Measure
It is an old cliché that "what gets measured gets done", but it's a persistent cliché for a reason. It's true. When designing program plans, it is essential to ensure that the proper metrics are created and the proper deadlines set. Equally as important, these deadlines and metrics, as well as progress against them, must be clearly and regularly communicated to the project team members.
5) Know What You Are Migrating
 |
| photo by Lawrence Berkley National Laboratory (Flickr Creative Commons) |
While this list is by no means comprehensive. Data center migration program management is tremendously complex and could hardly be covered 30 blog posts, let alone one. But keeping these 5 points in mind will minimize the risk for the program.
Good Talk,
Tom
Saturday, December 4, 2010
E-Health Care
I came across a great satirical video regarding the sorry state of technology in our health care system. If Air Travel worked like health care...that's a scary thought.
Please note: I'm reposting this video here under fair use standards. All rights remain with the original creators.
Please note: I'm reposting this video here under fair use standards. All rights remain with the original creators.
Google and Groupon - Who is Crazier?
I was just reading that Google offered to buy the social-commerce site Groupon.com for around $6 Billion…at first I swore the number must have been a typo. Google must be crazy to pay that much. Then I came across another article reporting that Groupon was going to reject the Google bid and remain an independent company. Right now my head is spinning. I can’t decide who’s crazier. $6 Billion seems like way too much money for a website/company whose sole source of revenue is derived from small business. Furthermore, according to nearly all reports I’ve read (which I will freely admit is not a comprehensive sample), nearly half of the businesses that have tried Groupon say they will not use the service again.
There is a fundamental issue with Groupon from the perspective of a small business. While the exposure and influx of new customers might seem like a positive in the short-term, one must consider the long-term cost. First off all, the business is discounting their respective product or service by 50% or more. On top of that, they need to pay Groupon 50% of the revenue they earn from the promotion. In essence, the company is giving up 75% of their revenue, destroying margins and eliminating profitability (except in a few select industries with extraordinary mark-ups).Now, you could argue that it’s ok to lose money on a promotion as long as the company is gaining customers and setting the stage for long-term growth and profitability. Unfortunately, that is not what happens in an overwhelming majority of the cases. As has been demonstrated by academic theory and real-world study, price-promotions generally harm long-term brand value (see here). In short, value consumers rarely become brand loyal consumers. They will hop from one phenomenal deal to the next seeking steep discounts along the way. These are not the kinds of consumers on whom you want to base your business.
Groupon is currently enjoying extraordinary success. The founders should be extremely proud of the business they have built and of the impact they have had on group buying and social media. Each day more and more consumers sign-up and take part in the daily Groupon. However, Google must recognize that the customers that Groupon needs to worry about are the small businesses. As the group coupon/group buying space matures competitors will emerge and small business will get smarter. I have serious doubts that the business can scale enough to cover a $6 Billion purchase price. I’d love to hear other thoughts. Who is crazier? Or are they both perfectly sane?
Good Talk,
Tom
Wednesday, December 1, 2010
Electric Cars and Electric Rates - What Policy/Rate changes are coming?
I've spent a lot of time thinking about the future of our electric grid and how it will change with the advent of a truly smart grid as well as the widespread adoption of electric cars. One of the biggest constraints of electricity generation and delivery is that we can not (to date) effectively store electricity. We either use it or lose it.
We're currently working on a smart grid that will allow energy to flow from the utility company to the consumer, and also the other way. This will allow those with wind mills or solar panels to sell energy back to the grid.
Electric cars rely on huge batteries to charge at night and then power the car during the daily commute. One of the really exciting things about widespread adoption (should it occur) is that we will have the largest collection of batteries in the history of man. If you charge your car fully over night (when electricity is cheaper), then drive a few miles to work you're not going to deplete the whole battery. There will be a lot of stored charge.
Imagine being able to plug in at work and sell that electricity back to the utility at peak rates (after having paid off-peak rates to charge it over-night). For this to work, however, you will need a personal utility account (like a debit card). Otherwise, your employer would get the credit (since it's probably his plug).
There are, of course, other uses: What if you get to a friend's house for dinner and your car is running low? Should your friend have to pay for you to charge your car? Of course not!
We will need to separate the idea of a utility meter from a house/office. Currently utilities track premises. In general there is one premise per home. I think in the future it might look more like one premise per person.
There are also other options utility companies are looking at. According to a recent Wall St Journal article, some utilities are offering a "all you can eat" rate plan specificially for charging electric cars (Detroit-Edison), others are offering lower rates and free charging stations. This does not solve the problem of charging away from home, but it can provide incentive to move to an electric car. The same article suggests that someone driving a Nissan Leaf 100 miles a day (which admittedly seems like a lot) can save more $350 a month compared to driving a traditional internal combustion car getting 25MPG.
I think the real interesting question is "how will governments respond to electric cars?" I imagine we'll see some free/heavily discounted public charging stations at least initially. Just as cities/states provide roads for our cars, I think it's reasonable that they will provide power to speed the adoption of electric vehicles (and by "free", of course I mean tax payer funded...)
I'll be interested to see what other policy changes emerge as a result of electric cars.
Good Talk,
Tom
[Source: http://online.wsj.com/article/SB10001424052748703882404575519641915241922.html]
We're currently working on a smart grid that will allow energy to flow from the utility company to the consumer, and also the other way. This will allow those with wind mills or solar panels to sell energy back to the grid.
Electric cars rely on huge batteries to charge at night and then power the car during the daily commute. One of the really exciting things about widespread adoption (should it occur) is that we will have the largest collection of batteries in the history of man. If you charge your car fully over night (when electricity is cheaper), then drive a few miles to work you're not going to deplete the whole battery. There will be a lot of stored charge.
Imagine being able to plug in at work and sell that electricity back to the utility at peak rates (after having paid off-peak rates to charge it over-night). For this to work, however, you will need a personal utility account (like a debit card). Otherwise, your employer would get the credit (since it's probably his plug).
There are, of course, other uses: What if you get to a friend's house for dinner and your car is running low? Should your friend have to pay for you to charge your car? Of course not!
We will need to separate the idea of a utility meter from a house/office. Currently utilities track premises. In general there is one premise per home. I think in the future it might look more like one premise per person.
There are also other options utility companies are looking at. According to a recent Wall St Journal article, some utilities are offering a "all you can eat" rate plan specificially for charging electric cars (Detroit-Edison), others are offering lower rates and free charging stations. This does not solve the problem of charging away from home, but it can provide incentive to move to an electric car. The same article suggests that someone driving a Nissan Leaf 100 miles a day (which admittedly seems like a lot) can save more $350 a month compared to driving a traditional internal combustion car getting 25MPG.
I think the real interesting question is "how will governments respond to electric cars?" I imagine we'll see some free/heavily discounted public charging stations at least initially. Just as cities/states provide roads for our cars, I think it's reasonable that they will provide power to speed the adoption of electric vehicles (and by "free", of course I mean tax payer funded...)
I'll be interested to see what other policy changes emerge as a result of electric cars.
Good Talk,
Tom
[Source: http://online.wsj.com/article/SB10001424052748703882404575519641915241922.html]
Subscribe to:
Posts (Atom)