Reflection essay
zhuzhuY
CH1245reading.docx
Introduction to Information Systems
CHAPTER OUTLINE LEARNING OBJECTIVES
1.1 Why Should I Study Information Systems? 1.1 Identify the reasons why being an informed user of information
systems is important in today’s world.
1.2 Overview of Computer-Based Information 1.2 Describe the various types of computer-based information Systems systems in an organization.
1.3 How Does IT Impact Organizations? 1.3 Discuss ways in which information technology can affect
managers and nonmanagerial workers.
1.4 Importance of Information Systems to 1.4 Identify positive and negative societal effects of the increased Society use of information technology.
FanDuel and DraftKings
POM MKT
FanDuel ( www.fanduel.com ), founded in 2009, and DraftKings (www
.draftkings.com), founded in 2012, operate web-based daily fantasy sports (DFS) games. The two companies began operations by taking advantage of an exclusion in the 2006 Unlawful Internet Gambling En forcement Act. This statute bans credit card issuers and banks from working with poker and sports-betting websites, effectively prevent ing U.S. customers from participating in those industries. The federal statute, however, exempts fantasy sports because they are considered games of skill, not luck. To maintain legal status, the operator of a fan tasy sports business must follow four rules: (1) publish prize amounts before the games begin, (2) make prize amounts independent of the number of players in the game, (3) level the playing field by allowing anyone in a league to draft any player they want, and (4) disregard point spreads and game scores.
FanDuel and DraftKings deliver simple and fast fantasy betting. After paying an entry fee, players become eligible to win daily cash pay outs based on the statistical performance of athletes in games played that day. Traditional fantasy sports often frustrate players because the
experience lasts for an entire season. If a player drafts a bad team, then he or she is stuck with that team for several months. Serious fantasy league players also analyze large amounts of statistics, roster changes, and injury reports. Many casual players do not have time for such anal yses. In contrast to these leagues, FanDuel and DraftKings allow cus tomers to play for just a day, a weekend, or a week.
The companies allow players to participate for free or bet up to $5,000 to draft a team of players in the National Football League (NFL), the National Basketball Association (NBA), Major League Base ball (MLB), and the National Hockey League (NHL). Players can com pete head-to-head against another individual or in a league with up to 125,000 teams. The winner is the one with the best player statistics, which translate into fantasy points. The companies take an average of 9 percent of each prize.
MIS
FanDuel and DraftKings spend millions of dollars on com puting power from Amazon Web Services and other cloud computing providers. Cloud computing (discussed in Technology Guide 3) enables the companies to manage, as only one example, the increase in web traffic just before Sunday’s NFL kickoff. At that time, the firms must manage hundreds of thousands of simultaneous users, who make a
1
2 CHAPTER 1 Introduction to Information Systems
myriad of roster changes per hour. The companies also provide mil lions of live scoring updates per minute during games, meaning that they must manage almost 10 terabytes of network traffic during game day. (A terabyte equals 1 trillion bytes.)
Professional sports have noted that FanDuel and DraftKings, with their easy-to-use apps, appeal to young and mobile sports fans. Fur thermore, these fans have money at stake, so they are more inclined to watch games on television than they otherwise would. An increase in viewers leads to an increase in advertising rates for the teams. In fact, in 2015, FanDuel signed multiyear sponsorship agreements with 15 NFL teams. These deals generally include stadium signage, radio and digital advertising, and other promotions. Interestingly, the NBA owns an equity stake in FanDuel.
The two companies had tremendous success. In 2015, they processed a combined $3 billion in player-entry fees and realized a combined revenue of $280 million. By the fall of 2016, the companies claimed to have almost 60 million players in the United States.
Despite their success, FanDuel and DraftKings faced serious prob lems. Their first problem is that they can operate only as long as the federal government and state governments allowed them to do so. At the federal level, the government could close the fantasy loophole in the 2006 statute at any time. At the state level, each state can decide that DFS constitutes gambling and prohibit DFS in that state.
Significantly, the federal statute does not give daily fantasy sports businesses immunity from state laws. In November 2015, New York Attorney General Eric Schneiderman sent cease-and-desist letters to both companies, declaring that their games constituted illegal gam bling under state law and ordering both to stop accepting bets from New York residents.
Their second problem involves litigation. Three federal grand ju ries—in Boston, New York, and Tampa, Florida—have notified one or both companies that they are under criminal investigation. Further more, a class-action lawsuit, consolidated in Massachusetts, alleges conspiracy, fraud, negligence, and other claims. The lawsuit repre sents losing DFS players from 25 states and the District of Columbia.
Their third problem is that industry analysts estimate that 60 per cent of the firms’ revenue comes from approximately 15,000 high- volume players wagering at least $10,000 per year. Some 50 players who are analytics-driven professionals each wager at least $1 million per year. These figures underscore the fact that the vast majority of DFS players lose.
As of the fall of 2016, FanDuel and DraftKings are conducting expensive state-by-state campaigns seeking regulatory and legal clarity on the gambling issue. To be permitted to operate in various states, the two companies had to make needed improvements in their
operations. Specifically, they now provide areas for players of all skill levels, particularly to make beginning players feel comfortable and welcome. Both companies’ employees are prohibited from competing on rival sites. The firms have created tiers of players so that beginning players can avoid playing against professional players. Along these lines, FanDuel introduced “Experienced Player Indicators” and Draft Kings introduced “Experienced Player Badges.”
Interestingly, in the spring of 2016, FanDuel suspended contests on college sports in all states as part of a negotiation with the National Collegiate Athletic Association.
As a result of their problems, the companies’ market values have decreased markedly and neither company was profitable in 2016. As of fall 2016, some 20 states have pending legislation permitting DFS.
And the unanswered question? Why have the two DFS companies not yet merged?
Sources: Compiled from D. Van Natta, “Welcome to the Big Time,” ESPN, August 24, 2016; A. Carr, “The Most Dangerous CEO in Sports,” Fast Company, May 2016; D. Purdum, “DraftKings, FanDuel to Stop Offering College Fantasy Games,” ESPN.com , March 31, 2016; A. Berzon, “Fantasy Sports Industry Mounts Lobbying Blitz,” Wall Street Journal, February 15, 2016; M. Brown, “FanDuel Lays Off Workers as Legal Pressure Mounts,” Forbes, January 20, 2016; J. Brustein, “New York Gambles on a Daily Fantasy Ban,” Bloomberg BusinessWeek, November 23–29, 2015; R. Axon, “Facing Threat from N.Y. Attorney General, FanDuel Suspends Entries in State,” USA Today, November 17, 2015; L. Baker, “FanDuel, DraftKings Vow to Fight New York’s Halt on Bets,” Reuters, November 12, 2015; D. Alba, “DraftKings and FanDuel Scandal Is a Cautionary Startup Tale,” Wired, October 9, 2015; D. Roberts, “Flight of Fantasy,” Fortune, October 1, 2015; D. Roberts, “Are DraftKings and FanDuel Legal?” Fortune, September 24, 2015; J. Brustein and I. Boudway, “Just a Fantasy,” Bloomberg BusinessWeek, September 14–20, 2015; K. Wagner, “DraftKings and FanDuel Are Battling over Your Favorite Teams,” www
.recode.net, July 17, 2015; R. Sandomir, “FanDuel and DraftKings, Leaders in Daily Fantasy Sports, Are Quickly Gaining Clout,” New York Times, July 13, 2015; S. Rodriguez, “Yahoo Enters World of Daily Fantasy Sports, Takes on DraftKings and FanDuel,” International Business Times, July 8, 2015; B. Schrotenboer, “FanDuel Signs Deals with 15 NFL Teams, Escalating Daily Fantasy Integration,” USA Today, April 21, 2015; D. Primack, “DraftKings and FanDuel Close in on Massive New Investments,” Fortune, April 6, 2015;
R. Bertoni, “Fantasy Sports, Real Money,” Forbes, January 19, 2015; B. Schrotenboer, “Fantasy Sports Debate: Gambling or Not Gambling?” USA Today, January 12, 2015; www.fanduel.com, www.draftkings.com, accessed September 20, 2016.
Questions
1. Describe how information technology is essential to the compa nies’ operations.
2. Is information technology one of the companies’ problems? Ex plain your answer.
3. Describe the companies’ information technology infrastructure. Now discuss possible technological problems that the companies might have.
4. The companies face serious problems that are not related to in formation technology. Can information technology help them ad dress these problems? Why or why not? Explain your answer.
Introduction
Before we proceed, we need to define information technology and information systems. Infor mation technology (IT) refers to any computer-based tool that people use to work with infor mation and to support the information and information-processing needs of an organization.
Introduction 3
An information system (IS) collects, processes, stores, analyzes, and disseminates informa tion for a specific purpose.
IT has far-reaching effects on individuals, organizations, and our planet. Although this text is largely devoted to the many ways in which IT has transformed modern organizations, you will also learn about the significant impacts of IT on individuals and societies, the global economy, and our physical environment. IT is also making our world smaller, enabling more and more people to communicate, collaborate, and compete, thereby leveling the competitive playing field.
This text focuses on the successful applications of IT in organizations. That is, how orga nizations can use IT to solve business problems and gain a competitive advantage in the mar ketplace. However, as you see in this chapter’s opening case, not all business problems can be solved with IT. This situation means that you must continue to develop your business skills!
When you graduate, you either will start your own business or you will work for an organi zation, whether it is public sector, private sector, for-profit, or not-for-profit. Your organization will have to survive and compete in an environment that has been radically transformed by information technology. This environment is global, massively interconnected, intensely com petitive, 24/7/365, real-time, rapidly changing, and information-intensive. To compete success fully, your organization must use IT effectively.
As you read this chapter and this text, keep in mind that the information technologies you will learn about are important to businesses of all sizes. No matter what area of business you major in, what industry you work for, or the size of your company, you will benefit from learning about IT. Who knows? Maybe you will use the tools you learn about in this class to make your great idea a reality by becoming an entrepreneur and starting your own business! In fact, as you see in the chapter opening case and IT’s About Business 1.1, you can use information technol ogy to help you start your own business.
The modern environment is intensely competitive not only for your organization, but for you as well. You must compete with human talent from around the world. Therefore, you per sonally will have to make effective use of IT.
Accordingly, this chapter begins with a discussion of why you should become knowledge able about IT. Next, it distinguishes among data, information, and knowledge, and differenti ates computer-based information systems from application programs. Finally, it considers the impacts of information systems on organizations and on society in general.
IT’s About Business 1.1
New Delivery Services Use Information Technology and delivery fleets in their attempt to serve customers who are will
ing to pay a bit extra to have things done quickly. These companies
POM
also often do not hire their workers. Rather, they use independent Webvan, an online grocery business that went bankrupt in 2001, is contractors who are willing to forgo benefits packages (e.g., health considered to be the largest dotcom failure in history. The compa insurance, 401(k) plans) for jobs they can perform whenever they ny’s business model was to deliver products to customers’ homes want to.
within 30 minutes of a time the customer chose. The delivery services differ from more established grocery
Today, busy consumers are increasingly looking for the con- delivery companies such as FreshDirect ( www.freshdirect.com ), venience of having many items delivered on demand, with food Peapod ( www.peapod.com ), and AmazonFresh (https://fresh being the largest category. In fact, despite the well-known failure of .amazon.com) because they do not actually sell groceries directly Webvan, many same-day, third-party delivery services are emerg to you. Instead, you select what you want online or through an app ing to compete in the delivery industry, which is worth about $70 and choose a delivery time. The service then sends a contractor to billion a year. Delivery services are an excellent strategy for small the store to pick up your order and deliver it to your door. Let’s take businesses to differentiate themselves from their competitors and a look at some of these services.
to compete with giant online retailers.
Delivery service providers include some of the largest firms Instacart. Instacart ( www.instacart.com ) delivers items from in technology and retail, as well as specialized startups. The major chains such as Safeway, Whole Foods, and Costco as well as local challenge facing these companies is how to deliver groceries and markets. Instacart has no physical infrastructure. In fact, the com other items door-to-door without incurring unmanageable costs. pany consists of two grocery-delivery smartphone apps.
These companies use information technology, such as apps Customers place orders using Instacart’s website or mobile on GPS-enabled smartphones, to bypass the need for warehouses app. A separate app, used by more than 4,000 personal shoppers
10 CHAPTER 1 Introduction to Information Systems
Why Should I Study Information Systems? 5
Personal shoppers fill several orders at once as they go from store to store. The app suggests the optimal driving route to a cus tomer’s home, taking into account weather, traffic, sporting events, and local construction. Instacart charges a premium based on the size of each purchase. The company also offers a $99-per-year membership that waives the delivery fee for orders greater than
$35.
Postmates. Postmates ( https://postmates.com ) works like this: The company’s 13,000 couriers receive orders on their smart- phones. For example, a customer wants 18 pounds of crushed ice, and Postmates offers the courier $4.80 to pick up the ice and deliver it. When the courier accepts the job, his phone guides him to the grocery store and then to the customer.
The majority of deliveries made by Postmates are hot meals. The company analyzes data such as food-preparation times to be come more effective at stacking—as their couriers drop off one or der, their next pickup is already assigned and being prepared.
Although roughly 80 percent of Postmates’ orders are pre pared food, the company is expanding to deliver other commodi ties; for example, healthcare and beauty products. Postmates has also reached a deal with Apple to deliver MacBooks and other prod ucts the same day that customers purchase them online.
Uber. In 2015, Uber ( www.uber.com ) launched an option on its app, called UberEats, in New York and Chicago. UberEats delivers meals from local restaurants, with the “menu” items changing daily. UberEats is displayed on the Uber app only when a user is in an area that is covered.
GrubHub/Seamless. GrubHub/Seamless ( www.grubhub.com ) is a top online ordering provider, partnering with more than 45,000 restaurants. The app allows customers to flip through menus, place orders, and pay for delivery through the web or a mobile app. In 2015, the company bought out competitors Restaurants on the Run and DiningIn. These acquisitions enable GrubHub/Seamless to own the “last mile” of the supply chain and become a one-stop shop for food, from ordering to delivery.
Ola Cabs. Ola Cabs (Ola; https://www.olacabs.com ) provides different types of cab service in India. Customers can reserve a cab through a web browser or a mobile app. The company commands about 60 percent of the market share in India. In 2015, Ola launched a grocery delivery service, Ola Store, that offers customers a choice of 12,000 items in 13 categories, everything from fruits and vegeta bles to baby items.
These companies do experience challenges. To begin with, the workforce that is essential to this business model may present a problem. That is, their labor costs will probably rise. Also, several on-demand companies are being sued for classifying their couriers as independent contractors rather than as employees to avoid pro viding them with benefits packages. In June 2015, California’s labor commissioner ruled that a driver for Uber should be classified as a company employee.
Another challenge is that convenience can be expensive be cause delivery charges can vary greatly. For example, Instacart of fers flat rates, whereas Postmates’ fees depend on the distance of the delivery. Besides delivery costs, Instacart charges a premium
for items from some of the stores it delivers from. Another down side is that shoppers may miss out on using coupons or browsing for cheaper alternatives in the store. Also, the orders do not always go according to plan. For example, if an item is sold out, then the delivery person has to call the customer for instructions on what to do.
Perhaps the most serious challenge in the delivery market is competition from many large, established companies that offer de livery services. Consider these examples:
· Amazon ( www.amazon.com ) was looking into crowdsourc ing (see Chapter 6) to use a mobile app to hook up individuals to deliver packages and existing brick-and-mortar stores to warehouse them.
· Walmart, which gets half of its sales from groceries, is explor ing the online food business ( http://grocery.walmart.com ). Customers order online and Walmart employees select and bag the products. When customers arrive at the store, em ployees load the groceries into the customers’ cars.
· Safeway grocery stores ( https://shop.safeway.com ) offers its “fresh to your door” delivery service.
· Starbucks (www.starbucks.com ) offers a delivery service.
With the intense competition in the delivery services market, it is too early to predict any results. However, the companies dis cussed in this case are receiving large amounts of venture capital funding.
Sources: Compiled from B. Solomon, “Why GrubHub Is Building What Its CEO Calls ‘A S***** Business,’” Forbes, April 20, 2016; J. Russell, “India’s Ola Takes a Leaf Out of Uber’s Book with New Grocery-Delivery Service,” TechCrunch, July 21, 2015; L. Rao, “Instacart Is Asking Its Customers to Do Something New,” Fortune, June 26, 2015; K. Kokalitcheva, “Why On- Demand Delivery Startup Postmates Really Raised $80 Million,” Fortune, June 25, 2015; M. Kosoff, “$2 Billion Grocery Delivery Startup Instacart Is Reclassifying Some of Its Workers as Employees,” Business Insider, June 22, 2015; G. Bensinger, “Amazon’s Next Delivery Drone: You,” Wall Street
Journal, June 16, 2015; A. Connolly, “Amazon Considers Copying Postmates with New Crowdsourced Delivery Service,” The Next Web, June 16, 2015;
L. Heller, “Amazon’s Uber-Like Delivery Service Could Be Coming Soon,” Forbes, June 16, 2015; P. Vasan, “Tech Giants Serving Up Real Compe tition for FreshDirect,” CNBC, June 12, 2015; J. Pinsker, “What Does the
On-Demand Workforce Look Like?” The Atlantic, May 20, 2015; L. Jennings, “New Services Disrupt Restaurant Delivery Landscape,” Nation’s Restaurant News, May 18, 2015; K. Taylor, “We Tested Chipotle and McDonald’s New Delivery Services. Here’s What Happened,” Entrepreneur, May 6, 2015;
R. Paley, “Watch Out Seamless: New Delivery Services Are Invading Your Turf,” Yahoo!, May 1, 2015; A. Stevenson, “Death to Amazon? Postmates’ Boost to Small Business,” CNBC, April 29, 2015; P. Sawers, “Uber Launches a Curated Meal-Delivery Service in New York and Chicago,” Venture Beat, April 28, 2015; K. Steinmetz, “Go Fetch,” Time, March 16, 2015; B. Solomon, “America’s Most Promising Company: Instacart, the $2 Billion Grocery App,” Forbes, January 21, 2015; D. Matthews, “Watch Out, Seamless and Grub Hub—Amazon Is Coming for You,” Fast Company, December 3, 2014.
Questions
1. Describe the information technology used and developed by the entrepreneurs who founded Instacart, Postmates, GrubHub/Seamless, Uber, and Ola Cabs. What is the impact of these technologies on the costs of starting a business?
2. What are the advantages and disadvantages of being an in dependent contractor for a company?
3. Would you consider a job as a courier for one of these com panies? Why or why not?
Why Should I Study Information Systems?
1.1
You are part of the most connected generation in history: You have grown up online; you are, quite literally, never out of touch; you use more information technologies (in the form of digital devices), for more tasks, and are bombarded with more information, than any generation in history. The MIT Technology Review refers to you as Homo conexus. Information technologies are so deeply embedded in your lives that your daily routines would be almost unrecognizable to a college student just 20 years ago.
Essentially, you practice continuous computing, surrounded by a movable information network. This network is created by constant cooperation between the digital devices you carry (for example, laptops, tablets, and smartphones); the wired and wireless networks that you access as you move about; and web-based tools for finding information and communicating and collaborating with other people. Your network enables you to pull information about vir tually anything from anywhere, at any time, and to push your own ideas back to the web, from wherever you are, through a mobile device. Think of everything you do online, often with your smartphone: register for classes; take classes (and not just at your university); access class syl labi, information, PowerPoints, and lectures; research class papers and presentations; conduct banking; pay your bills; research, shop, and buy products from companies and other people; sell your “stuff”; search for, and apply for, jobs; make your travel reservations (hotel, airline, rental car); create your own blog and post your own podcasts and videocasts to it; design your own page on Facebook and LinkedIn; make and upload videos to YouTube; take, edit, and print your own digital photographs; stream music and movies to your personal libraries; use RSS feeds to create your personal electronic newspaper; text and tweet your friends and family throughout your day; send Snaps; and many other activities. (Note: If any of these terms are unfamiliar to you, don’t worry. You will learn about everything mentioned here in detail later in this text.)
The Informed User—You!
So, the question is: Why you should learn about information systems and information technol ogies? After all, you can comfortably use a computer (or other electronic devices) to perform many activities, you have been surfing the web for years, and you feel confident that you can manage any IT application that your organization’s MIS department installs.
The answer lies in you becoming an informed user; that is, a person knowledgeable about information systems and information technology. There are several reasons why you should become an informed user.
MIS
In general, informed users tend to get more value from whatever technologies they use. You will enjoy many benefits from being an informed user of IT, including:
· You will benefit more from your organization’s IT applications because you will under stand what is “behind” those applications (see Figure 1.1); that is, what you see on your computer screen is brought to you by your MIS department, who is operating behind your screen.
· You will be in a position to enhance the quality of your organization’s IT applications with your input.
· Even as a new graduate, you will quickly be in a position to recommend—and perhaps help select—the IT applications that your organization will use.
· Being an informed user will keep you abreast of both new information technologies and rapid developments in existing technologies. Remaining on top of things will help you to anticipate the impacts that new and improved technologies will have on your organization and to make recommendations on the adoption and use of these technologies.
FIGURE 1.1 MIS provides what users see and use on their computers.
· You will understand how using IT can improve your organization’s performance and team work as well as your own productivity.
@ Slaomir Fajer/iStockphoto
· If you have ideas of becoming an entrepreneur, then being an informed user will help you use IT when you start your own business.
Going further, managing the IS function within an organization is no longer the exclusive responsibility of the IS department. Rather, users now play key roles in every step of this pro cess. The overall objective in this text is to provide you with the necessary information to con tribute immediately to managing the IS function in your organization. In short, the goal is to help you become a very informed user!
IT Offers Career Opportunities
Because IT is vital to the operation of modern businesses, it offers many employment opportunities. The demand for traditional IT staff—programmers, business analysts, systems analysts, and designers—is substantial. In addition, many well-paid jobs exist in areas such as the Internet and electronic commerce (e-commerce), mobile commerce (m-commerce), net work security, telecommunications, and multimedia design.
MIS
The IS field includes the people in various organizations who design and build information systems, the people who use those systems, and the people responsible for managing those systems. At the top of the list is the chief information officer (CIO).
The CIO is the executive who is in charge of the IS function. In most modern organizations, the CIO works with the chief executive officer (CEO), the chief financial officer (CFO), and other senior executives. Therefore, he or she actively participates in the organization’s strategic plan ning process. In today’s digital environment, the IS function has become increasingly strategic within organizations. As a result, although most CIOs still rise from the IS department, a grow ing number are coming up through the ranks in the business units (e.g., marketing or finance). Regardless of your major, you could become the CIO of your organization one day. This is an other reason to be an informed user of information systems!
Table 1.1 provides a list of IT jobs, along with a description of each one. For further details about careers in IT, see www.computerworld.com/careertopics/careers and www.monster.com .
Career opportunities in IS are strong and are projected to remain strong over the next 10 years. In fact, the U.S. News & World Report listed its “100 best jobs of 2016,” Money listed its “best jobs in America for 2016,” and Forbes listed its “10 best jobs” for 2016. Let’s take a look at these rankings. (Note that the rankings differ because the magazines used different criteria in their research.) As you can see, jobs suited for MIS majors rank extremely high in all three lists. The magazines with their job rankings are as follows:
U.S. News & World Report (out of 100)
3: Computer systems analyst 13: Software developer
20: Web developer
29: IT manager
Money
1: Software engineer
7: IT Analyst
Forbes (out of 10)
3: Information security analyst 7: Software engineer
8: Computer systems analyst
Managing Information Resources
Managing information systems in modern organizations is a difficult and complex task. Several factors contribute to this complexity. First, information systems have enormous strategic value to organizations. Firms rely on them so heavily that, in some cases, when these systems are not working (even for a short time), the firm cannot function. (This situation is called “being hostage to information systems”). Second, information systems are very expensive to acquire, operate, and maintain.
A third factor contributing to the difficulty in managing information systems is the evo lution of the management information systems (MIS) function within the organization. When businesses first began to use computers in the early 1950s, the MIS department “owned” the only computing resource in the organization, the mainframe. At that time, end users did not interact directly with the mainframe.
In contrast, in the modern organization, computers are located in all departments, and al most all employees use computers in their work. This situation, known as end user computing, has led to a partnership between the MIS department and the end users. The MIS department now acts more as of a consultant to end users, viewing them as customers. In fact, the main function of the MIS department is to use IT to solve end users’ business problems.
MIS
As a result of these developments, the responsibility for managing information resources is now divided between the MIS department and the end users. This arrangement raises several important questions: Which resources are managed by whom? What is the role of the MIS department, its structure, and its place within the organization? What is the appropriate relationship between the MIS department and the end users? Regardless of who is doing what, it is essential that the MIS department and the end users work in close cooperation.
There is no standard way to divide responsibility for developing and maintaining informa tion resources between the MIS department and the end users. Instead, that division depends on several factors: the size and nature of the organization, the amount and type of IT resources, the organization’s attitudes toward computing, the attitudes of top management toward com puting, the maturity level of the technology, the amount and nature of outsourced IT work, and even the countries in which the company operates. Generally speaking, the MIS department is responsible for corporate-level and shared resources, and the end users are responsible for departmental resources. Table 1.2 identifies both the traditional functions and various new, consultative functions of the MIS department.
So, where do the end users come in? Take a close look at Table 1.2. Under the traditional MIS functions, you will see two functions for which you provide vital input: managing systems development and infrastructure planning. Under the consultative MIS functions, in contrast, you exercise the primary responsibility for each function, while the MIS department acts as your advisor.
Before you go on. . .
1. Rate yourself as an informed user. (Be honest; this isn’t a test!)
2. Explain the benefits of being an informed user of information systems.
3. Discuss the various career opportunities offered in the IT field.
The Changing Role of the Information Systems Department
TABLE 1.2
Overview of Computer-Based Information Systems
1.2
Organizations refer to their management information systems functional area by several names, including the MIS Department, the Information Systems (IS) Department, the Infor mation Technology (IT) Department, and the Information Services Department. Regardless of the name, however, this functional area deals with the planning for—and the development,
10 CHAPTER 1 Introduction to Information Systems
Overview of Computer-Based Information Systems 11
FIGURE 1.2 Data, Information, and Knowledge
management, and use of—information technology tools to help people perform all the tasks related to information processing and management. Recall that information technology re lates to any computer-based tool that people use to work with information and to support the information and information-processing needs of an organization.
As previously stated, an information system collects, processes, stores, analyzes, and disseminates information for a specific purpose. The purpose of information systems has been defined as getting the right information to the right people at the right time in the right amount and in the right format. Because information systems are intended to supply useful informa tion, we need to differentiate between information and two closely related terms: data and knowledge (see Figure 1.2).
Data items refer to an elementary description of things, events, activities, and transac tions that are recorded, classified, and stored but are not organized to convey any specific meaning. Data items can be numbers, letters, figures, sounds, and images. Examples of data items are collections of numbers (e.g., 3.11, 2.96, 3.95, 1.99, 2.08) and characters (e.g., B, A, C, A, B, D, F, C).
Information refers to data that have been organized so that they have meaning and value to the recipient. For example, a grade point average (GPA) by itself is data, but a student’s name coupled with his or her GPA is information. The recipient interprets the meaning and draws conclusions and implications from the information. Consider the examples of data provided in the preceding paragraph. Within the context of a university, the numbers could be grade point averages, and the letters could be grades in an Introduction to MIS class.
Knowledge consists of data and/or information that have been organized and processed to convey understanding, experience, accumulated learning, and expertise as they apply to a current business problem. For example, suppose that a company recruiting at your school has found over time that students with grade point averages over 3.0 have experienced the greatest success in its management program. Based on this accumulated knowledge, that company may decide to interview only those students with GPAs over 3.0. This example pre sents an example of knowledge because the company uses information—GPAs—to address a
business problem—hiring successful employees. As you can see from this example, organiza tional knowledge, which reflects the experience and expertise of many people, has great value to all employees.
Consider this example:
|
Data Information |
Knowledge |
|
[No context] [University context] |
|
|
3.16 3.16 + John Jones = GPA |
· Job prospects |
|
2.92 2.92 + Sue Smith = GPA |
· Graduate school prospects |
|
1.39 1.39 + Kyle Owens = GPA |
· Scholarship prospects |
|
3.95 3.95 + Tom Elias = GPA |
|
|
Data Information |
Knowledge |
|
[No context] [Professional baseball pitcher context] |
|
|
3.16 3.16 + Ken Rice = ERA |
|
|
2.92 2.92 + Ed Dyas = ERA |
· Keep pitcher, trade pitcher, or |
|
|
send pitcher to minor leagues |
|
1.39 1.39 + Hugh Carr = ERA |
· Salary/contract negotiations |
|
3.95 3.95 + Nick Ford = ERA |
|
GPA = Grade point average (higher is better).
ERA = Earned run average (lower is better); ERA is the number of runs per nine innings that a pitcher surrenders.
You see that the same data items, with no context, can mean entirely different things in different contexts.
Now that you have a clearer understanding of data, information, and knowledge, let’s shift our focus to computer-based information systems. As you have seen, these systems process data into information and knowledge that you can use.
A computer-based information system (CBIS) is an information system that uses com puter technology to perform some or all of its intended tasks. Although not all information systems are computerized today, most are. For this reason the term “information system” is typically used synonymously with “computer-based information system.” The basic compo nents of computer-based information systems are listed further on. The first four are called information technology components. Figure 1.3 illustrates how these four components in teract to form a CBIS.
· Hardware consists of devices such as the processor, monitor, keyboard, and printer. To gether, these devices accept, process, and display data and information.
· Software is a program or collection of programs that enable the hardware to process data.
· A database is a collection of related files or tables containing data.
· A network is a connecting system (wireline or wireless) that permits different computers to share resources.
· Procedures are the instructions for combining the preceding components to process in formation and generate the desired output.
· People use the hardware and software, interface with it, or use its output.
Figure 1.4 illustrates how these components are integrated to form the wide variety of information systems found within an organization. Starting at the bottom of the figure, you see that the IT components of hardware, software, networks (wireline and wireless), and databases form the information technology platform. IT personnel use these components to develop information systems, oversee security and risk, and manage data. These activities cumulatively are called information technology services. The IT components plus IT services comprise the
FIGURE 1.3 Computer-based information systems consist of hardware, software, databases networks, procedures, and people.
FIGURE 1.4 Information technology inside your organization.
organization’s information technology infrastructure. At the top of the pyramid are the var ious organizational information systems.
Computer-based information systems have many capabilities. Table 1.3 summarizes the most important ones.
Information systems perform these various tasks through a wide spectrum of applications. An application (or app) is a computer program designed to support a specific task or business process. (A synonymous term is application program.) Each functional area or department within a business organization uses dozens of application programs. For example, the hu man resources department sometimes uses one application for screening job applicants and
|
TABLE 1.3 |
Major Capabilities of Information Systems |
|
Perform high-speed, high-volume numerical computations. Provide fast, accurate communication and collaboration within and among organizations. Store huge amounts of information in an easy-to-access, yet small space. Allow quick and inexpensive access to vast amounts of information, worldwide. Analyze and interpret vast amounts of data quickly and efficiently. Automate both semiautomatic business processes and manual tasks. |
another for monitoring employee turnover. The collection of application programs in a single department is usually referred to as a departmental information system (also known as a functional area information system). For example, the collection of application programs in the human resources area is called the human resources information system (HRIS). There are collections of application programs—that is, departmental information systems—in the other functional areas as well, such as accounting, finance, marketing, and production/ operations.
The importance of information systems cannot be understated. In fact, a 2016 report from the Software Alliance shows that information systems added more than $1 trillion of value to the United States gross domestic product.
Types of Computer-Based Information Systems
Modern organizations employ many different types of information systems. Figure 1.4 illus trates the different types of information systems that function within a single organization, and Figure 1.5 shows the different types of information systems that function among multiple organizations. You will study transaction processing systems, management information sys tems, and enterprise resource planning systems in Chapter 10. You will learn about customer relationship management (CRM) systems in Chapter 11, and supply chain management (SCM) systems in Chapter 11.
FIGURE 1.5 Information systems that function among multiple organizations.
In the next section you will learn about the numerous and diverse types of information sys tems employed by modern organizations. You will also read about the types of support these systems provide.
Breadth of Support of Information Systems. Certain information systems support parts of organizations, others support entire organizations, and still others support groups of organizations. This section addresses all of these systems.
Recall that each department or functional area within an organization has its own col lection of application programs, or information systems. These functional area information systems (FAISs) are supporting pillars for the information systems located at the top of Fig ure 1.4, namely, business intelligence systems and dashboards. As the name suggests, each FAIS supports a particular functional area within the organization. Examples are accounting IS, finance IS, production/operations management (POM) IS, marketing IS, and human resources IS.
ACCT FIN
Consider these examples of IT systems in the various functional areas of an organization. In finance and accounting, managers use IT systems to forecast revenues and business activity, to determine the best sources and uses of funds, and to perform audits to ensure that the organization is fundamentally sound and that all financial reports and docu ments are accurate.
MKT
In sales and marketing, managers use information technology to perform the following functions:
· Product analysis: Developing new goods and services.
· Site analysis: Determining the best location for production and distribution facilities.
· Promotion analysis: Identifying the best advertising channels.
· Price analysis: Setting product prices to obtain the highest total revenues.
Marketing managers also use IT to manage their relationships with their customers. In manufacturing, managers use IT to process customer orders, develop production schedules, control inventory levels, and monitor product quality. They also use IT to design and manu facture products. These processes are called computer-assisted design (CAD) and computer- assisted manufacturing (CAM).
POM
HRM
Managers in human resources use IT to manage the recruiting process, analyze and screen job applicants, and hire new employees. They also employ IT to help employees manage their careers, to administer performance tests to employees, and to monitor employee productivity. Finally, they rely on IT to manage compensation and benefits packages.
Two information systems that support the entire organization, enterprise resource plan ning systems (ERPs) and transaction processing systems, are designed to correct a lack of communication among the functional area ISs. For this reason Figure 1.4 shows ERP systems spanning the FAISs. ERP systems were an important innovation because the various functional area ISs were often developed as standalone systems and did not communicate effectively (if at all) with one another. ERP systems resolve this problem by tightly integrating the functional area ISs through a common database. In doing so, they enhance communications among the functional areas of an organization. For this reason, experts credit ERP systems with greatly increasing organizational productivity.
A transaction processing system (TPS) supports the monitoring, collection, storage, and processing of data from the organization’s basic business transactions, each of which gen erates data. When you are checking out at Walmart, for example, a transaction occurs each time the cashier swipes an item across the bar code reader. Significantly, within an organiza tion, different functions or departments can define a transaction differently. In accounting, for example, a transaction is anything that changes a firm’s chart of accounts. The information system definition of a transaction is broader: A transaction is anything that changes the firm’s database. The chart of accounts is only part of the firm’s database. Consider a scenario in which a student transfers from one section of an Introduction to MIS course to another section. This move would be a transaction to the university’s information system, but not to the university’s accounting department (the tuition payment would not change).
The TPS collects data continuously, typically in real time—that is, as soon as the data are generated—and it provides the input data for the corporate databases. TPSs are considered critical to the success of any enterprise because they support core operations. Significantly, nearly all ERP systems are also TPSs, but not all TPSs are ERP systems. In fact, modern ERP sys tems incorporate many functions that previously were handled by the organization’s functional area information systems. You study both TPSs and ERP systems in detail in Chapter 10.
ERP systems and TPSs function primarily within a single organization. Information sys tems that connect two or more organizations are referred to as interorganizational informa tion systems (IOSs). IOSs support many interorganizational operations, of which supply chain management is the best known. An organization’s supply chain is the flow of materials, infor mation, money, and services from suppliers of raw materials through factories and warehouses to the end customers.
Note that the supply chain in Figure 1.5 shows physical flows, information flows, and fi nancial flows. Digitizable products are those that can be represented in electronic form, such as music and software. Information flows, financial flows, and digitizable products go through the Internet, whereas physical products are shipped. For example, when you order a computer from www.dell.com , your information goes to Dell through the Internet. When your transaction is completed (that is, your credit card is approved and your order is processed), Dell ships your computer to you. (We discuss supply chains in more detail in Chapter 11.)
Electronic commerce (e-commerce) systems are another type of interorganizational information system. These systems enable organizations to conduct transactions, called busi ness-to-business (B2B) electronic commerce, and customers to conduct transactions with businesses, called business-to-consumer (B2C) electronic commerce. Figure 1.5 illustrates B2B and B2C electronic commerce. Electronic commerce systems are so important that we discuss them in detail in Chapter 7, with additional examples interspersed throughout the text. IT’s About Business 1.2 shows how information systems have enabled two roadside assistance companies to grow rapidly through e-commerce.
Support for Organizational Employees. So far, you have concentrated on infor mation systems that support specific functional areas and operations. Now you will learn about information systems that typically support particular employees within the organization.
Clerical workers, who support managers at all levels of the organization, include book keepers, secretaries, electronic file clerks, and insurance claim processors. Lower-level man agers handle the day-to-day operations of the organization, making routine decisions such as assigning tasks to employees and placing purchase orders. Middle managers make tactical decisions, which deal with activities such as short-term planning, organizing, and control.
Knowledge workers are professional employees such as financial and marketing ana lysts, engineers, lawyers, and accountants. All knowledge workers are experts in a particular subject area. They create information and knowledge, which they integrate into the business. Knowledge workers, in turn, act as advisors to middle managers and executives. Finally, ex ecutives make decisions that deal with situations that can significantly change the manner in which business is done. Examples of executive decisions are introducing a new product line, acquiring other businesses, and relocating operations to a foreign country.
Functional area information systems summarize data and prepare reports, primarily for middle managers, but sometimes for lower-level managers as well. Because these reports typically concern a specific functional area, report generators (RPGs) are an important type of functional area IS.
Business intelligence (BI) systems (also known as business analytics systems) pro vide computer-based support for complex, nonroutine decisions, primarily for middle manag ers and knowledge workers. (They also support lower-level managers, but to a lesser extent.) These systems are typically used with a data warehouse, and they enable users to perform their own data analysis. You learn about BI systems in Chapter 12.
Expert systems (ES) attempt to duplicate the work of human experts by applying reason ing capabilities, knowledge, and expertise within a specific domain. They have become valu able in many application areas, primarily, but not exclusively, areas involving decision making.
IT’s About Business 1.2
Disrupting the Roadside Assistance Industry
POM
The roadside assistance industry is worth $10 billion a year in the United States, encompassing a range of services including acci dents, dead batteries, flat tires, towing services, tire services, fuel services, and locksmith services. Today, the industry faces disrup tion from technology companies that are replacing call centers with algorithms that dispatch the nearest vehicle to help a driver who is locked out of his car or to winch a car out of a ditch. These companies provide an on-demand alternative to paying for insur ance plans that drivers might not use or to having to call a tow com pany without knowing how much it charges.
Two of these companies, Urgent.ly ( http://urgent.ly ) and Honk (www.honkforhelp.com ), offer flat rates, promise quick response times, and provide maps in their apps that display the location of the company vehicle, with real-time updates. The com panies do not charge annual membership fees, unlike the American Automobile Association (AAA; www.aaa.com ).
Customers are not restricted to particular tow-truck opera tors. The companies call the closest service vehicle to the customer, which can arrive in less than half the time and cost up to half the amounts charged by industry competitors. It costs $49 to get basic roadside help. Before users click for service, they are informed in advance of the total fee, which they pay by credit card.
These app-based roadside assistance services also bene fit tow-truck drivers, most of whom work as independents or for small operators. The traditional towing industry relies on receiving bookings from a central dispatcher, such as the AAA. Those drivers get an average of $23 per call, even though customers are typically charged $200. Drivers for Urgent.ly and Honk earn nearly double the traditional fee, mostly because these services don’t use call centers. These drivers can also attend to more calls in a day be cause the apps use algorithms for dispatching and the drivers have GPS on their smartphones.
Drivers for Urgent.ly and Honk work as contractors, not em ployees, using the apps to find customers. The services use only recognized towing companies, which must have their own business licenses and insurance, so that they are covered in the event of ac cidents or other mishaps. The drivers must also add Urgent.ly and Honk to their insurance policies and get extra insurance for general liability. The apps check out towing companies’ customer reviews before signing them on to the services.
Urgent.ly and Honk face intense competition from both the AAA and car manufacturers that offer roadside assistance. Well- known examples are General Motors’ OnStar ( www.onstar.com ),
BMW, Volvo, Lexus, Acura, Mazda, Audi, and Ferrari. The AAA, a nonprofit organization, is a federation of 43 motor clubs dispersed throughout the United States. The organization responds to more than 30 million calls per year. Members typically receive travel discounts or other membership perks. In addition, the AAA offers members four free annual tows.
Each AAA motor club can customize its offerings. For example, in late 2014, the Mid-Atlantic club launched RescueMeNow ( www
.rescuemenow.co ), a web-based on-demand service for nonmem bers, which comes with a follow-up contract enticing users to join the organization.
The AAA does not disclose how much its towing-service con tractors are paid. However, tow-truck operators state that the amount is about $25 per call. One towing-service company owner claimed he makes about $75 if the same call comes through his Ur gent.ly app. Like Uber, both startups take about 25 percent of the total cost, and the driver keeps the rest.
How intense is the competition between the established orga nizations and the disrupters? Honk maintains that it has received a number of call-and-cancel orders that it traced to AAA employees. An AAA spokesperson acknowledged that the organization does “mys tery shop” to determine how the comparable services compare.
Sources: Compiled from D. Kunz, “New App Honk Offers Easy Roadside Assistance,” ABC News, March 8, 2016; A. Goodwin, “Urgent.ly Is Like Uber for Roadside Assistance,” CNET, June 11, 2015; J. Biggs, “Urgent.ly Is Uber for When Your Ride Breaks Down,” TechCrunch, February 14, 2015; H. Keiling, “Honk for Help: The Roadside Assistance Startup,” Insurance Zebra, February 12, 2015; R. Rudnansky, “Roadside Assistance Apps Challenging AAA,” Travel Pulse, December 11, 2014; K. Owram, “Watch Out, CAA: New Roadside Assistance Apps Seeking to ‘Revolutionize’ Towing Industry,” Financial Post, December 9, 2014; C. Elliott, “Have Roadside Assistance Apps Replaced AAA?” Outside, December 4, 2014; K. Steinmetz, “There’s an App for the Next Time Your Car Breaks Down,” Time, December 1, 2014; M. Carney, “Forget AAA: Honk Is a Nationwide On-Demand Towing Platform Fueled by Technology,” Pando, November 19, 2014; R. Gray, “Honk Is a New App that Offers Help on the Highway,” Fox News Travel, November 19, 2014; http://urgent.ly, www.honkforhelp.com, accessed September 21, 2016.
Questions
1. Discuss how information technology enables the business models of the Urgent.ly and Honk apps.
2. Describe the advantages and disadvantages of Urgent.ly and Honk for customers and for tow-truck operators.
3. Would you use Urgent.ly or Honk? Why or why not?
4. If you were the CEO of AAA, how would you compete with Urgent.ly and Honk? Provide specific examples in your answer.
For example, navigation systems use rules to select routes, but we do not typically think of these systems as expert systems. Significantly, expert systems can operate as standalone sys tems or be embedded in other applications. We examine ESs in greater detail in Technology Guide 4.
Dashboards (also called digital dashboards) are a special form of IS that support all managers of the organization. They provide rapid access to timely information and direct ac cess to structured information in the form of reports. Dashboards that are tailored to the infor mation needs of executives are called executive dashboards. Chapter 12 provides a thorough discussion of dashboards.
Types of Organizational Information Systems
|
Type of System |
Function |
Example |
|
Transaction processing system |
Processes transaction data from terminal |
Walmart checkout point-of sale business events |
|
Enterprise resource planning |
Integrates all functional areas of the organization. |
Oracle, SAP system Microsoft Office |
|
Functional area IS |
Supports the activities within specific functional area. |
System for processing payroll |
|
Decision support system |
Provides access to data and analysis tools. |
“What-if” analysis of changes in budget |
|
Expert system |
Mimics human expert in a particular area and makes decisions. |
Credit card approval analysis |
|
Executive dashboard |
Presents structured, summarized information about aspects of business important to executives. |
Status of sales by product |
|
Supply chain management system |
Manages flows of products, services, and information among organizations. |
Walmart Retail Link system connecting suppliers to Walmart |
|
Electronic commerce system |
Enables transactions among organizations and between organizations and customers. |
Table 1.4 provides an overview of the different types of information systems used by organizations.
1. What is a computer-based information system?
2. Describe the components of computer-based information systems.
3. What is an application program?
4. Explain how information systems provide support for knowledge workers.
5. As we move up the organization’s hierarchy from clerical workers to executives, how does the type of support provided by information systems change?
How Does IT Impact Organizations?
1.3
Throughout this text you will encounter numerous examples of how IT affects various types of organizations, which will give you an idea just how important IT actually is to organizations. In fact, for the vast majority of organizations, if their information systems fail, they cease opera tions until the problems are found and fixed. In Chapter 2, IT’s About Business 2.4 illustrates how costly and disruptive IT failures can be.
This section provides an overview of the impact of IT on modern organizations. As you read this section you will learn how IT will affect you as well.
IT Impacts Entire Industries
As of mid-2016, the technology required to transform industries through software had been developed and integrated and could be delivered globally. Software tools and Internet-based
18 CHAPTER 1 Introduction to Information Systems
How Does IT Impact Organizations? 17
services also enabled companies in many industries to launch new software-powered start ups without investing in new infrastructure or training new employees. For example, in 2000, operating a basic Internet application cost businesses approximately $150,000 per month. In mid-2016, operating that same application in Amazon’s cloud (we discuss cloud computing in detail in Technology Guide 3) cost less than $1,000 per month.
In essence, software is impacting every industry, and every organization must prepare for these impacts. Let’s examine a few examples of software disruption across several industries. Many of these examples focus on two scenarios: (1) industries in which software disrupted the previous market-leading companies and (2) industries in which a new company (or companies) used software to achieve a competitive advantage.
The Book Industry. What is the largest book publisher and bookseller in the United States today? Would it surprise you to learn that the answer is Amazon, a software company? Amazon’s core capability is its software engine, which can sell virtually anything online with out building or maintaining any retail stores. Now, even books themselves have become soft ware products, known as electronic (or digital) books, or e-books. (In the fall of 2016, electronic books were gaining in popularity, but approximately 80 percent of book sales were still for print books. Interestingly, according to a 2016 study, 92 percent of American college students prefer a print book to an electronic version of it.)
Consider the Borders bookstore chain. In 2001, Borders agreed to hand over its online business to Amazon because Borders was convinced that online book sales were nonstrategic and unimportant. Ten years later, Borders filed for bankruptcy.
The Music Industry. Total U.S. album sales peaked at 785 million units in 2000, which was the year after Napster was created. (Recall that Napster allowed anyone with a computer and a reasonably fast web connection to download and trade music for free.) From 2000 to 2016, the major music labels (companies) worked diligently to eliminate illegal downloading and sharing, but album sales continued to decline. The result was that the music labels earned about $8 billion less in annual retail sales in 2016 than they did in 2000. Also, before 1999 six major music labels dominated the industry. By 2015, a series of mergers had created the “Big Three” music labels: Warner Music Group ( www.wmg.com ), Universal Music ( www.universalmusic
.com ), and Sony ( www.sonymusic.com ).
These large changes in the music industry were due to the emergence of digital music streaming technologies over the Internet. Two digital-streaming business models emerged: In ternet radio companies such as Pandora ( www.pandora.com ) that allow subscribers to passively listen to music that is customized for their tastes, and interactive companies such as Spotify ( www.spotify.com ) and Apple’s iTunes ( www.apple.com/itunes ) that allow users to pick songs. Internet radio companies can operate under a government-mandated license that dictates how much they have to pay. In contrast, interactive companies must make deals with labels and music publishers in order to license music for legal use in the United States.
Responding to these disruptions, the Big Three music labels have been buying stakes in digital entertainment startups, such as established streaming services Spotify ( www.spotify
.com ) and Rdio ( www.rdio.com ). The labels buy stakes very cheaply, and then often give them selves the right to buy larger amounts at deep discounts to market at a later date. The labels have purchased parts of startups such as choose-your-own-adventure music video seller Eko ( https://helloeko.com ), song-recognition company Shazam ( www.shazam.com ), and Sound- Cloud ( https://soundcloud.com ). Industry analysts estimate that the three labels have amassed positions in digital music startups valued at some $3 billion.
The Video Industry. Blockbuster—which rented and sold videos and ancillary prod ucts through its chain of stores—was the industry leader until it was disrupted by a software company, Netflix ( www.netflix.com ). In mid-2016, Netflix had the largest subscriber base of any video service with millions of subscribers. Meanwhile, Blockbuster declared bankruptcy in Feb ruary 2011 and was acquired by satellite television provider Dish Network ( www.dish.com ) a month later.
The Software Industry. Incumbent software companies such as Oracle and Microsoft are increasingly threatened by software-as-a-service (SaaS) products (e.g., Salesforce.com) and Android, an open-source operating system developed by the Open Hand set Alliance ( www.openhandsetalliance.com ). (We discuss operating systems in Technology Guide 2 and SaaS in Technology Guide 3.)
MIS
The Videogame Industry. Today, the fastest-growing entertainment companies are videogame makers—again, software. Examples are: Zynga ( www.zynga.com ), the creator of FarmVille; Rovio ( www.rovio.com ), the maker of Angry Birds; and Minecraft ( www.minecraft.net ), now owned by Microsoft (www.microsoft.com).
The Marketing Industry. Today’s largest direct marketing companies in clude Facebook ( www.facebook.com ), Google ( www.google.com ), and Foursquare ( www
MKT
.foursquare.com ). All of these companies are using software to disrupt the retail marketing industry.
The Recruiting Industry. LinkedIn ( www.linkedin.com ) is disrupting the tra ditional job recruiting industry. For the first time, employees and job searchers can maintain their resumes on a publicly accessible website that interested parties can search in real time.
HRM
The Financial Services Industry. Software has transformed the finan cial services industry. Practically every financial transaction (for example, buying and selling stocks) is now performed by software. Also, many of the leading innovators in financial services are software companies. For example, Square ( https://squareup.com ) allows anyone to accept credit card payments with a mobile phone.
FIN
The Motion Picture Industry. The process of making feature-length computer- generated films has become incredibly IT intensive. Studios require state-of-the-art infor mation technologies, including massive numbers of servers, sophisticated software, and an enormous amount of storage (all described in Technology Guide 1).
Consider DreamWorks Animation ( www.dreamworksanimation.com ), a motion picture stu dio that creates animated feature films, television programs, and online virtual worlds. For a single motion picture, the studio manages more than 500,000 files and 300 terabytes (a tera byte is 1 trillion bytes) of data, and it uses about 80 million central processing unit (CPU; de scribed in Technology Guide 1) hours. As DreamWorks executives state, “In reality, our product is data that looks like a movie. We are a digital manufacturing company.”
Software is also disrupting industries that operate primarily in the physical world. Con sider these examples:
· The Automobile Industry: In modern cars, software is responsible for running the engines; controlling safety features; entertaining passengers; guiding drivers to their destinations; and connecting the car to mobile, satellite, and GPS networks. Other software functions in modern cars include Wi-Fi receivers, which turn your car into a mobile hot spot; software, which helps maximize fuel efficiency; and ultrasonic sensors, which enable some models to parallel park automatically.
The next step is to network all vehicles together, a necessary step toward the next ma jor breakthrough: self-driving, or driverless cars. The creation of software-powered driver less cars is already being undertaken at Google as well as at several major car companies, and interestingly, Apple.
· The Agriculture Industry: Agriculture is increasingly powered by software, including satel lite analysis of soils linked to per-acre seed selection software algorithms. Precision agri culture also makes use of automated, driverless tractors controlled by global positioning systems and software. (Precision agriculture is based on observing, measuring, and re sponding to inter- and intra-field variability.)
· The Fashion Industry: Women have long “borrowed” special-occasion dresses from depart ment stores, buying them and then returning them after wearing them for one evening. Now, Rent the Runway ( www.renttherunway.com ) has redefined the fashion business, mak ing expensive clothing available to more women than ever before. The firm is also disrupt ing traditional physical retailers. After all, why buy a dress when you can rent one for a very low price? Some department stores feel so threatened by Rent the Runway that they have reportedly told vendors that they will remove floor merchandise if it ever shows up on that company’s website (see Chapter 12 opening case).
· Education: College graduates owe approximately $1.3 trillion in student debt, a crippling burden for many recent graduates. Consider UniversityNow ( www.unow.com ), founded to make college more accessible to working adults by offering online, self-paced degrees. Two key characteristics distinguish UniversityNow from an increasing number of rivals: (1) very low fees (as little as $2,600, which includes tuition and books for as many courses as students can complete in one year) and (2) fully accredited degrees, from an associate’s degree to an M.B.A.
· The Legal Profession: Today, electronic discovery (e-discovery) software applications can analyze documents in a fraction of the time that human lawyers would take, at a fraction of the cost. For example, Blackstone Discovery ( www.blackstonediscovery.com ) helped one company analyze 1.5 million documents for less than $100,000. That company estimated that the process would have cost $1.5 million had it been performed by lawyers.
Law firms are now beginning to use a new artificial intelligence software package called ROSS ( www.rossintelligence.com ). For example, law firm BakerHostetler has hired ROSS to serve as a legal researcher in bankruptcy cases.
IT Reduces the Number of Middle Managers
IT makes managers more productive, and it increases the number of employees who can report to a single manager. Thus, IT ultimately decreases the number of managers and experts. It is reasonable to assume, therefore, that in coming years organizations will have fewer manage rial levels and fewer staff and line managers. If this trend materializes, promotional opportuni ties will decrease, making promotions much more competitive. Bottom line: Pay attention in school!
IT Changes the Manager’s Job
One of the most important tasks of managers is making decisions. A major consequence of IT has been to change the manner in which managers make their decisions. In this way, IT ulti mately has changed managers’ jobs.
IT often provides managers with near-real-time information, meaning that managers have less time to make decisions, making their jobs even more stressful. Fortunately, IT also pro vides many tools—for example, business analytics applications such as dashboards, search engines, and intranets—to help managers handle the volumes of information they must deal with on an ongoing basis.
So far in this section, we have been focusing on managers in general. Now, let’s focus on you. Because of advances in IT, you will increasingly supervise employees and teams who are geographically dispersed. Employees can work from anywhere at any time, and teams can con sist of employees who are literally dispersed throughout the world. Information technologies such as telepresence systems (discussed in Chapter 6) can help you manage these employ ees even though you do not often see them face to face. For these employees, electronic or “remote” supervision will become the norm. Remote supervision places greater emphasis on completed work and less emphasis on personal contacts and office politics. You will have to re assure your employees that they are valued members of the organization, thereby diminishing any feelings they might have of being isolated and out of the loop.
Will IT Eliminate Jobs?
One major concern of every employee, part-time or full-time, is job security. Relentless cost-cutting measures in modern organizations often lead to large-scale layoffs. Put simply, or ganizations are responding to today’s highly competitive environment by doing more with less. Regardless of your position, then, you consistently will have to add value to your organization and to make certain that your superiors are aware of this value.
Many companies have responded to difficult economic times, increased global competi tion, demands for customization, and increased consumer sophistication by increasing their investments in IT. In fact, as computers continue to advance in terms of intelligence and capa bilities, the competitive advantage of replacing people with machines is increasing rapidly. This process frequently leads to layoffs. At the same time, however, IT creates entirely new catego ries of jobs, such as electronic medical record keeping and nanotechnology.
IT Impacts Employees at Work
Many people have experienced a loss of identity because of computerization. They feel like “just another number” because computers reduce or eliminate the human element present in noncomputerized systems.
The Internet threatens to exert an even more isolating influence than have computers and television. Encouraging people to work and shop from their living rooms could produce some unfortunate psychological effects, such as depression and loneliness.
IT Impacts Employees’ Health and Safety. Although computers and information systems are generally regarded as agents of progress, they can adversely affect individuals’ health and safety. To illustrate this point, we consider two issues associated with IT: job stress and long-term use of the keyboard.
HRM
An increase in an employee’s workload and responsibilities can trigger job stress. Although computerization has benefited organizations by increasing productivity, it also has created an ever-expanding workload for some employees. Some workers feel overwhelmed and have be come increasingly anxious about their job performance. These feelings of stress and anxiety can actually diminish rather than improve workers’ productivity while jeopardizing their phys ical and mental health. Management can help alleviate these problems by providing training, redistributing the workload among workers, and hiring more workers.
On a more specific level, the long-term use of keyboards can lead to repetitive strain inju ries such as backaches and muscle tension in the wrists and fingers. Carpal tunnel syndrome is a particularly painful form of repetitive strain injury that affects the wrists and hands.
Designers are aware of the potential problems associated with the prolonged use of com puters. To address these problems, they continually attempt to design a better computing envi ronment. The science of designing machines and work settings that minimize injury and illness is called ergonomics. The goal of ergonomics is to create an environment that is safe, well lit, and comfortable. Examples of ergonomically designed products are antiglare screens that al leviate problems of fatigued or damaged eyesight and chairs that contour the human body to decrease backaches. Figure 1.6 displays some sample ergonomic products.
IT Provides Opportunities for People with Disabilities. Computers can create new employment opportunities for people with disabilities by integrating speech- recognition and vision-recognition capabilities. For example, individuals who cannot type can use a voice-operated keyboard, and individuals who cannot travel can work at home.
Going further, adaptive equipment for computers enables people with disabilities to per form tasks they normally would not be able to do. For example, the web and graphical user interfaces (GUIs; for example, Windows) can be difficult for people with impaired vision to use. To address this problem, manufacturers have added audible screen tips and voice interfaces, which essentially restore the functionality of computers to the way it was before GUIs became standard.
FIGURE 1.6 Ergonomic products protect computer users.
Other devices help improve the quality of life in more mundane but useful ways for peo ple with disabilities. Examples are a two-way writing telephone, a robotic page turner, a hair brusher, and a hospital-bedside video trip to the zoo or the museum. Several organizations specialize in IT designed for people with disabilities.
Before you go on. . .
1. Why should employees in all functional areas become knowledgeable about IT?
2. Describe how IT might change the manager’s job.
3. Discuss several ways in which IT impacts employees at work.
Importance of Information Systems to Society
1.4
This section explains in greater detail why IT is important to society as a whole. Other examples of the impact of IT on society appear throughout the text. IT’s About Business 1.3 illustrates how IT is impacting one society—Cuba—in its entirety.
IT Affects Our Quality of Life
IT has significant implications for our quality of life. The workplace can be expanded from the traditional 9-to-5 job at a central location to 24 hours a day at any location. IT can provide
24 CHAPTER 1 Introduction to Information Systems
Importance of Information Systems to Society 23
IT’s About Business 1.3
Information Technology Has the Potential for Revolutionizing Cuba
In recent years, Cuba’s private sector has been undergoing a huge transformation. Hundreds of thousands of Cubans have obtained licenses to operate small businesses, but only in a limited set of service categories such as restaurants, hair salons, and transla tion services. Despite the limitations, by mid-2016, the number of licensed entrepreneurs—called cuentapropistas in Cuba; roughly translated as “those who are on their own”—rose to almost 500,000.
Unfortunately, the vast majority of these entrepreneurs do not use the Internet because they do not have access to it. In fact, experts estimate that only about 5 percent of Cuba’s citizens have even periodic Internet access. As of mid-2016, only the “elite” had easy Internet access, and only 5 percent of Cubans could access the Internet from home. The public can visit cybercafés that are sanc tioned by the government. However, it costs more than $5 per hour to access sites outside the country. To put this in perspective, the average Cuban earns $20 a month. Another barrier to Internet ac cess is that visitors to cybercafés must sign agreements that their Internet use will not hurt “public security.”
As we discuss further on, Cuba is a country of memory sticks and human middlemen, physically sent to conduct what in the developed world are frictionless digital transactions. In Cuba, smartphones are common, but they do not have data connections. Furthermore, there is no legal way to send or receive payments us ing credit cards or PayPal.
Young, highly motivated Cuban entrepreneurs, the country’s millennials, are circumventing these enormous hindrances by us ing digital technologies in different ways. Let’s consider four exam ples: Revolico, AlaMesa, El Paquete Semanal, and Vistar.
MKT Revolico ( www.revolico.com ). Black markets have been commonplace in Cuba for many years, but it was difficult for buyers and sellers to find each other. In December 2007, a young Cuban anonymously created Revolico, a website for classified ads that quickly became the Craigslist of Cuba.
Three months after the site’s launch, the government blocked it. Revolico got around the blocks by changing the web address for its servers and e-mailing personalized URLs to its users. The back and-forth between Revolico and the government continues as of this writing (mid-2016). Despite these tensions, however, Revolico has become part of the daily life of many Cubans.
By July 2016, Revolico had approximately 8 million monthly page views and 25,000 new daily listings. About half of its traffic came from outside Cuba—most of it from south Florida, which houses a large Cuban population—where the site makes some money selling ads. In Cuba, Revolico has no legal standing. The site charges for premium listings, which it promotes. Associates of Revolico collect payment for those listings unofficially, in cash.
MKT AlaMesa ( www.alamesacuba.com ). AlaMesa is a web- site and Android app that promotes Cuban culinary culture (think Yelp and OpenTable). Going door to door, AlaMesa staff members check out restaurants, examine their menus, and, if the restaurants agree, list them on the website and app. More than 600 restau rants in nine Cuban provinces have agreed to be listed. Roughly 30
percent of these restaurants pay, in cash, to be promoted on the site and app. Foreigners planning a trip to Cuba can download the app while at home. In Cuba, devoted fans spread the app by physi cally passing memory sticks to one another.
El Paquete Semanal. El Paquete Semanal (“the weekly pack age”) is an instant Internet solution for a nonconnected country. More precisely, it is the Internet on a portable hard drive. El Paquete is a large digital collection of recent movies, TV shows, magazines, apps, software updates, and other digital content made available to Cubans. It is copied and distributed on portable hard drives to 100 people, who then distribute it to 1,000 people, and so on. El Paquete is delivered through an informal network of human “mules” who travel in public buses to every corner of the island. Most customers get the drive at home, where they exchange it for last week’s drive. Customers pay more for more recent material and they pay based on how much material they receive.
Vistar ( www.vistarmagazine.com ). In 2013, the Cuban govern ment’s Office of Periodicals and Publications turned down a young Cuban’s application to start an online magazine focusing on Cuba’s youth culture. The young man decided to publish the magazine anyway, without identifying the magazine’s creators. The first issue of Vistar came out in March 2014. It contained excellent photogra phy and articles on food, music, ballet, art, and celebrities. By July 2016, Vistar had published 16 monthly issues and even listed the magazine’s staff on the masthead. Significantly, the government has not yet officially objected.
Although Vistar’s readers have not been harassed by the gov ernment, they have to deal with their country’s lack of connectiv ity. As a result, they access the magazine by sharing memory sticks and hard drives. The magazine’s staff support themselves through advertising. This process is noteworthy because advertising that is not linked to the government has been almost nonexistent for half a century. Vistar, which now publishes in English as well as Spanish, has more than 100,000 downloads, with 60 percent of them origi nating outside Cuba.
Cuba’s relations with the United States are improving, follow ing then-President Obama’s decision in December 2014 to begin normalizing relations between the two countries. Under the pro posal, Cuban citizens could have access to much better communi cations technology. However, the Internet is still strictly controlled under the Raúl Castro regime, and there are economic barriers as well as political ones, so it’s not certain whether and when Cubans will have inexpensive and open Internet access.
What of the situation in the fall of 2016? Cuban citizens con tinue their entrepreneurial activities, not knowing whether the government will shut them down. In 2015, the Cuban state phone company, ETECSA, had 65 Wi-Fi hotspots, and another 80 hotspots were planned for installation in 2016. Cubans can access these hotspots for $2 per hour. Internet cafés and some hotels offer In ternet access for $4 to $6 per hour. Cubans wryly note that this is “good news, bad news.” The good news is that the government is allowing any Wi-Fi hotspots at all. The bad news is that most Cu bans still cannot afford to use them.
In the fall of 2016, approximately 15 percent of Cuban citizens have some form of Internet access. Furthermore, fewer than 5 per cent of Cubans have an Internet connection at home.
Sources: Compiled from D. Renwick, B. Lee, and J. McBride, “U.S.–Cuba Relations,” Council on Foreign Relations, September 7, 2016; E. Griffith, “What It’s Like Trying to Get Online in Cuba,” Fortune, April 22, 2016; “The Internet in Cuba Today,” Cuba Business Report, April 7, 2016; A. Popescu, “Cuban Web Entrepreneur Endures a Murky Status,” MIT Technology Review, October 6, 2015; I. Lakshmanan, “Where the Internet Revolution Is Waiting to Happen,” Bloomberg BusinessWeek, September 7–13, 2015; M. Helft, “Cuba’s Tech Revolutionaries,” Forbes, July 21, 2015; J. Hamre, “Cuba, an Internet Laggard, Opens Wi-Fi Hotspots across Country,” Reuters, July 2, 2015;
V. Burnett, “Cuba Offers Its Citizens Better Access to Internet,” New York Times, June 18, 2015; “Cuba to Expand Internet Access to Battle Country’s Dire Lack of Connectivity,” The Guardian, June 18, 2015; S. Marshall, “This Is What It’s Like Using the Internet in Cuba,” ABC News, March 31, 2015;
N. Young, “Cuba’s Underground Alternative to the Internet,” www.cbc.ca ,
January 25, 2015; T. Johnson, “No Internet in Cuba? For Some, Offline Link to World Arrives Weekly,” McClatchyDC, January 9, 2015; D. Talbot, “Cuba’s Internet Revolution Faces Economic and Political Realities,” MIT Technology
Review, December 21, 2014; S. Fernandes and A. Halkin, “Do Cubans Really Want U.S.-Style Internet Freedom?” nacla.org, December 20, 2014; P. Baker, “U.S. to Restore Full Relations with Cuba, Erasing a Last Trace of Cold War Hostility,” New York Times, December 17, 2014.
Questions
1. Describe the work-arounds that Cuban entrepreneurs must perform to use digital technologies in the four examples dis- cussed in this case.
2. Discuss how free, open access to high-speed Internet con- nections would transform the operations of each of the four examples.
3. Why would the Cuban government limit access to the Inter- net? Provide specific examples in your answer.
employees with flexibility that can significantly improve the quality of leisure time, even if it doesn’t increase the total amount of leisure time.
From the opposite perspective, however, IT also can place employees on constant call, which means they are never truly away from the office, even when they are on vacation. In fact, surveys reveal that the majority of respondents take their laptops and smartphones on their vacations, and 100 percent took their cell phones. Going further, the majority of respondents did some work while vacationing, and almost all of them checked their e-mail regularly.
The Robot Revolution Is Here Now
Once restricted largely to science fiction movies, robots that can perform practical tasks are becoming more common. Around the world, quasi-autonomous devices have become increas ingly common on factory floors, in hospital corridors, and in farm fields. Let’s look at two exam ples: Baxter and drones.
Baxter. Baxter is a new kind of industrial robot by Rethink Robotics (www.rethinkrobotics
.com) that sells for $25,000. Humans share a workspace with Baxter, making it an excellent ex ample of a social, collaborative robot. Baxter works right out of the box and can be integrated into a factory’s workflow in about one hour. Another benefit of Baxter is that other factory work ers can train it.
In November 2014 Rethink Robotics announced its new Robot Positioning System for Bax ter. This system enables Baxter to adapt to changing, real-world environments such as tables and benches being moved. The new system highlights a huge advantage for companies that acquire Baxter. Because so much of Baxter’s capabilities are contained in its software, when the robot is upgraded it tends to increase in value.
However, Baxter does raise the question of the future of low-skilled labor in the United States: How fast will Baxter replace these workers, and what will they do after they are replaced?
LoweBots. In August 2016, Lowe’s announced that 11 of the firm’s store locations in San Francisco, California, will employ LoweBots, which are multilingual, autonomous customer as sistance robots.
Walmart shopping cart robots. In September 2016, Walmart obtained a patent for a system that allows shopping carts to drive themselves. The system attaches to shopping carts, allowing the carts to drive freely around the store, assist customers, and move safely into docks instead of clogging up parking lots. The carts can also potentially move containers; scan, retrieve, and deliver products; check inventory; and retrieve trash.
Drones. A drone is an unmanned aerial vehicle (UAV) that either is controlled by pilots from the ground or autonomously follows a preprogrammed mission. Commercial drones are used for a wide variety of business purposes, in contrast to drones used by hobbyists for recre ational purposes. Let’s examine three interesting uses of drones.
POM
Sensors on drones, coupled with data analytics (see Chapter 12), are extending pre cision agriculture beyond simply monitoring crops. Drones help farmers increase crop yields by optimizing the fertilizer mix for different parts of a field down to the square meter. They similarly help winemakers increase yields by precisely controlling drip irrigation down to the individual vine (“more crop per drop”).
POM
The energy industry uses drones for applications beyond monitoring and inspect ing pipelines. In Alaska, BP ( www.bp.com ) uses drones to monitor its gravel-extraction opera tions to comply with environmental guidelines. ConocoPhillips ( www.conocophillips.com ) and Chevron ( www.chevron.com ) use drones in the Arctic to help search for new sources of oil. First Solar ( www.firstsolar.com ) uses drones to inspect for faulty solar panels.
Uber is so successful in Mexico City that the company feels comfortable enough in using drones to tease drivers who are stuck in gridlocked traffic. One drone carried an ad saying, “Driving by yourself?” The idea was to guilt the driver into carpooling with UberPOOL.
Autonomous Vehicles. When thinking about autonomous vehicles, consider these statistics:
· Human error accounts for more than 90 percent of automobile crashes.
· Each year there are 6 million vehicle crashes reported to law enforcement.
· Approximately 33,000 Americans and 1.25 people worldwide die each year in automobile crashes.
· With mobile devices providing a distraction, U.S. highway fatalities increased 8 percent in 2016, the largest increase in 50 years.
· The average car in the U.S. is used 8 percent of the time.
These statistics offer compelling reasons for autonomous vehicles and development of these vehicles is proceeding rapidly. For example, Uber’s first self-driving cars arrived in Pitts burgh, Pennsylvania, in August 2016. These cars were Volvos supervised by humans in the driver’s seat. Fully automated, all-electric, public, 24-seat, driverless cabs are operating in Sin gapore. Finally, in October 2016, an Uber self-driving truck delivered 50,000 cans of beer at the end of a 120-mile, two-hour journey.
There is some bad news, however. A Tesla Model S driver died after crashing in the Nether lands and another fatality was blamed on a Tesla car in China.
It will probably be a long time before we see robots making decisions by themselves, han dling unfamiliar situations, and interacting with people. Nevertheless, robots are extremely helpful in various environments, particularly those that are repetitive, harsh, or dangerous to humans.
IT Impacts Healthcare
IT has brought about major improvements in healthcare delivery. Medical personnel use IT to make better and faster diagnoses and to monitor critically ill patients more accurately. IT also has streamlined the process of researching and developing new drugs. Expert systems now help doctors diagnose diseases, and machine vision is enhancing the work of radiologists. Sur geons use virtual reality to plan complex surgeries. They also employ surgical robots to perform long-distance surgery. Finally, doctors discuss complex medical cases through videoconferenc ing. New computer simulations recreate the sense of touch, allowing doctors-in-training to per form virtual procedures without risking harm to an actual patient.
Information technology can be applied to improve the efficiency and effectiveness of healthcare. For example, consider IBM Watson ( www.ibm.com/watson ), an IT system that uses
In healthcare, Watson functions as a clinical decision support system (discussed in Chap ter 12) to assist medical professionals in the treatment of patients. Watson examines treatment guidelines, electronic health records, notes from physicians and nurses, research materials, clinical studies, journal articles, and patient information, to provide a list of personalized, confidence-scored treatment recommendations.
Among the thousands of other healthcare applications, administrative systems are crit ically important. These systems perform functions ranging from detecting insurance fraud to creating nursing schedules to financial and marketing management.
The Internet contains vast amounts of useful medical information (see www.webmd.com , for example). Despite this information existing on the Internet, physicians caution against self-diagnosis. They maintain that people should use diagnostic information obtained only from Google and medical websites such as WebMD ( www.webmd.com ) to ask questions of their physicians.
The Emergence of Cognitive Computing: IBM Watson
MIS
IBM ( www.ibm.com ) developed Watson specifically to answer questions on the quiz show Jeopardy! In February 2011, Watson competed on Jeopardy! against former winners Brad Rut ter and Ken Jennings. Watson won the game series and received the first prize of $1 million. (In Jeopardy!, the host reads the answer, and the contestants must then provide the correct question.)
Watson is an application of advanced natural language processing, information retrieval, knowledge representation and reasoning, and machine learning technologies to the field of open-domain (general) question answering. The system is capable of answering questions posed in natural language. IBM has labeled the type of processing demonstrated by Watson as cognitive computing. Four main capabilities distinguish Watson as a cognitive system:
· The ability to understand human language, with all its nuance and ambiguity.
· The ability to learn and absorb information.
· The ability to formulate hypotheses.
· The ability to understand the context of a question.
There are many different types of Watson. Let’s look at some of them here:
· Medicine: Although some health data are structured—for example, blood pressure read ings and cholesterol counts—the vast majority are unstructured. These data include text books, medical journals, patient records, and nurse and physician notes. In fact, modern medicine entails so much unstructured data that its rapid growth has surpassed the ability of healthcare practitioners to keep up. It is important to note here that IBM has made it clear that Watson is not intended to replace doctors. Rather, its purpose is to assist them in avoiding medical errors and sharpening their medical diagnoses.
By early 2017, Watson had digested more than 26 million medical and scientific arti cles as well as information about 3,000 clinical trials collected from clinicaltrials.gov, the federal government’s public database. The system can read, and remember, patient his tories, monitor the latest drug trials, examine the potency of new therapies, and closely follow state-of-the-art guidelines that help doctors choose the best treatments. Watson can also analyze images such as MRIs and EKGs.
In early 2017, two top-ranked hospitals were working with Watson in the field of oncology (cancer care): Memorial Sloan Kettering ( www.mskcc.org ), and the Mayo Clinic ( www.mayoclinic.org ). The Cleveland Clinic and the New York Genome Center are also using Watson in the new field of genomic-based medicine. Similarly, Pathway Genomics ( www.pathway.com ) employs Watson to provide personalized options to help patients and their physicians make informed decisions about living a healthier life.
· Customer service. The Watson Engagement Advisor is designed to help customer- facing personnel assist consumers with deeper insights more quickly than was previously possible. Engagement Advisor’s “Ask Watson” feature can quickly address customers’ questions, offer feedback to guide their purchase decisions, and troubleshoot their prob lems. Companies employing the Advisor include USAA ( www.usaa.com ), Genesys (www
MKT
.genesys.com), DBS Bank of Singapore ( www.dbs.com.sg ), and many others.
· USAA is also using Watson to assist military personnel in transitioning from the military to civilian life.
· RedAnt ( www.redant.com ) uses Watson to transform how consumers shop. It also used Watson to develop a retail sales trainer that lets employees easily identify indi vidual customers’ buying preferences by analyzing demographics, purchase history, and wish lists, as well as product information, local pricing, customer reviews, and tech specs.
· MD Buyline ( www.mdbuyline.com ) uses Watson to help hospitals procure medical devices.
POM
· Welltok ( www.welltok.com ) uses Watson to enable health plans to more effec tively engage their members.
HRM
· Financial services. Many financial organizations have integrated Watson into their
FIN
business processes. As one example, Citigroup ( www.citigroup.com ) employs Watson to ana lyze financial, regulatory, economic, and social data across financial exchanges, currencies, and funds to help simplify and improve the bank’s digital interactions with its customers.
· Travel services. Terry Jones, founder of Travelocity ( www.travelocity.com ) and Kayak (www
.kayak.com), has launched WayBlazer ( www.wayblazer.com ), a new travel company pow ered by Watson. Watson engages, learns, and advises users through a natural language interface to help create the best travel experience.
· Other interesting applications:
· Macy’s ( www.macys.com ) uses Watson to better target Millennials by interpreting their social signals on social media.
MKT
· BNSF Railway ( www.bnsf.com ) is using Watson to help detect faulty sections in the company’s 32,500 miles of track before they break.
POM
· Repsol ( www.repsol.com ) is using Watson to improve its strategic decision making in the optimization of oil reservoir production and in the discovery of new oilfields.
POM
· Watson provides design advice to help fashion company Marchesa create what the com pany calls a cognitive dress. Marchesa’s design team told Watson the kinds of emotions they wanted to convey, and Watson offered color palette and fabric suggestions.
· Hilton Worldwide introduced a robot concierge, called Connie, that is powered by Watson.
· Bear Naked offers customers the opportunity to create their own granola formu lation. Chef Watson, as the system is called, suggests ingredients that complement those chosen by customers.
MKT
· Edge Up Sports teamed with Watson to bring analytical capabilities to fantasy football. The company’s app can analyze the vast amount of data about football and its players, thereby enabling fantasy league players to make better decisions.
· The Watson Trend app offers consumers insight into popular products.
· General Motors planned to roll out smarter vehicles in 2017 with its new cognitive mobil ity platform OnStar Go, powered by Watson. OnStar Go is capable of identifying informa tion about the car and its surroundings.
· Honda’s F1 race cars use Watson to analyze data, boost efficiency, and shape racing strategies.
POM
By early 2017, thousands of companies in at least 20 industries were using Watson. Inter estingly, IBM is moving Watson to smartphones.
Before you go on. . .
1. What are some of the quality-of-life improvements made possible by IT? Has IT had any negative effects on our quality of life? If so, explain, and provide examples.
2. Describe the robotic revolution, and consider its implications for humans.
3. Explain how IT has improved healthcare practices.
In Section 1.2, we discussed how IT supports each of the functional areas of the organization. Here we examine the MIS function.
What’s in IT for ME?
MIS For the MIS Major
The MIS function directly supports all other functional areas in an organization. That is, the MIS function is responsible for providing
the information that each functional area needs to make decisions. The overall objective of MIS personnel is to help users improve per formance and solve business problems using IT. To accomplish this objective, MIS personnel must understand both the information requirements and the technology associated with each functional area. Given their position, however, they must think about business needs first and technology second.
Summary
1. Identify the reasons why being an informed user of infor mation systems is important in today’s world.
The benefits of being an informed user of IT include the following:
· You will benefit more from your organization’s IT applications because you will understand what is behind those applications.
· You will be able to provide input into your organization’s IT appli cations, thus improving the quality of those applications.
· You will quickly be in a position to recommend, or participate in the selection of IT applications that your organization will use.
· You will be able to keep up with rapid developments in existing information technologies, as well as the introduction of new technologies.
· You will understand the potential impacts that new and improved technologies will have on your organization and therefore will be qualified to make recommendations concerning their adoption and use.
· You will play a key role in managing the information systems in your organization.
· You will be in a position to use IT if you decide to start your own business.
2. Describe the various types of computer-based information systems in an organization.
· Transaction processing systems (TPS) support the monitoring, collection, storage, and processing of data from the organiza tion’s basic business transactions, each of which generates data.
· Functional area information systems (FAISs) support a particular functional area within the organization.
· Interorganizational information systems (IOSs) support many in terorganizational operations, of which supply chain management is the best known.
· Enterprise resource planning (ERP) systems correct a lack of com munication among the FAISs by tightly integrating the functional area ISs through a common database.
· Electronic commerce (e-commerce) systems enable organiza tions to conduct transactions with other organizations (called business-to-business (B2B) electronic commerce), and with cus tomers (called business-to-consumer (B2C) electronic commerce).
· Office automation systems (OASs) typically support the clerical staff, lower and middle managers, and knowledge workers, by enabling them to develop documents (word processing and desktop publish ing software), schedule resources (electronic calendars), and com municate (e-mail, voice mail, videoconferencing, and groupware).
· Business intelligence (BI) systems provide computer-based sup port for complex, nonroutine decisions, primarily for middle managers and knowledge workers.
· Expert systems (ESs) attempt to duplicate the work of human ex perts by applying reasoning capabilities, knowledge, and exper tise within a specific domain.
3. Discuss ways in which information technology can affect managers and nonmanagerial workers.
Potential IT impacts on managers:
· IT may reduce the number of middle managers.
· IT will provide managers with real-time or near real-time informa tion, meaning that managers will have less time to make decisions.
· IT will increase the likelihood that managers will have to super vise geographically dispersed employees and teams.
Potential IT impacts on nonmanagerial workers:
· IT may cause employees to experience a loss of identity.
· IT can cause job stress and physical problems, such as repetitive stress injury.
4. List positive and negative societal effects of the increased use of information technology.
Positive societal effects:
· IT can provide opportunities for people with disabilities.
· IT can provide people with flexibility in their work (e.g., work from anywhere, anytime).
· Robots will take over mundane chores.
· IT will enable improvements in healthcare. Negative societal effects:
· IT can cause health problems for individuals.
· IT can place employees on constant call.
· IT can potentially misinform patients about their health problems.
Chapter Glossary
application (or app) A computer program designed to support a specific task or business process.
business analytics systems See business in telligence systems.
business intelligence (BI) systems Provide computer-based support for complex, nonrou tine decisions, primarily for middle managers and knowledge workers.
computer-based information system (CBIS) An information system that uses computer tech nology to perform some or all of its intended tasks.
dashboards A special form of IS that supports all managers of the organization by providing rapid access to timely information and direct access to structured information in the form of reports.
database A collection of related files or tables containing data.
data items An elementary description of things, events, activities, and transactions that are recorded, classified, and stored but are not organized to convey any specific meaning.
electronic commerce (e-commerce) sys tems A type of interorganizational infor mation system that enables organizations to conduct transactions, called business-to-busi ness (B2B) electronic commerce, and custom ers to conduct transactions with businesses, called business-to-consumer (B2C) electronic commerce.
enterprise resource planning (ERP) sys tems Information systems that correct a lack of communication among the functional area ISs by tightly integrating the functional area ISs through a common database.
ergonomics The science of adapting ma chines and work environments to people. It fo cuses on creating an environment that is safe, well lit, and comfortable.
expert systems (ES) Attempt to duplicate the work of human experts by applying reasoning capabilities, knowledge, and expertise within a specific domain.
functional area information systems (FAISs) ISs that support a particular func tional area within the organization.
hardware A device such as a processor, monitor, keyboard, or printer. Together, these devices accept, process, and display data and information.
information Data that have been organized so that they have meaning and value to the recipient.
information system (IS) Collects, processes, stores, analyzes, and disseminates information for a specific purpose.
information technology (IT) Relates to any computer-based tool that people use to work with information and support the informa tion and information-processing needs of an organization.
information technology components Hard ware, software, databases, and networks.
information technology infrastructure IT components plus IT services.
information technology platform Formed by the IT components of hardware, software, net works (wireline and wireless), and databases.
information technology services IT per sonnel use IT components to perform these IT services: develop information systems, oversee security and risk, and manage data.
informed user A person knowledgeable about information systems and information technology.
interorganizational information systems (IOSs) Information systems that connect two or more organizations.
knowledge Data and information that have been organized and processed to convey un derstanding, experience, accumulated learning, and expertise as they apply to a current prob lem or activity.
knowledge workers Professional employ ees such as financial and marketing analysts, engineers, lawyers, and accountants, who are experts in a particular subject area and create information and knowledge, which they inte grate into the business.
network A connecting system (wireline or wireless) that permits different computers to share resources.
procedures The set of instructions for com bining hardware, software, database, and network components in order to process infor mation and generate the desired output.
software A program or collection of programs that enable the hardware to process data.
supply chain The flow of materials, informa tion, money, and services from suppliers of raw materials through factories and warehouses to the end customers.
transaction processing system (TPS) Sup ports the monitoring, collection, storage, and processing of data from the organization’s basic business transactions, each of which generates data.
30 CHAPTER 1 Introduction to Information Systems
Discussion Questions
1. Describe a business that you would like to start. Discuss how infor mation technology could: (a) help you find and research an idea for a business, (b) help you formulate your business plan, and (c) help you finance your business.
2. Your university wants to recruit high-quality high school students from your state. Provide examples of (a) the data that your recruiters would gather in this process, (b) the information that your recruiters would process from these data, and (c) the types of knowledge that your recruiters would infer from this information.
3. Can the terms data, information, and knowledge have different meanings for different people? Support your answer with examples.
4. Information technology makes it possible to never be out of touch. Discuss the pros and cons of always being available to your employers and clients (regardless of where you are or what you are doing).
5. Robots have the positive impact of being able to relieve humans from working in dangerous conditions. What are some negative im pacts of robots in the workplace?
6. Is it possible to endanger yourself by accessing too much medical information on the web? Why or why not? Support your answer.
7. Describe other potential impacts of IT on societies as a whole.
8. What are the major reasons why it is important for employees in all functional areas to become familiar with IT?
9. Given that information technology is impacting every industry, what does this mean for a company’s employees? Provide specific ex amples to support your answer.
10. Given that information technology is impacting every industry, what does this mean for students attending a college of business? Pro vide specific examples to support your answer.
11. Is the vast amount of medical information on the web a good thing? Answer from the standpoint of a patient and from the stand point of a physician.
Problem-Solving Activities
1. Visit some websites that offer employment opportunities in IT. Prominent examples are: www.dice.com , www.monster.com , www
.collegerecruiter.com , www.careerbuilder.com , www.jobcentral
.com , www.job.com , www.career.com , www.simplyhired.com , and www.truecareers.com . Compare the IT salaries to salaries offered to accountants, marketing personnel, financial personnel, operations personnel, and human resources personnel. For other information on IT salaries, check Computerworld’s annual salary survey.
2. Enter the website of UPS ( www.ups.com ).
a. Find out what information is available to customers before they send a package.
b. Find out about the “package tracking” system.
c. Compute the cost of delivering a 10″ × 20″ × 15″ box, weighing 40 pounds, from your hometown to Long Beach, California (or to Lansing, Michigan, if you live in or near Long Beach). Compare the fastest delivery against the least cost. How long did this process take? Look into the business services offered by UPS. How do they make this process easier when you are a business customer?
3. Surf the Internet for information about the Department of Home land Security (DHS). Examine the available information, and comment on the role of information technologies in the department.
4. Access www.irobot.com , and investigate the company’s Education and Research Robots. Surf the web for other companies that manufac ture robots, and compare their products with those of iRobot.
Closing Case
The United States Postal Service Uses Information Technology to Modernize
POM
The Problems
Every American is a customer of the United States Postal Service (USPS; www.usps.gov ), an agency that delivers 158 billion pieces of mail per year. Despite its importance to U.S. citizens, however, the agency faces multiple challenges, including:
· Electronic mail has contributed to a decrease in the volume of first-class (or stamped) mail. This decrease has led to a decline in USPS revenue.
· Another cause of declining revenues is competition from private delivery companies like FedEx ( www.fedex.com ) and UPS ( www
.ups.com ). These businesses are taking customers away from USPS’s package delivery service while sometimes relying on the agency for last-mile delivery. Last-mile delivery is the final and typically most expensive leg of a delivery route.
Other companies are also developing services that could disrupt the USPS’s parcel delivery service. For example, Matternet ( http:// mttr.net ), Amazon (Amazon Prime Air), and Google (Project Wing) have developed unmanned aerial vehicles, or drones, that can deliver packages and letters.
Closing Case 31
· Transportation has long been the essential skill at the USPS. Nev ertheless, the agency has approximately 160,000 delivery vehi cles that are 20 years old and need to be replaced.
· In contrast to transportation skills, digital technology has not been an essential skill at the USPS. One major example that il lustrates this problem occurred in November 2014, when the USPS became a victim of a cyberattack that threatened to put the names, addresses, and social security numbers of 800,000 of its employees at risk.
· Furthermore, USPS efforts to use cloud computing to reduce costs have raised concerns. In September 2014, the USPS inspec tor general (IG) criticized the agency for not properly controlling applications in its cloud environment with regard to information accessibility and data security.
· In April 2016, the USPS was mandated to decrease the price of a first-class stamp from 49 cents to 47 cents. This decrease cost the USPS $2 billion per year.
The USPS has long recognized these problems, and it has tried to introduce cost-saving measures. However, even though the agency is part of the executive branch of the federal government, Congress has enormous power over it. (The USPS is not funded by taxpayers.) Specifically, Congress has rejected proposals to elimi nate Saturday delivery of first-class mail, and it has prevented the USPS from consolidating little-used post offices in rural areas. These moves would have helped the agency reduce costs. Congress has also required the USPS to make regular payments into its future re tirees’ health benefits, a mandate that imposed financial burdens on the agency.
The USPS also has massive amounts of data on every piece of mail exchanged among millions of Americans as well as the companies that sell to them. However, the agency must meet the privacy statutes that apply to federal agencies. As a result, the agency cannot sell its data to businesses to help them better target consumers and therefore increase sales revenues.
And the result of these numerous and diverse problems? Despite taking measures to reduce costs, such as closing processing centers and reducing employee working hours, 2016 was the USPS’s tenth con secutive year of losses.
A Variety of Solutions
To address these problems, the USPS is implementing a variety of solu tions. The agency is redesigning its mail-tracking system to encode as much information as possible on its letter and parcel bar codes with its Intelligent Mail bar code (IMB) system. The IMB uses automatic scanning devices and sorting equipment to scan bar codes to capture billions of data points and transmit them to a central database. Data range from the type of mail being delivered to a parcel’s final destina tion. The IMB enables the agency’s postal processing facilities to oper ate more efficiently.
In addition to supporting this real-time responsiveness, the USPS is also using data to enhance mail delivery. Accurately tracking how mail moves around the country, from the moment a delivery vehicle arrives at a dock to the second a letter reaches a delivery point, pro vides the agency with massive amounts of data. Data analytics enable the USPS to develop dynamic routing—the use of sophisticated algo rithms to map out the most efficient and cost-effective mail delivery routes.
Mobile computing is also driving innovation at the USPS. The agency has been replacing letter carriers’ cellphones with mobile
delivery devices (MDDs). These handheld devices access multiple wire less networks to track parcels in real time. The MDDs also provide the USPS with location data from its delivery vehicles. This process helps the agency ensure its employees’ safety, predict delivery times, and pick up urgent materials from its customers.
In the fall of 2014, the agency introduced an augmented reality technology designed to convert standard print ads into interactive experiences. The system enables consumers to use a free Android or iOS app to view digital presentations when they scan special icons that marketers attach to advertising brochures sent through the mail.
In November 2013, Amazon entered into an arrangement with the USPS to deliver packages on Sundays in select cities. The partnership created an opportunity for the USPS to establish a stronger foothold in the growing package-delivery market. Consequently, its package reve nue increased 12 percent from 2012 to 2014.
In response to the Inspector General’s criticisms regarding cloud applications, the USPS is using the Federal Cloud Credential Exchange. The exchange is a cloud-based clearing service that acts as a hub for validating the digital credentials of people who want access to online government services. As a result, the Exchange also provides a high level of security for USPS applications running in the cloud.
And the largest missed opportunity for a possible solution? If fed eral privacy guidelines allowed the practice, the USPS could use the IMB to help retailers and catalog companies create successful mar keting campaigns. Consider a retailer that receives an e-mail or a text message alert from the USPS that a particular customer has just re ceived the company’s catalog. The retailer could immediately e-mail the customer a digital coupon or a promotional offer in an effort to drive sales and enhance the overall customer experience.
The Results
The USPS is using sensors to help the expansion of smart city tech nology in four areas. (See our discussion of the Internet of Things in Chapter 8.)
· Placing software and cameras in some USPS vehicles to study road conditions and identify potholes and cracks.
· Attaching sensors to postal vehicles to detect vibrations during bridge crossing.
· Using USPS vehicles to gather data from sensors on water pipes and fire hydrants to determine problems in underground water infrastructure.
· Connecting air quality monitors to USPS vehicles.
The CIO of the USPS notes that information technology has be come a core function within the agency. That is, IT is no longer a cost center. Instead, it adds essential value to the organization. However, the success or failure of these diverse initiatives remains to be seen. That is, can the USPS stop losing so much money each year, or at least slow the hemorrhage?
Sources: Compiled from A. Razani, “USPS Looks to Rush in Delivering with Smart City Technology,” ReadWrite, October 3, 2016; D. Leonard, “From: Postmaster General; To: Amazon,” Bloomberg BusinessWeek, August 3–9, 2015; S. Tracy, “Autonomous Vehicles Will Replace Taxi Drivers, but That’s Just the Beginning,” Huffington Post, June 12, 2015; “Intelligent Mail Barcode for Mailpieces,” United States Postal Service, May 4, 2015; S. Edelstein, “U.S.P.S. ‘Long Life’ Vehicles Last 25 Years, But Age Shows Now,” Green Car Reports,
February 17, 2015; J. Williams, “Heading into 2015, USPS Looks to Tech to Reshape Model,” fedscoop, December 31, 2014; C. Waxer, “Digital SOS: How Technology Can Save the USPS,” Computerworld, December 8, 2014;
C. Waxer, “Modernizing the Mail,” Computerworld, December 2014; J. Williams,
32 CHAPTER 1 Introduction to Information Systems
“USPS Cloud Systems Don’t Comply with Established Standards, OIG Says,” fedscoop, September 10, 2014; M. Ashley, “Why Amazon Locker Is Better Than Home Delivery,” TechHive, July 28, 2014; “U.S. Postal Service Parcel Delivery Lockers,” Office of Inspector General, United States Postal Service, December 2013; J. Edgar, “How Technology Is Changing the USPS,” Wall Street Journal, October 10, 2013; W. Jackson, “USPS Set to Put Federal ID System to the Test,” GCN.com, August 22, 2013; www.usps.gov , accessed September 22, 2016.
Questions
1. Provide specific examples of how information technology is neg atively impacting the USPS.
2. Provide specific examples of how information technology is posi tively impacting the USPS.
3. Describe how information technology both positively and nega tively impacts your university.
4. Is it possible to generalize and describe information technology as a double-edged sword for all organizations? Why or why not?
Organizational Strategy, Competitive Advantage, and Information Systems
CHAPTER OUTLINE LEARNING OBJECTIVES
2.1 Business Processes 2.1 Discuss ways in which information systems enable cross-functional business processes and business processes for a single functional area.
2.2 Business Process Reengineering, Business 2.2 Differentiate between business process reengineering, Process Improvement, and Business Process business process improvement, and business process Management management.
2.3 Business Pressures, Organizational Responses, 2.3 Identify effective IT responses to different kinds of business and Information Technology Support pressures.
2.4 Competitive Advantage and Strategic Informa- 2.4 Describe the strategies that organizations typically adopt tion Systems to counter Porter’s five competitive forces.
Opening Case
Bank of America Transforms Its Information Technology
MIS
The Problem
After the financial crisis of 2007–2008, Bank of American (BofA; www
.bankofamerica.com ) executives directed the bank to take measures to eliminate the problems that led to its near-death experience in that crisis. Many of these measures involved BofA’s information technology.
A Multipart Solution
BofA developed a series of strategic goals for its IT function: (1) stand ardize its IT infrastructure, (2) streamline applications, (3) develop customer-focused innovations, and (4) streamline the physical infra structure. BofA’s IT organization, called Global Technology and Opera tions, was directly tasked with achieving the first three goals.
IT Infrastructure. In the past, the bank’s business flexibility was lim ited by a huge, global IT architecture that cost billions of dollars per year to operate. For example, the IT department typically allocated separate servers in its data centers for each line of business, such as its mortgage business and its trading applications. To improve efficiency and reduce costs, the bank’s first strategic goal was to create a standardized, shared IT infrastructure that all business units could readily access.
To accomplish this goal, the bank implemented a software- defined infrastructure (SDI), private cloud (discussed in Technology Guide 3), in which software provides the server, storage, and net working resources to business users as needed. This process is sim ilar to the way cloud service providers offer computing on demand to their customers. The SDI private cloud enabled the bank, which operated 64 data centers in 2008, to plan to operate only eight data centers in 2019.
33
CHAPTER 2
34 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
Business Processes 35
The SDI private cloud enabled the bank to respond more quickly to changing business conditions and to cut costs—as much as 50 per cent from the bank’s current data center costs. The cloud approach also enabled the bank to perform more computing tasks with less hardware. It also increased the ability of the bank’s network, storage, and server capacity to scale up or scale down as business conditions dictate. Essentially, the cloud gives the bank more flexibility and speed to react to changes in the bank’s dynamic business environment.
The SDI private cloud requires more complex security controls and compliance reporting. BofA must be able to prove to auditors that it is securely managing sensitive data, such as bank account numbers and credit card information, in its cloud. In fact, to improve informa tion security and regulatory compliance, the bank is experimenting with tagging or labeling each piece of data so that it can follow the data across its global network, tracking anyone who has had access to it or has made changes to it.
Applications. The BofA has retired more than 18,000 applications, many of them left over from its acquisitions of other companies. For ex ample, the bank spent $100 million to consolidate five Merrill Lynch finan cial advisor applications into one. (BofA acquired Merrill Lynch in 2013.) Furthermore, users at corporate clients in 140 countries now access Bo fA’s CashPro Online portal in 11 languages. The portal replaced hundreds of applications, including liquidity management, currency conversion, wire transfers, and many others. The bank also consolidated 22 collateral management systems into one and eight teller systems into one.
Simplifying its IT infrastructure and reducing the license and support costs of thousands of applications have enabled the bank to invest a larger percentage of its $10 billion annual IT budget on new, innovative applications. In fact, BofA has doubled its spending on new development since 2009.
Innovative Customer Service. The bank’s customers stated they wanted their bank to be “where they are.” In response, the bank launched new versions of its customer smartphone and iPad app in 2014. The app provides three features:
MKT
1. Account information and transactional capabilities. For example, customers must be able to view account details and transfer funds on any device from wherever they are. Furthermore, customers can order new debit and credit cards, view their available card credit, schedule appointments, modify scheduled bill payments, order copies of posted checks, and perform many other functions.
2. Service. For example, if bank customers are traveling internation ally, then they should be able to place a travel notification on their accounts through a mobile device rather than having to call the bank to speak to a customer service representative.
3. Mobile payments and commerce. BofA is offering services such as its clearXchange person-to-person payments network jointly with JPMorgan Chase and Wells Fargo. The bank also offers its BankA meriDeals merchant-funded rewards program, which allows cus tomers to receive coupons from retailers by clicking on offers sent directly to their online banking accounts.
By the fall of 2016, the app had some 20 million users and was growing rapidly. BofA is now managing millions of transactions made from mobile devices, an amount that is growing at a rate of 50 percent per year.
FinTech. FinTech refers to the innovative use of technology in the de sign and delivery of financial services and products. FinTech encompasses lending, advice, investment management, and payments. Many FinTech
companies use mobile technologies, Big Data, and analytics to customize products for various customer segments. There are many examples:
· Digital payment systems such as digital wallets, mobile pay ments, and peer-to-peer payments;
· Investment systems such as crowdfunding and peer-to-peer lending;
· Financing systems such as microloans.
Interestingly, Bank of America IT executives meet annually with 40 technology startups in Silicon Valley to learn about new products. Over the years, the bank has decided to do business with about 17 per cent of these startups. BofA’s work with startups balances the bank’s need for scale and reliability against its need for new ideas.
BofA has high expectations for these vendors. The bank requires open standards and interoperability. It also requires technology con tracts in which costs scale down as well as up. Finally, technology vendors must share BofA’s risk and regulatory rules, including, in some cases, agreeing to contracts in which vendors share in the lia bility if their technology causes problems that lead to losses or fines for the bank. In just one example, BofA is working with Quarule ( www
.quarule.com ), a company that applies artificial intelligence to banks’ regulatory compliance tasks.
POM Physical Infrastructure. To reduce costs, BofA analyzed its network of bank branch locations. The bank tracked every transaction by customer, location, time, and channel. For security purposes, the bank removed all details that would identify any individual. In addi tion to tracking customer activity, the bank examined the capacity of each branch, the costs of each location, each branch’s total revenues, annual sales, and first-year revenue sales to a new customer. Based on the results of the analysis, BofA reduced the number of its branch banks by some 20 percent.
The Results
The IT transformation is ongoing, and the bank’s financial results seem sound. In the fall of 2016, Bank of America was the country’s second- largest bank, with approximately $2.1 trillion in assets. Furthermore, the bank reported net income of $16.5 billion in 2015.
Sources: Compiled from P. Crosman, “How B of A’s Billion-Dollar Tech Cuts Could Fuel Startups,” American Banker, June 28, 2016; L. Shen, “Here’s Why Bank of American Is Slashing Up to 8,400 Jobs,” Fortune, June 15, 2016; “BofA Has $3 Billion to Pour into Innovations as Banks Are Swarming Around FinTech Startups,” Let’s Talk Payments, January 8, 2016; H. Clancy, “This Fortune 500 Bank’s Patents Are Cited by Apple, Google, and Nike,” Fortune, June 29, 2015;
R. King, “Bank of America’s Data Initiative Follows Internet Companies into the Cloud,” Wall Street Journal, March 6, 2015; C. Murphy, “How Bank of America Taps Tech Startups,” InformationWeek, December 1, 2014; R. Preston, “IT Chief of the Year: Bank of America’s Cathy Bessant,” InformationWeek, December
1, 2014; T. Groenfeldt, “Bank of America’s Data Mapping Adds $1 Per Share,” Forbes, August 21, 2014; C. Murphy, “Bank of America’s ‘Why Stop There?’ Cloud Strategy,” InformationWeek, February 4, 2014; D. Campbell, “Bank of America Finishes Merger of Merrill Lynch into Parent,” Bloomberg Business, October 1, 2013; B. Yurcan, “The Future of Mobile at Bank of America,” InformationWeek, March 25, 2013; P. Crosman, “Inside BofA’s IT Makeover,” American Banker, September 1, 2011; “BofA Repays All of Government Funds,” MSNBC, December 10, 2009; www.bankofamerica.com, accessed September 22, 2016.
Questions
1. What is the relationship between the development of mobile bank ing customer applications and the closing of banking centers?
2. Refer to Porter’s strategies for competitive advantage. Which strategy (or strategies) is (are) Bank of America pursuing? Provide specific examples to support your answer.
Organizations operate in the incredible complexity of the modern high-tech world. As a result, they are subject to a myriad of business pressures. Information systems are critically important in helping organizations respond to business pressures and in supporting organizations’ global strategies. As you study this chapter, you will see that any information system can be strategic, meaning that it can provide a competitive advantage if it is used properly. The chapter opening case, as well as all the other cases in this chapter, illustrate how information technology (IT) can provide a competitive advantage to organizations.
Competitive advantage refers to any assets that provide an organization with an edge against its competitors in some measure such as cost, quality, or speed. A competitive advan tage helps an organization control a market and accrue larger-than-average profits. Signifi cantly, both strategy and competitive advantage take many forms.
Although there are many companies that use technology in more expensive ways, an en trepreneurial spirit coupled with a solid understanding of what IT can do for you will provide competitive advantages to entrepreneurs just as it does for Wall Street CIOs. As you study this chapter, think of the small businesses in your area that are utilizing popular technologies in interesting and novel ways. Have any of them found an innovative use for Twitter? Facebook? Amazon? PayPal? If not, then can you think of any businesses that would benefit from employ ing these technologies?
This chapter is important for you for several reasons. First, the business pressures we ad dress in the chapter will affect your organization. Just as important, however, they also will affect you. Therefore, you must understand how information systems can help you—and even tually your organization—respond to these pressures.
Acquiring a competitive advantage is also essential for your organization’s survival. Many organizations achieve competitive advantage through the efforts of their employees. There fore, becoming knowledgeable about strategy and how information systems affect strategy and competitive position will help you throughout your career.
This chapter encourages you to become familiar with your organization’s strategy, mis sion, and goals and to understand its business problems and how it makes (or loses) money. It will help you understand how information technology contributes to organizational strat egy. Furthermore, you likely will become a member of business or IT committees that decide (among many other things) how to use existing technologies more effectively and whether to adopt new ones. After studying this chapter, you will be able to make immediate contributions in these committees when you join your organizations.
In this chapter, you will see how information systems enable organizations to respond to business pressures. Next, you will learn how information systems help organizations gain com petitive advantages in the marketplace.
Business Processes
2.1
A business process is an ongoing collection of related activities that create a product or a ser vice of value to the organization, its business partners, and its customers. The process involves three fundamental elements:
· Inputs: Materials, services, and information that flow through and are transformed as a result of process activities
· Resources: People and equipment that perform process activities
· Outputs: The product or a service created by the process
If the process involves a customer, then that customer can be either internal or external to the organization. A manager who is the recipient of an internal reporting process is an example of an internal customer. In contrast, an individual or a business that purchases the organiza tion’s products is the external customer of the fulfillment process.
Successful organizations measure their process activities to evaluate how well they are executing these processes. Two fundamental metrics that organizations employ in assessing their processes are efficiency and effectiveness. Efficiency focuses on doing things well in the process; for example, progressing from one process activity to another without delay or with out wasting money or resources. Effectiveness focuses on doing the things that matter; that is, creating outputs of value to the process customer—for example, high quality products.
Many processes cross functional areas in an organization. For example, product devel opment involves research, design, engineering, manufacturing, marketing, and distribution. Other processes involve only a single functional area. Table 2.1 identifies the fundamental business processes performed in an organization’s functional areas.
TABLE 2.1 Examples of Business Processes
ACCT Accounting Business Processes Managing accounts payable Managing accounts receivable Reconciling bank accounts Managing cash receipts
FIN Finance Business Processes Managing account collection Managing bank loan applications Producing business forecasts
Applying customer credit approval and credit terms
MKT Marketing Business Processes Managing post-sale customer follow-up Collecting sales taxes
Applying copyrights and trademarks Using customer satisfaction surveys Managing customer service
POM Production/Operations Management Business Processes
Processing bills of materials
Processing manufacturing change orders Managing master parts list and files Managing packing, storage, and distribution Processing physical inventory
Managing purchasing
HRM Human Resources Business Processes
Applying disability policies Managing employee hiring Handling employee orientation Managing files and records Applying healthcare benefits Managing pay and payroll
MIS Management Information Systems Business Processes
Antivirus control
Computer security issues incident reporting Training computer users
Computer user and staff training Applying disaster recovery procedures
Managing invoice billings Managing petty cash Producing month-end close Producing virtual close
Producing property tax assessments Managing stock transactions Generating financial cash flow reports
Handling customer complaints
Handling returned goods from customers Producing sales leads
Entering sales orders Training sales personnel
Managing quality control for finished goods Auditing for quality assurance
Receiving, inspecting, and stocking parts and materials Handling shipping and freight claims
Handling vendor selection, files, and inspections
Producing performance appraisals and salary adjustments Managing resignations and terminations
Applying training and tuition reimbursement Managing travel and entertainment Managing workplace rules and guidelines Overseeing workplace safety
Applying electronic mail policy Generating Internet use policy
Managing service agreements and emergency services Applying user workstation standards
Managing the use of personal software
Cross-Functional Processes
All of the business processes in Table 2.1 fall within a single functional area of the company. However, many other business processes, such as procurement and fulfillment, cut across mul tiple functional areas; that is, they are cross-functional business processes, meaning that no single functional area is responsible for their execution. Rather, multiple functional areas col laborate to perform the process. For a cross-functional process to be successfully completed, each functional area must execute its specific process steps in a coordinated, collaborative way. To clarify this point, let’s take a look at the procurement and fulfillment cross-functional processes. We discuss these processes in greater detail in Chapter 10.
POM
The procurement process includes all of the tasks involved in acquiring needed ma terials externally from a vendor. Procurement comprises five steps that are completed in three different functional areas of the firm: warehouse, purchasing, and accounting.
ACCT
The process begins when the warehouse recognizes the need to procure mate rials, perhaps due to low inventory levels. The warehouse documents this need with a pur chase requisition, which it sends to the purchasing department (step 1). In turn, the purchasing department identifies a suitable vendor, creates a purchase order based on the purchase requisition, and sends the order to the vendor (step 2). When the vendor receives the purchase order, it ships the materials, which are received in the warehouse (step 3). The vendor then sends an invoice, which is received by the accounting department (step 4). Accounting sends payment to the vendor, thereby completing the procurement process (step 5).
POM ACCT
The fulfillment process is concerned with processing customer orders. Ful fillment is triggered by a customer purchase order that is received by the sales department. Sales then validates the purchase order and creates a sales order. The sales order communi cates data related to the order to other functional areas within the organization, and it tracks the progress of the order. The warehouse prepares and sends the shipment to the customer. Once accounting is notified of the shipment, it creates an invoice and sends it to the customer. The customer then makes a payment, which accounting records.
An organization’s business processes can create a competitive advantage if they enable the company to innovate or to execute more effectively and efficiently than its competitors. They can also be liabilities, however, if they make the company less responsive and productive. Consider the airline industry. It has become a competitive necessity for all of the airlines to offer electronic ticket purchases through their websites. To provide competitive advantage, how ever, these sites must be highly responsive and they must provide both current and accurate information on flights and prices. An up-to-date, user-friendly site that provides fast answers to user queries will attract customers and increase revenues. In contrast, a site that provides outdated or inaccurate information, or has a slow response time, will hurt rather than improve business.
Clearly, good business processes are vital to organizational success. But how can organiza tions determine if their business processes are well designed? The first step is to document the process by describing its steps, its inputs and outputs, and its resources. The organization can then analyze the process and, if necessary, modify it to improve its performance.
To understand this point, let’s consider the e-ticketing process. E-ticketing consists of four main process activities: searching for flights, reserving a seat, processing payment, and issuing an e-ticket. These activities can be broken down into more detailed process steps. The result may look like the process map in Figure 2.1. Note that different symbols correspond to differ ent types of process steps. For example, rectangles (steps) are activities that are performed by process resources (reserve seats, issue e-ticket). Diamond-shaped boxes indicate decisions that need to be made (seats available?). Arrows are used as connectors between steps; they indicate the sequence of activities.
These symbols are important in the process flowchart (which is similar to a program ming flowchart). Other symbols may be used to provide additional process details. For example, D-shaped boxes are used instead of rectangles when a waiting period is part of a process; ovals can show start and stop points; and process resources can be attached to activities with resource connector lines, or included as an annotation or property for each activity box.
FIGURE 2.1 Business process for ordering an e-ticket from an airline website.
The customers of the process are travelers planning a trip, and the process output is an e-ticket. Travelers provide inputs to the process: the desired travel parameters to begin the search, the frequent flyer miles number, and their credit card information. Also, a computer ized reservation system that stores information for many airlines provides some of the process inputs such as the seat availability and prices. The resources used in the process are the airline website, the computerized reservation system, and, if the customer calls the airline call center at any time during the process, the call center system and the human travel agents. The process creates customer value by efficiently generating an output that meets the customer search cri teria—dates and prices. The performance of the process depends on efficiency metrics such as the time required to purchase an e-ticket, from the moment the customer initiates the ticket search until he or she receives the e-ticket. Effectiveness metrics include customer satisfaction with the airline website. Finally, the performance of the process may be affected if the quality or the timeliness of the inputs is low—for example, if the customer enters the wrong dates—or if the process resources are not available—for example, if the website crashes before the pur chase is finalized.
Information Systems and Business Processes
An information system (IS) is a critical enabler of an organization’s business processes. Information systems facilitate communication and coordination among different functional areas, and allow easy exchange of, and access to, data across processes. Specifically, ISs play a vital role in three areas:
MIS
· Executing the process
· Capturing and storing process data
· Monitoring process performance
In this section, you will learn about each of these roles. In some cases, the role is fully automated—that is, it is performed entirely by the IS. In other cases, the IS must rely on the manager’s judgment, expertise, and intuition. IT’s About Business 2.1 shows how NASCAR uses information technology to streamline its prerace process.
Executing the Process.
An IS helps organizations execute processes efficiently
and effectively. ISs are typically embedded into the processes, and they play a critical role in executing the processes. In other words, an IS and the processes are usually intertwined. If the IS does not work, the process cannot be executed. An IS helps execute processes by informing people when it is time to complete a task, by providing the necessary data to complete the task, and, in some cases, by providing the means to complete the task.
MIS
In the procurement process, for example, the IS generates the purchase requisitions and then informs the purchasing department that action on these requisitions is needed. The ac countant will be able to view all shipments received to match an invoice that has been received from a supplier and verify that the invoice is accurate. Without the IS, these steps, and therefore
IT’s About Business 2.1
NASCAR Uses IT in Its Prerace Inspection
MIS
The National Association for Stock Car Auto Racing (NASCAR; www
.nascar.com ) is a family-owned-and-operated business that governs multiple auto racing events. One of NASCAR’s key business processes is the prerace inspection of the cars. The rationale for prerace inspec tion is to ensure that all cars are as evenly matched as possible.
Prerace inspection begins two days before a race. Each car on the entry list for a particular race must pass a thorough inspection to compete. Here is how the process works.
In the first inspection, NASCAR officials assess whether a car meets NASCAR requirements—for example, height off the ground at the front and the back of the car, weight, fuel tank capacity, and many other factors. Cars that meet these requirements are cleared to practice, and they qualify for the race.
If a car does not pass the first inspection, then NASCAR allows that team to fix the problem and undergo a second inspection. However, the team is sent to the end of the line. This process can cause a backup of cars waiting to be cleared before the race. In the past, NASCAR would let a team with a violation keep its spot in line while it fixed the problem, essentially jumping ahead of teams still waiting to undergo the initial inspection. That situation meant that crew chiefs had little incentive when trying to repair violations. If the repair did not fix the violation, they would simply try again.
After the first inspection, each team has two days before the race to work on their cars. After each team qualifies, NASCAR con ducts a second, postqualifying inspection. On race morning, all cars are inspected one final time.
Historically, NASCAR officials performed the prerace inspec tion by walking to each inspection station and visually observing each car. Moreover, they recorded their observations on paper. These forms contained more than 100 items clustered in categories depending on the kind of inspection. The form would remain with each vehicle as it went through the inspection process. Each sea son, NASCAR used roughly 25,000 sheets of paper for inspections.
In September 2014, NASCAR implemented an app from Micro- soft that incorporates everything from the paper form, but in a
more useful format. Each vehicle is shown on a dashboard that tracks its stages through the inspection process. The dashboard also uses color-coded flags to highlight violations. NASCAR offi cials can be alerted to any pending issues for each vehicle and they can access the NASCAR rulebook at the press of a digital button. Officials can also add digital notes and photographs to detail any infractions. The app also enables officials to determine whether prerace inspections are on time. Finally, the race director can use his tablet to monitor each inspection station, identify which cars have been cited for violations, and find out the status of every car.
The Microsoft app has simplified the prerace inspection pro cess. Consider, for example, that the paper form needed a NASCAR official’s signature on every item. In contrast, the app by default assumes every item’s status is good unless otherwise noted by officials.
One interesting benefit of the app is the wealth of data that it stores. Information on the prerace inspections of all vehicles is col lected in real time. Consequently, NASCAR officials can spot trends and patterns to help make the races fair for everyone.
Sources: Compiled from S. Choney, “NASCAR Levels the Playing Field by Bringing the Latest Technology into an American Tradition,” Microsoft Blog, June 27, 2016; N. Linhart, “NASCAR App Improves Inspection Efficiency,” Charlotte Sun Times, February 10, 2015; J. Gluck, “App Improves NASCAR Inspection Process,” USA Today, February 8, 2015; “A Day at the Track
for a NASCAR Race,” NASCAR.com, January 5, 2015; “Going Through Inspections,” NASCAR.com, January 5, 2015; J. Richter, “NASCAR Pre-Race Inspection? There’s an App for That,” Fox Sports, October 23, 2014; T. Bradley, “NASCAR Turns to Microsoft and Windows 8 to Streamline Race Operations,” Forbes, October 21, 2014; J. Hammond, “NASCAR Inspections a Work in Progress,” Fox Sports, April 16, 2013; www.nascar.com, accessed September 2, 2016.
Questions
1. Describe why prerace inspection is a business process for NASCAR.
2. Describe the various benefits that the app provides to NASCAR.
3. Refer to Section 2.3. Is the app a strategic information sys tem for NASCAR? Why or why not? Support your answer.
the process, cannot be completed. For example, if the IS is not available, how will the ware house know which orders are ready to pack and ship?
In the fulfillment process, the IS will inform people in the warehouse that orders are ready for shipment. It also provides them with a listing of what materials must be included in the order and where to find those materials in the warehouse.
Capturing and Storing Process Data.
Processes create datasuch asdates,
times, product numbers, quantities, prices, and addresses, as well as who did what, when, and where. IS captures and stores these data, commonly referred to as process data or transaction data. Some of these data are generated and automatically captured by the IS. These are data related to who completes an activity, when, and where. Other data are generated outside the IS and must be entered into it. This data entry can occur in various ways, ranging from manual entry to automated methods involving data in forms such as bar codes and RFID tags that can be read by machines.
MIS
In the fulfillment process, for example, when a customer order is received by mail or over the phone, the person taking the order must enter data such as the customer’s name, what the customer ordered, and how much he or she ordered. Significantly, when a customer order is re ceived through the firm’s website, then all customer details are captured by the IS. Data such as the name of the person entering the data (who), at which location the person is completing the task (where), and the date and time (when) are automatically included by the IS when it creates the order. The data are updated as the process steps are executed. When the order is shipped, the warehouse will provide data about which products were shipped and in what quantities, and the IS will automatically include data related to who, when, and where.
An important advantage of using an IS compared to a manual system or multiple func tional area information systems is that the data need to be entered into the system only once. Furthermore, once they are entered, other people in the process can easily access them, and there is no need to reenter them in subsequent steps.
The data captured by the IS can provide immediate feedback. For example, the IS can use the data to create a receipt or to make recommendations for additional or alternative products.
Monitoring Process Performance.
A third contribution of IS is to help
monitor the state of the various business processes. That is, the IS indicates how well a process is executing. The IS performs this role by evaluating information about a process. This informa tion can be created at either the instance level (i.e., a specific task or activity) or at the process level (i.e., the process as a whole).
MIS
For example, a company might be interested in the status of a particular customer order. Where is the order within the fulfillment process? Was the complete order shipped? If so, when? If not, then when can we expect it to be shipped? Or, for the procurement process, when was the purchase order sent to the supplier? What will be the cost of acquiring the material? At the process level, the IS can evaluate how well the procurement process is being executed by calcu lating the lead time, or the time between sending the purchase order to a vendor and receiving the goods, for each order and each vendor over time.
Not only can the IS help monitor a process, but it can also detect problems with the pro cess. The IS performs this role by comparing the information with a standard—that is, what the company expects or desires—to determine if the process is performing within expectations. Management establishes standards based on organizational goals.
If the information provided by the IS indicates that the process is not meeting the stan dards, then the company assumes that some type of problem exists. Some problems can be routinely and automatically detected by the IS, whereas others require a person to review the information and make judgments. For example, the IS can calculate the expected date that a specific order will be shipped and determine whether this date will meet the established stan dard. Or, the IS can calculate the average time taken to fill all orders over the past month and compare this information with the standard to determine if the process is working as expected. Monitoring business processes, then, helps detect problems with these processes.
POM
These problems are very often really symptoms of a more fundamental problem. In such cases,
the IS can help diagnose the cause of the symptoms by providing managers with additional de tailed information. For example, if the average time to process a customer order appears to have increased over the previous month, this problem could be a symptom of a more basic problem.
HRM
A manager can then drill down into the information to diagnose the underlying problem. To accomplish this task, the manager can request a breakdown of the information by type of product, customer, location, employees, day of the week, time of day, and so on. Af ter reviewing this detailed information, the manager might determine that the warehouse has experienced an exceptionally high employee turnover rate over the past month and that the delays are occurring because new employees are not sufficiently familiar with the process. The manager might conclude that this problem will work itself out over time, in which case there is nothing more to be done. Alternatively, the manager could conclude that the new employees are not being adequately trained and supervised. In this case, the company must take actions to correct the problem. The following section discusses several methodologies that managers can use to take corrective action when process problems are identified.
Before you go on. . .
1. What is a business process?
2. Describe several business processes carried out at your university.
3. Define a cross-functional business process, and provide several examples of such processes.
4. Pick one of the processes described in Question 2 or 3, and identify its inputs, outputs, customer(s), and resources. How does the process create value for its customer(s)?
Business Process Improvement, Business Process Reengineering, and Business Process Management
2.2
Excellence in executing business processes is widely recognized as the underlying basis for all significant measures of competitive performance in an organization. Consider the following measures, for example:
· Customer satisfaction: The result of optimizing and aligning business processes to fulfill customers’ needs, wants, and desires.
· Cost reduction: The result of optimizing operations and supplier processes.
· Cycle and fulfillment time reduction: The result of optimizing the manufacturing and logis tics processes.
· Quality: The result of optimizing the design, development, and production processes.
· Differentiation: The result of optimizing the marketing and innovation processes.
· Productivity: The result of optimizing each individual’s work processes.
The question is: How does an organization ensure business process excellence?
In their book Reengineering the Corporation, first published in 1993, Michael Hammer and James Champy argued that to become more competitive, American businesses needed to radically redesign their business processes to reduce costs and increase quality. The authors further asserted that information technology is the key enabler of such change. This radical redesign, called business process reengineering (BPR), is a strategy for making an organiza tion’s business processes more productive and profitable. The key to BPR is for enterprises to
42 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
Business Process Improvement, Business Process Reengineering, and Business Process Management 41
examine their business processes from a “clean sheet” perspective and then determine how they can best reconstruct those processes to improve their business functions. BPR’s popu larity was propelled by the unique capabilities of information technology, such as automation and standardization of many process steps and error reduction due to improved communica tion among organizational information silos.
Although some enterprises have successfully implemented BPR, many organizations found this strategy too difficult, too radical, too lengthy, and too comprehensive. The impact on employees, on facilities, on existing investments in information systems, and even on orga nizational culture was overwhelming. Despite the many failures in BPR implementation, how ever, businesses increasingly began to organize work around business processes rather than individual tasks. The result was a less radical, less disruptive, and more incremental approach, called business process improvement (BPI).
BPI focuses on reducing variation in the process outputs by searching for root causes of the variation in the process itself (e.g., a broken machine on an assembly line) or among the process inputs (e.g., a decline in the quality of raw materials purchased from a certain supplier). BPI is usually performed by teams of employees that include a process expert—usually the pro cess owner (the individual manager who oversees the process)—as well as other individuals who are involved in the process. These individuals can be involved directly; for example, the workers who actually perform process steps. Alternatively, these individuals can be involved indirectly; for example, customers who purchase the outputs from the process.
Six Sigma is a popular methodology for BPI initiatives. Its goal is to ensure that the process has no more than 3.4 defects per million outputs by using statistical methods to analyze the process. (A defect is defined as a faulty product or an unsatisfactory service.) Six Sigma was developed by Motorola in the 1980s, and it is now used by companies worldwide, thanks in part to promotional efforts by early adopters such as GE. Six Sigma is especially appropriate for manufacturing environments, in which product defects can be easily defined and measured. Over the years, the methodology has been modified so that it focuses less on defects and more on customer value. As a result, it can now be applied to services as well as to products. Today, Six Sigma tools are widely used in financial services and healthcare institutions as components of process-improvement initiatives.
Regardless of the specific methodology you use, a successful BPI project generally follows five basic phases: define, measure, analyze, improve, and control (DMAIC).
· In the define phase, the BPI team documents the existing “as is” process activities, process resources, and process inputs and outputs, usually as a graphical process map or diagram. The team also documents the customer and the customer’s requirements for the process output, together with a description of the problem that needs to be addressed.
· In the measure phase, the BPI team identifies relevant process metrics, such as time and cost to generate one output (product or service), and collects data to understand how the metrics evolve over time. Sometimes the data already exist, in which case they can be ex tracted from the IS that supports the process, as described in the previous section. Many times, however, the BPI team needs to combine operational process data already stored in the company’s IS systems with other data sources, such as customer and employee obser vations, interviews, and surveys.
· In the analysis phase, the BPI team examines the “as is” process map and the collected data to identify problems with the process (e.g., decreasing efficiency or effectiveness) and their root causes. If possible, the team should also benchmark the process; that is, com pare its performance with that of similar processes in other companies, or other areas of the organization. The team can employ IT applications such as statistical analysis software or simulation packages in this phase.
It is often valuable to use process simulation software during the analysis phase. Using this software provides two benefits. First, it enables a process manager to quickly simulate a real situation (e.g., with a certain number of people undertaking activities) for a specific amount of time (e.g., a working day, a week, or a month). The manager can then estimate the process performance over time without having to observe the process in practice. Second, it allows
the manager to create multiple scenarios; for example, using a different number of resources in the process or using a different configuration for the process steps. Process simulation soft ware can also provide a number of outputs regarding a process including the time used by all resources to execute specific activities, the overall cycle time of a process, the identification of resources that are infrequently used, and the bottlenecks in the process. Simulating a process is extremely valuable for process managers because it is a risk-free and inexpensive test of an improvement solution that does not need to be conducted with real resources.
· In the improve phase, the BPI team identifies possible solutions for addressing the root causes, maps the resulting “to be” process alternatives, and selects and implements the most appropriate solution. Common ways to improve processes are eliminating process activities that do not add value to the output and rearranging activities in a way that re duces delays or improves resource use. The organization must be careful, however, not to eliminate internal process controls—those activities that safeguard company resources, guarantee the accuracy of its financial reporting, and ensure adherence to rules and regulations.
· In the control phase, the team establishes process metrics and monitors the improved pro cess after the solution has been implemented to ensure the process performance remains stable. An IS system can be very useful for this purpose.
Although BPI initiatives do not deliver the huge performance gains promised by BPR, many organizations prefer them because they are less risky and less costly. BPI focuses on delivering quantifiable results—and if a business case cannot be made, the project is not continued. All employees can be trained to apply BPI techniques in their own work to identify opportunities for improvement. Thus, BPI projects tend to be performed more from the bottom up, in con trast to BPR projects, which involve top-down change mandates. BPI projects take less time overall, and even if they are unsuccessful, they consume fewer organizational resources than BPR projects. However, if incremental improvements through BPI are no longer possible, or if significant changes occur in the firm’s business environment, then the firm should consider BPR projects. One final consideration is that over time, employees can become overstretched or lose interest if the company undertakes too many BPI projects and does not have an effec tive system to manage and focus the improvement efforts.
POM
To sustain BPI efforts over time, organizations can adopt business process management (BPM), a management system that includes methods and tools to support the design, analysis, implementation, management, and continuous optimization of core business processes throughout the organization. BPM integrates disparate BPI initiatives to ensure con sistent strategy execution.
Important components of BPM are process modeling and business activity monitoring. BPM begins with process modeling, which is a graphical depiction of all of the steps in a process. Process modeling helps employees understand the interactions and dependencies among the people involved in the process, the information systems they rely on, and the information they require to optimally perform their tasks. Process modeling software can support this activity. IT’s About Business 2.2 shows how Chevron has employed BPR, BPI, and BPM.
Business activity monitoring (BAM) is a real-time approach for measuring and managing business processes. Companies use BAM to monitor their business processes, identify failures or exceptions, and address these failures in real time. Furthermore, because BAM tracks process operations and indicates whether they succeed or fail, it creates valuable records of process behaviors that organizations can use to improve their processes.
BPM activities are often supported by business process management suites (BPMS). A BPMS is an integrated set of applications that includes a repository of process information such as process maps and business rules; tools for process modeling, simulation, execution, coordina tion across functions, and reconfiguration in response to changing business needs as well as process-monitoring capabilities.
Gartner ( www.gartner.com ), a leading IT research and advisory firm, states that compa nies need to focus on developing and mastering BPM skills throughout the organization. Gart ner notes that high-performing companies use BPM technologies such as real-time process
IT’s About Business 2.2
BPR, BPI, and BPM at Chevron
POM
Chevron ( www.chevron.com ), one of the world’s largest oil and gas companies, and its subsidiaries are involved in exploring and producing oil and natural gas, as well as in manufacturing, trans porting, and distributing petrochemical products, including gaso line and refined products. In 2013, Chevron employed more than 60,000 people worldwide, produced the equivalent of more than
2.6 million barrels of oil every day, and garnered more than $230 billion in sales. Chevron has initiated several process reengineering and improvement efforts over the years, evolving from BPR to BPI and eventually to BPM, as described next.
In 1995, Chevron’s output was less than half of its current amount, producing roughly 1 million barrels of oil per day across six plants. The company had three major departments: Refining, Marketing, and Supply and Distribution (S&D). Management deter mined that they needed to improve their supply chain (see Chap ter 11) to better integrate their multiple internal processes. A key figure in this initiative was Vice President Peter McCrea, who had a strong idea for dramatically improving performance. McCrea was convinced that Chevron had to reengineer the company’s core pro cesses from beginning to end: from the acquisition of crude oil to the distribution of final products to Chevron customers.
To accomplish this task, Chevron adopted a holistic approach. The company collaborated with a consulting firm to create a model of the existing processes. The objective was to radically improve these processes to align with Chevron’s business goals. In other words, Chevron’s strategy was not to concentrate on the existing processes to identify specific areas to improve. Rather, the project identified the desired outputs and then worked backward by ex amining the supporting processes, using BPR. As an added benefit, this holistic approach led the company to examine the interdepen dencies among processes used in different business units. This ap proach ultimately improved the company’s overall performance. In a 1996 report, Chevron claimed the BPR project saved the company
$50 million.
This complex BPR effort was initially followed by several smaller, employee-driven BPI initiatives. For example, in 1998, six Chevron employees initiated a project to improve water treatment processes at a company plant in California. Operating costs fell by one-third. Their success inspired other employees to initiate BPI projects in Indonesia, Angola, and other locations around the globe by using the Six Sigma improvement methodology. Although some managers were able to demonstrate the benefits of BPI at the local level, it wasn’t until 2006 that these efforts achieved companywide recognition and corporate backing. In that year, Lean Six Sigma, which combines statistical process analysis with techniques to eliminate waste and improve process flow, became Chevron’s pre ferred improvement methodology. Since Chevron implemented Lean Six Sigma, company employees have initiated hundreds of BPI projects worldwide, resulting in significant savings. From 2008 to 2010 alone, Chevron reported more than $1 billion in BPI bene fits. To support these internal improvement efforts, Chevron got its suppliers on board in BPI initiatives as well.
To coordinate these various BPI efforts, Chevron has adopted a unified BPM approach that involves standardizing processes
across the entire company and consolidating process information within a central repository. Chevron figures that only 20 percent of its processes can be fully automated—the rest involve a combina tion of manual and automated steps. Thus, process standardiza tion involves not only supporting activities that can be automated but also ensuring that relevant employees are familiar with the standards for manual activities. To familiarize employees with all these processes, Chevron implemented Nimbus (nimbus.tibco
.com), a BPMS that acts as a repository of standard, companywide rules and procedures. Nimbus can also provide employees with detailed work instructions.
Take Chevron’s shipping process as an example where the BPMS could shine. Shipping was executed in different ways in locations throughout Asia, Europe, and the United States. To es tablish uniform company standards, Chevron employed a BPI ap proach. The company documented its processes as they existed across different geographical locations, identified best practices, and combined these practices into a common process to imple ment. It then detailed these new policies and procedures, which it distributed to managers through the company’s web-based BPMS.
Chevron has a companywide management system that fo cuses on operational excellence, and BPM is a key part of that sys tem. All Chevron operating companies and business units must implement continuous improvement, using carefully defined guidelines, metrics, and targets that are reviewed and adapted ev ery year. Chevron’s metrics focus on process efficiency, safety, risk, and the environment. The commitment to continuous improve ment is part of Chevron’s corporate culture. All employees partic ipate in operational excellence activities, and managers receive specific operational excellence training.
Operational excellence is especially crucial when economic times are tough. For example, in the fourth quarter of 2014, Chev ron’s net income was $3.5 billion, down nearly 30 percent from $4.9 billion for the same period in 2013. This decline resulted primarily from the steep drop in crude oil prices. However, it’s likely that re sults would have been worse without the operational excellence initiatives. Chevron’s CEO noted that the lower crude oil prices were partially offset by increased operational efficiency in the com pany’s downstream operations—that is, refining oil products and delivering them to customers. This increased efficiency was a prod uct of the company’s ongoing BPR, BPI, and BPM efforts.
Sources: Compiled from P. Harmon, Business Process Management, Else- vier, Burlington, MA, 2007; “Operational Excellence,” chevron.com , March 2012; “Chevron—Using Nimbus Control Software to Manage Processes,” FindingPetroleum.com, September 23, 2010; “Chevron Wins Boston Strategies International’s 2010 Award for Lean Six Sigma Implementation in Oil and Gas Operations,” www.bostonstrategies.com, September 22, 2010; E. Schmidt, “From the Bottom Up: Grassroots Effort Finds Footing at Chevron,” isixsigma.com, March 1, 2010; R. Parker, “Business Process
Improvement: A Talk with Chevron’s Jim Boots,” Ebizq.net, August 26, 2009; www.chevron.com, accessed October 31, 2016.
Questions
1. Describe the main advantages of BPR at Chevron.
2. Why did Chevron adopt BPI?
3. How does Chevron apply BPM in its operations today?
monitoring, visualization, analytics, and intelligent automated decision making to support intelligent business operations.
Another promising emerging trend is social BPM. This technology enables employees to collaborate, using social media tools on wired and mobile platforms, both internally across functions and externally with stakeholders (such as customers or subject-area experts), to ex change process knowledge and improve process execution.
BPM initially helps companies improve profitability by decreasing costs and increasing rev enues. Over time, BPM can create a competitive advantage by improving organizational flexi bility—making it easy to adapt to changing business conditions and to take advantage of new opportunities. BPM also increases customer satisfaction and ensures compliance with rules and regulations. In all cases, the company’s strategy should drive the BPM effort.
Before you go on. . .
1. What is business process reengineering?
2. What is business process improvement?
3. What is business process management?
Business Pressures, Organizational Responses, and Information Technology Support
2.3
Modern organizations compete in a challenging environment. To remain competitive, they must react rapidly to problems and opportunities that arise from extremely dynamic condi tions. In this section, you examine some of the major pressures confronting modern organiza tions and the strategies that organizations employ to respond to these pressures.
Business Pressures
The business environment is the combination of social, legal, economic, physical, and politi cal factors in which businesses conduct their operations. Significant changes in any of these fac tors are likely to create business pressures on organizations. Organizations typically respond to these pressures with activities supported by IT. Figure 2.2 illustrates the relationships among business pressures, organizational performance and responses, and IT support. You will learn about three major types of business pressures: market, technology, and societal pressures.
Market Pressures. Market pressures are generated by the global economy, intense competition, the changing nature of the workforce, and powerful customers. Let’s look more closely at each of these factors.
Globalization. Globalization is the integration and interdependence of economic, social, cultural, and ecological facets of life, made possible by rapid advances in information technol ogy. Today, individuals around the world are able to connect, compute, communicate, collab orate, and compete everywhere and anywhere, any time, and all the time; to access limitless amounts of information, services, and entertainment; to exchange knowledge; and to produce and sell goods and services. People and organizations can now operate without regard to ge ography, time, distance, or even language barriers. The bottom line? Globalization is markedly increasing competition.
46 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
Business Pressures, Organizational Responses, and Information Technology Support 45
FIGURE 2.2 Business pressures, organizational performance and responses, and IT support.
These observations highlight the importance of market pressures for you. Simply put, you and the organizations you join will be competing with people and organizations from all over a flat world.
Let’s consider some examples of globalization:
· Multinational corporations operate on a global scale, with offices and branches located worldwide.
· Many automobile manufacturers use parts from other countries, such as a car being as sembled in the United States with parts coming from Japan, Germany, or Korea.
· The World Trade Organization (WTO; www.wto.org ) supervises international trade.
· Regional agreements such as the North American Free Trade Agreement (NAFTA), which includes the United States, Canada, and Mexico, have contributed to increased world trade and increased competition.
· The European Union (EU) is an economic and political union of 28 countries that are lo cated in Europe. Note: As of early 2017, the United Kingdom remained in the EU. Under the terms of Brexit, the U.K. will be able to formally leave the EU in March 2019.
· The rise of India and China as economic powerhouses has increased global competition.
One important pressure that businesses in a global market must contend with is the cost of labor, which varies widely among countries. In general, labor costs are higher in developed countries such as the United States and Japan than in developing countries such as Bangladesh and El Salvador. Also, developed countries usually offer greater benefits, such as healthcare, to employees, driving the cost of doing business even higher. Therefore, many labor-intensive
industries have moved their operations to countries with low labor costs. IT has made such moves much easier to implement.
However, manufacturing overseas is no longer the bargain it once was, and manufacturing in the United States is no longer as expensive. For example, manufacturing wages in China have more than doubled between 2002 and 2015, and they continue to rise. Meanwhile, the value of China’s currency has steadily risen.
The Changing Nature of the Workforce. The workforce, particularly in developed countries, is becoming more diversified. Increasing numbers of women, single parents, mi norities, and persons with disabilities are now employed in all types of positions. IT is easing the integration of these employees into the traditional workforce. IT is also enabling people to work from home, which can be a major benefit for parents with young children and for people confronted with mobility or transportation issues.
Powerful Customers. Consumer sophistication and expectations increase as customers become more knowledgeable about the products and services they acquire. Customers can use the Internet to find detailed information about products and services, to compare prices, and to purchase items at electronic auctions.
Organizations recognize the importance of customers and they have increased their ef forts to acquire and retain them. Modern firms strive to learn as much as possible about their customers to better anticipate and address their needs. This process, called customer intimacy, is an important component of customer relationship management (CRM), an organizationwide effort toward maximizing the customer experience. You will learn about CRM in Chapter 11.
Technology Pressures. The second category of business pressures consists of those pressures related to technology. Two major technology-related pressures are technological in novation and information overload.
Technological Innovation and Obsolescence. New and improved technologies rap idly create or support substitutes for products, alternative service options, and superb quality. As a result, today’s state-of-the-art products may be obsolete tomorrow. For example, how fast are new versions of your smartphone being released? How quickly are electronic versions of books, magazines, and newspapers replacing traditional hard copy versions? These changes force businesses to keep up with consumer demands.
Consider the rapid technological innovation of the Apple iPad ( www.apple.com/ipad ):
· Apple released the first iPad in April 2010 and sold three million devices in just 80 days.
· Apple released the iPad 2 on March 11, 2011, only 11 months later.
· Apple released the iPad 3 on March 7, 2012.
· Apple released its fourth-generation iPad on November 2, 2012, along with the iPad mini.
· On November 1, 2013, Apple released the fifth generation of its iPad, called the iPad Air.
· On November 12, 2013, Apple released its iPad Mini 2 with Retina Display.
· In October 2014, Apple released the iPad Air 2 and the iPad Mini 3.
· In September 2015, Apple released the iPad Mini 4.
· In November 2015, Apple released the iPad Pro.
One manifestation of technological innovation is “bring your own device (BYOD).” BYOD re fers to the policy of permitting employees to bring personally owned mobile devices (laptops, tablet computers, and smartphones) to the workplace and to use those devices to connect to the corporate network as well as for personal use as well. The academic version of BYOD in volves students’ using personally owned devices in educational settings to connect to their school’s network.
MIS
The rapid increase in BYOD represents a huge challenge for IT departments. Not only has IT lost the ability to fully control and manage these devices, but employees are now demanding that they be able to conduct company business from multiple personal devices.
The bad news is security concerns. Many companies with BYOD policies have experienced an increase in malware (malicious software, discussed in Chapter 4). Furthermore, there is an increased risk of losing sensitive, proprietary information. Such information might not be se curely stored on a personal mobile device, which can be lost or stolen.
Information Overload. The amount of information available on the Internet doubles approximately every year, and much of it is free. The Internet and other telecommunications networks are bringing a flood of information to managers. To make decisions effectively and efficiently, managers must be able to access, navigate, and use these vast stores of data, infor mation, and knowledge. Information technologies, such as search engines (discussed in Chap ter 6) and data mining (Chapter 12), provide valuable support in these efforts.
Societal/Political/Legal Pressures. The third category of business pressures includes social responsibility, government regulation/deregulation, spending for social pro grams, spending to protect against terrorism, and ethics. This section will explain how all of these elements affect modern businesses. We start with social responsibility.
Social Responsibility. Social issues that affect businesses and individuals range from the state of the physical environment, to company and individual philanthropy, to education. Some corporations and individuals are willing to spend time and money to address various so cial problems. These efforts are known as organizational social responsibility or individual social responsibility.
One critical social problem is the state of the physical environment. A growing IT initiative, called green IT, addresses some of the most pressing environmental concerns. IT is instrumen tal in organizational efforts to “go green” in three areas:
1. Facilities design and management. Organizations are creating more environmentally sus tainable work environments. Many organizations are pursuing Leadership in Energy and Environmental Design (LEED) certification from the U.S. Green Building Council, a nonprofit group that promotes the construction of environmentally friendly buildings. One impact of this development is that IT professionals are expected to help create green facilities.
2. Carbon management. As companies try to reduce their carbon footprints, they are turning to IT executives to develop the systems needed to monitor carbon throughout the organi zation and its supply chain, which can be global in scope. Therefore, IT employees need to become knowledgeable about embedded carbon and how to measure it in the company’s products and processes.
3. International and U.S. environmental laws. IT executives must deal with federal and state laws and international regulations that impact everything from the IT products they buy to how they dispose of them to their company’s carbon footprint.
Continuing our discussion of social responsibility, social problems all over the world may be addressed through corporate and individual philanthropy. In some cases, questions arise as to what percentage of contributions actually goes to the intended causes and recipients and what percentage goes to the charity’s overhead. Another problem that concerns contributors is that they often exert little influence over the selection of projects their contributions will sup port. The Internet can help address these concerns and facilitate generosity and connection. Consider the following examples:
· PatientsLikeMe ( www.patientslikeme.com ), or any of the thousands of message boards dedicated to infertility, cancer, and various other ailments. People use these sites and mes sage boards to obtain information about healthcare decisions based on volunteered infor mation, while also receiving much-needed emotional support from strangers.
· Collaborative Consumption ( www.collaborativeconsumption.com ): This website is an online hub for discussions about the growing business of sharing, resale, reuse, and barter (with many links to websites engaged in these practices).
· Kiva ( www.kiva.org ): Kiva is a nonprofit enterprise that provides a link between lenders in developed countries and entrepreneurs in developing countries. Users pledge interest- free loans rather than tax-deductible donations. Kiva directs 100 percent of the loans to borrowers.
· DonorsChoose ( www.donorschoose.org ): DonorsChoose is an education-oriented web- site that functions entirely within the United States. Users make donations rather than loans. The website addresses the huge problem of underfunded public schools.
Still another social problem that affects modern business is the digital divide. The digital divide refers to the wide gap between those individuals who have access to information and communications technology and those who do not. This gap exists both within and among countries.
Many government and international organizations are trying to close the digital divide. As technologies develop and become less expensive, the speed at which the gap can be closed will accelerate. On the other hand, the rapid pace of technological development can make it more difficult for groups with few resources to keep up with more affluent groups.
One well-known project to narrow the divide is the One Laptop per Child (OLPC) project ( http://one.laptop.org ). OLPC is a nonprofit association dedicated to developing a very inex pensive laptop—a technology that aims to revolutionize how the world can educate its chil dren. In early 2015, the price of OLPC’s laptop remains approximately $200. We should note however, that this price includes educational software loaded on the laptop.
IT’s About Business 2.3 examines the role that IT plays in two important social issues: (1) social responsibility in the form of protecting the environment and (2) narrowing the digital divide.
Compliance with Government Regulations. Another major source of business pres sures is government regulations regarding health, safety, environmental protection, and equal opportunity. Businesses tend to view government regulations as expensive constraints on their activities. In general, government deregulation intensifies competition.
In the wake of 9/11 and numerous corporate scandals, the U.S. government passed many new laws, including the Sarbanes-Oxley Act, the USA PATRIOT Act, the Gramm-Leach-Bliley Act, and the Health Insurance Portability and Accountability Act (HIPAA). Organizations must be in compliance with the regulations contained in these statutes. The process of becoming and re maining compliant is expensive and time consuming. In almost all cases, organizations rely on IT support to provide the necessary controls and information for compliance.
Protection Against Terrorist Attacks. Since September 11, 2001, organizations have been under increased pressure to protect themselves against terrorist attacks. Employees who are in the military reserves have also been called up for active duty, creating personnel prob lems. Information technology can help protect businesses by providing security systems and possibly identifying patterns of behavior associated with terrorist activities, including cyberat tacks (discussed in Chapter 4). For a good example of a firm that provides this protection, see Palantir ( www.palantir.com ).
An example of protection against terrorism is the Department of Homeland Security’s (DHS) Office of Biometric Identity Management (OBIM) program. (We discuss biometrics in Chapter 4.) OBIM ( www.dhs.gov/obim ) is a network of biometric screening systems such as fingerprint and iris and retina scanners that ties into government databases and watch lists to check the iden tities of millions of people entering the United States. The system is now operational in more than 300 locations, including major international ports of entry by air, sea, and land.
Ethical Issues. Ethics relates to general standards of right and wrong. Information ethics relates specifically to standards of right and wrong in information processing practices. Ethical issues are very important because, if handled poorly, they can damage an organization’s image and destroy its employees’ morale. The use of IT raises many ethical issues, ranging from mon itoring e-mail to invading the privacy of millions of customers whose data are stored in private and public databases. Chapter 3 covers ethical issues in detail.
IT’s About Business 2.3
Using Information Technology for Social Good
MIS
Stopping illegal logging. According to a 2014 study by Interpol ( www.interpol.int ), an organization that encourages cooperation among law enforcement agencies in different countries, illegal logging is pervasive, accounting for between 50 and 90 percent of all trees harvested. According to the World Wildlife Fund ( www
.worldwildlife.org ), illegal logging is particularly serious in the Amazon and Congo Basins, but it is widespread all over the world.
Going further, these activities a part of a huge black market for wood, reducing world timber prices by about 15 percent. The World Bank estimates that illegal logging costs the industry $10 bil lion worldwide every year.
These illegal logging activities reduce the size of the world’s rainforests by 5 to 10 percent every 10 years, causing a biodiversity crisis. Moreover, about 17 percent of greenhouse gas emissions are caused by illegal logging.
One organization that is hoping to halt illegal logging is a San Francisco–based nonprofit known as the Rainforest Connection ( https://rfcx.org ). Volunteers put solar panels on old smartphones and place them on treetops in a rainforest. The phones can pick up the sound of tree-cutting chainsaws within one square mile, and emit data to rangers patrolling the area, who can quickly stop the loggers. Just one phone can save enough trees to stop 15,000 tons of carbon emissions.
The Infoladies of Bangladesh. Just 3 percent of people in Ban gladesh have regular Internet connections. Most people who want to use the Internet are in rural villages. To provide regular access to villagers, the nonprofit organization Dnet ( http://dnet.org.bd) set up the Infoladies project ( http://infolady.com.bd ). Armed with a laptop and other digital equipment, a group of 50 young women cycle to the villages to make computers, tablets, smartphones, and digital cameras available to all. The Infoladies also bring a glucom eter so that villagers can monitor their blood sugar levels. Farmers
can also research information on crops and farming methods. The most popular request is for villagers to communicate with male rel atives via Skype. Many of these men work in the Middle East. Dnet also lends women $650 so they can buy their own equipment to have an Infoladies franchise. Each franchisee earns an average of
$90 per month for offering these digital services, which is more lu crative than farming in Bangladesh.
The Internet Saathi (Partner) Project. Millions of women in rural India do not have Internet access, so Google and Tata Trusts have partnered to deliver Internet access to them by bicycle. Fe male guides learn how the Internet and World Wide Web work, and then are provided with bicycles with Internet-connected An droid smartphones and tablets. The guides bike to remote villages, teaching women how to use the devices. In the program’s first year, it trained some 9,000 guides who in turn taught 1 million women.
Sources: Compiled from N. Purnell, “How Google’s Bicycle-Riding Internet Tutors Are Getting Rural Indian Women Online,” the Wall Street Journal, October 3, 2016; “Start-Up Creates Devices from Old Cell Phones to Tackle Illegal Logging and Poaching,” We Are Anonymous, July 28, 2015; A. Cernigoi, “Bangladesh’s Travelling Infoladies: A Rural Revolution,” Philanthropy
Age, January 25, 2015; J. Hance, “Daring Activists Use High-Tech to Track Illegal Logging Trucks in the Brazilian Amazon,” MongaBay, October 15, 2014; J. Prentice-Dunn, “How Technology Can Help Stop Illegal Logging,” Sierra Club, July 6, 2015; S. Chowdhury, “‘Infoladies’ Bring Change in Rural Bangladesh,” Aljazeera, August 28, 2014; L. Gilpin, “How Recycled Solar Powered Phones Could Save Rainforests and Change How the Tech Indus try Tackles Climate Change,” TechRepublic, August 8, 2014; G. Akash, “The Infoladies of Bangladesh,” Bloomberg BusinessWeek, July 3, 2014; http:// infolady.com.bd; https://rfcx.org, accessed September 22, 2016.
Questions
1. Describe how the Infoladies are a strategic information sys tem for the country of Bangladesh. Provide specific exam ples to support your answer.
2. Discuss how the Rainforest Connection’s use of smart- phones is a strategic information system for our planet. Pro vide specific examples to support your answer.
Clearly, then, the pressures on organizations are increasing, and organizations must be prepared to take responsive actions if they are to succeed. You will learn about these organiza tional responses in the next section.
Organizational Responses
Organizations are responding to the various pressures just discussed by implementing IT such as strategic systems, customer focus, make-to-order and mass customization, and e-business. This section explores each of these responses.
Strategic Systems. Strategic systems provide organizations with advantages that en able them to increase their market share and profits to better negotiate with suppliers and to prevent competitors from entering their markets. IT’s About Business 2.4 provides an example of how strategically important information systems can be to an organization. As you will see, many information systems are so strategically important to organizations that if they are inad equate, or fail altogether, their organizations are at risk of failing as well.
IT’s About Business 2.4
Target Fails to Expand in Canada
POM
MIS Seventy-two-billion-dollar Target Corporation ( www.target
.com ) is a fixture in the American retail landscape, with more than 1,800 stores. Target decided in 2011 to move north and open lo cations in Canada. To do so, Target paid $1.8 billion (U.S. dollars) for the leases to 124 Zellers discount stores. At that time, compe tition from Walmart had adversely impacted Zellers’ sales and the Canadian retailer realized that its property was worth more than its sales. Unfortunately, most Zellers stores were dated, didn’t match Target’s retailing layout, and were in locations not often frequented by Target’s usual middle-class demographic.
Target planned to open Target Canada in 2013. This strategic goal meant that the retailer had less than two years to get ready. It had to deploy a distribution system (including three distribution centers and a supply chain management system), hire and train workers, renovate the old Zellers stores, develop supplier relation ships, develop databases containing product and consumer data, place products into its physical stores, and get the word out among potential customers.
One of Target’s most important operational goals for its ex pansion into Canada was to develop and implement the supply chain management (SCM) system. Target had an excellent SCM system already operating in the United States. However, the com pany felt that customizing its existing system presented too many programming obstacles. Target chose to build and deploy an en tirely new supply chain management system for the Canadian market.
Developing any new information system to support a compa ny’s operations in a new country requires a great deal of planning, development, and customization. In the case of Canada, there were two complicating factors.
First, Canada has its own currency and the conversion rate be tween the U.S. dollar and Canadian dollar fluctuates regularly. The SCM system for Target Canada had to manage both U.S. dollars and Canadian dollars because many products were sourced from the United States. This process meant that the SCM system had to have a currency field. Second, Canada uses the metric system whereas the United States uses the Imperial system. For example, a 12-fluid ounce bottle of shampoo in the United States is 355 milliliters in Can ada. Therefore, Target Canada’s SCM system had to manage both measurement systems and be able to convert between the two.
Target Canada’s SCM system had to log some 75,000 products. Each product contained a great deal of data, such as the physical dimensions, supplier, UPC code, pricing, weight, and many other variables. Because the parent company did not use its U.S. SCM sys tem, the Canadian system had to either import data from the par ent company or require staff to input the data manually. Numerous errors arose, resulting in some 70 percent of the products with one or more data errors.
Data for each of the 75,000 products had to be analyzed in or der to construct a model for purchase (demand side) and restocking (supply side) for each store. As with all supply chain management systems, Target Canada’s SCM system had to know when product stock levels reached reorder levels. However, Target Canada penal ized its marketing analysts any time there were too few products in
stock. The SCM system automatically reordered products running low, such as those that were surprisingly popular. When this situa tion occurred, the analyst responsible for such products would be reprimanded.
As a result, the analysts turned off this tracking feature in the SCM because it allowed them to do so. Essentially, the analysts were being penalized for low stocks and they switched off the fea ture that would alert their managers when that was indeed the case. Managers therefore often thought that stock levels were ade quate when they really were not.
As a result, Target Canada could not monitor its stock. Ini tially, too few products were shipped to the distribution centers, resulting in empty shelves. Target Canada ordered the products, but it experienced backups in its distribution centers because it could not correctly calculate shelf space (due to confusion be tween the Imperial and the metric system). Target Canada had to move items to extra warehouses. The retailer ended up with far too much inventory in its warehouses and far too few products in its stores.
The end result? Canadian customers were not happy when faced with empty shelves and sales suffered. Target Canada filed for bankruptcy, closed all of its stores, and threw 17,000 people out of work. The parent company took a loss of approximately 2.1 bil lion U.S. dollars on its Canadian business.
And the takeaway message from this experience? Target should not have developed a new SCM system for Canada. Rather, the company should have slowly adapted their existing SCM sys tem for the Canadian market. Furthermore, the strategy of launch ing stores nationwide, rather than rolling them out slowly, was extremely risky.
Sources: Compiled from D. Gewirtz, “Billion-Dollar Mistake: How Inferior IT Killed Target Canada,” ZDNet, February 11, 2016; J. Castaldo, “The Last Days of Target Canada,” Canadian Business, January 22, 2016; L. Northrup,
“15 Things We Learned about the Downfall of Target Canada,” Consumerist, January 22, 2016; S. Harris, “Target Canada Closing 80 Stores by Easter Weekend,” CBC News, March 25, 2015; D. Dahlhoff, “Why Target’s Canadian Expansion Failed,” Harvard Business Review, January 20, 2015; H. Peterson, “5 Reasons Target Failed in Canada,” Business Insider, January 16, 2015;
H. Shaw, “Target Corp’s Spectacular Canada Flop: A Gold Standard Case Study for What Retailers Shouldn’t Do,” Financial Post, January 15, 2015; P. Wahba, “Why Target Failed in Canada,” Fortune, January 15, 2015; I. Austen, “Target Push into Canada Stumbles,” New York Times, February 24, 2014; www.target.com, accessed October 31, 2016.
Questions
1. Look ahead to the primary activities in Porter’s value chain. Which of these activities did Target Canada’s supply chain management system impact?
2. In the last sentence of the case, we note that it was very risky for Target to open an entire nation of stores at once. If Target had chosen to open only a few stores at first, how would that decision have impacted Target Canada’s supply chain management system?
3. In your opinion, which was Target Canada’s largest prob lem? Its faulty supply chain management system or the parent company’s decision to open over a hundred stores at once? Support your answer.
Organizational attempts to provide superb customer service
can make the difference between attracting and retaining customers versus losing them to competitors. Numerous IT tools and business processes have been designed to keep customers happy. (Recall that a business process is a collection of related activities that produce a product or a service of value to the organization, its business partners, and its customers.) Consider Amazon, for example. When you visit Amazon’s website any time after your first visit, the site welcomes you back by name and it presents you with information about items that you might like, based on your previous purchases. In another example, Dell guides you through the pro cess of purchasing a computer by providing information and choices that help you make an informed buying decision.
MKT
Make-to-Order and Mass Customization. Make-to-order is a strategy of pro ducing customized (made to individual specifications) products and services. The business problem is how to manufacture customized goods efficiently and at a reasonably low cost. Part of the solution is to change manufacturing processes from mass production to mass custom ization. In mass production, a company produces a large quantity of identical items. An early example of mass production was Henry Ford’s Model T, for which buyers could pick any color they wanted—as long as it was black.
Ford’s policy of offering a single product for all of its customers eventually gave way to consumer segmentation, in which companies provide standard specifications for different consumer groups, or segments. Clothes manufacturers, for example, design their products in different sizes and colors to appeal to different customers. The next step is configured mass customization, in which companies offer features that allow each shopper to custom ize his or her product or service with a range of components. Examples are ordering a car, a computer, or a smartphone, for which the customer can specify which features he or she wants.
In the current strategy, known as mass customization, a company produces a large quan tity of items, but it customizes them to match the needs and preferences of individual custom ers. Mass customization is essentially an attempt to perform make-to-order on a large scale. Examples include:
· NikeID ( www.nikeid.com ) allows customers to design their footwear.
· M&M candies: My M&Ms ( www.mymms.com ) allows customers to add photos, art, and messages to candy.
· Dell ( www.dell.com ) and HP ( www.hp.com ) allow customers to exactly specify the com puter they want.
IT’s About Business 2.5 provides another example of mass customization, the problem of “fit” in online shopping for clothes.
E-Business and E-Commerce. Conducting business electronically is an essential strategy for companies that are competing in today’s business environment. Electronic com merce (EC or e-commerce) describes the process of buying, selling, transferring, or exchang ing products, services, or information through computer networks, including the Internet. E-business is a somewhat broader concept. In addition to the buying and selling of goods and services, e-business also refers to servicing customers, collaborating with business partners, and performing electronic transactions within an organization. Chapter 7 focuses extensively on this topic. E-commerce applications also appear throughout the text.
You now have a general overview of the pressures that affect companies in today’s busi ness environment and the responses that they choose to manage these pressures. To plan for the most effective responses, companies formulate strategies. In the new digital economy, these strategies rely heavily on information technology, especially strategic information sys tems. You examine these topics in the next section.
IT’s About Business 2.5
The “Fit” Problem When Shopping for Clothes Online
MIS
POM MKT Online shopping for the latest fashions is convenient for customers, but they cannot try on the clothes. Not being able to assess actual fit is a problem because in the world of apparel, sizes can differ widely by brand, so even when an online retailer provides clothing measurements, it might not accurately reflect how an item will actually fit on the wearer. Fashion industry analysts claim this situation is deliberate: If a customer knows that Levi’s jeans, for ex ample, are going to fit, then he or she will generally purchase that brand. Going further, there is no consensus in the clothing industry on sizes, leading to customer irritation.
Even if there were standard sizes, there would still be a fit problem. Specifically, consider the different types of clothing fab rics—some are more stretchy than others. Two pieces of clothing of the same size could be made from different fabrics and therefore fit differently.
The inability to virtually try on clothing is partly responsible for the high rates of return (20 percent to 40 percent) and shopping cart abandonment (50 percent) in online fashion shopping. Online retailer Zappos has set the industry standard on returns, pioneer ing no-cost shipping and handling for returns. No-cost shipping for returns raised customer satisfaction to new levels and stimulated online retail purchasing, reducing barriers to shoppers being re luctant to buy something they couldn’t try on. However, the policy costs online retailers a great deal of money.
As a result of these return costs, several startup companies are addressing the fit problem. These companies believe that if customers’ clothes fit them better, then they will be more satisfied and less likely to return the items. Let’s consider several of these companies.
Virtusize ( www.virtusize.com ) takes the measurements of users’ favorite items of clothing for an online comparison. The site creates digital garments over which customers can layer the outline of the item they are interested in buying online, for comparison.
Clothes Horse (bought in December 2014 by fits.me; ( http:// fits.me ) has developed software that takes data from both shop pers (body dimensions, preferred brands, and preferred fit) and apparel manufacturers. The result is a database of actual measure- ments—chest, waist, hips, sleeves—for every item and every brand
in the company’s database, which it then uses to make a recom mendation to a customer regarding fit. The software also contains proprietary algorithms that account for variables such as type of fabric.
LoveThatFit ( http://beta.lovethatfit.com ) is a startup that allows consumers to send in a full body picture taken in tight clothes. The service uses proprietary algorithms to address the fit problem. It even compensates for photos’ tilt and distortion, while pinpointing the points of fit on the customer’s body. The website is social, allowing customers to discuss potential purchases within their network.
Bodymetrics ( www.bodymetrics.com ) is a good example of mass customization. Bodymetrics provides a “body scanner” that customers can access either at home or in a store. This technol ogy scans the customer’s body, captures more than 150 measure ments, and produces a digital replica of the customer’s size and shape. This scan is then used to provide made-to-measure jeans and swimsuits for women and men.
Toshiba has created a digital dressing room. Using a 3-D scan ner and camera, the service analyzes customers’ measurements so they can assess fit through a display. The system sizes the clothes to fit. Customers can use a companion app on their mobile device to create outfits or make an order.
Sources: Compiled from “Japan’s ‘Virtual Dressing Rooms,’” BBC News, January 23, 2015; E. Brooke, “8 Startups Trying to Help You Find Clothing that Fits,” Fashionista, July 22, 2014; N. Laskowski, “Fashion Tech Startups Use Data Science to Build Virtual Dressing Rooms,” Tech Target, January 14, 2015; J. Ersing, “Clothing Stores Are Setting a Powerful Example that All Businesses Should Follow,” Identities.mic, January 8, 2015; L. Wang, “Can Technology Solve the Fit Problem in Fashion E-Commerce?” Business of
Fashion, August 12, 2014; R. Shah, “Fixing How Clothes Fit You Can Reshape Online Retail Logistics,” Forbes, April 11, 2014; “Gina Mancuso, LoveThatFit,” Charlottesville Tomorrow, March 24, 2014; V. Woollaston, “The End of Online Returns? App Lets You See How Clothes Will Fit Based on Items You Already Own,” Daily Mail, March 17, 2014.
Questions
1. Look ahead to Porter’s five strategies for competitive advan tage. Take each of the example companies in this case and identify which of Porter’s strategies that company is using.
2. Do the systems these companies are using constitute strate gic information systems? Why or why not?
Before you go on. . .
1. What are the characteristics of the modern business environment?
2. Discuss some of the pressures that characterize the modern global business environment.
3. Identify some of the organizational responses to these pressures. Are any of these responses specific to a particular pressure? If so, which ones?
Competitive Advantage and Strategic Information Systems
2.4
A competitive strategy is a statement that identifies a business’s approach to compete, its goals, and the plans and policies that will be required to carry out those goals (Porter, 1985). 1 A strat egy, in general, can apply to a desired outcome, such as gaining market share. A competitive strategy focuses on achieving a desired outcome when competitors want to prevent you from reaching your goal. Therefore, when you create a competitive strategy, you must plan your own moves, but you must also anticipate and counter your competitors’ moves.
Through its competitive strategy, an organization seeks a competitive advantage in an in dustry. That is, it seeks to outperform its competitors in a critical measure such as cost, quality, and time-to-market. Competitive advantage helps a company function profitably with a mar ket and generate larger-than-average profits.
Competitive advantage is increasingly important in today’s business environment, as you will note throughout the text. In general, the core business of companies has remained the same. That is, information technologies simply offer tools that can enhance an organization’s success through its traditional sources of competitive advantage, such as low cost, excellent customer service, and superior supply chain management. Strategic information systems (SISs) provide a competitive advantage by helping an organization implement its strategic goals and improve its performance and productivity. Any information system that helps an or ganization either achieve a competitive advantage or reduce a competitive disadvantage qual ifies as a strategic information system.
Porter’s Competitive Forces Model
The best-known framework for analyzing competitiveness is Michael Porter’s competitive forces model (Porter, 1985). Companies use Porter’s model to develop strategies to increase their competitive edge. Porter’s model also demonstrates how IT can make a company more competitive.
Porter’s model identifies five major forces that can endanger or enhance a company’s po sition in a given industry. Figure 2.3 highlights these forces. Although the web has changed the nature of competition, it has not changed Porter’s five fundamental forces. In fact, what makes these forces so valuable as analytical tools is that they have not changed for centuries. Every competitive organization, no matter how large or small, or what business it is in, is driven by these forces. This observation applies even to organizations that you might not consider com petitive, such as local governments. Although local governments are not-for-profit enterprises, they compete for businesses to locate in their districts, for funding from higher levels of govern ment, for employees, and for many other things.
Significantly, Porter (2001) 2 concludes that the overall impact of the web is to increase competition, which generally diminishes a firm’s profitability. Let’s examine Porter’s five forces and the ways that the web influences them.
1. The threat of entry of new competitors. The threat that new competitors will enter your mar ket is high when entry is easy and low when there are significant barriers to entry. An entry barrier is a product or service feature that customers have learned to expect from organi zations in a certain industry. A competing organization must offer this feature to survive in the marketplace. There are many types of entry barriers. Consider, for example, legal re quirements such as admission to the bar to practice law or a license to serve liquor, where only a certain number of licenses are available.
1 M.E. Porter, Competitive Advantage (New York: Free Press, 1985).
2 M.E. Porter, “Strategy and the Internet,” Harvard Business Review, March 2001.
FIGURE 2.3 Porter’s competitive forces model.
Suppose you want to open a gasoline station. To compete in that industry, you would have to offer pay-at-the-pump service to your customers. Pay-at-the-pump is an IT-based barrier to entering this market because you must offer it for free. The first gas station that offered this service gained first-mover advantage and established barriers to entry. This advantage did not last, however, because competitors quickly offered the same service and thus overcame the entry barrier.
For most firms, the web increases the threat that new competitors will enter the mar ket because it sharply reduces traditional barriers to entry, such as the need for a sales force or a physical storefront. Today, competitors frequently need only to set up a website. This threat of increased competition is particularly acute in industries that perform an in termediation role, which is a link between buyers and sellers (e.g., stock brokers and travel agents), as well as in industries in which the primary product or service is digital (e.g., the music industry). The geographical reach of the web also enables distant competitors to compete more directly with an existing firm.
In some cases, the web increases barriers to entry. This scenario occurs primarily when customers have come to expect a nontrivial capability from their suppliers. For example, the first company to offer web-based package tracking gained a competitive advantage from that service. Competitors were forced to follow suit.
2. The bargaining power of suppliers. Supplier power is high when buyers have few choices from whom to buy and low when buyers have many choices. Therefore, organizations would rather have more potential suppliers so that they will be in a stronger position to negotiate price, quality, and delivery terms.
The Internet’s impact on suppliers is mixed. On the one hand, it enables buyers to find alternative suppliers and to compare prices more easily, thereby reducing the supplier’s bargaining power. On the other hand, as companies use the Internet to integrate their sup ply chains, participating suppliers prosper by locking in customers.
3. The bargaining power of customers (buyers). Buyer power is high when buyers have many choices from whom to buy and low when buyers have few choices. For example, in the past, there were few locations where students could purchase textbooks (typically, one or two campus bookstores). In this situation, students had low buyer power. Today, the web provides students with access to a multitude of potential suppliers as well as detailed information about textbooks. As a result, student buyer power has increased dramatically. In contrast, loyalty programs reduce buyer power. As their name suggests, loyalty pro grams reward customers based on the amount of business they conduct with a particular organization (e.g., airlines, hotels, car rental companies). Information technology enables companies to track the activities and accounts of millions of customers, thereby reducing
56 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
Competitive Advantage and Strategic Information Systems 55
buyer power. That is, customers who receive perks from loyalty programs are less likely to do business with competitors. (Loyalty programs are associated with customer relation ship management, which you will study in Chapter 11.)
4. The threat of substitute products or services. If there are many alternatives to an organi zation’s products or services, then the threat of substitutes is high. If there are few alter natives, then the threat is low. Today, new technologies create substitute products very rapidly. For example, customers today can purchase wireless telephones instead of land- line telephones, Internet music services instead of traditional CDs, and ethanol instead of gasoline for their cars.
Information-based industries experience the greatest threat from substitutes. Any in dustry in which digitized information can replace material goods (e.g., music, books, soft ware) must view the Internet as a threat because the Internet can convey this information efficiently and at low cost and high quality.
Even when there are many substitutes for their products, however, companies can create a competitive advantage by increasing switching costs. Switching costs are the costs, in money and time, imposed by a decision to buy elsewhere. For example, contracts with smartphone providers typically include a substantial penalty for switching to another provider until the term of the contract expires (quite often, two years). This switching cost is monetary.
As another example, when you buy products from Amazon, the company develops a profile of your shopping habits and recommends products targeted to your preferences. If you switch to another online vendor, that company will need time to develop a profile of your wants and needs. In this case, the switching cost involves time rather than money.
5. The rivalry among existing firms in the industry. The threat from rivalry is high when there is intense competition among many firms in an industry. The threat is low when the compe tition is among fewer firms and is not as intense.
In the past, proprietary information systems—systems that belong exclusively to a sin gle organization—have provided strategic advantage to firms in highly competitive indus tries. Today, however, the visibility of Internet applications on the web makes proprietary systems more difficult to keep secret. In simple terms, when I see my competitor’s new system online, I will rapidly match its features to remain competitive. The result is fewer differences among competitors, which leads to more intense competition in an industry.
To understand this concept, consider the highly competitive grocery industry, in which Walmart, Kroger, Safeway, and other companies compete essentially on price. Some of these companies have IT-enabled loyalty programs in which customers receive discounts and the store gains valuable business intelligence on customers’ buying preferences. Stores use this business intelligence in their marketing and promotional campaigns. (You will learn about business intelligence in Chapter 12.)
Grocery stores are also experimenting with wireless technologies such as radio- frequency identification (RFID, discussed in Chapter 8) to speed up the checkout process, track customers through the store, and notify customers of discounts as they pass by cer tain products. Grocery companies also use IT to tightly integrate their supply chains for maximum efficiency and thus reduce prices for shoppers.
Established companies can also gain a competitive advantage by allowing customers to use data from the company’s products to improve their own performance. For exam ple, Babolat ( www.babolat.com ), a manufacturer of sports equipment, has developed its Babolat Play Pure Drive system. The system has sensors embedded into the handle of its tennis rackets. A smartphone app uses the data from the sensors to monitor and evaluate ball speed, spin, and impact location to give tennis players valuable feedback.
Competition is also being affected by the extremely low variable cost of digital prod ucts. That is, once a digital product has been developed, the cost of producing additional units approaches zero. Consider the music industry as an example. When artists record music, their songs are captured in digital format. Physical products, such as CDs or DVDs of the songs for sale in music stores, involve costs. The costs of a physical distribution chan nel are much higher than those involved in delivering the songs digitally over the Internet.
In fact, in the future, companies might give away some products for free. For exam ple, some analysts predict that commissions for online stock trading will approach zero because investors can search the Internet for information to make their own decisions re garding buying and selling stocks. At that point, consumers will no longer need brokers to give them information that they can obtain themselves, virtually for free.
Porter’s Value Chain Model
Organizations use Porter’s competitive forces model to design general strategies. To identify specific activities in which they can use competitive strategies for greatest impact, they use his value chain model (1985). A value chain is a sequence of activities through which the organi zation’s inputs, whatever they are, are transformed into more valuable outputs, whatever they are. The value chain model identifies points for which an organization can use information technology to achieve a competitive advantage (see Figure 2.4).
According to Porter’s value chain model, the activities conducted in any organization can be divided into two categories: primary activities and support activities. Primary activities relate to the production and distribution of the firm’s products and services. These activities create value for which customers are willing to pay. The primary activities are buttressed by support activities. Unlike primary activities, support activities do not add value directly to the firm’s products or services. Rather, as their name suggests, they contribute to the firm’s competitive advantage by supporting the primary activities.
Next, you will see examples of primary and support activities in the value chain of a manu facturing company. Keep in mind that other types of firms, such as transportation, healthcare, education, retail, and others, have different value chains. The key point is that every organiza tion has a value chain.
FIGURE 2.4 Porter’s value chain model.
In a manufacturing company, primary activities involve purchasing materials, processing the materials into products, and delivering the products to customers. Manufacturing compa nies typically perform five primary activities in the following sequence:
1. Inbound logistics (inputs)
2. Operations (manufacturing and testing)
3. Outbound logistics (storage and distribution)
4. Marketing and sales
5. Services
As work progresses in this sequence, value is added to the product in each activity. Specif ically, the following steps occur:
1. The incoming materials are processed (in receiving, storage, and so on) in activities called
inbound logistics.
2. The materials are used in operations, in which value is added by turning raw materials into products.
3. These products are prepared for delivery (packaging, storing, and shipping) in the out bound logistics activities.
4. Marketing and sales sell the products to customers, increasing product value by creating demand for the company’s products.
5. Finally, the company performs after-sales service for the customer, such as warranty ser vice or upgrade notification, adding further value.
As noted earlier, these primary activities are buttressed by support activities. Support activities consist of the following:
1. The firm’s infrastructure (accounting, finance, management)
2. Human resources management
3. Product and technology development (R&D)
4. Procurement
Each support activity can be applied to any or all of the primary activities. The support activities can also support one another.
A firm’s value chain is part of a larger stream of activities, which Porter calls a value sys tem. A value system, or an industry value chain, includes the suppliers that provide the inputs necessary to the firm along with their value chains. After the firm creates products, these prod ucts pass through the value chains of distributors (which also have their own value chains), all the way to the customers. All parts of these chains are included in the value system. To achieve and sustain a competitive advantage, and to support that advantage with information technol ogies, a firm must understand every component of this value system.
Strategies for Competitive Advantage
Organizations continually try to develop strategies to counter the five competitive forces iden tified by Porter. You will learn about five of those strategies here. Before we go into specifics, however, it is important to note that an organization’s choice of strategy involves trade-offs. For example, a firm that concentrates only on cost leadership might not have the resources avail able for research and development, leaving the firm unable to innovate. As another example, a company that invests in customer happiness (customer orientation strategy) will experience increased costs.
Companies must select a strategy and then stay with it, because a confused strategy can not succeed. This selection, in turn, decides how a company will use its information systems.
FIGURE 2.5 Strategies for competitive advantage.
A new information system that can improve customer service but will increase costs slightly will be welcomed at a high-end retailer such as Nordstrom’s, but not at a discount store such as Walmart. The following list presents the most commonly used strategies. Figure 2.5 provides an overview of these strategies.
1. Cost leadership strategy. Produce products and services at the lowest cost in the in dustry. An example is Walmart’s automatic inventory replenishment system, which enables Walmart to reduce inventory storage requirements. As a result, Walmart stores use floor space only to sell products, and not to store them, thereby reducing inventory costs.
2. Differentiation strategy. Offer different products, services, or product features than your competitors. Southwest Airlines, for example, has differentiated itself as a low-cost, short- haul, express airline. This has proved to be a winning strategy for competing in the highly competitive airline industry.
3. Innovation strategy. Introduce new products and services, add new features to existing products and services, or develop new ways to produce them. A classic example is the introduction of automated teller machines (ATMs) by Citibank. The convenience and cost-cutting features of this innovation gave Citibank a huge advantage over its compet itors. Like many innovative products, the ATM changed the nature of competition in the banking industry. Today, an ATM is a competitive necessity for any bank. Another excellent example is Apple’s rapid introduction of innovative products.
4. Operational effectiveness strategy. Improve the manner in which a firm executes its inter nal business processes so that it performs these activities more effectively than its rivals. Such improvements increase quality, productivity, and employee and customer satisfac tion while decreasing time to market.
5. Customer orientation strategy. Concentrate on making customers happy. Web-based sys tems are particularly effective in this area because they can create a personalized, one-to one relationship with each customer. Amazon ( www.amazon.com ), Apple ( www.apple
.com ), and Starbucks ( www.starbucks.com ) are classic examples of companies devoted to customer satisfaction.
Business–Information Technology Alignment
The best way for organizations to maximize the strategic value of IT is to achieve business– information technology alignment. In fact, the holy grail of organizations is business–information technology alignment, or strategic alignment (which we will call simply alignment). Business– information technology alignment (business–IT alignment) is the tight integration of the IT function with the organization’s strategy, mission, and goals. That is, the IT function directly supports the business objectives of the organization. There are six characteristics of excellent alignment:
1. Organizations view IT as an engine of innovation that continually transforms the business, often creating new revenue streams.
2. Organizations view their internal and external customers and their customer service func tion as supremely important.
3. Organizations rotate business and IT professionals across departments and job functions.
4. Organizations provide overarching goals that are completely clear to each IT and business employee.
5. Organizations ensure that IT employees understand how the company makes (or loses) money.
6. Organizations create a vibrant and inclusive company culture.
Unfortunately, many organizations fail to achieve this type of close alignment. In fact, ac cording to a McKinsey and Company survey on IT strategy and spending, only 16 percent of the IT and business executives who participated agreed that their organization had adequate align ment between IT and the business. Given the importance of business and IT alignment, why do so many organizations fail to implement this policy? The major reasons are the following:
· Business managers and IT managers have different objectives.
· The business and IT departments are ignorant of the other group’s expertise.
· A lack of communication.
Put simply, business executives often know little about information technology, and IT ex ecutives understand the technology but may not understand the real needs of the business. One solution to this problem is to foster a collaborative environment in organizations so that business and IT executives can communicate freely and learn from each other.
Businesses can also use enterprise architecture to foster alignment. Originally developed as a tool to organize a company’s IT initiatives, the enterprise architecture concept has evolved to encompass both a technical specification (the information and communication technolo gies and the information systems used in an organization) and a business specification (a col lection of core business processes and management activities).
Before you go on. . .
1. What are strategic information systems?
2. According to Porter, what are the five forces that could endanger a firm’s position in its industry or marketplaces?
3. Describe Porter’s value chain model. Differentiate between Porter’s competitive forces model and his value chain model.
4. What strategies can companies use to gain competitive advantage?
5. What is business–IT alignment?
6. Give examples of business–IT alignment at your university, regarding student systems. (Hint: What are the “business” goals of your university with regard to student registration, fee payment, grade posting, and so on?)
Summary 61
For All Business Majors
What’s in IT for me?
All functional areas in any organization must work together in an integrated fashion for the firm to respond adequately to business pressures. These responses typically require each functional area to use a variety of information systems to support, document, and manage cross-functional business processes. In today’s competi tive global marketplace, the timeliness and accuracy of these re sponses are even more critical.
Closely following this discussion, all functional areas must work together for the organization to gain a competitive advantage in its marketplace. Again, the functional areas use a variety of stra tegic information systems to achieve this goal. BPR and BPI process change efforts contribute to the goal as well.
information systems can help you, and eventually your organiza tion, respond to these pressures.
Achieving a competitive advantage is also essential for your organization’s survival. In many cases, you, your team, and all your colleagues will be responsible for creating a competitive ad vantage. Therefore, having general knowledge about strategy and about how information systems affect the organization’s strategy and competitive position will help you in your career.
You also need a basic knowledge of your organization’s strat egy, mission, and goals, as well as its business problems and how it makes (or loses) money. You now know how to analyze your or ganization’s strategy and value chain, as well as the strategies and value chains of your competitors. You also have acquired a general knowledge of how information technology contributes to organiza tional strategy. This knowledge will help you to do your job better, to be promoted more quickly, and to contribute significantly to the success of your organization.
Summary
1. Discuss ways in which information systems enable cross-functional business processes and processes for a single functional area.
A business process is an ongoing collection of related activities that produce a product or a service of value to the organization, its business partners, and its customers. Examples of business processes in the functional areas include managing accounts payable, managing ac counts receivable, managing after-sale customer follow-up, managing bills of materials, managing manufacturing change orders, applying disability policies, employee hiring, computer user and staff training, and applying Internet use policy. The procurement and fulfillment pro cesses are examples of cross-functional business processes.
2. Compare and contrast business process reengineering and business process management to determine the different ad vantages and disadvantages of each.
Business process reengineering (BPR) is a radical redesign of business processes that is intended to improve the efficiency and effectiveness of an organization’s business processes. The key to BPR is for enter prises to examine their business processes from a “clean sheet” per spective and then determine how they can best reconstruct those processes to improve their business functions. Because BPR proved difficult to implement, organizations have turned to business process management. Business process management (BPM) is a management technique that includes methods and tools to support the design, analysis, implementation, management, and optimization of business processes.
3. Identify effective IT responses to different kinds of business pressures.
· Market pressures: An example of a market pressure is powerful customers. Customer relationship management is an effective IT response that helps companies achieve customer intimacy.
· Technology pressures: An example of a technology pressure is information overload. Search engines and business intelligence applications enable managers to access, navigate, and use vast amounts of information.
· Societal/political/legal pressures: An example of a societal/politi cal/legal pressure is social responsibility, such as the state of the physical environment. Green IT is one response that is intended to improve the environment.
4. Describe the strategies that organizations typically adopt to counter Porter’s five competitive forces.
Porter’s five competitive forces:
1. The threat of entry of new competitors: For most firms, the web in creases the threat that new competitors will enter the market by reducing traditional barriers to entry. Frequently, competitors need only to set up a website to enter a market. The web can also in crease barriers to entry, as when customers come to expect a non trivial capability from their suppliers.
2. The bargaining power of suppliers: The web enables buyers to find alternative suppliers and to compare prices more easily, thereby
62 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
reducing suppliers’ bargaining power. From a different perspective, as companies use the web to integrate their supply chains, partici pating suppliers can lock in customers, thereby increasing suppliers’ bargaining power.
3. The bargaining power of customers (buyers): The web provides cus tomers with incredible amounts of choices for products, as well as information about those choices. As a result, the web increases buyer power. However, companies can implement loyalty programs in which they use the web to monitor the activities of millions of customers. Such programs reduce buyer power.
4. The threat of substitute products or services: New technologies create substitute products very rapidly, and the web makes in formation about these products available almost instantly. As a result, industries (particularly information-based industries) are in great danger from substitutes (e.g., music, books, news papers, magazines, software). However, the web also can enable a company to build in switching costs, so that it will cost cus tomers time or money to switch from your company to that of a competitor.
5. The rivalry among existing firms in the industry: In the past, propri etary information systems provided strategic advantage for firms in highly competitive industries. The visibility of Internet applications on the web makes proprietary systems more difficult to keep secret. Therefore, the web makes strategic advantage more short-lived.
The five strategies are as follows:
1. Cost leadership strategy—Produce products and services at the lowest cost in the industry.
2. Differentiation strategy—Offer different products, services, or prod uct features.
3. Innovation strategy—Introduce new products and services, put new features in existing products and services, or develop new ways to produce them.
4. Operational effectiveness strategy—Improve the manner in which internal business processes are executed so that a firm performs similar activities better than its rivals.
5. Customer orientation strategy—Concentrate on making customers happy.
Chapter Glossary
business environment The combination of social, legal, economic, physical, and politi cal factors in which businesses conduct their operations.
business–information technology align ment The tight integration of the IT function with the strategy, mission, and goals of the organization.
business process A collection of related activ ities that create a product or a service of value to the organization, its business partners, and its customers.
business process management A manage ment technique that includes methods and tools to support the design, analysis, imple mentation, management, and optimization of business processes.
business process reengineering A radical re design of a business process that improves its efficiency and effectiveness, often by beginning with a “clean sheet” (i.e., from scratch).
competitive advantage An advantage over competitors in some measure such as cost, quality, or speed; leads to control of a market and to larger-than-average profits.
competitive forces model A business framework devised by Michael Porter that analyzes competitiveness by recognizing five
major forces that could endanger a company’s position.
cross-functional processes No single functional area is responsible for a process’s execution.
digital divide The gap between those who have access to information and communica tions technology and those who do not.
entry barrier Product or service feature that customers expect from organizations in a cer tain industry; an organization trying to enter this market must provide this product or service at a minimum to be able to compete.
globalization The integration and interde pendence of economic, social, cultural, and eco logical facets of life, enabled by rapid advances in information technology.
individual social responsibility See organi zational social responsibility.
make-to-order The strategy of producing customized products and services.
mass customization A production process in which items are produced in large quantities but are customized to fit the desires of each customer.
organizational social responsibility (also individual social responsibility) Efforts
by organizations to solve various social problems.
primary activities Those business activities related to the production and distribution of the firm’s products and services, thus creating value.
strategic information systems (SISs) Sys tems that help an organization gain a compet itive advantage by supporting its strategic goals and increasing performance and productivity.
support activities Business activities that do not add value directly to a firm’s product or service under consideration but support the pri mary activities that do add value.
value chain A sequence of activities through which the organization’s inputs, whatever they are, are transformed into more valuable out puts, whatever they are.
value chain model Model that shows the primary activities that sequentially add value to the profit margin; also shows the support activities.
value system Includes the producers, suppli ers, distributors, and buyers, all with their own value chains.
Closing Case 63
Discussion Questions
Consider the student registration process at your university:
· Describe the steps necessary for you to register for your classes each semester.
· Describe how information technology is used (or is not used) in each step of the process.
· Why is it so difficult for an organization to actually implement business process reengineering?
· Explain why IT is both a business pressure and an enabler of re sponse activities that counter business pressures.
· What does a flat world mean to you in your choice of a major? In your choice of a career? Will you have to be a “lifelong learner”? Why or why not?
· What might the impact of a flat world be on your standard of living?
· Is IT a strategic weapon or a survival tool? Discuss.
· Why might it be difficult to justify a strategic information system?
· Describe the five forces in Porter’s competitive forces model, and explain how increased access to high-speed Internet has affected each one.
· Describe Porter’s value chain model. What is the relationship be tween the competitive forces model and the value chain model?
· Describe how IT can be used to support different value chains for different companies.
· Discuss the idea that an information system by itself can rarely provide a sustainable competitive advantage.
Problem-Solving Activities
1. Surf the Internet for information about the Department of Home land Security. Examine the available information, and comment on the role of information technologies in the department.
2. Experience mass customization by designing your own shoes at www.nike.com , your car at www.jaguar.com , your CD at www
.easternrecording.com , your business card at www.iprint.com , and your diamond ring at www.bluenile.com . Summarize your experiences.
3. Access www.go4customer.com . What does this company do and where is it located? Who are its customers? Provide examples of how a
U.S. company would use its services.
4. Enter Walmart China ( www.wal-martchina.com/english/index
.htm ). How does Walmart China differ from your local Walmart (con sider products, prices, services, and so on.)? Describe these differences.
5. Apply Porter’s value chain model to Costco ( www.costco.com ). What is Costco’s competitive strategy? Who are Costco’s major com petitors? Describe Costco’s business model. Describe the tasks that Costco must accomplish for each primary value chain activity. How would Costco’s information systems contribute to Costco’s competi tive strategy, given the nature of its business?
Apply Porter’s value chain model to Dell ( www.dell.com ). What is Dell’s competitive strategy? Who are Dell’s major competitors? Describe Dell’s business model. Describe the tasks that Dell must accomplish for each primary value chain activity. How would Dell’s in formation systems contribute to Dell’s competitive strategy, given the nature of its business?
Closing Case
Football Teams Use Virtual Reality
POM
The Problem
College and professional football teams have a unique set of problems. First and foremost, teams would like to reduce the physical wear and tear of drills and practices on their players. In the National Football League (NFL), the most recent Collective Bargaining Agreement (2011) reduced the number of off-season practices, prohibited training camp “two-a-day” practices, and limited the number of contact practices in both the preseason and the regular season.
At the same time, however, players must learn the playbook as quickly and thoroughly as possible. However, when football teams prac tice, the time on the field for repetitions (“reps”) is limited. It is particu larly important for the starting players to participate in reps together.
Specifically, consider quarterbacks, arguably the most important position on a football team. Young quarterbacks are often thrown into live action before they are ready because starters are injured. This situation compresses the amount of time available for young quar terbacks to learn enough to make correct decisions, let alone have a chance of winning.
A Potential Solution
Teams are beginning to use an immersive virtual reality experi ence that makes players feel and think as if they are actually on the practice field. Virtual reality (VR) is a set of information tech nologies that simulate physical presence in the real world, includ ing sight, smell, sound, and touch. Modern VR environments are presented on stereoscopic, head-mounted displays—for example,
64 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
the Oculus Rift, now owned by Facebook; www.oculus.com —to realistically create an artificial experience such as a video game. VR environments can also create a lifelike, real-world experience such as football. As of July 2015, two companies were providing VR experiences for professional, college, and high school football pro grams: STriVR Labs ( http://strivrlabs.com ) and EON Sports ( www
Here is how these experiences work from the perspective of a quarterback. When he puts on the Oculus Rift headset and the head phones, he is standing in his position on the practice field. As he scans the field, he recognizes the defensive alignment, and he observes how his offense is positioned. He turns around, and he sees that his run ning back is waiting for the handoff. A voice calls the play, the ball is snapped, and a play unfolds. As the play progresses, the quarterback can scan the defense to determine the type of coverage. One quarter back noted, “It is like watching film, but you are actually there on the field. I feel like I am actually in the scrimmage.”
The systems offer a fully immersive, 360-degree view for players and coaches as teams run through plays on a practice field, providing simulated bodies with natural body movements. Players can also hear coaches talking as well as the things they would normally hear on the practice field. Staff members spend many hours turning the video into useful virtual reality footage.
The systems gather video from multiple cameras on four-foot tripods placed around the scrimmage on both the offensive and de fensive sides. The cameras capture live plays and content from teams’ practices and then, through their software, produce three-dimensional video for players through an Oculus Rift headset and headphones. The VR technology essentially has football players walking through real-game experiences.
Although the systems work for every player, quarterback was the logical starting point. The systems were initially utilized as a method to train quarterbacks with mental exercises to reinforce actual prac tice repetitions. They quickly expanded for use with other positions, because they are invaluable in improving players’ reaction times and decision making.
STriVR and EON clients include college teams such as Stanford, Auburn, Clemson, Dartmouth, Vanderbilt, Kansas, Mississippi, and UCLA, as well as the National Football League’s Dallas Cowboys and New England Patriots. The first pick in the 2015 NFL draft, Jameis Winston of the Tampa Bay Buccaneers, trained using the EON system. Furthermore, nearly 100 high school football programs are using VR packages.
STriVR and EON have concentrated on building libraries of basic plays for their clients. After shooting video at various practices, the companies deliver the VR footage to the teams within a few weeks. However, in the near future, the companies hope to reduce the turn around time, allowing teams to use VR video tailored to specific game plans.
There are other uses for VR technology in football programs, including:
· Teaching incoming freshmen and preparing backup players who do not get as many reps as the starters.
· Providing value in recruiting, because coaches could take lap- tops, VR headsets, and headphones on the road. Without visiting a campus, recruits could be virtually standing in a locker room with potential teammates, listening to a pregame pep talk. They could then be in the tunnel, racing onto the field with the other players, or on the sidelines during a game.
· Helping injured players—instead of pushing their bodies through a real practice, they could work on their reps and their mental ex ercises virtually.
The Results
The use of virtual reality technology in sports is just beginning. How ever, one NFL executive told STriVR to charge $250,000 per year to pro fessional football teams because teams using the technology would be “picking up half a coach.” Finally, STriVR and EON have plans for basketball and baseball in the near future.
Sources: Compiled from J. Zorowitz, “It Just Got Real,” NBC Sports, 2016;
M. Burns, “Texas Tech, Stanford Football Big Believers in Virtual Reality,” SportTechie, September 29, 2016; C. Osborne, “Oculus Rift: How Will Virtual Reality Change Watching and Playing Sport?” BBC Sport, April 7, 2016; S. Wagner-McGough, “Report: Patriots Will Arm Themselves with Virtual Reality Technology,” CBS Sports, July 23, 2015; S. Springer, “Patriots Poised to Enhance Practice with Virtual Reality Technology,” The Boston Globe, July 22, 2015; M. Lelinwalla, “All You Need to Know about Virtual Reality Training in College Football and the NFL,” Tech Times, June 29, 2015; G. Schroeder, “Virtual Reality Becomes a Reality for College Football,” USA Today, June 9, 2015; B. Fischer, “Use of Virtual-Reality Training Continues to Grow in College Football,” NFL.com , June 8, 2015; B. Wallace, “Tackling Tech: Why Virtual Reality Will Become Reality for the NFL,” www.patriots.com , May 28, 2015; B. Feldman,
“‘I Was Blown Away’: Welcome to Football’s Quarterback Revolution,” Fox Sports, March 11, 2015; M. Tait, “KU Becomes Pioneer in Using Virtual Reality to Enhance Football Program,” Tale of the Tait KUsports.com , March 26, 2013; N. Davis, “NFL, Players Announce New 10-Year Labor Agreement,” USA Today, July 25, 2011; http://strivrlabs.com, accessed September 22, 2016.
Questions
1. In what other ways could professional and college football programs use virtual reality systems? (Hint: Consider the fan experience.)
2. Are STriVR and EON strategic information systems for any foot ball program? Why or why not? Support your answer with specific examples.
3. Will STriVR and EON become competitive necessities for football programs? Why or why not? Support your answer with specific examples.
Information Security
CHAPTER OUTLINE LEARNING OBJECTIVES
1.1 Introduction to Information 4.1 Identify the five factors that contribute to the increasing vulnerability of Security information resources and specific examples of each factor.
1.2 Unintentional Threats to 4.2 Compare and contrast human mistakes and social engineering, and Information Systems provide a specific example of each one.
1.3 Deliberate Threats to Informa- 4.3 Discuss the 10 types of deliberate attacks. tion Systems
1.4 What Organizations Are Doing to 4.4 Describe the three risk mitigation strategies, and provide an example of Protect Information Resources each one in the context of owning a home.
1.5 Information Security Controls 4.5 Identify the three major types of controls that organizations can use to
protect their information resources, and provide an example of each one.
The Hacks of the Democratic National Committee
The Problem
Before we discuss the hacks of the Democratic National Com mittee (DNC; www.democrats.org ), let’s take a brief look at the organ ization and its security status before the hacks. The DNC is a nonprofit group, dependent on donations, and had a fraction of the security budget that a corporation its size would normally have. Before the hacks, the DNC had a standard e-mail spam-filtering service, intended to block phishing attacks and malware. That is, the DNC did not have the most advanced systems in place to monitor suspicious network traffic, detect attacks, and prohibit them from compromising DNC systems.
MIS
In September 2015, the Federal Bureau of Investigation (FBI; www.fbi.gov ) called the DNC, stating that hackers had compromised the DNC’s computer system. The FBI’s call went to a Mr. Talmene at the DNC’s help desk. He was not an expert in cyberattacks and was not even sure that the call actually came from the FBI. In fact, Mr. Talmene was a contractor, not a full-time DNC employee. His initial scan of the DNC system—using outdated security software tools and incomplete information from the FBI—found nothing.
In October 2015, the FBI left numerous voice messages warning him of a cyberintrusion at the DNC. He had not noticed or found any thing, and therefore did not respond. In November 2015, the FBI told him that a DNC computer was sending information to Russia.
Attackers then sent many spear-phishing e-mails to American po litical targets. For example, on March 19, 2016, Mr. John Podesta, chair man of the Clinton campaign, received a spear-phishing e-mail. The e-mail warned him that someone had used his password to try to sign in to his Google account. The message added that the sign-in attempt had occurred in Ukraine and that Google had stopped the attempt. The message then stated that Mr. Podesta should change his password immediately. He did so, and as a result the hackers had access to some 60,000 of his past e-mails.
On March 22, 2016, Mr. Billy Rinehart, a former DNC regional field director who was working for Mrs. Clinton’s campaign, received an identical spear-phishing e-mail. When Mr. Rinehart changed his pass word, the hackers had access to his e-mail account.
Then a second team of hackers began to target the DNC and other Democrats. During this second wave of attacks, the hackers also gained access to the Democratic Congressional Campaign Committee
85
100 CHAPTER 4 Information Security
(DCCC; www.dccc.org ). The confidential documents stolen from the DCCC appeared in congressional races in many states, smearing some of them with accusations of scandal.
The hackers then gained access to the DNC’s computer network through a virtual private network connection. Though DNC officials had learned that the DCCC had been infected, they did not notify their sister organization because they were afraid that the information would leak.
The FBI also noted this activity and again warned Mr. Talmene. He had found copies of the spear-phishing e-mails in the DNC’s spam filter, but he said that he had no reason to believe that the DNC’s com puter systems had been compromised.
The Democratic Party’s problems continued. In mid-June 2016, someone calling himself Guccifer 2.0 appeared on the web, claiming to be the DNC hacker. He posted a confidential committee document detailing Mr. Trump’s record and other documents to prove that he had genuine information. Guccifer 2.0 stated that he gave the main part of the papers to WikiLeaks and that WikiLeaks would publish them soon. By the summer of 2016, Democrats’ private e-mails and confidential documents began to appear online.
On July 22, three days before the start of the Democratic National Convention, WikiLeaks released 44,000 DNC e-mails. Some of the messages made it clear that some DNC officials favored Mrs. Clinton over her challenger, Bernie Sanders. On October 7, WikiLeaks began the serial publication of thousands of private e-mails to and from Mr. Podesta, Mrs. Clinton’s campaign manager.
A Too-Late IT Solution
In mid-April 2016, seven months after it had first been warned, the DNC installed an up-to-date set of security software tools. Using the new software, Mr. Talmene examined the administrative logs of the DNC’s computer system and found that an unauthorized person, with administrator-level security access, had gained access to the DNC’s system.
Now, the three most important questions for the DNC were: What data was accessed? How was the attack accomplished? How do we stop it?
The DNC immediately hired CrowdStrike ( www.crowdstrike
.com ), a cybersecurity firm, to scan its systems, identify the intruders, and build a new computer and telephone system from scratch. Within a day, CrowdStrike security experts identified the two sets of attackers, naming them Cozy Bear and Fancy Bear. CrowdStrike concluded that it was Cozy Bear that first penetrated the DNC in the summer of 2015. Fancy Bear appeared in March 2016, first penetrating the computers of the DCCC, and then penetrating the DNC.
Interestingly, CrowdStrike experts found signs that the two hack ing groups had not coordinated their attacks. Fancy Bear, apparently not knowing that Cozy Bear had been stealing DNC files for months, stole many of the same documents.
CrowdStrike then helped the DNC secretly replace its computer systems. All laptops were turned in and their hard drives were wiped clean, with the uninfected information on them placed on new hard drives.
Furthermore, CrowdStrike stated that the intrusions had origi nated in Russia. For a discussion of the reasons behind why Crowd- Strike and the U.S. intelligence community accused Russia of state-sponsored hacks, see the Endnotes of this case.
Results
When the FBI initially discovered the hack of the DNC, one cyberse curity firm stated that it was surprising that the FBI did not contact a
more senior DNC official or send an agent in person to party headquar ters in order to force a response. Furthermore, the FBI could not e-mail anyone at the DNC, for fear of alerting the hackers that the FBI knew they were in the DNC’s network.
The DNC’s slow response to the FBI’s notifications meant that the best chance to stop the attacks was lost. The failure to understand the scope of the attacks resulted in an inability to minimize their impact. Furthermore, the hesitant approach by the FBI meant that the hackers moved freely through the DNC’s network for nearly seven months be fore DNC officials were alerted to the attack and hired cyberexperts to protect their systems.
The release of confidential e-mails and documents had seri ous consequences. Specifically, Representative Debbie Wasserman Schultz, chairperson of the DNC, and many of her top aides resigned under pressure on the eve of the Democratic convention. Furthermore, serious debate continues over whether or not the serial release of the e-mails and documents cost Hilary Clinton the presidency.
Julian Assange, WikiLeaks founder and editor, has denied that his site had become a conduit for Russian hackers working for Mr. Putin’s government or that he was deliberately trying to undermine Mrs. Clin ton’s candidacy. In fact, Mr. Assange has refused to say anything about WikiLeaks sources for the hacked material.
Security experts in the private sector as well as the U.S. intelli gence community assert that the compromise of the DNC’s computer system was a cyberespionage and information-warfare campaign de signed to disrupt the 2016 presidential election, the first such attempt by a foreign power in American history. Security experts feel that the attack intended to harm one candidate, Hillary Clinton, and influence the election in favor of her opponent, Donald Trump.
On October 7, 2016, the United States formally accused the Rus sian government of being behind the hackings. The United States Department of Homeland Security and the office of the Director of National Intelligence stated that the U.S. intelligence community was confident that the Russian government directed the attacks and the release of the obtained or allegedly obtained material in an attempt to interfere with the U.S. election process. Admiral Michael Rogers, the director of the National Security Agency and commander of the U.S. Cyber Command, noted at a postelection conference: “There should not be any doubt in anybody’s mind that this (the Russian attack) was a conscious effort by a nation-state to attempt to achieve a specific effect.”
On December 9, 2016, the CIA told U.S. legislators that the
U.S. intelligence community had concluded that Russia conducted operations during the 2016 U.S. election to assist Donald Trump in winning the presidency. Then President-elect Trump immediately issued a statement that disregarded the intelligence community’s conclusions.
On December 29, 2016, the White House announced a series of measures to punish Russian’s state-sponsored political hackers and deter further interference in U.S. elections. The measures include sanc tions against several Russian organizations and individuals targeted by name. The United States also expelled 35 Russian diplomats believed to have acted as intelligence agents and banned Russian personnel from two Russian-government compounds that the White House said were used for Russian intelligence gathering on U.S. soil. The White House noted that these measures would not be the end of U.S. retali ation for the hacks.
In late December, 2016, four U.S. senators—two Republicans and two Democrats—joined forces to pledge an investigation while point edly ignoring Mr. Trump’s skeptical claims. The FBI has declined to comment on the agency’s handling of the hack.
Introduction 87
Endnotes (Evidence Pointing to the Russian Government)
The CrowdStrike investigators had recognized the distinctive digital signatures of Cozy Bear and Fancy Bear. Cozy Bear and Fancy Bear are CrowdStrike’s names for two Russian hacking groups. (Cozy Bear is CrowdStrike’s name for “the Dukes.”)
It is often impossible to name an attacker with absolute certainty. However, by accumulating a reference library of hacking techniques and targets over time, it is possible to identify repeat offenders. Fancy Bear, for example, had gone after military and political targets in Ukraine and Georgia, and at NATO installations. Another clue was that the Russian hacking groups tended to be active during working hours in the Moscow time zone.
While CrowdStrike caught the attackers in the act (in real time), the digital details by themselves do not offer definitive proof of the identity of those behind the hacks. In early February 2017, there was still no definite proof of who was responsible for the attacks.
Sources: “U.S. Intel Report Identifies Russians Who Gave Emails to WikiLeaks Officials,” Reuters, January 6, 2017; W. Ashford, “Security Research Links Russia to U.S. Election Cyber Attacks,” Computer Weekly, January 6, 2017; K. Williams, “FBI, DHS Release Report on Russia Hacking,” The Hill, December 29, 2016; A. Greenberg, “Obama’s Russian Hacking Retaliation Is Biggest ‘Since the Cold War,’” Wired, December 29, 2016; M. Calabresi and R. Rebala, “Here’s the Evidence Russia Hacked the Democratic National Committee,” Time, December 13, 2016; E. Lipton, D. Sanger, and S. Shane, “The Perfect Weapon: How Russian Cyberpower Invaded the U.S.,” New York Times, December
13, 2016; S. Gallagher, “Did the Russians ‘Hack’ the Election? A Look at the Established Facts,” Ars Technica, December 12, 2016; A. Entous, E. Nakashima, and G. Miller, “Secret CIA Assessment Says Russia Was Trying to Help Trump Win White House,” The Washington Post, December 9, 2016; C. Sanchez and B. Logan, “The CIA Says It Has Evidence that Russia Tried to Help Trump Win the
U.S. Election,” Business Insider, December 9, 2016; T. Rid, “How Russia Pulled Off the Biggest Election Hack in U.S. History,” Esquire, October 20, 2016; E. Nakashima, “U.S. Government Officially Accuses Russia of Hacking Campaign to Interfere with Elections,” The Washington Post, October 7, 2016; A. Spencer and S. Thielman, “U.S. Officially Accuses Russia of Hacking DNC and Interfering with Election,” The Guardian, October 7, 2016; “U.S. Election: Email Row Claims Debbie Wasserman Schultz,” BBC News, July 25, 2016; “Bernie Sanders Calls for Debbie Wasserman Schultz to Resign in Wake of Email Leaks,” ABC News, July 24, 2016.
Questions
1. Discuss the problems with the DNC’s security efforts before the hack.
2. Discuss the problems with the way the FBI handled the hacks.
3. What is the best solution for preventing successful hacks such as those of the DNC and DCCC?
Introduction
The cases in this chapter provide several lessons. First, it is difficult, if not impossible, for or ganizations to provide perfect security for their data. Second, there is a growing danger that countries are engaging in economic cyberwarfare among themselves. Third, it appears that it is impossible to secure the Internet. The answer to this question impacts each and every one of us. In essence, our personally identifiable, private data are not secure.
The answers to these issues and others are not clear. As you learn about information secu rity in the context of information technology, you will acquire a better understanding of these issues, their importance, their relationships, and their trade-offs. Keep in mind that the issues involved in information security impact individuals and small organizations as well as large companies.
Information security is especially important to small businesses. Large organizations that experience an information security problem have greater resources to bring to both resolve and survive the problem. In contrast, small businesses have fewer resources and therefore can be more easily destroyed by a data breach.
When properly used, information technologies can have enormous benefits for individ uals, organizations, and entire societies. In Chapters 1 and 2, you read about diverse ways in which IT has made businesses more productive, efficient, and responsive to consumers. You also explored fields such as medicine and philanthropy in which IT has improved people’s health and well-being. Unfortunately, information technologies can also be misused, often with devastating consequences. Consider the following scenarios:
· Individuals can have their identities stolen.
· Organizations can have customer information stolen, leading to financial losses, erosion of customer confidence, and legal action.
· Countries face the threats of cyberterrorism and cyberwarfare, terms for Internet-based at tacks. Cyberwarfare is a critical problem for the U.S. government. In fact, President Obama signed a cyberwarfare directive in October 2012. In that directive, the White House, for the first time, laid out specific ground rules for how and when the U.S. military can carry out offensive and defensive cyber operations against foreign threats. The directive emphasizes the Obama administration’s focus on cybersecurity as a top priority.
Clearly, the misuse of information technologies has come to the forefront of any discussion of IT. Studies have revealed that each security breach costs an organization millions of dollars. In fact, a study by the Ponemon Institute ( www.ponemon.org ) revealed that for large companies in the United States, the average cost of cybercrime was approximately $15 million in 2016. For large companies outside the United States, the average cost of a data breach was almost $8 mil lion in 2016. Security analysts note that total, global cybercrime cost organizations $400 billion in 2015. Unfortunately, these analysts fear that cybercrime costs will increase to $2 trillion by 2019. The direct costs of a data breach include hiring forensic experts, notifying customers, set
ting up telephone hotlines to field queries from concerned or affected customers, offering free credit monitoring, and providing discounts for future products and services. The more intan gible costs of a breach include the loss of business from increased customer turnover—called customer churn—and decreases in customer trust.
Just how bad is cybercrime today? Let’s consider these examples:
· Swift ( www.swift.com )—the Society for Worldwide Interbank Financial Telecommunica tion—is known as an extremely secure system that banks use to authorize payments from one account to another. In April 2016, Swift acknowledged that cyberthieves had stolen
$81 million from Bangladesh’s central bank by gaining access to Swift financial networks.
· In 2016, Yahoo! revealed that attackers had stolen data from over 500 million user accounts in 2014. The company was criticized for not informing users sooner about the breach, for poor security practices, and for failing to encrypt all user security questions and answers. Unfortunately, after disclosing the 2014 breach, Yahoo! announced that in 2013, attackers had stolen personal information from an additional one billion accounts.
In July 2016, Verizon announced that it would buy Yahoo! for $4.8 billion. In October 2016, Verizon was reportedly seeking a $1 billion discount on the purchase, claiming that Yahoo! had diminished in value since the data breach. In February 2017, the two companies agreed to re duce the acquisition price by $350 million, resulting in a $4.48 billion all-cash offer.
Unfortunately, employee negligence causes many data breaches, meaning that organiza tional employees are a weak link in information security. It is therefore very important for you to learn about information security so that you will be better prepared when you enter the workforce.
Introduction to Information Security
4.1
Security can be defined as the degree of protection against criminal activity, danger, dam age, or loss. Following this broad definition, information security refers to all of the processes and policies designed to protect an organization’s information and information systems (IS) from unauthorized access, use, disclosure, disruption, modification, or destruction. You have seen that information and information systems can be compromised by deliberate criminal ac tions and by anything that can impair the proper functioning of an organization’s information systems.
Before continuing, let’s consider these key concepts. Organizations collect huge amounts of information and employ numerous information systems that are subject to myriad threats. A threat to an information resource is any danger to which a system may be exposed. The exposure of an information resource is the harm, loss, or damage that can result if a threat compromises that resource. An information resource’s vulnerability is the possibility that the system will be harmed by a threat.
88 CHAPTER 4 Information Security
Introduction to Information Security 89
Today, five key factors are contributing to the increasing vulnerability of organizational information resources, making it much more difficult to secure them:
1. Today’s interconnected, interdependent, wirelessly networked business environment
2. Smaller, faster, cheaper computers and storage devices
3. Decreasing skills necessary to be a computer hacker
4. International organized crime taking over cybercrime
5. Lack of management support
The first factor is the evolution of the IT resource from mainframe only to today’s highly complex, interconnected, interdependent, wirelessly networked business environment. The Internet now enables millions of computers and computer networks to communicate freely and seamlessly with one another. Organizations and individuals are exposed to a world of un trusted networks and potential attackers. In general, a trusted network is any network within your organization and an untrusted network is any network external to your organization. Also, wireless technologies enable employees to compute, communicate, and access the Internet anywhere and any time. Significantly, wireless is an inherently unsecure broadcast communi cations medium.
The second factor reflects the fact that modern computers and storage devices (e.g., thumb drives or flash drives) continue to become smaller, faster, cheaper, and more portable, with greater storage capacity. These characteristics make it much easier to steal or lose a com puter or storage device that contains huge amounts of sensitive information. Also, far more people are able to afford powerful computers and connect inexpensively to the Internet, thus raising the potential of an attack on information assets.
The third factor is that the computing skills necessary to be a hacker are decreasing. The reason is that the Internet contains information and computer programs called scripts that us ers with few skills can download and use to attack any information system connected to the Internet. (Security experts can also use these scripts for legitimate purposes, such as testing the security of various systems.)
The fourth factor is that international organized crime is taking over cybercrime. Cyber- crime refers to illegal activities conducted over computer networks, particularly the Internet. iDefense ( http://labs.idefense.com ), a company that specializes in providing security infor mation to governments and Fortune 500 companies, maintains that groups of well-organized criminal organizations have taken control of a global billion-dollar crime network. The net work, powered by skillful hackers, targets known software security weaknesses. These crimes are typically nonviolent, but quite lucrative. Consider, for example, that losses from armed rob beries average hundreds of dollars, and those from white-collar crimes average tens of thou sands of dollars. In contrast, losses from computer crimes average hundreds of thousands of dollars. Also, computer crimes can be committed from anywhere in the world, at any time, effectively providing an international safe haven for cybercriminals. Computer-based crimes cause billions of dollars in damages to businesses each year, including the costs of repairing information systems and of lost business.
The fifth, and final, factor is lack of management support. For the entire organization to take security policies and procedures seriously, senior managers must set the tone. Unfortu nately, senior managers often do not do so. Ultimately, however, lower-level managers may be even more important. These managers are in close contact with employees every day and are thus in a better position to determine whether employees are following security procedures.
Before you go on. . .
1. Define information security.
2. Differentiate among a threat, an exposure, and a vulnerability.
3. Why are the skills needed to be a hacker decreasing?
Unintentional Threats to Information Systems
4.2
Information systems are vulnerable to many potential hazards and threats, as you can see in Figure 4.1. The two major categories of threats are unintentional threats and deliberate threats. This section discusses unintentional threats, and the next section addresses deliberate threats. Unintentional threats are acts performed without malicious intent that nevertheless rep resent a serious threat to information security. A major category of unintentional threats is hu
man error.
FIGURE 4.1 Security threats.
90 CHAPTER 4 Information Security
Human Errors
Unintentional Threats to Information Systems 91
Organizational employees span the breadth and depth of the organization, from mail clerks to the CEO, and across all functional areas. There are two important points to be made about employees. First, the higher the level of employee, the greater the threat he or she poses to information security. This is true because higher-level employees typically have greater access to corporate data, and they enjoy greater privileges on organizational information systems. Second, employees in two areas of the organization pose especially significant threats to infor mation security: human resources and information systems (IS). Human resources employees generally have access to sensitive personal information about all employees. Likewise, IS em ployees not only have access to sensitive organizational data, but also often control the means to create, store, transmit, and modify those data.
Other employees include contract labor, consultants, and janitors and guards. Contract labor, such as temporary hires, may be overlooked in information security arrangements. How ever, these employees often have access to the company’s network, information systems, and information assets. Consultants, although technically not employees, perform work for the company. Depending on the nature of their work, they may also have access to the company’s network, information systems, and information assets.
Finally, janitors and guards are the most frequently ignored people in information security systems. Companies frequently outsource their security and janitorial services. As with con tractors, then, these individuals work for the company although they technically are not em ployees. Moreover, they are usually present when most—if not all—other employees have gone home. They typically have keys to every office, and nobody questions their presence in even the most sensitive parts of the building. In fact, an article from 2600: The Hacker Quarterly described how to get a job as a janitor for the purpose of gaining physical access to an organization.
Human errors or mistakes by employees pose a serious problem. These errors are typically the result of laziness, carelessness, or a lack of awareness concerning information security. This lack of awareness arises from poor education and training efforts by the organization. Human mistakes manifest themselves in many different ways, as illustrated in Table 4.1.
The human errors you have just studied, although unintentional, are committed entirely by employees. However, employees also can make unintentional mistakes in response to
|
TABLE 4.1 |
Human Mistakes |
|
Human Mistake |
Description and Examples |
|
Carelessness with laptops |
Losing or misplacing laptops, leaving them in taxis, and so on. |
|
Carelessness with computing devices |
Losing or misplacing these devices, or using them carelessly so that malware is introduced into an organization’s network. |
|
Opening questionable e-mails |
Opening e-mails from someone unknown, or clicking on links em bedded in e-mails (see phishing attack in Table 4.2). |
|
Careless Internet surfing |
Accessing questionable websites; can result in malware and alien software being introduced into the organization’s network. |
|
Poor password selection and use |
Choosing and using weak passwords (see strong passwords in the “Authentication” section later in this chapter). |
|
Carelessness with one’s office |
Leaving desks and filing cabinets unlocked when employees go home at night; not logging off the company network when leaving the office for any extended period of time. |
|
Carelessness using unmanaged devices |
Unmanaged devices are those outside the control of an organi zation’s IT department and company security procedures. These devices include computers belonging to customers and business partners, computers in the business centers of hotels, and so on. |
|
Carelessness with discarded equipment |
Discarding old computer hardware and devices without completely wiping the memory; includes computers, smartphones, BlackBerry units, and digital copiers and printers. |
|
Careless monitoring of environmental hazards |
These hazards, which include dirt, dust, humidity, and static elec tricity, are harmful to the operation of computing equipment. |
actions by an attacker. Attackers often employ social engineering to induce individuals to make unintentional mistakes and disclose sensitive information.
Social Engineering
Social engineering is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords. The most common example of social engineering occurs when the attacker impersonates some one else on the telephone, such as a company manager or an information systems employee. The attacker claims he forgot his password and asks the legitimate employee to give him a password to use. Other common ploys include posing as an exterminator, an air conditioning technician, or a fire marshal. Examples of social engineering abound.
In one company, a perpetrator entered a company building wearing a company ID card that looked legitimate. He walked around and put up signs on bulletin boards reading “The help desk telephone number has been changed. The new number is 555-1234.” He then exited the building and began receiving calls from legitimate employees thinking they were calling the company help desk. Naturally, the first thing the perpetrator asked for was username and pass word. He now had the information necessary to access the company’s information systems.
Two other social engineering techniques are tailgating and shoulder surfing. Tailgating is a technique designed to allow the perpetrator to enter restricted areas that are controlled with locks or card entry. The perpetrator follows closely behind a legitimate employee and, when the employee gains entry, the attacker asks him or her to “hold the door.” Shoulder surf ing occurs when a perpetrator watches an employee’s computer screen over the employee’s shoulder. This technique is particularly successful in public areas such as in airports and on commuter trains and airplanes.
Before you go on. . .
1. What is an unintentional threat to an information system?
2. Provide examples of social engineering attacks other than the ones just discussed.
Deliberate Threats to Information Systems
4.3
There are many types of deliberate threats to information systems. We provide a list of 10 com mon types for your convenience:
1. Espionage or trespass
2. Information extortion
3. Sabotage or vandalism
4. Theft of equipment or information
5. Identity theft
6. Compromises to intellectual property
7. Software attacks
8. Alien software
9. Supervisory control and data acquisition (SCADA) attacks
10. Cyberterrorism and cyberwarfare
92 CHAPTER 4 Information Security
Deliberate Threats to Information Systems 93
Espionage or Trespass
Espionage or trespass occurs when an unauthorized individual attempts to gain illegal access to organizational information. It is important to distinguish between competitive intelligence and industrial espionage. Competitive intelligence consists of legal information gathering tech niques, such as studying a company’s website and press releases, attending trade shows, and similar actions. In contrast, industrial espionage crosses the legal boundary.
Information Extortion
Information extortion occurs when an attacker either threatens to steal, or actually steals, in formation from a company. The perpetrator demands payment for not stealing the informa tion, for returning stolen information, or for agreeing not to disclose the information.
Sabotage or Vandalism
Sabotage and vandalism are deliberate acts that involve defacing an organization’s website, potentially damaging the organization’s image and causing its customers to lose faith. One form of online vandalism is a hacktivist or cyberactivist operation. These are cases of high-tech civil disobedience to protest the operations, policies, or actions of an organization or govern ment agency. For example, the English Twitter account for the Arabic news network Al Jazeera was subjected to hacktivism. The Associated Press reported that supporters of Syrian President Bashar Al Assad used the account to tweet pro Assad links and messages.
Theft of Equipment or Information
Computing devices and storage devices are becoming smaller yet more powerful with vastly increased storage (e.g., laptops, personal digital assistants, smartphones, digital cameras, thumb drives, iPods). As a result, these devices are becoming easier to steal and easier for at tackers to use to steal information. IT’s About Business 4.1 illustrates the consequences of the theft of information.
Table 4.1 points out that one type of human mistake is carelessness with laptops. In fact, many laptops have been stolen because of such carelessness. The cost of a stolen laptop in cludes the loss of data, the loss of intellectual property, laptop replacement, legal and regula tory costs, investigation fees, and lost productivity.
One form of theft, known as dumpster diving, involves rummaging through commercial or residential trash to find discarded information. Paper files, letters, memos, photographs, IDs, passwords, credit cards, and other forms of information can be found in dumpsters. Unfortu nately, many people never consider that the sensitive items they throw in the trash might be recovered. When this information is recovered, it can be used for fraudulent purposes.
Dumpster diving is not necessarily theft, because the legality of this act varies. Because dumpsters are usually located on private premises, dumpster diving is illegal in some parts of the United States. Even in these cases, however, these laws are enforced with varying degrees of rigor.
Identity Theft
Identity theft is the deliberate assumption of another person’s identity, usually to gain access to his or her financial information or to frame him or her for a crime. Techniques for illegally obtaining personal information include the following:
· Stealing mail or dumpster diving
· Stealing personal information in computer databases
IT’s About Business 4.1
The St. Louis Cardinals Accused of Hacking the gained access by breaking into an Astros executive’s e-mail ac
Houston Astros
MIS
For almost two decades, two professional baseball teams, the Houston Astros ( http://houston.astros.mlb.com ) and the St. Louis Cardinals ( http://stlouis.cardinals.mlb.com ), were divi sional rivals in Major League Baseball’s National League. During some of the period between 1994 and 2012, Jeff Luhnow was a Cardinals executive mainly in charge of scouting and player devel- opment. He was recognized as having developed the best minor league system in pro baseball, and he drafted several players who were instrumental to the Cardinals victory in the 2011 World Series. While Luhnow was working for the Cardinals, the team devel oped a computer system called Redbird. The system managed the team’s operations data. This valuable, highly secret information
contained scouting reports and other player data.
Then, in December 2011, the Astros hired Luhnow away from the Cardinals to be their general manager. When Luhnow joined the Astros, some of the Cardinals’ front office staff went with him.
count and then read information on Houston’s draft rankings, scouting reports, and trade notes.
In July 2015, the Cardinals terminated Correa’s contract. He confessed to hacking into the Astros’ system. He maintained, how- ever, that his sole objective was to determine whether the Astros had taken proprietary information from the Cardinals.
Correa was charged with unauthorized access of a protected computer and pleaded guilty to five counts in January 2016. The
U.S. District Court judge sentenced him to 46 months in prison and ordered him to pay $279,038 in compensation. The Cardinals also had to give Houston their two top players in the 2017 draft. The Cardinals also have to pay Houston $2 million in damages for the hacking incident.
This incident was the first known case of corporate espionage in which a professional sports team hacked a rival’s system. Some- what humorously, when Luhnow was asked how the incident af- fected the way he interacts with other teams, he responded that he now uses a pencil and paper.
The Astros promptly developed a computer system called Ground Sources: Compiled from R. Blum, “St. Louis Cardinals Lose Top 2 Picks,
Control. Similar to Redbird, Ground Control managed the team’s Must Pay Houston Astros $2M for Hacking,” the Denver Post, January 30,
baseball operations information. Specifically, the system analyzed a group of attributes and ranked them by weights assigned by the
2017; D. Lengel, “Why Major League Baseball Must Crush the Saint Louis Cardinals for Their Sins,” The Guardian, July 21, 2016; M. McCann, “Breaking Down Chris Correa’s Prison Sentence for Hacking Astros,” Sports Illustrat
organization’s statisticians, doctors, scouts, and coaches. ed, July 19, 2016; B. Costa and D. Barrett, “Ex-Cardinals Scouting Director
In 2014, some data from the Astros’ information system was Pleads Guilty to Hacking Houston Astros,” Wall Street Journal, January
anonymously uploaded online. The leak included information on trade talks that the Astros had conducted with other teams. Major League Baseball, thinking the team had been the victim of a secu-
8, 2016; M. Oz, “The Details in the Cardinals-Astros Hacking Scandal Are Insane,” Yahoo! Sports, January 8, 2016; D. Brown, “Cardinals Fire Scouting Director, Possibly Linked to Hacking Scandal,” CBS Sports, July 2, 2015; B. Reiter, “Exclusive: Astros GM Jeff Luhnow Speaks Out about Hacking Scan
rity breach, informed the FBI. dal,” Sports Illustrated, June 18, 2015; I. Crouch, “Baseball’s Data Breaches,”
The FBI began investigating the Cardinals’ front office person- The New Yorker, June 17, 2015; “FBI Investigates Cardinals for Hacking into
nel, whom they alleged had hacked into an Astros internal network to take proprietary player data. Agents found indications that Cardi- nals’ staff illegally accessed an Astros database containing informa
Astros’ Database,” ESPN.com , June 17, 2015; D. Wilber and M. Levinson, “FBI Investigating St. Louis Cardinals for Hacking Houston Astros,” Bloomberg BusinessWeek, June 16, 2015; J. Green, “My Time with the Architect of
the Astros’ ‘Ground Control’ Database,” Bloomberg BusinessWeek, June
tion concerning internal meetings about trades, confidential player 16, 2015; M. Schmidt, “Cardinals Investigated for Hacking into Astros’
statistics, and scouting reports. The investigation found that: Database,” New York Times, June 16, 2015; J. Green, “Extreme Moneyball:
The Houston Astros Go All in on Data Analysis,” Bloomberg BusinessWeek,
· Just three days into the Major League Baseball draft in 2013, August 28, 2014; http://houston.astros.mlb.com, http://stlouis.cardinals
the Cardinals’ scouting director (Christopher Correa) ac- .mlb.com, accessed July 31, 2016.
cessed the Astros’ Ground Control system and read reports on
players.
· On another occasion, Correa hacked into the Astros’ system again and looked at Houston’s data on trade talks.
· Months later, Correa was able to again get into Ground Control, even after the Astros had switched all its users’ passwords. He
Questions
1. Describe how the Cardinals apparently were able to gain ac cess to the Astros’ computer system.
2. What lessons should the Astros learn from this security breach?
· Infiltrating organizations that store large amounts of personal information (e.g., data ag gregators such as Acxiom) ( www.acxiom.com )
· Impersonating a trusted organization in an electronic communication (phishing)
Recovering from identity theft is costly, time consuming, and burdensome. Victims also report problems in obtaining credit and obtaining or holding a job, as well as adverse effects on insurance or credit rates. Victims also state that it is often difficult to remove negative informa tion from their records, such as their credit reports.
Compromises to Intellectual Property
Protecting intellectual property is a vital issue for people who make their livelihood in knowl edge fields. Intellectual property is the property created by individuals or corporations that is protected under trade secret, patent, and copyright laws.
A trade secret is an intellectual work, such as a business plan, that is a company secret and is not based on public information. An example is the formula for Coca-Cola. A patent is an official document that grants the holder exclusive rights on an invention or a process for a specified period of time. Copyright is a statutory grant that provides the creators or owners of intellectual property with ownership of the property, also for a designated period. Current U.S. laws award patents for 20 years and copyright protection for the life of the creator plus 70 years. Owners are entitled to collect fees from anyone who wants to copy their creations. It is impor tant to note that these are definitions under U.S. law. There is some international standardiza tion of copyrights and patents, but it is far from total. Therefore, there can be discrepancies between U.S. law and other countries’ laws.
The most common intellectual property related to IT deals with software. In 1980, the
U.S. Congress amended the Copyright Act to include software. The amendment provides pro tection for the source code and object code of computer software, but it does not clearly iden tify what is eligible for protection. For example, copyright law does not protect fundamental concepts, functions, and general features such as pull-down menus, colors, and icons. How ever, copying a software program without making payment to the owner—including giving a disc to a friend to install on his or her computer—is a copyright violation. Not surprisingly, this practice, called piracy, is a major problem for software vendors. The BSA ( www.bsa.org ) Global Software Piracy Study found that the commercial value of software theft totals billions of dollars per year.
Software Attacks
Software attacks have evolved from the early years of the computer era, when attackers used malicious software (called malware) to infect as many computers worldwide as possible, to the profit driven, web-based attacks of today. Modern cybercriminals use sophisticated, blended malware attacks, typically through the web, to make money. Table 4.2 displays a variety of software attacks. These attacks are grouped into three categories: remote attacks requiring user action, remote attacks requiring no user action, and software attacks initiated by pro grammers during the development of a system.
Not all cybercriminals are sophisticated, however. For example, a student at a U.S. uni versity was sentenced to one year in prison for using keylogging software (discussed later in this chapter) to steal 750 fellow students’ passwords and vote himself and four of his fraternity brothers into the student government’s president and four vice president positions. The five positions would have brought the students a combined $36,000 in stipends.
The student was caught when university security personnel noticed strange activity on the campus network. Authorities identified the computer used in the activity from its IP address. On this computer, which belonged to the student in question, authorities found a PowerPoint presentation detailing the scheme. Authorities also found research on his computer, with que ries such as “how to rig an election” and “jail time for keylogger.”
Once the university caught on to the scheme, the student reportedly turned back to hack ing to try to get himself out of trouble. He created new Facebook accounts in the names of ac tual classmates, going as far as conducting fake conversations between the accounts to try to
deflect the blame. Those actions contributed to the one-year prison sentence, which the judge imposed even after the student pleaded guilty and requested probation.
There are many different kinds of software attacks, with more appearing every day. As you see in IT’s About Business 4.2, ransomware has become a huge problem very quickly. Software attacks have become so sophisticated that there is a very real concern about the viability of the Internet itself. IT’s About Business 4.3 illustrates this problem.
Alien Software
Many personal computers have alien software, or pestware, running on them that the own ers are unaware of. Alien software is clandestine software that is installed on your computer through duplicitous methods. It typically is not as malicious as viruses, worms, or Trojan horses, but it does use up valuable system resources. It can also enable other parties to track your web surfing habits and other personal behaviors.
The vast majority of pestware is adware—software that causes pop-up advertisements to appear on your screen. Adware is common because it works. According to advertising agencies, for every 100 people who close a pop-up ad, 3 click on it. This “hit rate” is extremely high for Internet advertising.
Spyware is software that collects personal information about users without their consent.
Two common types of spyware are keystroke loggers and screen scrapers.
Keystroke loggers, also called keyloggers, record both your individual keystrokes and your Internet web browsing history. The purposes range from criminal—for example, theft of pass words and sensitive personal information such as credit card numbers—to annoying—for ex ample, recording your Internet search history for targeted advertising.
IT’s About Business 4.2
Ransomware
MIS
In early 2016 the Hollywood (California) Presbyterian Medical Center ( www.hollywoodpresbyterian.com ) experienced acyberattack that encrypted some of the hospital’s crucial information. In response, the hospital turned off its network so that the infection could not spread and began negotiations with the attackers, who demanded a ru mored $3 million in bitcoins as ransom. Hospital employees resorted to pen, paper, telephones, and fax machines for many tasks normally carried out by information systems. Such tasks included access ing patient information and test results, documenting patient care, and transmitting laboratory work, X-rays, and CT scans. The hospi tal stated that the network shutdown did not affect patient care, al though the hospital did send some patients to other facilities.
The hackers held the hospital hostage for 10 days until the hospital paid them approximately $17,000 worth of bitcoins to de crypt its key information.
Over Thanksgiving weekend in 2016, the public transit system in San Francisco would not accept riders’ money. Attackers had compromised the agency’s ticketing system, encrypted its data, and reportedly demanded 100 bitcoins (about $73,000 at that time) to send the decryption key. The agency refused to pay the attack ers. Instead, the agency deactivated its ticketing machines and let riders go through the gates for free. The agency restored its ticket ing machines and by Monday the system was operating normally, even if the agency missed two days of revenue.
The malicious software that infected the hospital and the tran sit system is called ransomware. Ransomware, or digital extortion, blocks access to a computer system until the system owner or opera tor pays a sum of money. Types of ransomware include Cryptolocker, Cryptowall, TeslaCrypt, CTB Locker, and Locky. The most current form of ransomware demands payment through the hard-to-trace cryptocurrency Bitcoin, and it uses the anonymizing Tor network ( www.torproject.org ). Some attackers are even taking a “freemium” approach: They decrypt some data for free to show victims that they can get the remainder of the encrypted data if they pay the ransom.
Ransomware is typically disseminated through established botnets and phishing attacks. Victims are told to pay the ransom in Bitcoin or through MoneyGram to untraceable gift cards in East ern Europe. Ransomware attacks are growing rapidly. The average charge to decrypt data has grown from $294 in December 2015 to $679 by June 2016, according to security firm Symantec ( www
.symantec.com ). The FBI estimated that the ransomware industry may have reached a total of $1 billion in ransom paid in 2016.
Many ransomware victims stated that the attackers were hon oring their promise to decrypt the data if the victim complied with the terms within the specified time. This situation was an incen tive for additional victims to pay the ransom rather than pursuing another, generally more costly, solution. In fact, security analysts estimate that almost half of ransomware victims pay the ransom.
Two recent ransomware variants appeared at the end of 2016. The first variant offers the decryption key to a victim if the victim pro vides a link to the ransomware to two other people or to companies that pay the ransom. With the second variant, hackers pretend to be job hunters in an effort to infect corporate human resources systems. The cybercriminals even submit cover letters to appear legitimate.
There are several possible solutions to the ransomware problem.
· The first line of defense is to back up crucial data and infor mation often, preferably through an encrypted cloud-based storage company or an online backup service to make copies of your operating system and data. See, for example, iDrive ( www.idrive.com ), CrashPlan ( www.crashplan.com ), SOS Online Backup ( www.sosonlinebackup.com ), and Carbonite ( www.carbonite.com ). Your backup data storage must be con nected to only your system when you are backing up the data. Canada’s Ottawa Hospital averted a ransomware inter ruption because it had backed up the data encrypted on some of the hospital’s computers. The hospital completely erased the hard drives of the infected computers, restored them, and
returned them to service.
· Second, it is imperative to provide education and training so that users are aware of phishing and spear-phishing attacks and not click on any suspicious e-mails or suspicious links in e-mails.
· Third, employ a real-time monitoring system that can possibly stop ransomware almost immediately. Such a system, called CryptoDrop, was created by staff at the Florida Institute for Cybersecurity Research. CryptoDrop stops the ransomware encryption at the start of the process, ensuring victims have less reason to pay the ransom.
· Fourth, victims can pay the ransom, even though the FBI ad vises against this practice. However, one hospital administrator noted that she had no choice because patient safety was at risk.
Sources: Compiled from D. Palmer, “This Ransomware Targets HR Departments with Fake Job Applications,” ZDNet, January 4, 2017; M. Heller, “Unique Threat Offers Victims Ransomware Decryption to Spread Infections,” TechTarget, December 12, 2016; J. Stewart, “SF’s Transit Hack Could’ve Been Way Worse—And Cities Must Prepare,” Wired, November 28, 2016; J. Lee, “CryptoDrop: Prevent Ransomware Attacks by Stopping En cryption Early,” Ipswitch blog, September 1, 2016; G. Fleishman, “Two Ways to Stop Ransomware in Its Tracks,” MIT Technology Review, July 29, 2016;
K. Zetter, “4 Ways to Protect Against the Very Real Threat of Ransomware,” Wired, May 13, 2016; T. Simonite, “With Hospital Ransomware Infections, the Patients Are at Risk,” MIT Technology Review, April 1, 2016; W. Ashford, “U.S. Hospital Claims to Have Fought Off a Ransomware Attack,” Computer Weekly, March 23, 2016; M. Orcutt, “Hollywood Hospital’s Run-In with Ransomware Is Part of an Alarming Trend in Cybercrime,” MIT Technology Review, February 18, 2016; M. Heller, “Ransomware Attack Causes Internal Emergency at Hollywood Hospital,” TechTarget, February 16, 2016; T.
Simonite, “Hospital Forced Back to Pre-Computer Era Shows the Power of Ransomware,” MIT Technology Review, February 16, 2016; P. Muncaster,
“Over One-Third of Firms Hit by Ransomware Blitz,” InfoSecurity Magazine, June 26, 2015; C. Stobing, “Ransomware Is the New Hot Threat Everyone Is Talking About; What Do You Need to Know?” Digital Trends, June 6, 2015; R. Lemos, “Ransomware Threat Drives Companies to Enforce Better Backup Habits,” eWeek, May 26, 2015; R. Simon, “‘Ransomware’ a Growing Threat to Small Businesses,” Wall Street Journal, April 15, 2015; R. Lemos, “How
to Prevent Ransomware: What One Company Learned the Hard Way,” PC World, March 26, 2015; L. Constantin, “Malvertising Campaign Delivers Digi tally Signed CryptoWall Ransomware,” PC World, September 29, 2014.
Questions
1. Why is ransomware more than a nuisance?
2. Are your digital files adequately backed up? Why or why not?
IT’s About Business 4.3
An Attack on the Internet impacted, as well as users in Brazil, Germany, India, Spain, and the
MIS
Dyn ( www.dyn.com ) is a cloud-based Internet performance man- agement company that provides Domain Name System (DNS) services for Internet websites (see Chapter 6). Dyn is one of the companies that function as a directory service for the Internet. The DNS is a hierarchical, decentralized naming system for any resource connected to the Internet. The DNS translates the do main names that users type in, such as www.usatoday.com , into their numeric Internet Protocol address, such as 184.50.238.11. The DNS is an essential component of the functionality of the Internet.
On October 21, 2016, the servers at Dyn began experiencing a distributed denial-of-service (DDoS) attack. This DDoS attacked the Dyn servers that form the infrastructure needed to make Internet connections.
In a DDoS attack, the intruders first infect and then take over many computers, typically by using malicious software. These com puters are called bots. The attacker uses these bots—which form a botnet—to deliver a coordinated stream of information requests to a target computer, causing it to crash or cease functioning. Security experts state that such DDoS attacks are becoming more prevalent,
United Kingdom. Security analysts believe that this DDoS attack was the largest to date.
For some time, security analysts have predicted that the bal looning traffic on the Internet would mean these devices would create a huge security risk. In fact, the Internet of Things is growing faster than government’s or industry’s ability to secure it. In 2016, there are some 6.4 billion connected devices around the world. By 2020, analysts estimate that number will increase to some 21 bil lion devices.
Most security analysts state that the device manufacturers must be held responsible for better security. How to actually ac- complish that remains unclear. In just one example, China-based camera manufacturer Hangzhou Xiongmai Technology Company recalled thousands of its cameras after it was told that the de- vices may have been used to create part of the botnet that at- tacked Dyn.
Chipmaker Qualcomm is thinking about using machine in- telligence to improve Internet-connected devices’ safety. Security analysts at the company feel that they can instruct these devices to watch for certain behaviors: For example, is it doing something un usual? Is the device communicating with some unexpected device?
more sophisticated, and increasingly aimed at core Internet infra- Sources: Compiled from J. Wagstaff, and J.R. Wu, “After Cyber Attacks,
structure providers such as Dyn. Internet of Things Wrestles with Making Smart Devices Safer,” Reuters,
How did the perpetrators generate this DDoS attack on Dyn? First, they delivered malicious software called Mirai through phish
November 8, 2016; H. Edwards and M. Vella, “A Shocking Internet Attack Shows America’s Vulnerability,” Time, November 7, 2016; E. Blumenthal and E. Weise, “Hacked Home Devices Caused Massive Internet Outage,” USA
ing e-mails. The Mirai software infected an estimated 500,000 Today, October 21, 2016; B. Krebs, “DDoS on Dyn Impacts Twitter, Spotify,
remotely controlled Internet-connected devices—for example, Reddit,” Krebs on Security, October 21, 2016; L. Franceschi-Bicchierai,
surveillance cameras, CCTVs, web cams, printers, cable set-top boxes, home routers, speakers, digital thermostats, digital video recorders, baby monitors, and many others. These relatively simple
“Twitter, Reddit, Spotify Were Collateral Damage in Major Internet Attack,” Motherboard, October 21, 2016; L. Newman, “What We Know about Friday’s Massive East Coast Internet Outage,” Wired, October 21, 2016; J. Condliffe, “Massive Internet Outage Could Be a Sign of Things to Come,” MIT Technol
devices, which make up the Internet of Things, often do not have ogy Review, October 21, 2016; N. Perlroth, “Hackers Used New Weapons to
sophisticated security. Disrupt Major Websites across U.S.,” New York Times, October 21, 2016; E.
The attackers now had control of these Internet-connected devices, which formed a botnet. They then instructed the devices in
Weise, “Internet of Things Comes Back to Bite Us as Hackers Spread Botnet Code,” USA Today, October 3, 2016.
the botnet to send a flood of information requests to the Dyn serv- ers. There were so many information requests that the Dyn servers
Questions
could not handle them, and the servers stopped functioning. 1. Discuss how the distributed, denial-of-service attack on Dyn
The DDoS attacks on Dyn were so severe that they eventually has led some security analysts to question the long-term vi-
blocked or significantly slowed user access to dozens of other web- ability of the Internet itself.
sites such as Twitter, Netflix, Spotify, CNN, the New York Times, Red- 2. What is the best way for Dyn to have avoided the distribut
dit, Etsy, SoundCloud, and Airbnb. Millions of American users were ed, denial-of-service attack altogether?
Companies have attempted to counter keyloggers by switching to other forms of identify ing users. For example, at some point all of us have been forced to look at wavy, distorted let ters and type them correctly into a box. That string of letters is called a CAPTCHA, and it is a test. The point of CAPTCHA is that computers cannot (yet) accurately read those distorted letters. Therefore, the fact that you can transcribe them means that you are probably not a software program run by an unauthorized person, such as a spammer. As a result, attackers have turned to screen scrapers, or screen grabbers. This software records a continuous “movie” of a screen’s contents rather than simply recording keystrokes.
Spamware is pestware that uses your computer as a launch pad for spammers. Spam is unsolicited e-mail, usually advertising for products and services. When your computer is in fected with spamware, e-mails from spammers are sent to everyone in your e-mail address book, but they appear to come from you.
Not only is spam a nuisance, but it wastes time and money. Spam costs U.S. companies billions of dollars every year. These costs arise from productivity losses, clogged e-mail sys tems, additional storage, user support, and antispam software. Spam can also carry viruses and worms, making it even more dangerous.
Cookies are small amounts of information that websites store on your computer, tem porarily or more or less permanently. In many cases, cookies are useful and innocuous. For example, some cookies are passwords and user IDs that you do not want to retype every time you access the website that issued the cookie. Cookies are also necessary for online shopping because merchants use them for your shopping carts.
Tracking cookies, however, can be used to track your path through a website, the time you spend there, what links you click on, and other details that the company wants to record, usually for marketing purposes. Tracking cookies can also combine this information with your name, purchases, credit card information, and other personal data to develop an intrusive pro file of your spending habits.
Most cookies can be read only by the party that created them. However, some companies that manage online banner advertising are, in essence, cookie-sharing rings. These companies can track information such as which pages you load and which ads you click on. They then share this information with their client websites, which may number in the thousands.
Supervisory Control and Data Acquisition Attacks
SCADA refers to a large-scale distributed measurement and control system. SCADA systems are used to monitor or to control chemical, physical, and transport processes such as those used in oil refineries, water and sewage treatment plants, electrical generators, and nuclear power plants. Essentially, SCADA systems provide a link between the physical world and the electronic world.
SCADA systems consist of multiple sensors, a master computer, and communications infra structure. The sensors connect to physical equipment. They read status data such as the open/ closed status of a switch or a valve, as well as measurements such as pressure, flow, voltage, and current. They control the equipment by sending signals to it, such as opening or closing a switch or a valve or setting the speed of a pump.
The sensors are connected in a network, and each sensor typically has an Internet ad dress (Internet Protocol, or IP, address, discussed in Chapter 6). If attackers gain access to the network, they can cause serious damage, such as disrupting the power grid over a large area or upsetting the operations of a large chemical or nuclear plant. Such actions could have cat astrophic results.
Cyberterrorism and Cyberwarfare
Cyberterrorism and cyberwarfare refer to malicious acts in which attackers use a target’s computer systems, particularly through the Internet, to cause physical, real-world harm or severe disruption, often to carry out a political agenda. Although not definitely proven in early 2016, the U.S. government considers the Sony hack (see the Sony Pictures Entertainment hack on Wikipedia) to be an example of cyberwarfare committed by North Korea. These ac tions range from gathering data to attacking critical infrastructure (e.g., through SCADA sys tems). We treat the two types of attacks as synonymous here, even though cyberterrorism is typically carried out by individuals or groups, whereas cyberwarfare is carried out by nation states or nonstate actors such as terrorists. IT’s About Business 4.4 provides an example of a cyberattack.
IT’s About Business 4.4
The Cyberattack on Ukraine
MIS
After Russia annexed Crimea from Ukraine in 2014, authorities started nationalizing Ukrainian-owned energy companies in Crimea. In late 2015, Ukrainian supporters physically attacked elec trical power distribution centers, plunging two million Crimeans in the dark.
Each of Ukraine’s 24 regions is served by a different electric company. On December 23, 2015, the Ukrainian power grid expe rienced a cyberattack. The activists simultaneously attacked three power distribution substations, cutting power to some 230,000 Ukrainians.
The multistage, targeted cyberattack actually started in the spring of 2015. Let’s take a look at how the cyberattack unfolded.
The Spear-Phishing Attack. In the first stage, the attackers launched a spear-phishing attack on IT staff and system adminis trators at three of the power distribution companies in Ukraine. The attack sent e-mails to employees that contained a malicious Word file. If an employee clicked on the document, a popup window told them to enable macros for that file. If they did so, a malicious soft ware program named BlackEnergy3 infected their computers and allowed the hackers entry into their system.
Reconnaissance. The spear-phishing attack allowed the intrud ers to access the power distribution companies’ corporate networks. However, the intruders still had to gain access to the supervisory control and data acquisition (SCADA) networks that actually oper ated the power grid, but the power companies had competently separated those networks from corporate networks with a firewall. Therefore, the attackers had to search the corporate networks and gain entry to the Windows Domain Controllers. From there, the hack ers gathered employee login credentials from the user accounts. Some of these login credentials were used by employees to access virtual private networks (VPNs) to remotely log in to the SCADA net work. The attackers now had access to the SCADA networks.
Disabling the uninterruptible power supply. The attackers now rejigged the supply of uninterruptible power to the three systems’ control centers. They wanted to cut power to the operators as well as the customers.
Disabling the converters. The attackers then coded malicious software to supersede the actual software on converters at power company substation control systems. (These converters handle data from the SCADA network to the substations.) Disabling the converters stopped employees from transmitting remote com mands to reestablish power after it was cut. The converters could not work and could not be recovered. This situation meant that the power companies could not recover until they obtained new converters and incorporated them into the power system. (Note: Power companies in the United States use the same type of con verters as those used in Ukraine.)
Denial-of-service attack. The attackers now targeted customer call centers, initiating a telephone denial-of-service attack. That meant that customers could not call in to report the blackout when it occurred. The attack jammed up the distribution centers’ call centers with thousands of false calls, blocking actual customers from getting through. This denial-of-service attack allowed the at tackers more time to work on their attack because not only were substation employees seeing false information on their hijacked
computers, but they were receiving no phone calls reporting power outages.
Causing the blackout. On December 23, the attackers used the commandeered VPNs to access the SCADA networks and deactivate the uninterruptible power supply that they had already reconfig ured. Then they removed substations from the power grid.
Deploying KillDisk. Lastly, the attackers deployed software called KillDisk to complete their path of destruction. KillDisk de letes or overwrites essential system files from operators’ comput ers to disable them as well. Because KillDisk also wipes the master boot file, operators could not reboot the crashed computers.
About half the homes in Ukraine’s Ivano-Frankivsk region lost power. The cybercriminals also simultaneously attacked a large mining company and a major railway. The incidents seem to have been politically motivated, meant to disable Ukrainian critical in frastructure in a strike, according to security analysts at Trend Mi cro ( www.trendmicro.com ).
Homes and businesses in the impacted areas only lost power from one to six hours. However, more than two months later, the control centers were still not completely back online. Electricity was still being delivered, but employees had to manually operate the power substations.
The attack caused only digital damage; if the substations had been physically damaged, it would have taken much longer to re store power. In 2007, the U.S. government showed how criminals could remotely destroy a power generator through a SCADA attack with just 21 lines of malicious code.
Infrastructure personnel can learn many lessons from the at tack. Ukraine’s power generation control systems were unexpect edly more robust than some in the United States. The reason is that the Ukrainian SCADA networks were separated from the business networks with excellent firewalls. However, the Ukrainian control systems still had security weaknesses. For example, employees remotely accessing the SCADA network were not prompted to use two-factor authentication, which enabled the hackers to steal login information and gain entry to the SCADA systems.
Another lesson is that in the United States many power sys tems lack manual backups. That is, if criminals were to attack auto mated SCADA systems in the United States, it would be much more difficult to bring the grid back online.
This first-ever successful attack of a power grid’s computers is a dire safety warning for other such systems across the world. Ex perts in industrial control systems at the Sans Institute ( www.sans
.org ) say the hack of the Ukrainian power grid was the first time that cybercriminals have managed to directly bring down a power grid.
In December 2016, Ukraine was attacked again. Reports al leged that a group of Russians attacked computers at a control center of a power supplier in Kiev. The attackers apparently used phishing attacks on workers, enabling the intruders to grab login information and disable substations. The shutdown affected some 20 percent of Kiev’s nighttime electrical use.
Sources: Compiled from J. Condliffe, “Ukraine’s Power Grid Gets Hacked Again, a Worrying Sign for Infrastructure Attacks,” MIT Technology Review, December 22, 2016; E. Markowitz, “After Ukraine Cyberattacks, FBI and DHS Urge U.S. Power Companies to Develop Better Safety Protocols,” International Business Times, April 21, 2016; “FBI, DHS Issue Warning about Increasing Cyber Threat to Nation’s Power Grid after Downplaying It in Jan uary,” Cyberwar.news, April 12, 2016; B. Gertz, “FBI Warns of Cyber Threat
What Organizations Are Doing to Protect Information Resources 101
to Electric Grid,” The Washington Free Beacon, April 8, 2016; K. Zetter, “Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid,” Wired, March 3, 2016; D. Voltz, “U.S. Government Concludes Cyber Attack Caused Ukraine Power Outage,” Reuters, February 25, 2016; W. Ashford, “Ukraine Cyber Attacks Beyond Power Companies, Says Trend Micro,” Computer Weekly, February 12, 2016; J. Robertson and M. Riley, “How Hackers Took Down a Power Grid,” Bloomberg BusinessWeek, January 14, 2016; M. Heller, “Russian Actors Accused of Attacking Ukraine with BlackEnergy Malware,” TechTarget, January 4, 2016; D. Goodin, “First Known Hacker-Caused Power Outage Signals Troubling Escalation,” Ars Technica, January 4, 2016; J. Cox, “Malware Found Inside Downed Ukrainian Grid Management Points to Cyberattack,” Motherboard, January 4, 2016.
Questions
1. Describe what the Ukrainian power distribution companies did correctly to try to prevent such attacks.
2. Describe what other actions that the Ukrainian power dis tribution companies did incorrectly, or did not do at all, in order to try and prevent such attacks.
3. What lessons can other power companies gain from the Ukrainian cyberattack?
1. Why has the theft of computing devices become more serious over time?
2. What are the three types of software attacks?
3. Define alien software and explain why it is a serious problem.
4. What is a SCADA system? Why can attacks against SCADA system have catastrophic consequences
What Organizations Are Doing to Protect Information Resources
4.4
Why is stopping cybercriminals such a challenge? Table 4.3 illustrates the many major difficul ties involved in protecting information. Because organizing an appropriate defense system is so important to the entire enterprise, it is one of the major responsibilities of any prudent CIO as well as of the functional managers who control information resources. In fact, IT security is the business of everyone in an organization.
In addition to the problems listed in Table 4.3, another reason why information resources are difficult to protect is that the online commerce industry is not particularly willing to in stall safeguards that would make completing transactions more difficult or complicated. As
Difficulties in Protecting Information Resources
TABLE 4.3
|
Hundreds of potential threats exist. Computing resources may be situated in many locations. Many individuals control or have access to information assets. Computer networks can be located outside the organization, making them difficult to protect. Rapid technological changes make some controls obsolete as soon as they are installed. Many computer crimes are undetected for a long period of time, so it is difficult to learn from experience. People tend to violate security procedures because the procedures are inconvenient. The amount of computer knowledge necessary to commit computer crimes is usually minimal. As a matter of fact, a potential criminal can learn hacking, for free, from the Internet. The costs of preventing hazards can be very high. Therefore, most organizations simply cannot afford to protect themselves against all possible hazards. It is difficult to conduct a cost-benefit justification for controls before an attack occurs because it is difficult to assess the impact of a hypothetical attack. |
one example, merchants could demand passwords or personal identification numbers for all credit card transactions. However, these requirements might discourage people from shopping online. For credit card companies, it is cheaper to block a stolen credit card and move on than to invest time and money prosecuting cybercriminals.
And the final reason why information resources are difficult to protect is that it is extremely difficult to catch perpetrators. However, it is possible to catch attackers, albeit with great effort, time, and expense.
Organizations spend a great deal of time and money protecting their information re sources. Before doing so, they perform risk management.
A risk is the probability that a threat will impact an information resource. The goal of risk management is to identify, control, and minimize the impact of threats. In other words, risk management seeks to reduce risk to acceptable levels. Risk management consists of three pro cesses: risk analysis, risk mitigation, and controls evaluation.
Organizations perform risk analyses to ensure that their IS security programs are cost effective. Risk analysis involves three steps: (1) assessing the value of each asset being pro tected, (2) estimating the probability that each asset will be compromised, and (3) comparing the probable costs of the asset’s being compromised with the costs of protecting that asset. The organization then considers how to mitigate the risk.
In risk mitigation, the organization takes concrete actions against risks. Risk mitigation has two functions: (1) implementing controls to prevent identified threats from occurring, and
(2) developing a means of recovery if the threat becomes a reality. There are several risk mitiga tion strategies that organizations can adopt. The three most common are risk acceptance, risk limitation, and risk transference.
1. Risk acceptance: Accept the potential risk, continue operating with no controls, and ab sorb any damages that occur.
2. Risk limitation: Limit the risk by implementing controls that minimize the impact of the threat.
3. Risk transference: Transfer the risk by using other means to compensate for the loss, such as by purchasing insurance.
Finally, in controls evaluation, the organization examines the costs of implementing ad equate control measures against the value of those control measures. If the costs of imple menting a control are greater than the value of the asset being protected, the control is not cost effective. In the next section, you will study the various controls that organizations use to protect their information resources.
Before you go on. . .
1. Describe several reasons why it is difficult to protect information resources.
2. Compare and contrast risk management and risk analysis.
Information Security Controls
4.5
To protect their information assets, organizations implement controls, or defense mechanisms (also called countermeasures). These controls are designed to protect all of the components of an information system, including data, software, hardware, and networks. Because there are so many diverse threats, organizations use layers of controls, or defense-in-depth.
Controls are intended to prevent accidental hazards, deter intentional acts, detect prob lems as early as possible, enhance damage recovery, and correct problems. Before you study controls in more detail, it is important to emphasize that the single most valuable control is
102 CHAPTER 4 Information Security
Information Security Controls 103
FIGURE 4.2 Where defense mechanisms are located.
user education and training. Effective and ongoing education makes every member of the or ganization aware of the vital importance of information security.
In this section, you will learn about three major types of controls: physical controls, ac cess controls, and communications controls. Figure 4.2 illustrates these controls. In addition to applying controls, organizations plan for business continuity in case of a disaster, and they periodically audit their information resources to detect possible threats. You will study these topics in this section as well.
Physical Controls
Physical controls prevent unauthorized individuals from gaining access to a company’s fa cilities. Common physical controls include walls, doors, fencing, gates, locks, badges, guards, and alarm systems. More sophisticated physical controls include pressure sensors, tempera ture sensors, and motion detectors. One shortcoming of physical controls is that they can be inconvenient to employees.
Guards deserve special mention because they have very difficult jobs, for at least two rea sons. First, their jobs are boring and repetitive and generally do not pay well. Second, if guards perform their jobs thoroughly, the other employees harass them, particularly if they slow up the process of entering the facility.
Organizations also implement physical security measures that limit computer users to ac ceptable login times and locations. These controls also limit the number of unsuccessful login attempts, and they require all employees to log off their computers when they leave for the day. They also set the employees’ computers to automatically log off the user after a certain period of disuse.
Access Controls
Access controls restrict unauthorized individuals from using information resources. These controls involve two major functions: authentication and authorization. Authentication con firms the identity of the person requiring access. After the person is authenticated (identified), the next step is authorization. Authorization determines which actions, rights, or privileges the person has, based on his or her verified identity. Let’s examine these functions more closely.
Authentication. To authenticate (identify) authorized personnel, an organization can use one or more of the following methods: something the user is, something the user has, something the user does, or something the user knows.
Something the user is, also known as biometrics, is an authentication method that exam ines a person’s innate physical characteristics. Common biometric applications are fingerprint scans, palm scans, retina scans, iris recognition, and facial recognition. Of these applications, fingerprints, retina scans, and iris recognition provide the most definitive identification. A huge biometric identification project in India provides an example of the power of biometrics.
India has vast numbers of anonymous, poor citizens. The Indian government does not of ficially acknowledge the existence of these citizens because they do not possess birth certifi cates and other official documentation. Therefore, they cannot access government services to which they are entitled, nor can they open bank accounts.
To address these problems, the nation instituted its Unique Identification Project, also known as Aadhaar, which means “the foundation” in several Indian languages. The goal of the project is to issue identification numbers linked to the fingerprints and iris scans of all 1.2 bil lion Indian citizens. The biometrics and the Aadhaar identification number will serve as a ver ifiable, portable, and unique national ID. The Aadhaar project should enable millions of poor Indian citizens to access government services that previously were out of reach to them. As of March 31, 2017, Aadhaar had approximately 1.133 billion enrolled members. This figure means that over 99 percent of Indians aged 18 and over had enrolled.
Something the user has is an authentication mechanism that includes regular identifica tion (ID) cards, smart ID cards, and tokens. Regular ID cards, or dumb cards, typically have the person’s picture and often his or her signature. Smart ID cards have an embedded chip that stores pertinent information about the user. (Smart ID cards used for identification differ from smart cards used in electronic commerce, which you learn about in Chapter 7. Both types of card have embedded chips, but they are used for different purposes.) Tokens have embedded chips and a digital display that presents a login number that the employees use to access the organization’s network. The number changes with each login.
Something the user does is an authentication mechanism that includes voice and signature recognition. In voice recognition, the user speaks a phrase (e.g., his or her name and depart ment) that has been previously recorded under controlled conditions. The voice recognition system matches the two voice signals. In signature recognition, the user signs his or her name, and the system matches this signature with one previously recorded under controlled, moni tored conditions. Signature recognition systems also match the speed and the pressure of the signature.
Something the user knows is an authentication mechanism that includes passwords and passphrases. Passwords present a huge information security problem in all organizations. Most of us have to remember numerous passwords for different online services, and we typi cally must choose complicated strings of characters to make them harder to guess. Passwords must effectively manage the trade-off between convenience and security. For example, if pass words are 50 characters in length and include special symbols, they might keep your computer and its files safe, but they would be impossible to remember.
We have all bought into the idea that a password is sufficient to protect our data, as long as it is sufficiently elaborate. In reality, however, passwords by themselves can no longer protect us, regardless of how unique or complex we make them.
Attackers employ a number of strategies to obtain our passwords, no matter how strong they are. They can guess them, steal them (with phishing or spear-phishing attacks), crack them
using brute force computation, or obtain them online. Given these problems with passwords, what are users and businesses supposed to do?
To identify authorized users more efficiently and effectively, organizations are implement ing more than one type of authentication, a strategy known as multifactor authentication. This system is particularly important when users log in from remote locations.
Single-factor authentication, which is notoriously weak, commonly consists simply of a password. Two-factor authentication consists of a password plus one type of biometric identifi cation (e.g., a fingerprint). Three-factor authentication is any combination of three authentica tion methods. In most cases, the more factors the system uses, the more reliable it is. However, stronger authentication is also more expensive, and, as with strong passwords, it can be irri tating to users.
Several initiatives are under way to improve the authentication process under the aus pices of the Fast Identity Online (FIDO) Alliance ( https://fidoalliance.org ). FIDO is an indus try consortium to address the lack of interoperability among strong authentication devices and the problems that users face in creating and remembering multiple usernames and passwords.
The concept underlying FIDO is that identifiers such as a person’s fingerprint, iris scan, and the unique identifier of any USB device or contactless ring will not be sent over the Internet. Rather, they will be checked locally. The only data that will be transferred over the Internet are cryptographic keys that cannot be reverse-engineered to steal a person’s identity. Let’s con sider examples of security systems using biometrics:
· Millions of customers at Bank of America, JPMorgan Chase, and HSBC routinely use finger prints to log in to their bank accounts through their mobile phones.
· Wells Fargo allows some customers to scan their eyes with their mobile devices to log into corporate accounts.
· USAA, which provides insurance and banking services to members of the military and their families, identifies some of its customers through their facial coutours.
· Google has announced a new way of securing Android apps called Trust API. Rather than using standard passwords, Trust API uses biometrics such as facial recognition, your typ ing pattern, even how you walk to help determine that you are who you say you are. Each metric contributes to an overall “trust score” that will let you unlock your apps. The pro gram will run in the background of an Android phone, using the phone’s sensors to contin uously monitor the user’s behavior. If the trust score falls below a certain threshold, a user might be prompted to provide additional authentication.
If you must use passwords, make them strong passwords, which are more difficult for hackers to discover. The basic guidelines for creating strong passwords are:
· They should be difficult to guess.
· They should be long rather than short.
· They should have uppercase letters, lowercase letters, numbers, and special characters.
· They should not be recognizable words.
· They should not be the name of anything or anyone familiar, such as family names or names of pets.
· They should not be a recognizable string of numbers, such as a Social Security number or a birthday.
Unfortunately, strong passwords are more difficult to remember than weak ones. Conse quently, employees frequently write them down, which defeats their purpose. The ideal solu tion to this dilemma is to create a strong password that is also easy to remember. To achieve this objective, many people use passphrases.
A passphrase is a series of characters that is longer than a password but is still easy to memorize. Examples of passphrases are “maytheforcebewithyoualways” and “goaheadmake myday.” A passphrase can serve as a password itself, or it can help you create a strong pass word. You can turn a passphrase into a strong password in this manner. Starting with the last
preceding passphrase, take the first letter of each word. You will have “gammd.” Then, capital ize every other letter to create “GaMmD.” Finally, add special characters and numbers to create “9GaMmD//*.” You now have a strong password that you can remember.
One company provides a new type of authentication. IT’s About Business 4.5 shows how Trustev analyzes customer behavior to help merchants combat online fraud.
Authorization. After users have been properly authenticated, the rights and privileges to which they are entitled on the organization’s systems are established in a process called authorization. A privilege is a collection of related computer system operations that a user is authorized to perform. Companies typically base authorization policies on the principle of least privilege, which posits that users be granted the privilege for an activity only if there is a justifiable need for them to perform that activity.
IT’s About Business 4.5
Trustev: Helping to Prevent Credit Card Fraud
MIS
Many millions of people have had a credit card used fraudulently but with thankfully minimal damage. The reason is that, for the most part, these people are not liable for fraudulent use of their cards.
Industry analysts claim that electronic commerce is unfair to merchants because they assume all of the risk in credit card trans actions. Merchants also suffer most, if not all, of the financial dam ages in fraudulent transactions. As a result, many online retailers feel such a chill that they limit their business opportunities. In fact, the analysts note that merchants reject approximately 2 percent of valid customers. This number is more damaging than it might appear, because merchants suffer hidden costs as well. The cost to acquire an online customer is about $51 per person. If merchants block a legitimate customer, then they lose the $51. More signifi cantly, they lose the lifetime value of that customer because he or she is not likely to return to the website after being denied.
Going further, some merchants block transactions from entire countries. For example, only 6 percent of European online mer chants permit electronic transactions from another country. And then there is China, which has a huge demand for high-end mer chandise. Since 2010, Chinese citizens have been issued 3 billion credit cards. Nevertheless, Chinese consumers often cannot shop on foreign retailers’ websites because few merchants accept pay ments from China because of fraud concerns.
This problem provides the rationale for the startup company Trustev ( www.trustev.com ), which enables online retailers to ac cept more online transactions. The company helps reduce fraud by analyzing shoppers’ behavior while they browse and buy online. Using this analysis, Trustev takes roughly two tenths of a second to decide whether to process each transaction. In essence, Trustev ver ifies the shoppers themselves, in addition to their payment method.
When first launching the service, merchants allow Trustev into its systems. Trustev then crafts a profile for a regular online customer by observing transactions for a period of time. It collects data on 80 variables including the customer’s device (e.g., desktop, laptop, smartphone), Internet Protocol address, shipping address, physical location, e-mail address, and other relevant data. In es sence, Trustev creates a digital picture of the customer at the point
in time of a transaction. To protect data security, the company, by law, must erase all data after 90 days.
Trustev is growing rapidly. One company in the United King dom tried out Trustev for four weeks. The company’s goal was to stop fraudulent online transactions while letting through real cus tomers who may be accidentally blocked. In just four weeks, the company noted a 5 percent revenue increase from blocking fraud ulent transactions and another 6 percent increase from accepting customers who previously would have been blocked. In another example, in September 2014, RadioShack ( www.radioshack.com ) announced that it would install Trustev in its 4,000 U.S. stores in a multimillion-dollar agreement.
And the results? In Trustev’s first year of operation, the com pany was named Europe’s Top Technology Startup by the Euro pean Union Commission as well as one of Forbes’ Hottest Global Startups.
Online fraud continues to plague shoppers and retailers. As a result of this problem, TransUnion ( www.transunion.com ), which provides credit reports, fraud protection, and identity manage ment solutions, acquired Trustev in 2016 in a $44 million transac tion. TransUnion is integrating Trustev’s electronic commerce fraud management functionality to improve TransUnion’s offerings in the area of electronic commerce.
Sources: Compiled from I. Lunden, “TransUnion Buys Trustev in $44M Deal to Beef Up in E-Commerce Fraud Protection,” TechCrunch, Decem
ber 10, 2015; “Are You Who You Say You Are?” University of New South Wales Business Think, April 22, 2015; R. Bradbury, “How 5% of Online Revenues Are Tossed Away,” Trustev Blog, April 22, 2015; J. Temperton, “Digital Fingerprinting Could Stop Web Trolls for Good,” Wired, December 18, 2014;
K. Russell, “Trustev Uses Fraud Detection Soft ware to Crack Down on Internet Trolls,” TechCrunch, December 9, 2014; J. Kennedy, “Cork’s Trustev in Multimillion Dollar Security Deal with RadioShack,” Silicon Republic, September 5, 2014; J. McManus, “Catching Credit Card Cheats from Cork to China,” The Irish Times, July 11, 2014; “Trustev Taps Datameer Big Data Analytics for E-Commerce ID Verification,” Finextra, March 5, 2014; www.trustev.com, www.transunion.com accessed July 29, 2016.
Questions
1. Describe how Trustev’s authentication method differs from other authentication methods.
2. What are potential disadvantages with Trustev’s authentica tion method?
Communications Controls
Communications controls (also called network controls) secure the movement of data across networks. Communications controls consist of firewalls, anti-malware systems, white- listing and blacklisting, encryption, virtual private networks (VPNs), transport layer security (TLS), and employee monitoring systems.
Firewalls. A firewall is a system that prevents a specific type of information from moving between untrusted networks, such as the Internet, and private networks, such as your compa ny’s network. Put simply, firewalls prevent unauthorized Internet users from accessing private networks. All messages entering or leaving your company’s network pass through a firewall. The firewall examines each message and blocks those that do not meet specified security rules. Firewalls range from simple, for home use, to very complex for organizational use. Fig
ure 4.3(a) illustrates a basic firewall for a home computer. In this case, the firewall is imple mented as software on the home computer. Figure 4.3(b) shows an organization that has implemented an external firewall, which faces the Internet, and an internal firewall, which faces the company network. Corporate firewalls typically consist of software running on a computer dedicated to the task. A demilitarized zone (DMZ) is located between the two firewalls. Mes sages from the Internet must first pass through the external firewall. If they conform to the defined security rules, they are then sent to company servers located in the DMZ. These servers typically handle web page requests and e-mail. Any messages designated for the company’s internal network (e.g., its intranet) must pass through the internal firewall, again with its own defined security rules, to gain access to the company’s private network.
The danger from viruses and worms is so severe that many organizations are placing fire- walls at strategic points inside their private networks. In this way, if a virus or worm does get through both the external and internal firewalls, then the internal damage may be contained.
Anti-malware Systems. Anti-malware systems, also called antivirus, or AV, soft ware, are software packages that attempt to identify and eliminate viruses and worms, and other malicious software. AV software is implemented at the organizational level by the IS de partment. Hundreds of AV software packages are currently available. Among the best known are Norton AntiVirus ( www.symantec.com ), McAfee VirusScan ( www.mcafee.com ), and Trend Micro PC-cillin ( www.trendmicro.com ).
Anti-malware systems are generally reactive. Whereas firewalls filter network traffic ac cording to categories of activities that are likely to cause problems, anti-malware systems fil ter traffic according to a database of specific problems. These systems create definitions, or signatures, of various types of malware and then update these signatures in their products.
FIGURE 4.3 (a) Basic firewall for a home computer.
(b) Organization with two firewalls and a demilitarized zone.
The anti-malware software then examines suspicious computer code to determine whether it matches a known signature. If the software identifies a match, then it removes the code. For this reason, organizations regularly update their malware definitions.
Because malware is such a serious problem, the leading vendors are rapidly developing anti-malware systems that function proactively as well as reactively. These systems evaluate behavior rather than relying entirely on signature matching. In theory, therefore, it is possible to catch malware before it can infect systems.
Whitelisting and Blacklisting. A report by the Yankee Group ( www.yankeegroup
.com ), a technology research and consulting firm, stated that 99 percent of organizations had installed anti-malware systems, but 62 percent still suffered malware attacks. As we have seen, anti-malware systems are usually reactive, and malware continues to infect companies.
One solution to this problem is whitelisting. Whitelisting is a process in which a company identifies the software that it will allow to run on its computers. Whitelisting permits acceptable software to run, and it either prevents any other software from running or lets new software run only in a quarantined environment until the company can verify its validity.
Whereas whitelisting allows nothing to run unless it is on the whitelist, blacklisting al lows everything to run unless it is on the blacklist. A blacklist, then, includes certain types of software that are not allowed to run in the company environment. For example, a company might blacklist peer-to-peer file sharing on its systems. Besides software, people, devices, and websites can also be whitelisted and blacklisted.
Encryption. Organizations that do not have a secure channel for sending information use encryption to stop unauthorized eavesdroppers. Encryption is the process of converting an original message into a form that cannot be read by anyone except the intended receiver.
All encryption systems use a key, which is the code that scrambles and then decodes the messages. The majority of encryption systems use public key encryption. Public-key encryp tion—also known as asymmetric encryption—uses two different keys: a public key and a private key (see Figure 4.4). The public key (locking key) and the private key (the unlocking key) are created simultaneously using the same mathematical formula or algorithm. Because the two keys are mathematically related, the data encrypted with one key can be decrypted by using the other key. The public key is publicly available in a directory that all parties can access. The private key is kept secret, never shared with anyone, and never sent across the Internet. In this
FIGURE 4.4 How public-key encryption works.
FIGURE 4.5 How digital certificates work. Sony and Dell, business partners, use a digital certificate from VeriSign for authentication.
system, if Hannah wants to send a message to Harrison, she first obtains Harrison’s public key (locking key), which she uses to encrypt her message (put the message in the “two-lock box”). When Harrison receives Hannah’s message, he uses his private key to decrypt it (open the box). Although this arrangement is adequate for personal information, organizations that con duct business over the Internet require a more complex system. In these cases, a third party, called a certificate authority, acts as a trusted intermediary between the companies. The cer tificate authority issues digital certificates and verifies the integrity of the certificates. A digital certificate is an electronic document attached to a file that certifies that the file is from the organization it claims to be from and has not been modified from its original format. As you can see in Figure 4.5, Sony requests a digital certificate from VeriSign, a certificate authority, and it uses this certificate when it conducts business with Dell. Note that the digital certifi cate contains an identification number, the issuer, validity dates, and the requester’s public key. For examples of certificate authorities, see www.entrust.com , www.verisign.com , www
.cybertrust.com , www.secude.com , and www.thawte.com .
Virtual Private Networking. A virtual private network (VPN) is a private network that uses a public network (usually the Internet) to connect users. VPNs essentially integrate the global connectivity of the Internet with the security of a private network and thereby extend the reach of the organization’s networks. VPNs are called virtual because they have no separate physical existence. They use the public Internet as their infrastructure. They are created by us ing logins, encryption, and other techniques to enhance the user’s privacy, which we defined in Chapter 3 as the right to be left alone and to be free of unreasonable personal intrusion.
VPNs have several advantages. First, they allow remote users to access the company net work. Second, they provide flexibility. That is, mobile users can access the organization’s net work from properly configured remote devices. Third, organizations can impose their security policies through VPNs. For example, an organization may dictate that only corporate e-mail applications are available to users when they connect from unmanaged devices.
To provide secure transmissions, VPNs use a process called tunneling. Tunneling encrypts each data packet to be sent and places each encrypted packet inside another packet. In this manner, the packet can travel across the Internet with confidentiality, authentication, and in tegrity. Figure 4.6 illustrates a VPN and tunneling.
FIGURE 4.6 Virtual private network and tunneling.
Transport Layer Security (TLS). Transport layer security, formerly called se cure socket layer, is an encryption standard used for secure transactions such as credit card purchases and online banking. TLS encrypts and decrypts data between a web server and a browser end to end.
TLS is indicated by a URL that begins with “https” rather than “http,” and it often dis plays a small padlock icon in the browser’s status bar. Using a padlock icon to indicate a secure connection and placing this icon in a browser’s status bar are artifacts of specific browsers. Other browsers use different icons (e.g., a key that is either broken or whole). The important thing to remember is that browsers usually provide visual confirmation of a se cure connection.
Employee Monitoring Systems. Many companies are taking a proactive approach to protecting their networks against what they view as one of their major security threats, namely, employee mistakes. These companies are implementing employee monitoring sys tems, which scrutinize their employees’ computers, e-mail activities, and Internet surfing ac tivities. These products are useful to identify employees who spend too much time surfing on the Internet for personal reasons, who visit questionable websites, or who download music il legally. Vendors that provide monitoring software include SpectorSoft ( www.spectorsoft.com ) and Websense ( www.websense.com ).
Business Continuity Planning
A basic security strategy for organizations is to be prepared for any eventuality. A critical element in any security system is a business continuity plan, also known as a disaster recov ery plan.
Business continuity is the chain of events linking planning to protection and to recovery. The purpose of the business continuity plan is to provide guidance to people who keep the business operating after a disaster occurs. Employees use this plan to prepare for, react to, and recover from events that affect the security of information assets. The objective is to restore the business to normal operations as quickly as possible following an attack. The plan is intended to ensure that critical business functions continue.
In the event of a major disaster, organizations can employ several strategies for business continuity. These strategies include hot sites, warm sites, and cold sites. A hot site is a fully configured computer facility with all of the company’s services, communications links, and physical plant operations. A hot site duplicates computing resources, peripherals, telephone systems, applications, and workstations. A warm site provides many of the same services and options as the hot site. However, it typically does not include the actual applications the com pany needs. A warm site includes computing equipment such as servers, but it often does not include user workstations. A cold site provides only rudimentary services and facilities, such
110 CHAPTER 4 Information Security
Information Security Controls 111
as a building or a room with heating, air conditioning, and humidity control. This type of site provides no computer hardware or user workstations.
Hot sites reduce risk to the greatest extent, but they are the most expensive option. Con versely, cold sites reduce risk the least, but they are the least expensive option.
Information Systems Auditing
Companies implement security controls to ensure that information systems function properly. These controls can be installed in the original system, or they can be added after a system is in operation. Installing controls is necessary but not sufficient to provide adequate security. People who are also responsible for security need to answer questions such as: Are all controls installed as intended? Are they effective? Has any breach of security occurred? If so, what ac tions are required to prevent future breaches?
These questions must be answered by independent and unbiased observers. Such observ ers perform the task of information systems auditing. In an IS environment, an audit is an exam ination of information systems, their inputs, outputs, and processing.
Types of Auditors and Audits. There are two types of auditors and audits: internal and external. IS auditing is usually a part of accounting internal auditing, and it is frequently performed by corporate internal auditors. An external auditor reviews the findings of the inter nal audit as well as the inputs, processing, and outputs of information systems. The external audit of information systems is frequently a part of the overall external auditing performed by a certified public accounting (CPA) firm.
IS auditing considers all of the potential hazards and controls in information systems. It fo cuses on issues such as operations, data integrity, software applications, security and privacy, budgets and expenditures, cost control, and productivity. Guidelines are available to assist au ditors in their jobs, such as those from the Information Systems Audit and Control Association ( www.isaca.org ).
How Is Auditing Executed? IS auditing procedures fall into three categories: (1) auditing around the computer, (2) auditing through the computer, and (3) auditing with the computer.
Auditing around the computer means verifying processing by checking for known outputs using specific inputs. This approach is most effective for systems with limited outputs. In audit ing through the computer, auditors check inputs, outputs, and processing. They review program logic, and they test the data contained within the system. Auditing with the computer means using a combination of client data, auditor software, and client and auditor hardware. This approach enables the auditor to perform tasks such as simulating payroll program logic using live data.
Before you go on. . .
1. What is the single most important information security control for organizations?
2. Differentiate between authentication and authorization. Which of these processes is always per formed first?
3. Compare and contrast whitelisting and blacklisting.
4. What is the purpose of a disaster recovery plan?
5. What is information systems auditing?
112 CHAPTER 4 Information Security
What’s in IT for me?
ACCT For the Accounting Major
Public companies, their accountants, and their auditors have sig nificant information security responsibilities. Accountants are now being held professionally responsible for reducing risk, assuring compliance, eliminating fraud, and increasing the transparency of transactions according to Generally Accepted Accounting Prin ciples (GAAP). The SEC and the Public Company Accounting Over sight Board (PCAOB), among other regulatory agencies, require information security, fraud prevention and detection, and internal controls over financial reporting. Forensic accounting, a combina tion of accounting and information security, is one of the most rap idly growing areas in accounting today.
FIN For the Finance Major
Because information security is essential to the success of organi zations today, it is no longer just the concern of the CIO. As a result of global regulatory requirements and the passage of the Sar- banes–Oxley Act, responsibility for information security lies with the CEO and CFO. Consequently, all aspects of the security audit, including the security of information and information systems, are a key concern for financial managers.
MKT For the Marketing Major
Marketing professionals have new opportunities to collect data on their customers, for example, through business-to-consumer electronic commerce. Customers expect their data to be properly secured. However, profit-motivated criminals want those data. Therefore, marketing managers must analyze the risk of their op erations. Failure to protect corporate and customer data will cause significant public relations problems, make customers very angry,
may lead to lawsuits, and may result in losing customers to com petitors. CRM operations and tracking customers’ online buying habits can expose data to misuse (if they are not encrypted) or re sult in privacy violations.
POM For the Production/Operations Management Major
Every process in a company’s operations—inventory purchasing, receiving, quality control, production, and shipping—can be dis rupted by an information technology security breach or an IT se curity breach at a business partner. Any weak link in supply chain management or enterprise resource management systems puts the entire chain at risk. Companies may be held liable for IT secu rity failures that impact other companies.
HRM For the Human Resource Management Major
HR managers have responsibilities to secure confidential employee data. They must also ensure that all employees explicitly verify that they understand the company’s information security policies and procedures.
MIS For the MIS Major
The MIS function provides the security infrastructure that protects the organization’s information assets. This function is critical to the success of the organization, even though it is almost invisible until an attack succeeds. All application development, network deploy ment, and introduction of new information technologies have to be guided by IT security considerations. MIS personnel must cus tomize the risk exposure security model to help the company iden tify security risks and prepare responses to security incidents and disasters.
Senior executives of publicly held companies look to the MIS function for help in meeting Sarbanes–Oxley Act requirements, particularly in detecting “significant deficiencies” or “material weaknesses” in internal controls and remediating them. Other functional areas also look to the MIS function to help them meet their security responsibilities.
Summary
1. Identify the five factors that contribute to the increasing vul nerability of information resources, and specific examples of each factor.
The five factors are the following:
· Today’s interconnected, interdependent, wirelessly networked business environment.
· Example: The Internet
· Smaller, faster, cheaper computers and storage devices
· Examples: Netbooks, thumb drives, iPads.
· Decreasing skills necessary to be a computer hacker.
· Example: Information system hacking programs circulating on the Internet
· International organized crime taking over cybercrime.
· Example: Organized crime has formed transnational cyber- crime cartels. Because it is difficult to know exactly where
Summary 113
cyberattacks originate, these cartels are extremely hard to bring to justice.
· Lack of management support.
· Example: Suppose that your company spent $10 million on in formation security countermeasures last year, and they did not experience any successful attacks on their information resources. Short-sighted management might conclude that the company could spend less during the next year and obtain the same re sults. Bad idea.
2. Compare and contrast human mistakes and social engi neering, along with specific examples of each one.
Human mistakes are unintentional errors. However, employees can also make unintentional mistakes as a result of actions by an at tacker, such as social engineering. Social engineering is an attack through which the perpetrator uses social skills to trick or manip ulate a legitimate employee into providing confidential company information.
An example of a human mistake is tailgating. An example of social engineering is when an attacker calls an employee on the phone and impersonates a superior in the company.
3. Discuss the 10 types of deliberate attacks.
The 10 types of deliberate attacks are the following:
Espionage or trespass occurs when an unauthorized individual at tempts to gain illegal access to organizational information.
Information extortion occurs when an attacker either threatens to steal, or actually steals, information from a company. The per petrator demands payment for not stealing the information, for returning stolen information, or for agreeing not to disclose the information.
Sabotage and vandalism are deliberate acts that involve defacing an organization’s website, possibly causing the organization to lose its image and experience a loss of confidence by its customers.
Theft of equipment and information is becoming a larger problem be cause computing devices and storage devices are becoming smaller yet more powerful with vastly increased storage, making these de vices easier and more valuable to steal.
Identity theft is the deliberate assumption of another person’s identity, usually to gain access to his or her financial information or to frame him or her for a crime.
Preventing compromises to intellectual property is a vital issue for peo ple who make their livelihood in knowledge fields. Protecting in tellectual property is particularly difficult when that property is in digital form.
Software attacks occur when malicious software penetrates an orga nization’s computer system. Today, these attacks are typically profit-driven and web-based.
Alien software is clandestine software that is installed on your com puter through duplicitous methods. It is typically not as malicious
as viruses, worms, or Trojan horses, but it does use up valuable sys tem resources.
Supervisory control and data acquisition refers to a large-scale distrib uted measurement and control system. SCADA systems are used to monitor or control chemical, physical, and transport processes. A SCADA attack attempts to compromise such a system to cause dam age to the real-world processes that the system controls.
With both cyberterrorism and cyberwarfare, attackers use a target’s computer systems, particularly through the Internet, to cause physical, real-world harm or severe disruption, usually to carry out a political agenda.
4. Describe the three risk-mitigation strategies and examples of each one in the context of owning a home.
The three risk-mitigation strategies are the following:
Risk acceptance, in which the organization accepts the potential risk, continues operating with no controls, and absorbs any dam ages that occur. If you own a home, you may decide not to insure it. Thus, you are practicing risk acceptance. Clearly, this is a bad idea.
Risk limitation, in which the organization limits the risk by implement ing controls that minimize the impact of threats. As a homeowner, you practice risk limitation by putting in an alarm system or cutting down weak trees near your house.
Risk transference, in which the organization transfers the risk by us ing other means to compensate for the loss, such as by purchas ing insurance. The vast majority of homeowners practice risk transference by purchasing insurance on their houses and other possessions.
5. Identify the three major types of controls that organiza tions can use to protect their information resources along with an example of each one.
Physical controls prevent unauthorized individuals from gaining access to a company’s facilities. Common physical controls include walls, doors, fencing, gates, locks, badges, guards, and alarm systems. More sophisticated physical controls include pressure sensors, temperature sensors, and motion detectors.
Access controls restrict unauthorized individuals from using informa tion resources. These controls involve two major functions: authen tication and authorization. Authentication confirms the identity of the person requiring access. An example is biometrics. After the person is authenticated (identified), the next step is authorization. Authorization determines which actions, rights, or privileges the person has, based on his or her verified identity. Authorization is generally based on least privilege.
Communications (network) controls secure the movement of data across networks. Communications controls consist of firewalls, anti-malware systems, whitelisting and blacklisting, encryption, virtual private networking, secure socket layer, and vulnerability management systems.
114 CHAPTER 4 Information Security
Chapter Glossary
access controls Controls that restrict unauthor ized individuals from using information resources and are concerned with user identification.
adware Alien software designed to help pop-up advertisements appear on your screen.
alien software Clandestine software that is installed on your computer through duplicitous methods.
anti-malware systems (antivirus soft ware) Software packages that attempt to identify and eliminate viruses, worms, and other malicious software.
audit An examination of information systems, their inputs, outputs, and processing.
authentication A process that determines the identity of the person requiring access.
authorization A process that determines which actions, rights, or privileges the person has, based on verified identity.
back door Typically a password, known only to the attacker, that allows the attacker to ac cess the system without having to go through any security procedures.
biometrics The science and technology of authentication (i.e., establishing the identity of an individual) by measuring the subject’s physi ological or behavioral characteristics.
blacklisting A process in which a company identifies certain types of software that are not allowed to run in the company environment.
bot A computer that has been compromised by, and under the control of, a hacker.
botnet A network of computers that have been compromised by, and under control of, a hacker, who is called the botmaster.
business continuity The chain of events link ing planning to protection and to recovery.
certificate authority A third party that acts as a trusted intermediary between computers (and companies) by issuing digital certificates and ver ifying the worth and integrity of the certificates.
communications controls (also network con trols) Controls that deal with the movement of data across networks.
controls Defense mechanisms (also called
countermeasures).
cookie Small amounts of information that websites store on your computer, temporarily or more or less permanently.
copyright A grant from a governmental au thority that provides the creator of intellectual property with ownership of it for a specified pe riod of time, currently the life of the creator plus 70 years.
cybercrime Illegal activities executed on the Internet.
cyberterrorism Can be defined as a pre meditated, politically motivated attack against information, computer systems, computer pro grams, and data that results in violence against noncombatant targets by subnational groups or clandestine agents.
cyberwarfare War in which a country’s infor mation systems could be paralyzed from a mas sive attack by destructive software.
demilitarized zone (DMZ) A separate orga nizational local area network that is located between an organization’s internal network and an external network, usually the Internet.
denial-of-service attack A cyberattack in which an attacker sends a flood of data packets to the target computer with the aim of overload ing its resources.
digital certificate An electronic document attached to a file certifying that this file is from the organization it claims to be from and has not been modified from its original format or content.
distributed denial of service (DDoS) at tack A denial of service attack that sends a flood of data packets from many compromised computers simultaneously.
employee monitoring systems Systems that monitor employees’ computers, e-mail activi ties, and Internet surfing activities.
encryption The process of converting an orig inal message into a form that cannot be read by anyone except the intended recipient.
exposure The harm, loss, or damage that can result if a threat compromises an information resource.
firewall A system (either hardware, software, or a combination of both) that prevents a spe cific type of information from moving between untrusted networks, such as the Internet, and private networks, such as your company’s network.
identity theft Crime in which someone uses the personal information of others to create a false identity and then uses it fraudulently.
information security Protecting an organi zation’s information and information systems from unauthorized access, use, disclosure, dis ruption, modification, or destruction.
intellectual property The intangible prop erty created by individuals or corporations, which is protected under trade secret, patent, and copyright laws.
least privilege A principle that users be granted the privilege for some activity only
if there is a justifiable need to grant this authorization.
logic bombs Segments of computer code em bedded within an organization’s existing com puter programs.
malware Malicious software such as viruses and worms.
network controls See communications controls.
password A private combination of charac ters that only the user should know.
patent A document that grants the holder exclusive rights on an invention or process for a specified period of time, currently 20 years.
phishing attack An e-mail attack that uses deception to fraudulently acquire sensitive per sonal information by masquerading as an offi cial looking e-mail.
physical controls Controls that restrict un authorized individuals from gaining access to a company’s computer facilities.
piracy Copying a software program (other than freeware, demo software, etc.) without making payment to the owner.
privilege A collection of related computer sys tem operations that can be performed by users of the system.
public-key encryption (also called asymmet ric encryption) A type of encryption that uses two different keys, a public key and a private key.
risk The likelihood that a threat will occur.
risk acceptance A strategy in which an organ ization accepts the potential risk, continues to operate with no controls, and absorbs any dam ages that occur.
risk analysis The process by which an orga nization assesses the value of each asset being protected, estimates the probability that each asset might be compromised, and compares the probable costs of each being compromised with the costs of protecting it.
risk limitation A strategy in which an orga nization limits its risk by implementing controls that minimize the impact of a threat.
risk management A process that identifies, controls, and minimizes the impact of threats, in an effort to reduce risk to manageable levels.
risk mitigation A process whereby an organi zation takes concrete actions against risks, such as implementing controls and developing a dis aster recovery plan.
risk transference A process in which an or ganization transfers the risk by using other
Problem-Solving Activities 115
means to compensate for a loss, such as by pur chasing insurance.
secure socket layer (SSL) (also known as transport layer security) An encryption stand ard used for secure transactions such as credit card purchases and online banking.
security The degree of protection against criminal activity, danger, damage, or loss.
social engineering Getting around security systems by tricking computer users inside a company into revealing sensitive information or gaining unauthorized access privileges.
spam Unsolicited e-mail.
spamware Alien software that uses your com puter as a launch platform for spammers.
spyware Alien software that can record your keystrokes or capture your passwords.
threat Any danger to which an information resource may be exposed.
trade secret Intellectual work, such as a busi ness plan, that is a company secret and is not based on public information.
transport layer security (TLS) See secure socket layer.
trap doors See back door.
Trojan horse A software program containing a hidden function that presents a security risk.
tunneling A process that encrypts each data packet to be sent and places each encrypted packet inside another packet.
virtual private network (VPN) A private net work that uses a public network (usually the Internet) to securely connect users by using encryption.
viruses Malicious software that can attach itself to (or “infect”) other computer programs without the owner of the program being aware of the infection.
vulnerability The possibility that an informa tion resource will be harmed by a threat.
whitelisting A process in which a company identifies acceptable software and permits it to run, and either prevents anything else from run ning or lets new software run in a quarantined environment until the company can verify its validity.
worms Destructive programs that replicate themselves without requiring another program to provide a safe environment for replication.
zombie computer See bot.
Discussion Questions
1. Why are computer systems so vulnerable?
2. Why should information security be a prime concern to management?
3. Is security a technical issue? A business issue? Both? Support your answer.
4. Compare information security in an organization with insuring a house.
5. Why are authentication and authorization important to e-commerce?
6. Why is cross-border cybercrime expanding rapidly? Discuss possi ble solutions.
7. Discuss why the Sarbanes–Oxley Act is having an impact on infor mation security.
8. What types of user authentication are used at your university or place of work? Do these measures seem to be effective? What if a higher level of authentication were implemented? Would it be worth it, or would it decrease productivity?
9. Why are federal authorities so worried about SCADA attacks?
Problem-Solving Activities
1. A critical problem is assessing how far a company is legally obli gated to go in order to secure personal data. Because there is no such thing as perfect security (i.e., there is always more that one can do), resolving this question can significantly affect cost.
a. When are security measures that a company implements suffi cient to comply with its obligations?
b. Is there any way for a company to know if its security measures are sufficient? Can you devise a method for any organization to determine if its security measures are sufficient?
2. Assume that the daily probability of a major earthquake in Los An geles is 0.07 percent. The chance that your computer center will be damaged during such a quake is 5 percent. If the center is damaged, the estimated damage to the computer center will be $4.0 million.
a. Calculate the expected loss in dollars.
b. An insurance agent is willing to insure your facility for an annual fee of $25,000. Analyze the offer, and discuss whether to accept it.
3. Enter www.scambusters.org . Find out what the organization does. Learn about e-mail scams and website scams. Report your findings.
4. Visit www.dhs.gov/dhspublic (Department of Homeland Security). Search the site for “National Strategy to Secure
Cyberspace” and write a report on their agenda and accomplish ments to date.
5. Enter www.alltrustnetworks.com and other vendors of biomet rics. Find the devices they make that can be used to control access into information systems. Prepare a list of products and major capabilities of each vendor.
6. Software piracy is a global problem. Access the following websites: www.bsa.org and www.microsoft.com/piracy/. What can organiza tions do to mitigate this problem? Are some organizations dealing with the problem better than others?
7. Investigate the Sony PlayStation Network hack that occurred in April 2011.
a. What type of attack was it?
b. Was the success of the attack due to technology problems at Sony, management problems at Sony, or a combination of both? Provide specific examples to support your answer.
c. Which Sony controls failed?
d. Could the hack have been prevented? If so, how?
e. Discuss Sony’s response to the hack.
f. Describe the damages that Sony incurred from the hack.
116 CHAPTER 4 Information Security
Closing Case
The Office of Personnel Management Breach
MIS
The Problem
Despite high-profile security breaches in the past, many U.S. govern ment agencies have not made cybersecurity a priority. In fact, govern ment officials noted that security-related incidents at federal agencies have increased dramatically in recent years. Audits of federal agencies have demonstrated the seriousness of this lack of security. Consider the following cases:
· A January 2015 audit of the Federal Aviation Administration cited “significant security control weaknesses” in the agency’s network, placing the operation of the nation’s air traffic control system at risk.
· Federal auditors found numerous security problems with the Department of Energy’s network, which contains sensitive infor mation on nuclear propulsion and critical nuclear infrastructure. The auditors criticized the Energy Department for poor secu rity controls, lack of encryption, and a failure to repair known vulnerabilities.
· Federal auditors identified 69 security vulnerabilities at the In ternal Revenue Service. Then, when IRS officials informed Gov ernment Accountability Office auditors that the agency had fixed 24 of the problems, the auditors found that only 14 had been re paired. In August 2015, the IRS revealed that hackers had gained access to the tax returns of some 334,000 U.S. citizens.
The U.S. Office of Personnel Management (OPM; www.opm.gov ) is the human resources department for the federal government. As such, the agency manages how federal employees are hired, fired, and promoted. The agency also manages benefits and pensions for mil lions of current and retired civil servants.
In June 2015, OPM announced that it had been the target of two data breaches that stole the personal records of approximately 22 million people. U.S. government officials have described the breaches as among the largest thefts of government data in U.S. history. (Note: In fairness to the OPM, the agency successfully thwarts some 10 mil lion attempted digital intrusions per month, but these breaches were successful.)
Evidence of the breaches appears to have been discovered ac cidentally during a product demonstration by network security com pany CyTech Services ( www.cytechservices.com ). CyTech’s team was demonstrating the company’s product, CyFIR, and the software tool identified the previously unknown malware associated with the breaches.
Information stolen in the OPM breaches affected not only OPM employees, but contractors, applicants, and family members as well. The stolen information included personally identifiable information such as Social Security numbers, names, dates and places of birth, residency and educational history, and addresses. Also stolen was in formation about immediate family and other personal and business acquaintances, as well as health, criminal, and financial histories. The attackers also stole detailed security clearance–related background information that included more than one million fingerprints.
Significantly, the OPM had been warned multiple times of security vulnerabilities. In 2008, the Inspector General’s office recommended that OPM eliminate the unnecessary use of Social Security numbers
(SSNs). By 2014, OPM had stopped using SSNs for some systems, but not all. A subsequent 2014 audit of OPM’s cloud computing contracts found that OPM did not follow best practices for moving software and data to the cloud. (We discuss cloud computing in Technology Guide 3.) It further discovered that OPM had failed to keep up with required testing and certification to ensure that its systems met security stan dards. These authorizations must be conducted every three years. In 2014, 11 of 47 major systems due for authorization were operating without it, including systems in human resources, finance, and inves tigative services. A March 2015 Inspector General report to Congress warned of persistent deficiencies in OPM’s security programs.
The IT Solution (?)
To improve the cybersecurity of federal agencies, U.S. Chief Informa tion Officer Tony Scott launched a 30-day “Cybersecurity Sprint.” Scott instructed federal agencies to take carefully defined steps to improve cybersecurity:
· Immediately patch critical security vulnerabilities.
· Tighten policies and procedures for privileged users by limiting the number of user accounts.
· Dramatically accelerate the implementation of multifactor au thentication, especially for privileged users.
Unfortunately, major agencies were not expected to have all these defenses in place until 2017, and smaller agencies could take even longer. Furthermore, legal, political, and bureaucratic roadblocks still make it difficult for cybersecurity officials to act quickly. In par ticular, bureaucratic obstacles hindered efforts by the Department of Homeland Security to compete in the highly competitive market for cybersecurity specialists. Federal agencies also note that as difficult as it is to hire top cybersecurity talent, government bureaucracy makes it even more difficult to fire underperforming government personnel.
Security experts state that the Cybersecurity Sprint reveals a fundamental problem in current approaches to information security. We emphasize prevention at the expense of mitigation. Attackers are causing so much damage because the average time between a mali cious software infection and discovery of that infection is more than 200 days. Unfortunately, this gap is not shrinking.
The Results
At some federal agencies, 100 percent of users are, for the first time, logging in with two-factor authentication. Security problems that have existed for years are being patched. For example, employees can no longer access their gmail accounts from their office computers. Thou sands of low-level employees and contractors with access to the na tion’s most sensitive secrets now have very limited access privileges.
Unfortunately, many federal agencies remain highly vulnerable to sophisticated cybercriminals, who are often sponsored by other coun tries. The government is still facing obstacles in procuring the most current cybersecurity systems and attracting digital security experts. Furthermore, senior cybersecurity officials maintain that the 30-day Sprint, although helpful, had limited long-range usefulness because federal systems still use out-of-date equipment and security software. Security experts noted that the breaches have created a signifi
cant threat to U.S. national security that will last for decades and cost billions of dollars to monitor. Specifically, the stolen data constitute a
Closing Case 117
counterintelligence threat that could easily last 40 years, or until the youngest members of the federal workforce retire. The security experts further contend that the OPM can do little to reverse the damage that has already been done.
Lawmakers have introduced legislation that would provide af fected employees with free lifetime identity protection and $5 million in identity theft insurance. Meanwhile, Katherine Archuleta, the direc tor of the OPM, claimed that her agency suffered from an old technol ogy infrastructure that she was working to improve. Director Archuleta resigned her position in July 2015.
In September 2015, acting OPM Director Beth Cobert announced that the agency had awarded a contract to Identity Theft Guard Solu tions LLC ( www.identityguard.com ) to provide identity theft and credit protection for those affected by the OPM breach. The contract is valued at approximately $133 million and will provide up to three years of protection for the people affected by the breach, as well as any dependents who were still minors as of July 1, 2015.
The fallout from the OPM breach continued in early February 2016, when OPM’s chief information officer, Donna Seymour, also re signed. The American Federation of Government Employees has also filed a class-action lawsuit against the federal government, seeking monetary damages as well as lifetime credit monitoring and identity theft protection for affected persons. The two executives’ departures caused concerns among their peers at other federal agencies, who are now wondering what information they have that attackers might want that they have not thought about before?
Sources: Compiled from B. Koerner, “Inside the Cyberattack that Shocked the
U.S. Government,” Wired, October 23, 2016; B. Naylor, “One Year after OPM Data Breach, What Has the Government Learned?” National Public Radio, June 6, 2016; M. Adams, “Why the OPM Hack Is Far Worse than You Imagine,”
Lawfare, March 11, 2016; E. Kelly, “OPM’s Cybersecurity Chief Resigns in Wake of Massive Data Breach,” USA Today, February 22, 2016; M. Heller, “OPM Breach
Protection Services on the Way for 21.5M Victims,” TechTarget, September 3, 2015; J. McKinnon and L. Saunders, “IRS Says Hackers Hit More Accounts,” Wall Street Journal, August 18, 2015; C. Bennett, “White House Hands Out ‘Cyber Sprint’ Grades,” The Hill, July 31, 2015; M. Shear and N. Perlroth, “U.S. vs. Hackers: Still Lopsided Despite Years of Warnings and a Recent Push,” New York Times, July 18, 2015; J. Rogers, “Why the OPM Hack Is an Ongoing Cyber Headache,” Fox News, July 14, 2015; K. Corbin, “How OPM Data Breach Could Have Been Prevented,” CIO, July 13, 2015; D. Verton, “Impact of OPM Breach Could Last More than 40 Years,” Fedscoop, July 12, 2015; S. Norton and C. Boulton, “Years of Tech Mismanagement Led to OPM Breach, Resignation of Chief,” CIO Journal, July 10, 2015; J. Sciutto, “OPM Government Data Breach Impacted 21.5 Million,” CNN, July 10, 2015; P. Zengerle and M. Cassella, “Millions More Americans Hit by Government Personnel Data Hack,” Reuters, July 9, 2015; D. Paletta, “Personnel Data Breach a ‘Huge Deal’,” Wall Street Journal, July 9, 2015; J. Davidson, “New OPM Data Breach Numbers Leave Federal Employees Anguished, Outraged,” The Washington Post, July 9, 2015;
M. Heller, “Stolen Passwords to Blame for OPM Breach; Director May Take the Fall,” TechTarget, June 25, 2015; S. Vaughan-Nichols, “It Gets Worse: Two Federal OPM Hacks Affected Up to 18 Million,” ZDNet, June 23, 2015; A. Boyd,
“Second OPM Hack Exposed Highly Personal Background Info,” Federal Times, June 16, 2015; A. Boyd, “Feds on ‘3-Day Sprint’ to Better Cybersecurity,” Federal Times, June 15, 2015; “Officials: Second Hack Exposed Military and Intel Data,” Associated Press, June 12, 2015; R. Hackett, “A Product Demo May Have Revealed What Could Be the Biggest Ever Government Data Breach,” Fortune, June 12, 2015; www.opm.gov, accessed July 31, 2016.
Questions
1. What actions should the OPM have taken to prevent the breaches? Provide specific examples in your answer.
2. Should the U.S. government do anything more for the victims of the breaches? If so, what?
3. Place yourself as a victim in the OPM breaches. What should you do when you are notified that your personal data have been compromised?
4. Does this case really have an IT solution? Why or why not?
Data and Knowledge Management
CHAPTER OUTLINE LEARNING OBJECTIVES
5.1 Managing Data 5.1 Discuss ways that common challenges in managing data can be addressed using data governance.
5.2 The Database Approach 5.2 Discuss the advantages and disadvantages of relational databases.
5.3 Big Data 5.3 Define Big Data and its basic characteristics.
5.4 Data Warehouses and Data Marts 5.4 Explain the elements necessary to successfully implement and
maintain data warehouses.
5.5 Knowledge Management 5.5 Describe the benefits and challenges of implementing knowledge
management systems in organizations.
5.6 Appendix: Fundamentals of Relational 5.6 Understand the processes of querying a relational database, Database Operations entity-relationship modeling, and normalization and joins.
Opening Case
Tracking Pot from Seed to Customer
The Problem
When Colorado’s Amendment 64 legalized recreational mari juana in 2012, most of its support came from voters in Denver and its surrounding metropolitan area, and not from the state’s more rural ar eas. As a result, Colorado remains divided over the drug, which is still illegal under federal law (as of March 2017).
POM
In fact, of 321 municipalities in Colorado, 228 opted out of allow ing marijuana. Local officials and law enforcement throughout the state, unconvinced of the benefits of legalizing marijuana, have tried to push back against legalization, citing the federal government’s ban on the drug. Meanwhile, investors, business owners, tourists, and many Colorado residents argue that legal recreational marijuana has benefited the state.
At least partially in response to this ongoing debate, Colorado has placed strict regulations on all aspects of the marijuana production process. These regulations mandate that producers and distributors track each plant throughout its life cycle. The problem was how to im plement these regulations in an efficient, accountable, cost-effective manner.
The IT Solution
Colorado’s marijuana growers and distributors are having to adjust to regulations concerning their newly legitimate businesses. Under the state’s rules, growers must put a microchip on each plant so it can be recorded and monitored in Colorado’s Marijuana Enforcement Track ing Reporting Compliance (METRC; www.metrc.com ) system.
Franwell ( www.franwell.com ), a Florida-based technology com pany, developed METRC. The system provides end-to-end tracking and
CHAPTER 5
118
120 CHAPTER 5 Data and Knowledge Management
Introduction 119
tracing of marijuana plants and products. Franwell developed the sys tem specifically for government agencies in charge of legalized mari juana enforcement. As of November 2016, METRC had registered over 20,000 users and tracked over 5 million plants and 4 million packages. Here is how METRC works.
A yellow radio-frequency identification (RFID) tag placed on each plant enables officials consulting a statewide database to track crops from “bud to blunt.” The tags contain 24-digit identification codes, and they are staked into the soil or wrapped around individual plants while they grow. The tags travel with the plants through the grow house, to harvest, and as the pot flowers are dried and cured for flavor. (A grow house is a property that is primarily used for the production of mar ijuana.) For shipment to stores, each strain of marijuana is grouped into a batch that receives its own RFID tag, which remains on the pack ages until the batch is sold. During scheduled and unscheduled visits to dispensaries or grow houses, state officials use RFID scanners and electronic inventories to ensure that none of the plants goes missing.
Each plant tag costs 45 cents, and the batch package tag costs 25 cents. Growers contend that the tags are expensive. For many grow ers, however, their biggest frustration is having to enter the data twice: once into their own accounting databases and again into the MITS sys tem, which is not compatible with most other accounting programs. The penalties for mistakes in entering the data include loss of license and criminal charges. Given that the potential for mistakes is high, growers feel that these penalties are excessively harsh. For example, when a plant dies, growers must follow a lengthy ticketing procedure to document and delete that plant from the system or face severe pen alties for a “missing” plant.
A spokeswoman for Colorado’s marijuana enforcement division maintains that red tape and fees are “part of being regulated.” Com plaints notwithstanding, one grower stated that RFID tagging and capturing the data in the MITS database is necessary to legitimize the industry.
The plant tags do provide some benefits to growers. Specifically, they offer knowledgeable growers a closer look at which strains are selling well or where a troublesome batch shipped. For example, when a batch of pot-infused gummy bears shipped from Native Roots ( http://nativeroots303.com , the largest marijuana dispensary in Colorado) became moldy, the store manager used the data recorded on the METRC database to locate and recall only the rotten gummies.
Other growers are installing their own RFID scanners to electronically track each plant’s location in their warehouses.
The Results
As of November 2016, the state of Colorado had issued some 3,000 li censes for marijuana cultivation, production, and testing facilities and retail stores in both the medical and recreational markets. Marijuana brought in nearly $80 million for the state in taxes and fees during the 2015 fiscal year (based on $996.5 million in total licensed marijuana sales). The revenue comes from a 2.9 percent retail and medical mar ijuana sales tax, a 10 percent retail marijuana special sales tax, and a 15 percent marijuana excise tax, plus application and license fees for retail and medical marijuana.
Those figures did not keep track of the economic contributions of thousands of tourists who come to Colorado partly for its marijuana. In fact, according to Colorado’s Marijuana Enforcement Division, up to 90 percent of recreational marijuana sales in some areas, particularly mountain resort towns, are made to tourists.
By May 2017, Alaska, Washington, Oregon, California, Massachu setts, Nevada, Maine, Colorado, and the District of Columbia had le galized nonmedical cultivation and uses of marijuana. Most of these states were planning to use an RFID system similar to Colorado’s to monitor marijuana production and distribution.
Sources: Compiled from T. Fuller, “Californians Legalize Marijuana in Vote that Could Echo Nationally,” New York Times, November 9, 2016; J. Alsever, “Is Pot Losing Its Buzz in Colorado?” Fortune, June 29, 2016; R. Grenoble, “Revenue from Colorado Marijuana Tax Expected to Double in 2015,” The Huffington Post, September 21, 2015; K. Wyatt, “Colorado Pot Growers Save Big Bucks on Tax Holiday Caused by Quirk in State Law,” US News and World Report, September 16, 2015; J. Frank, “Ahead of 2015 Vote, Campaign Pushes Marijuana Tax Question in Colorado,” Denver Post, September 13, 2015; C. Cooper, “Colorado Profits, But Still Divided on Legal Weed,” The Center for Public Integrity, August 16, 2015; R. Baca, “Colorado Pot Sales Spike in June, Top $50 Million for
First Time,” The Cannabist, August 13, 2015; H. Borrud, “Oregon Pot Tracking System Will Use RFID Technology,” East Oregonian, June 14, 2015; S. Lohmeyer, “States Turn to Tech for Tracking Marijuana,” GCN.com , May 26, 2015; K. Weise, “Tracking Colorado’s Legal Pot, Plant by Plant,” Bloomberg BusinessWeek, March 17–23, 2014; R. Hiscott, “RFID Tags Track Marijuana from Seed to Sale in Colorado,” Mashable, February 11, 2014.
Questions
1. Describe how database technology plays an important role en abling Colorado to closely monitor the marijuana production and distribution process.
2. Describe potential disadvantages in using RFID tags to monitor marijuana production and distribution.
Introduction
Information technologies and systems support organizations in managing—that is, acquiring, organizing, storing, accessing, analyzing, and interpreting—data. As you noted in Chapter 1, when these data are managed properly, they become information and then knowledge. As you see in the chapter’s opening case, information and knowledge are invaluable organizational resources that can provide any organization with a competitive advantage.
So, just how important are data and data management to organizations? From confidential customer information to intellectual property to financial transactions to social media posts, organizations possess massive amounts of data that are critical to their success. Of course, to benefit from these data, they need to manage them effectively. This type of management,
however, comes at a huge cost. According to Symantec’s ( www.symantec.com ) State of Informa tion Survey, digital information costs organizations worldwide over $1 trillion annually, and it makes up roughly half of an organization’s total value. The survey found that large organiza tions spend an average of some $40 million annually to maintain and use data, and small- to medium-sized businesses spend almost $350,000.
Despite the monetary value of data, some organizations are building their business mod els on giving data away for free. IT’s About Business 5.1 shows how Jana is bringing Internet access to the developing world using this practice.
This chapter examines the processes whereby data are transformed first into information and then into knowledge. Managing data is critically important in all organizations. Few busi ness professionals are comfortable making or justifying business decisions that are not based on solid information. This is especially true today, when modern information systems make ac cess to that information quick and easy. For example, we have information systems that format data in a way that managers and analysts can easily understand. Consequently, these profes sionals can access these data themselves and then analyze them according to their needs. The result is useful information. Managers can then apply their experience to use this information to address a business problem, thereby producing knowledge. Knowledge management, enabled by information technology, captures and stores knowledge in forms that all organizational em ployees can access and apply, thereby creating the flexible, powerful “learning organization.”
Organizations store data in databases. Recall from Chapter 1 that a database is a collection of related data files or tables containing data. We discuss databases in Section 5.2, focusing on the relational database model. In the Appendix to this chapter (Section 5.6), we take a look at the fundamentals of relational database operations.
Clearly, data and knowledge management are vital to modern organizations. But, why should you learn about them? The reason is that you will play an important role in the devel opment of database applications. The structure and content of your organization’s database depend on how users (you) define your business activities. For example, when database de velopers in the firm’s MIS group build a database, they use a tool called entity-relationship (ER) modeling. This tool creates a model of how users view a business activity. When you under stand how to create and interpret an ER model, then you can evaluate whether the developers have captured your business activities correctly.
Keep in mind that decisions about data last longer, and have a broader impact, than deci sions about hardware or software. If decisions concerning hardware are wrong, then the equip ment can be replaced relatively easily. If software decisions turn out to be incorrect, they can be modified, though not always painlessly or inexpensively. Database decisions, in contrast, are much harder to undo. Database design constrains what the organization can do with its data for a long time. Remember that business users will be stuck with a bad database design, while the programmers who created the database will quickly move on to their next projects.
Furthermore, consider that databases typically underlie the enterprise applications that users access. If there are problems with organizational databases, it is unlikely that any appli cations will be able to provide the necessary functionality for users. Databases are difficult to set up properly and to maintain. They are also the component of an information system that is most likely to receive the blame for poor performance of the system, and the least likely to be recognized for excellent performance of the system. This is why it is so important to get data base designs right the first time—and you will play a key role in these designs.
You might also want to create a small, personal database using a software product such as Microsoft Access. In that case, you will need to be familiar with at least the basics of the product.
After the data are stored in your organization’s databases, they must be accessible to users in a form that helps them make decisions. Organizations accomplish this objective by devel oping data warehouses. You should become familiar with data warehouses because they are invaluable decision-making tools. We discuss data warehouses in Section 5.4.
You will also make extensive use of your organization’s knowledge base to perform your job. For example, when you are assigned a new project, you will likely research your firm’s knowledge base to identify factors that contributed to the success (or failure) of previous, sim ilar projects. We discuss knowledge management in Section 5.5.
122 CHAPTER 5 Data and Knowledge Management
Introduction 121
IT’s About Business 5.1
Giving Data Away for Free
MIS MKT
The rapid increase in the number of new smartphones in devel oping countries has not been accompanied by a corresponding increase in mobile marketing, because wireless data are still too expensive. In Africa and Asia, for example, prepaid plans are the norm, not contracts, meaning that most mobile users pay for small amounts of minutes and data.
The cost of wireless access in developing countries may seem affordable to Americans, but it’s not when compared with average incomes. In India, for example, users pay just $4 for a gigabyte of 3G data, versus about $20 in the United States. The price of a smart- phone in India starts at $40, and the average monthly bill is $7. But in many developing countries, the minimum wage is just 20 cents an hour. In India, only 57 percent of smartphone owners use data, and the average monthly use is just 80 megabytes, compared with 800 for the average American. In the United States, mobile data costs 1 to 2 percent of the average wage, compared with 10 percent in Brazil and more than 33 percent in Africa.
One company is trying to help emerging market consum ers access the Internet more cheaply. Jana ( http://jana.com ) is a mobile startup that has business relationships with 237 telecom munications firms in 102 countries, whose customers own some
3.5 billion mobile phones. In 2014, Jana deployed Marketplace, a service that enables marketers to send ads to phones around the world at no cost to the recipient. The ads can be either short videos or app install ads.
For many millions of people in the developing world, Jana is an entry point to the mobile web. Jana’s mCent ( www.mcent.com ) app rewards mobile users with data in exchange for sampling apps and allowing Jana to gather personal information, such as their past usage and which friends they persuaded to join the service. The app developers pay for the data rewards and Jana gets a per centage. For example, in India, mobile customers can sign up for the chat app LINE ( http://line.me/en/ ) and receive 13 rupees worth of data, and sign up for the music service Saavn ( www.saavn.com ) and get 28 rupees worth of data. Thus, users acquire free data with which to connect to the Internet.
mCent’s popularity skyrocketed, ranking it the number five app in India in just 12 months. It helped Jana turn a profit by early 2015. Approximately 50 percent of Jana’s revenue comes from Chi na’s Tencent, Amazon, and Twitter, with the remainder (more than 1,500 apps) coming from many other companies.
Jana released its Marketplace platform in an attempt to over come the difficult business case for mobile in developing countries. Mobile operators in emerging markets could boost bandwidth by erecting more cell towers, but they are limited by narrow profit margins, growing competition, and low capital spending. In many areas, the average revenue per customer is decreasing as impover ished people increasingly access wireless networks.
Besides growing its revenues, Jana’s aim is to offer free Inter net service to billions of people. The startup is facing intense com petition in this effort.
One solution to the Internet access problem is zero-rating— also called sponsored data—systems. With zero-rating, web-based firms establish deals with Internet service providers whereby they
pay for the cost of users visiting their sites. Facebook, Google, and WhatsApp have used zero-rating for some time with bare-bones services such as Facebook Zero, a text-only platform without im ages. In a move to make its Android apps more accessible, Google has created a data-sponsorship business.
The zero-rating system has its critics because there is no level playing field: Larger apps with deeper pockets can better afford data than smaller apps. Also, some users are not aware of what the Internet is and how it usually works. In Indonesia, for example, 11 percent of Facebook Zero users said they didn’t know that they were on the Internet. In fact, Indian critics have protested Face book’s Internet.org app, arguing that the fact that it allows smart- phone users to visit certain sites for free misleads consumers into knowing how open the web can be.
Jana maintains that the objections to zero-rating systems do not apply to its mCent app. The reason is that after signing up for a sponsored app, consumers can use their free data however they like, including any app, website, or video clip.
Critics say that companies going into developing countries used sponsored data to increase data usage, while impoverished consumers who are just getting to know the Internet and how it works risk being exploited.
Significantly, mCent users can also be taken advantage of be cause they may download many apps they’re not interested in so that they can receive free data. Jana attempts to negate this prob lem by customizing mCent to users and by monitoring the time that users spend on the apps they download.
Sources: Compiled from S. Vijayakumar, “Jana Is in Full Support of Net Neutrality,” The Hindu, April 2, 2016; D. Primack, “Jana Raises $57 Million to Bring Internet to Developing World,” Fortune, February 18, 2016; K. Majithia, “Facebook’s Internet.org ‘Not Scalable’ Claims Rival Startup mCent,” Mobile World Live, September 9, 2015; N. Pahwa, “Google Joins Facebook in Trying to Prevent IAMAI from Taking Strong Anti-Zero Rating Stand,” Medianama, August 20, 2015; P. Olson, “This App Is Cashing in on Giving the World Free Data,” Forbes, July 29, 2015; N. Alawadhi and J. PK, “Google Puts Zero Rating Plan in India on Backburner for Fear of Backlash,” The Times of India,
May 28, 2015; J. Nanos, “Mobile App Marketplace Jana Pushes Deeper into the Developing World,” Boston Globe, May 6, 2015; M. Godwin, “What the ‘Zero Rating’ Debate Reveals about Net Neutrality,” Reason.com , April 8, 2015; A. Howard, “Zero Rating Poses a Conundrum for Net Neutrality Advocates around the World,” TechRepublic, January 23, 2015; A. Drossos, “Forget Fast Lanes. The Real Threat Net-Neutrality Is Zero-Rated Content,” GigaOM, April 26, 2014; M. Bergen, “Mobile Startup Jana Launches Tool to Reach Next Billion Consumers, on Their Phones,” Advertising Age, March
19, 2014; “Why Jana Will Help Marketers Reach the Next Billion Customers,” vivaki.com , July 15, 2013; http://jana.com, www.mcent.com, accessed October 11, 2016.
Questions
1. At first glance, giving away data for free seems to be a ques tionable business strategy. Describe how Jana’s business model makes this practice a success.
2. Why are Facebook and Google so interested in bringing In ternet access to the developing world?
3. Discuss the pros and cons of the zero-rating system.
4. Is Jana correct in claiming that its system is not really a zero-rating system? Why or why not?
You begin this chapter by examining the multiple problems involved in managing data. You then study the database approach that organizations use to help solve these problems. You turn your attention to Big Data, which organizations must manage in today’s business envi ronment. Next, you study data warehouses and data marts, and you learn how to use them for decision making. You finish the chapter by examining knowledge management.
Managing Data
5.1
All IT applications require data. These data should be of high quality, meaning that they should be accurate, complete, timely, consistent, accessible, relevant, and concise. Unfortunately, the process of acquiring, keeping, and managing data is becoming increasingly difficult.
The Difficulties of Managing Data
Because data are processed in several stages and often in multiple locations, they are fre quently subject to problems and difficulties. Managing data in organizations is difficult for many reasons.
First, the amount of data increases exponentially with time. Much historical data must be kept for a long time, and new data are added rapidly. For example, to support millions of cus tomers, large retailers such as Walmart have to manage many petabytes of data. (A petabyte is approximately 1,000 terabytes, or trillions of bytes; see Technology Guide 1.)
Data are also scattered throughout organizations, and they are collected by many individ uals using various methods and devices. These data are frequently stored in numerous servers and locations and in different computing systems, databases, formats, and human and com puter languages.
Another problem is that data are generated from multiple sources: internal sources (for example, corporate databases and company documents); personal sources (for example, per sonal thoughts, opinions, and experiences); and external sources (for example, commercial databases, government reports, and corporate websites). Data also come from the web in the form of clickstream data. Clickstream data are those data that visitors and customers pro duce when they visit a website and click on hyperlinks (described in Chapter 6). Clickstream data provide a trail of the users’ activities in the website, including user behavior and browsing patterns.
Adding to these problems is the fact that new sources of data such as blogs, podcasts, tweets, Facebook posts, YouTube videos, texts, and RFID tags and other wireless sensors, are constantly being developed, and the data these technologies generate must be managed. The currency of data also degrade over time. For example, customers move to new addresses or change their names; companies go out of business or are bought; new products are developed; employees are hired or fired; and companies expand into new countries.
Data are also subject to data rot. Data rot refers primarily to problems with the media on which the data are stored. Over time, temperature, humidity, and exposure to light can cause physical problems with storage media and thus make it difficult to access the data. The second aspect of data rot is that finding the machines needed to access the data can be difficult. For ex ample, it is almost impossible today to find 8-track players to listen to music on. Consequently, a library of 8-track tapes has become relatively worthless, unless you have a functioning 8-track player or you convert the tapes to a more modern medium like CDs.
Data security, quality, and integrity are critical, yet they are easily jeopardized. Legal re quirements relating to data also differ among countries as well as among industries, and they change frequently.
Another problem arises from the fact that, over time, organizations have developed infor mation systems for specific business processes, such as transaction processing, supply chain management, and customer relationship management. Information systems that specifically support these processes impose unique requirements on data, which results in repetition and
Managing Data 123
conflicts across the organization. For example, the marketing function might maintain infor mation on customers, sales territories, and markets. These data might be duplicated within the billing or customer service functions. This situation can produce inconsistent data within the enterprise. Inconsistent data prevent a company from developing a unified view of core business information—data concerning customers, products, finances, and so on—across the organization and its information systems.
ACCT FIN
Two other factors complicate data management. First, federal regulations— for example, the Sarbanes–Oxley Act of 2002—have made it a top priority for companies to better account for how they are managing information. Sarbanes–Oxley requires that (1) public companies evaluate and disclose the effectiveness of their internal financial controls and (2) independent auditors for these companies agree to this disclosure. The law also holds CEOs and CFOs personally responsible for such disclosures. If their companies lack satisfactory data management policies and fraud or a security breach occurs, the company officers could be held liable and face prosecution.
Second, companies are drowning in data, much of which is unstructured. As you have seen, the amount of data is increasing exponentially. To be profitable, companies must develop a strategy for managing these data effectively.
An additional problem with data management is Big Data. Big Data are so important that we devote the entire Section 5.3 to this topic.
Data Governance
To address the numerous problems associated with managing data, organizations are turning to data governance. Data governance is an approach to managing information across an en tire organization. It involves a formal set of business processes and policies that are designed to ensure that data are handled in a certain, well-defined fashion. That is, the organization fol lows unambiguous rules for creating, collecting, handling, and protecting its information. The objective is to make information available, transparent, and useful for the people who are au thorized to access it, from the moment it enters an organization until it is outdated and deleted. One strategy for implementing data governance is master data management. Master data management is a process that spans all organizational business processes and applications. It provides companies with the ability to store, maintain, exchange, and synchronize a consis
tent, accurate, and timely “single version of the truth” for the company’s master data.
Master data are a set of core data, such as customer, product, employee, vendor, geo graphic location, and so on, that span the enterprise information systems. It is important to distinguish between master data and transaction data. Transaction data, which are generated and captured by operational systems, describe the business’s activities, or transactions. In con trast, master data are applied to multiple transactions and are used to categorize, aggregate, and evaluate the transaction data.
Let’s look at an example of a transaction: You (Mary Jones) purchase one Samsung 42-inch plasma television, part number 1234, from Bill Roberts at Best Buy, for $2,000, on April 20, 2015. In this example, the master data are “product sold,” “vendor,” “salesperson,” “store,” “part number,” “purchase price,” and “date.” When specific values are applied to the master data, then a transaction is represented. Therefore, transaction data would be, respectively, “42-inch plasma television,” “Samsung,” “Best Buy,” “Bill Roberts,” “1234,” “$2,000,” and “April 20, 2015.” An example of master data management is Dallas, Texas, which implemented a plan for digitizing the city’s public and private records, such as paper documents, images, drawings, and video and audio content. The master database can be used by any of the 38 government departments that have appropriate access. The city is also integrating its financial and billing processes with its customer relationship management program. (You will learn about customer
relationship management in Chapter 11.)
How will Dallas use this system? Imagine that the city experiences a water-main break. Before it implemented the system, repair crews had to search City Hall for records that were filed haphazardly. Once the workers found the hard-copy blueprints, they would take them to the site and, after examining them manually, would decide on a plan of action. In contrast, the
new system delivers the blueprints wirelessly to the laptops of crews in the field, who can mag nify or highlight areas of concern to generate a rapid response. This process reduces the time it takes to respond to an emergency by several hours.
Along with data governance, organizations use the database approach to efficiently and effectively manage their data. We discuss the database approach in Section 5.2.
Before you go on. . .
1. What are some of the difficulties involved in managing data?
2. Define data governance, master data, and transactional data.
The Database Approach
5.2
From the mid-1950s, when businesses first adopted computer applications, until the early 1970s, organizations managed their data in a file management environment. This environment evolved because organizations typically automated their functions one application at a time. Therefore, the various automated systems developed independently from one another, with out any overall planning. Each application required its own data, which were organized in a data file.
A data file is a collection of logically related records. In a file management environment, each application has a specific data file related to it. This file contains all of the data records the application requires. Over time, organizations developed numerous applications, each with an associated, application-specific data file.
For example, imagine that most of your information is stored in your university’s central database, but a club to which you belong maintains its own files, the athletics department has separate files for student athletes, and your instructors maintain grade data on their personal computers. It is easy for your name to be misspelled in one of these databases or files. Similarly, if you move, then your address might be updated correctly in one database or file but not in others.
Using databases eliminates many problems that arose from previous methods of storing and accessing data, such as file management systems. Databases are arranged so that one set of software programs—the database management system—provides all users with access to all of the data. (You will study database management systems later in this chapter.) Database systems minimize the following problems:
· Data redundancy: The same data are stored in multiple locations.
· Data isolation: Applications cannot access data associated with other applications.
· Data inconsistency: Various copies of the data do not agree. Database systems also maximize the following:
· Data security: Because data are “put in one place” in databases, there is a risk of losing a lot of data at one time. Therefore, databases must have extremely high security measures in place to minimize mistakes and deter attacks.
· Data integrity: Data meet certain constraints; for example, there are no alphabetic charac ters in a Social Security number field.
· Data independence: Applications and data are independent of one another; that is, ap plications and data are not linked to each other, so all applications are able to access the same data.
124 CHAPTER 5 Data and Knowledge Management
The Database Approach 125
FIGURE 5.1 Database management system.
Figure 5.1 illustrates a university database. Note that university applications from the reg istrar’s office, the accounting department, and the athletics department access data through the database management system.
A database can contain vast amounts of data. To make these data more understandable and useful, they are arranged in a hierarchy. We take a closer look at this hierarchy in the next section.
The Data Hierarchy
Data are organized in a hierarchy that begins with bits and proceeds all the way to databases (see Figure 5.2). A bit (binary digit) represents the smallest unit of data a computer can pro cess. The term binary means that a bit can consist only of a 0 or a 1. A group of eight bits, called a byte, represents a single character. A byte can be a letter, a number, or a symbol. A logical grouping of characters into a word, a small group of words, or an identification number is called a field. For example, a student’s name in a university’s computer files would appear in the “name” field, and her or his Social Security number would appear in the “Social Security number” field. Fields can also contain data other than text and numbers. They can contain an
FIGURE 5.2 Hierarchy of data for a computer-based file.
image, or any other type of multimedia. Examples are a motor vehicle department’s licensing database that contains a driver’s photograph and a field that contains a voice sample to autho rize access to a secure facility.
A logical grouping of related fields, such as the student’s name, the courses taken, the date, and the grade, comprises a record. In the Apple iTunes Store, a song is a field in a record, with other fields containing the song’s title, its price, and the album on which it appears. A log ical grouping of related records is called a data file or a table. For example, a grouping of the records from a particular course, consisting of course number, professor, and students’ grades, would constitute a data file for that course. Continuing up the hierarchy, a logical grouping of related files constitutes a database. Using the same example, the student course file could be grouped with files on students’ personal histories and financial backgrounds to create a stu dent database. In the next section, you will learn about relational database models.
The Relational Database Model
A database management system (DBMS) is a set of programs that provide users with tools to create and manage a database. Managing a database refers to the processes of adding, delet ing, accessing, modifying, and analyzing data stored in a database. An organization can access the data by using query and reporting tools that are part of the DBMS or by using application programs specifically written to perform this function. DBMSs also provide the mechanisms for maintaining the integrity of stored data, managing security and user access, and recovering information if the system fails. Because databases and DBMSs are essential to all areas of busi ness, they must be carefully managed.
There are a number of different database architectures, but we focus on the relational da tabase model because it is popular and easy to use. Other database models (for example, the hierarchical and network models) are the responsibility of the MIS function and are not used by organizational employees. Popular examples of relational databases are Microsoft Access and Oracle.
Most business data—especially accounting and financial data—traditionally were orga nized into simple tables consisting of columns and rows. Tables allow people to compare in formation quickly by row or column. Users can also retrieve items rather easily by locating the point of intersection of a particular row and column.
The relational database model is based on the concept of two-dimensional tables. A re lational database generally is not one big table—usually called a flat file—that contains all of the records and attributes. Such a design would entail far too much data redundancy. Instead, a relational database is usually designed with a number of related tables. Each of these tables contains records (listed in rows) and attributes (listed in columns).
To be valuable, a relational database must be organized so that users can retrieve, analyze, and understand the data they need. A key to designing an effective database is the data model. A data model is a diagram that represents entities in the database and their relationships. An entity is a person, place, thing, or event—such as a customer, an employee, or a product— about which information is maintained. Entities can typically be identified in the user’s work environment. A record generally describes an entity. An instance of an entity refers to each row in a relational table, which is a specific, unique representation of the entity. For example, your university’s student database contains an entity called student. An instance of the student entity would be a particular student. For instance, you are an instance of the student entity in your university’s student database.
Each characteristic or quality of a particular entity is called an attribute. For example, if our entities were a customer, an employee, and a product, entity attributes would include customer name, employee number, and product color.
Consider the relational database example about students diagrammed in Figure 5.3. The table contains data about the entity called students. As you can see, each row of the table cor responds to one student record. (You have your own row in your university’s student database.) Attributes of the entity are student name, undergraduate major, grade point average, and grad uation date. The rows are the records on Sally Adams, John Jones, Jane Lee, Kevin Durham,
FIGURE 5.3 Student database example.
Juan Rodriguez, Stella Zubnicki, and Ben Jones. Of course, your university keeps much more data on you than our example shows. In fact, your university’s student database probably keeps hundreds of attributes on each student.
Every record in the database must contain at least one field that uniquely identifies that re cord so that it can be retrieved, updated, and sorted. This identifier field (or attribute) is called the primary key. For example, a student record in a U.S. university would use a unique student number as its primary key. (Note: In the past, your Social Security number served as the pri mary key for your student record. However, for security reasons, this practice has been discon tinued.) You see that Sally Adams is uniquely identified by her student ID of 012345.
In some cases, locating a particular record requires the use of secondary keys. A second ary key is another field that has some identifying information, but typically does not identify the record with complete accuracy. For example, the student’s major might be a secondary key if a user wanted to identify all of the students majoring in a particular field of study. It should not be the primary key, however, because many students can have the same major. Therefore, it cannot uniquely identify an individual student.
A foreign key is a field (or group of fields) in one table that uniquely identifies a row of an other table. A foreign key is used to establish and enforce a link between two tables. We discuss foreign keys in more detail in Section 5.6.
Organizations implement databases to efficiently and effectively manage their data. There are a variety of operations that can be performed on databases. We look at three of these oper ations in detail in Section 5.6: query languages, normalization, and joins.
As we noted earlier in this chapter, organizations must manage huge quantities of data. Such data consist of structured and unstructured data and are called Big Data (discussed in Section 5.3). Unstructured data refers to data that does not reside in a traditional relational database. Examples of unstructured data include e-mail messages, word processing docu ments, videos, images, audio files, PowerPoint presentations, Facebook posts, tweets, snaps, ratings and recommendations, and web pages. Industry analysts estimate that 80 to 90 percent of the data in an organization is unstructured. To manage Big Data, many organizations are using special types of databases, which we also discuss in Section 5.3.
Because databases typically process data in real time (or near real time), it is not practical to allow users access to the databases. After all, the data will change while the user is looking at them! As a result, data warehouses have been developed to allow users to access data for decision making. You will learn about data warehouses in Section 5.4.
Before you go on. . .
1. What is a data model?
2. What is a primary key? A secondary key?
3. What is an entity? An attribute? An instance?
4. What are the advantages and disadvantages of relational databases?
Big Data
5.3
We are accumulating data and information at an increasingly rapid pace from many diverse sources. In fact, organizations are capturing data about almost all events—including events that, in the past, firms never used to think of as data at all, such as a person’s location, the vibrations and temperature of an engine, and the stress at numerous points on a bridge—and then analyzing those data.
Organizations and individuals must process a vast amount of data that continues to rap idly increase. According to IDC (a technology research firm; www.idc.com ), the world generates exabytes of data each year (an exabyte is 1 trillion terabytes). Furthermore, the amount of data produced worldwide is increasing by 50 percent each year.
As recently as the year 2000, only 25 percent of the stored information in the world was digital. The other 75 percent was analog; that is, it was stored on paper, film, vinyl records, and the like. By 2016, the amount of stored information in the world was over 98 percent digital and less than 2 percent nondigital.
As we discussed at the beginning of this chapter, we refer to the superabundance of data available today as Big Data. That is, Big Data is a collection of data so large and complex that it is difficult to manage using traditional database management systems. (We capitalize Big Data to distinguish the term from large amounts of traditional data.)
Essentially, Big Data is about predictions. Predictions do not come from “teaching” com puters to “think” like humans. Instead, predictions come from applying mathematics to huge quantities of data to infer probabilities. Consider these examples:
· The likelihood that an e-mail message is spam;
· The likelihood that the typed letters “teh” are supposed to be “the”;
· The likelihood that the direction and speed of a person jaywalking indicates that he will make it across the street in time, meaning that a self-driving car need only slow down slightly.
Big Data systems perform well because they contain huge amounts of data on which to base their predictions. Moreover, these systems are configured to improve themselves over time by searching for the most valuable signals and patterns as more data are input.
Defining Big Data
It is difficult to define Big Data. Here we present two descriptions of the phenomenon. First, the technology research firm Gartner ( www.gartner.com ) defines Big Data as diverse, high-volume, high-velocity information assets that require new forms of processing to enable enhanced deci sion making, insight discovery, and process optimization. Second, the Big Data Institute (TBDI; https://thebigdatainstitute.wordpress.com/ ) defines Big Data as vast datasets that:
· Exhibit variety;
· Include structured, unstructured, and semi-structured data;
· Are generated at high velocity with an uncertain pattern;
· Do not fit neatly into traditional, structured, relational databases; and
· Can be captured, processed, transformed, and analyzed in a reasonable amount of time only by sophisticated information systems.
Big Data generally consists of the following:
· Traditional enterprise data—examples are customer information from customer relation ship management systems, transactional enterprise resource planning data, web store transactions, operations data, and general ledger data.
· Machine-generated/sensor data—examples are smart meters; manufacturing sensors; sensors integrated into smartphones, automobiles, airplane engines, and industrial ma chines; equipment logs; and trading systems data.
· Social data—examples are customer feedback comments; microblogging sites such as Twitter; and social media sites such as Facebook, YouTube, and LinkedIn.
· Images captured by billions of devices located throughout the world, from digital cameras and camera phones to medical scanners and security cameras.
Let’s take a look at a few specific examples of Big Data:
· In 2016, the world was producing 2.5 exabytes of data every day.
· Facebook’s 1.8 billion members upload more than 300 million new photos every day. They also click a “like” button or leave a comment nearly 5 billion times every day.
· The 1 billion monthly users of Google’s YouTube service upload more than 300 hours of video per minute.
· The number of messages on Twitter is growing at 200 percent every year. By November 2016, the volume exceeded 500 million tweets per day.
Characteristics of Big Data
Big Data has three distinct characteristics: volume, velocity, and variety. These characteristics distinguish Big Data from traditional data:
1. Volume: We have noted the huge volume of Big Data. Consider machine-generated data, which are generated in much larger quantities than nontraditional data. For example, sen sors in a single jet engine can generate 10 terabytes of data in 30 minutes. (See our discus sion of the Internet of Things in Chapter 8.) With more than 25,000 airline flights per day, the daily volume of data from just this single source is incredible. Smart electrical meters, sensors in heavy industrial equipment, and telemetry from automobiles compound the volume problem.
2. Velocity: The rate at which data flow into an organization is rapidly increasing. Velocity is critical because it increases the speed of the feedback loop between a company, its customers, its suppliers, and its business partners. For example, the Internet and mobile technology enable online retailers to compile histories not only on final sales, but on their customers’ every click and interaction. Companies that can quickly use that information— for example, by recommending additional purchases—gain competitive advantage.
3. Variety: Traditional data formats tend to be structured and relatively well described, and they change slowly. Traditional data include financial market data, point-of-sale transac tions, and much more. In contrast, Big Data formats change rapidly. They include satellite imagery, broadcast audio streams, digital music files, web page content, scans of govern ment documents, and comments posted on social networks.
Irrespective of their source, structure, format, and frequency, Big Data are valuable. If cer tain types of data appear to have no value today, it is because we have not yet been able to
130 CHAPTER 5 Data and Knowledge Management
Big Data 129
analyze them effectively. For example, several years ago when Google began harnessing satel lite imagery, capturing street views, and then sharing these geographical data for free, few peo ple understood its value. Today, we recognize that such data are incredibly valuable because analyses of Big Data yield deep insights. We discuss analytics in detail in Chapter 12.
Issues with Big Data
Despite its extreme value, Big Data does have issues. In this section, we take a look at data in tegrity, data quality, and the nuances of analysis that are worth noting.
Big Data Can Come from Untrusted Sources. As we discussed earlier, one of the characteristics of Big Data is variety, meaning that Big Data can come from numerous, widely varied sources. These sources may be internal or external to the organization. For exam ple, a company might want to integrate data from unstructured sources such as e-mails, call center notes, and social media posts with structured data about its customers from its data warehouse. The question is, how trustworthy are those external sources of data? For example, how trustworthy is a tweet? The data may come from an unverified source. Furthermore, the data itself, reported by the source, may be false or misleading.
Big Data Is Dirty. Dirty data refers to inaccurate, incomplete, incorrect, duplicate, or erroneous data. Examples of such problems are misspelling of words and duplicate data such as retweets or company press releases that appear numerous times in social media.
Suppose a company is interested in performing a competitive analysis using social media data. The company wants to see how often a competitor’s product appears in social media outlets as well as the sentiments associated with those posts. The company notices that the number of positive posts about the competitor is twice as large as the number of positive posts about itself. This finding could simply be a case of the competitor pushing out its press releases to multiple sources, in essence, blowing its own horn. Alternatively, the competitor could be getting many people to retweet an announcement.
Big Data Changes, Especially in Data Streams. Organizations must be aware that data quality in an analysis can change, or the data itself can change, because the condi tions under which the data are captured can change. For example, imagine a utility company that analyzes weather data and smart-meter data to predict customer power usage. What hap pens when the utility is analyzing this data in real time and it discovers data missing from some of its smart meters?
Managing Big Data
Big Data makes it possible to do many things that were previously impossible; for example, to spot business trends more rapidly and accurately, prevent disease, track crime, and so on. When properly analyzed, Big Data can reveal valuable patterns and information that were pre viously hidden because of the amount of work required to discover them. Leading corpora tions, such as Walmart and Google, have been able to process Big Data for years, but only at great expense. Today’s hardware, cloud computing (see Technology Guide 3), and open-source software make processing Big Data affordable for most organizations.
The first step for many organizations toward managing data was to integrate information silos into a database environment and then to develop data warehouses for decision making. (An information silo is an information system that does not communicate with other, related information systems in an organization.) After completing this step, many organizations turned their attention to the business of information management—making sense of their proliferat ing data. In recent years, Oracle, IBM, Microsoft, and SAP have spent billions of dollars purchas ing software firms that specialize in data management and business analytics. (You will learn about business analytics in Chapter 12.)
As you have seen in this chapter, traditional relational databases such as Oracle and MySQL store data in tables organized into rows and columns. Recall that each row is associated with a unique record and each column is associated with a field that defines an attribute of that account.
In contrast, NoSQL databases can manipulate structured as well as unstructured data and inconsistent or missing data. For this reason, NoSQL databases are particularly useful when working with Big Data. Many products use NoSQL databases, including Cassandra ( http://cas sandra.apache.org ), CouchDB ( http://couchdb.apache.org ), and MongoDB ( www.mongodb.org ).
Hadoop ( http://hadoop.apache.org ) is not a type of database, but rather a collection of pro grams that allow storage, retrieval, and analysis of very large datasets using massively parallel processing. Massively parallel processing is the coordinated processing of an application by multiple processors that work on different parts of the application, with each processing using its own operating system and memory. As such, Hadoop enables the processing of NoSQL da tabases, which can be spread across thousands of servers without a reduction in performance. For example, a large database application that could take 20 hours of processing time on a centralized relational database system may take only a few minutes when using Hadoop’s par allel processing. IT’s About Business 5.2 shows how TrueCar uses Hadoop to manage its rapidly growing amount of data.
MapReduce refers to the software procedure of dividing an analysis into pieces that can be distributed across different servers in different locations. MapReduce first distributes the anal ysis (map) and then collects and integrates the results back into one report (reduce).
Putting Big Data to Use
Organizations must manage Big Data and gain value from it. There are several ways to do this.
Making Big Data Available. Making Big Data available for relevant stakeholders can help organizations gain value. For example, consider open data in the public sector. Open data is accessible public data that individuals and organizations can use to create new businesses and solve complex problems. In particular, government agencies gather very large amounts of data, some of which is Big Data. Making that data available can provide economic benefits. The Open Data 500 study at the GovLab at New York University found some 500 examples of U.S.-based companies whose business models depend on analyzing open government data. Another example of making Big Data available occurred in the fight against the Ebola virus, as you see in IT’s About Business 5.3.
Enabling Organizations to Conduct Experiments. Big Data allows organi zations to improve performance by conducting controlled experiments. For example, Amazon (and many other companies such as Google and LinkedIn) constantly experiment by offering slightly different looks on its website. These experiments are called A/B experiments, because each experiment has only two possible outcomes. Here is an example of an A/B experiment at Etsy.com, an online marketplace for vintage and handmade products.
MKT
When Etsy analysts noticed that one of its web pages attracted customer attention but failed to keep it, they looked more closely at the page. They found that the page had few “calls to action.” (A call to action is an item, such as a button, on a web page that enables a customer to do something.) On this particular Etsy page, customers could leave, buy, search, or click on two additional product images. The analysts decided to show more product images on the page.
Consequently, one group of visitors to the page saw a strip across the top of the page that displayed additional product images. Another group of page visitors saw only the two original product images. On the page with additional images, customers viewed more products and bought more products. The results of this experiment revealed valuable information to Etsy.
132 CHAPTER 5 Data and Knowledge Management
Big Data 131
IT’s About Business 5.2
TrueCar Uses Hadoop
MKT
TrueCar ( www.truecar.com ) is an automotive pricing and informa tion website for buyers and dealers of new and used cars. Through its e-commerce website, the company offers buyers information on how much other customers have paid for cars in addition to trans parent pricing and access to more than 10,000 TrueCar dealers. Par ticipating dealerships pay TrueCar when customers purchase a car from them through the site.
Founded in 2005, TrueCar grew very rapidly, but its data management infrastructure did not keep pace. TrueCar decided to implement Hadoop, for two reasons. First, the software tool is an economical way to store data, and it’s compatible with several analytics tools.
Second, TrueCar experienced problems in using traditional relational databases to analyze very large amounts of rapidly ac cumulating data. For example, the car data differ greatly in struc ture, meaning that some of the data are structured and some are unstructured. Examples of the company’s structured data are vehicle brand, name, color, and price. Examples of unstructured data are customer comments and vehicle images. This data vari ability had created problems for TrueCar’s existing infrastructure. The company is using Hadoop to mine and monetize all of its data assets.
TrueCar developed a 2-petabyte Hadoop data lake that stores data on vehicles, transactions, registrations, customers’ buying habits, and many additional variables. A data lake stores vast amounts of data in their original format until they are required, rather than forcing the integration of large volumes of data before analysis. Examples of these raw data are documents in .doc, .txt, or
.rtf formats; Adobe Photoshop documents in .psd formats, images in .jpg and .gif formats, and video in .mp4 format.
Hadoop allows TrueCar to work with rapidly increasing amounts of data. In fact, TrueCar was managing 24 times as much data by the end of 2014 as it was a year earlier. Those data origi nated from 12,000 data sources and contain 65 billion data items. Of the 2 petabytes in its Hadoop data lake, TrueCar uses 600 tera bytes at any moment, involving more than 20 million buyer pro files. Hadoop allows TrueCar customers to conduct advanced searches in real time to help them find their perfect cars.
An early example of TrueCar’s use of Hadoop was to handle 700 million vehicle photos every day. The firm notes that without a photo of a vehicle, there is no sale.
TrueCar is also using Hadoop to make money from “exhaust data,” which is information resulting from a spinoff of normal op erations. For example, the company collects exhaust data about actual and potential customers who visit its website. TrueCar
analyzes that information and provides pricing and online sales tips to its network of car dealers.
TrueCar has experienced problems implementing Hadoop. For example, TrueCar sells a “white label” or generic form of its ser vice to other companies, such as banks, to rebrand as their own. But the white label version needs security features that Hadoop does not currently support. Third-party clients such as banks and financial institutions must comply with regulations and privacy laws for Hadoop data to function. Because of these particular data requirements, TrueCar is closely monitoring the rollout of new functions in Hadoop, such as improved security features and the ability to collect metadata.
Because the Hadoop data lake holds all of the data in a single location, TrueCar can perform a variety of valuable analytics. For example, one analysis revealed a positive link between a web cache and purchases. A web cache temporarily stores web documents, such as images, to speed up the loading of web pages. The analysis found that as the web cache size increases, so does the speed of page loading, customer satisfaction, and the likelihood of a sale.
This is one instance in which TrueCar’s analytics use “dark data,” which organizations typically deleted, overlooked, or disre garded. That is, the sizes of web caches were largely ignored in the past, but today they are considered valuable.
And how is TrueCar doing? As of November 2016, more than two million vehicles had been bought from 13,000 TrueCar-certified dealers.
Sources: Compiled from J. Treece, “New CEO Leads Changes in Listing Vehicle Prices, Billing Retailers,” Automotive News, March 27, 2016; K. Korosec, “TrueCar Helps Sam’s Club Get into the Car Business,” Fortune, September 3, 2015; C. Bruce, “Scott Painter Stepping Down as TrueCar CEO by Year End,” Autoblog, August 10, 2015; D. Undercoffler, “TrueCar Works on Relationships,” Automotive News, July 27, 2015; “TrueCar Announces Its Users Have Bought over 2 Million Vehicles from TrueCar Certified Dealers,” PR Newswire, June 29, 2015; D. Levin, “TrueCar, Facing Lawsuits, Sees Share Price Decline for Most of 2015,” TheStreet, June 20, 2015; D. Needle, “Hadoop Summit: Wrangling Big Data Requires Novel Tools, Techniques,” eWeek, June 10, 2015; D. Undercoffler, “Dealers vs. TrueCar: The Saga Con tinues,” Automotive News, June 1, 2015; J. Vaughan, “Hadoop Fuels TrueC
ar’s Data-Driven Business Model,” TechTarget, November 21, 2014; “TrueCar: Over 1 Million Cars Sold through Affinity Auto Buying Programs,” Insurance- NewsNet, June 13, 2014; www.truecar.com, accessed October 10, 2016.
Questions
1. Describe how Hadoop manages Big Data in its data lake.
2. Discuss why relational databases experienced problems with the variety of data that TrueCar has to manage and analyze.
3. What are the benefits of Big Data to TrueCar?
Microsegmentation of Customers. Segmentation of a company’s customers means dividing them up into groups that share one or more characteristics. Microsegmenta tion simply means dividing customers up into very small groups, or even down to the individual level.
MKT
For example, Paytronix Systems ( www.paytronix.com ) provides loyalty and rewards program software for thousands of different restaurants. Paytronix gathers restaurant guest
134 CHAPTER 5 Data and Knowledge Management
Big Data 133
IT’s About Business 5.3
Combining Big Data and Open Data to Fight Ebola
POM
In December 2013, an outbreak of the Ebola virus began in the West African nation of Guinea and then spread to the neighboring coun tries of Liberia and Sierra Leone. In mid-2014, the World Health Organization (WHO; www.who.it ) declared the outbreak a public health emergency of international concern. The spread of the dis ease was blamed on many factors, including an ailing healthcare system, limited public financial and infrastructure resources, a mistrust of government officials after years of armed conflict, local burial customs that include washing the body, widespread poverty, and the delay in responding to the outbreak for several months. The outbreak became the largest recorded occurrence of Ebola.
The unparalleled scope of the outbreak, coupled with the fact that the Ebola virus incubates between 2 and 21 days before the host is aware he or she is infected, made it extremely difficult to predict how and where the disease would spread. This situation presented an enormous challenge for the aid agencies providing care to the most vulnerable. For example, although it has 4 million people, Liberia had only 200 physicians. As a result, the integra tion of open data from governments, Big Data, analytics software, and the willingness to collaborate across traditional geopolitical boundaries was essential in trying to stop the outbreak.
IBM’s research lab in Africa ( www.research.ibm.com/labs/af rica/ ) created a system that enables citizens to engage directly with government agencies regarding any Ebola issues. IBM also pro vided staff who volunteered to pinpoint and catalog all sources of open Ebola-related data in the Ebola Open Data Repository ( www
.eboladata.org ). The system supplies information on the daily ex periences of communities to governments and aid agencies in the hopes of helping to stop the spread of the disease.
IBM created its analytics system in cooperation with the Open Government Initiative from the Sierra Leone government ( www
.ogi.gov.sl ), the Africa’s Voices project at Cambridge University, telecommunications carrier Airtel ( www.airtel.com ), and Kenya’s Echo Mobile ( www.echomobile.org ). IBM’s system incorporates data from a number of sources. For example, wireless carriers gather data from cell phones and make it anonymous before pro viding it to researchers. Specifically, Airtel launched a toll-free number that citizens used to report Ebola-related matters through short message service (SMS) or voice calls.
Utilizing IBM’s cloud-based analytics software, the system picked up on and correlated trends found among all messages. The text message and voice data identify location, so the system
can show heatmaps that link public mobile call data with specific locations. (A heatmap is a graphical representation of data that represents individual data values as colors.) The analytics pro cess provided an overview of regional population movements that helped forecast the path of Ebola. The mobile data models and WHO reports were used to concentrate on the best ways to block the spread and provide healthcare.
Integrating other data, such as social media, hospital reports, health clinic and physician reports, media reports, transactional data from retailers and pharmacies, and flight information, authori ties used analytics software to determine where and how to react to the crisis. The system also integrated open data from governments that assisted in relief efforts, such as census data and other data concerning roads, airports, schools, and health facilities. Finally, it enabled healthcare workers to focus on unexpected trends and slow the spread of Ebola, thereby reducing the number of deaths.
Not all the news about the system was good. The WHO fore cast 20,000 cases of the disease, when in fact only 13,000 cases were reported. In addition, the WHO predicted a 90 percent death rate from Ebola, when the actual rate was around 70 percent. These figures point out the difficulty in making rapid predictions from very complicated data.
And the next question: Can Big Data and open data be used to prevent the spread of the Zika virus?
Sources: Compiled from L. Kugler, “What Happens When Big Data Blunders?” Communications of the ACM, June, 2016; B. Marr, “Can Big Data Help Fight the Zika Virus?” Forbes, February 10, 2016; “Ebola Situ ation Report,” World Health Organization Report, September 30, 2015;
K. Dvorak, “Researchers Turn to Big Data, Social Media to Track Ebola,” FierceHealthcare, May 13, 2015; M. Shacklett, “Fighting Ebola with a Holistic Vision of Big Data,” TechRepublic, March 23, 2015; B. Rossi, “How Big Data Is Beating Ebola,” Information Age, March 5, 2015; E. Malykhina, “IBM Brings Open Data Tech to Ebola Fight,” InformationWeek Government, November 10, 2014; “Ebola and Big Data: Call for Help,” The Economist, October 25, 2014; M. Wall, “Ebola: Can Big Data Analytics Help Contain Its Spread?” BBC News, October 15, 2014; D. Richards, “How Big Data Could Help Stop the Ebola Outbreak,” CNBC, October 1, 2014; “How Big Data Can Help Beat Ebo la,” IBM Smarter Planet, August 2014; L. Gilpin, “How an Algorithm Detected the Ebola Outbreak a Week Early, and What It Could Do Next,” TechRepublic, August 26, 2014; www.who.int, accessed October 13, 2016.
Questions
1. Provide examples of open data mentioned in this case.
2. Provide examples of Big Data mentioned in this case.
3. Why was the integration of open data and Big Data essential to help diminish the impact of the Ebola virus?
data from a variety of sources beyond loyalty and gift programs, including social media. Paytr onix analyzes this Big Data to help its restaurant clients microsegment their guests. Restaurant managers are now able to more precisely customize their loyalty and gift programs. In doing so, the managers are noting improved performance in their restaurants in the form of profitability and customer satisfaction.
Creating New Business Models.
Companies are able to use Big Data to
create new business models. For example, a commercial transportation company operated a large fleet of large, long-haul trucks. The company recently placed sensors on all of its trucks.
POM
These sensors wirelessly communicate large amounts of information to the company, a pro cess called telematics. The sensors collect data on vehicle usage (including acceleration, brak ing, cornering, etc.), driver performance, and vehicle maintenance.
By analyzing this Big Data, the transportation company was able to improve the condi tion of its trucks through near-real-time analysis that proactively suggested preventive main tenance. The company was also able to improve the driving skills of its operators by analyzing their driving styles.
The transportation company then made its Big Data available to its insurance carrier. Us ing this data, the insurance carrier performed risk analysis on driver behavior and the condition of the trucks, resulting in a more precise assessment. The insurance carrier offered the trans portation company a new pricing model that lowered the transportation company’s premiums by 10 percent.
Organizations Can Analyze More Data. In some cases, organizations can even process all the data relating to a particular phenomenon, meaning that they do not have to rely as much on sampling. Random sampling works well, but it is not as effective as analyzing an entire dataset. Random sampling also has some basic weaknesses. To begin with, its accuracy depends on ensuring randomness when collecting the sample data. However, achieving such randomness is problematic. Systematic biases in the process of data collection can cause the results to be highly inaccurate. For example, consider political polling using landline phones. This sample tends to exclude people who use only cell phones. This bias can seriously skew the results because cell phone users are typically younger and more liberal than people who rely primarily on landline phones.
Big Data Used in the Functional Areas of the Organization
In this section, we provide examples of how Big Data is valuable to various functional areas in the firm.
Human Resources.
Employee benefits, particularly healthcare, represent a
major business expense. Consequently, some companies have turned to Big Data to better manage these benefits. Caesars Entertainment ( www.caesars.com ), for example, analyzes health- insurance claim data for its 65,000 employees and their covered family members. Managers can track thousands of variables that indicate how employees use medical services, such as the num ber of emergency room visits and whether employees choose a generic or brand name drug.
HRM
Consider the following scenario: Data revealed that too many employees with medical emergencies were being treated at hospital emergency rooms rather than at less expensive urgent-care facilities. The company launched a campaign to remind employees of the high cost of emergency room visits, and they provided a list of alternative facilities. Subsequently, 10,000 emergencies shifted to less expensive alternatives for a total savings of $4.5 million.
Big Data is also having an impact on hiring. An example is Catalyst IT Services ( www.cata lystdevworks.com ), a technology outsourcing company that hires teams for programming jobs. Traditional recruiting is typically too slow, and hiring managers often subjectively choose can didates who are not the best fit for the job. Catalyst addresses this problem by requiring candi dates to fill out an online assessment. It then uses the assessment to collect thousands of data points about each candidate. In fact, the company collects more data based on how candidates answer than on what they answer.
For example, the assessment might give a problem requiring calculus to an applicant who is not expected to know the subject. How the candidate responds—laboring over an answer, answering quickly and then returning later, or skipping the problem entirely—provides insight into how that candidate might deal with challenges that he or she will encounter on the job. That is, someone who labors over a difficult question might be effective in an assignment that requires a methodical approach to problem solving, whereas an applicant who takes a more aggressive approach might perform better in a different job setting.
As one measure of success, employee turnover at Catalyst averages about 15 percent per year, compared with more than 30 percent for its U.S. competitors and more than 20 percent for similar companies overseas.
Product Development.
Big Data can help capture customer preferences and
put that information to work in designing new products. For example, Ford Motor Company ( www.ford.com ) was considering a “three blink” turn indicator that had been available on its European cars for years. Unlike the turn signals on its U.S. vehicles, this indicator flashes three times at the driver’s touch and then automatically shuts off.
MKT
Ford decided that conducting a full-scale market research test on this blinker would be too costly and time consuming. Instead, it examined auto-enthusiast websites and owner forums to discover what drivers were saying about turn indicators. Using text-mining algo rithms, researchers culled more than 10,000 mentions and then summarized the most relevant comments.
The results? Ford introduced the three-blink indicator on the new Ford Fiesta in 2010, and by 2013 it was available on most Ford products. Although some Ford owners complained on line that they have had trouble getting used to the new turn indicator, many others defended it. Ford managers note that the use of text-mining algorithms was critical in this effort because they provided the company with a complete picture that would not have been available using traditional market research.
Operations.
For years, companies have been using information technology to
make their operations more efficient. Consider United Parcel Service (UPS). The company has long relied on data to improve its operations. Specifically, it uses sensors in its delivery vehicles that can, among other things, capture the truck’s speed and location, the number of times it is placed in reverse, and whether the driver’s seat belt is buckled. These data are uploaded at the end of each day to a UPS data center, where they are analyzed overnight. By combining GPS information and data from sensors installed on more than 46,000 vehicles, UPS reduced fuel consumption by 8.4 million gallons, and it cut 85 million miles off its routes.
POM
Marketing.
Marketing managers have long used data to better understand their
customers and to target their marketing efforts more directly. Today, Big Data enables market ers to craft much more personalized messages.
MKT
The United Kingdom’s InterContinental Hotels Group (IHG; www.ihg.com ) has gathered details about the members of its Priority Club rewards program, such as income levels and whether members prefer family-style or business-traveler accommodations. The company then consolidated all this information with information obtained from social media into a single data warehouse. Using its data warehouse and analytics software, the hotelier launched a new mar keting campaign. Whereas previous marketing campaigns generated, on average, between 7 and 15 customized marketing messages, the new campaign generated more than 1,500. IHG rolled out these messages in stages to an initial core of 12 customer groups, each of which is defined by 4,000 attributes. One group, for example, tends to stay on weekends, redeem reward points for gift cards, and register through IHG marketing partners. Using this information, IHG sent these customers a marketing message that alerted them to local weekend events.
The campaign proved to be highly successful. It generated a 35 percent higher rate of cus tomer conversions, or acceptances, than previous, similar campaigns.
Government Operations.
With 55 percent of the population of the Nether
lands living under the threat of flooding, water management is critically important to the Dutch government. The government operates a sophisticated water management system, managing a network of dikes or levees, canals, locks, harbors, dams, rivers, storm-surge barriers, sluices, and pumping stations.
POM
In its water management efforts, the government makes use of a vast number of sensors embedded in every physical structure used for water control. The sensors generate at least 2 petabytes of data annually. As the sensors are becoming cheaper, the government is deploying more of them, increasing the amount of data generated.
In just one example of the use of sensor data, sensors in dikes can provide information on the structure of the dike, how well it is able to handle the stress of the water it controls, and whether it is likely to fail. Furthermore, the sensor data are providing valuable insights for new designs for Dutch dikes. The result is that Dutch authorities have reduced the costs of manag ing water by 15 percent.
Before you go on. . .
2. Describe the characteristics of Big Data.
3. Describe how companies can use Big Data to a gain competitive advantage.
Data Warehouses and Data Marts
5.4
Today, the most successful companies are those that can respond quickly and flexibly to mar ket changes and opportunities. A key to this response is the effective and efficient use of data and information by analysts and managers. The challenge is providing users with access to corporate data so that they can analyze the data to make better decisions. Let’s look at an ex ample. If the manager of a local bookstore wanted to know the profit margin on used books at her store, she could obtain that information from her database, using SQL or QBE. However, if she needed to know the trend in the profit margins on used books over the past 10 years, she would have to construct a very complicated SQL or QBE query.
This example illustrates several reasons why organizations are building data warehouses and data marts. First, the bookstore’s databases contain the necessary information to answer the manager’s query, but this information is not organized in a way that makes it easy for her to find what she needs. Second, the organization’s databases are designed to process millions of transactions every day. Therefore, complicated queries might take a long time to answer, and they also might degrade the performance of the databases. Third, transactional databases are designed to be updated. This update process requires extra processing. Data warehouses and data marts are read-only, and the extra processing is eliminated because data already con tained in the data warehouse are not updated. Fourth, transactional databases are designed to access a single record at a time. Data warehouses are designed to access large groups of related records.
As a result of these problems, companies are using a variety of tools with data warehouses and data marts to make it easier and faster for users to access, analyze, and query data. You will learn about these tools in Chapter 12 on Business Analytics.
Describing Data Warehouses and Data Marts
In general, data warehouses and data marts support business analytics applications. As you will see in Chapter 12, business analytics encompasses a broad category of applications, tech nologies, and processes for gathering, storing, accessing, and analyzing data to help business users make better decisions. A data warehouse is a repository of historical data that are orga nized by subject to support decision makers in the organization.
Because data warehouses are so expensive, they are used primarily by large companies. A data mart is a low-cost, scaled-down version of a data warehouse that is designed for the end-user needs in a strategic business unit (SBU) or an individual department. Data marts can be implemented more quickly than data warehouses, often in less than 90 days. Furthermore, they support local rather than central control by conferring power on the user group. Typically, groups that need a single or a few business analytics applications require only a data mart, rather than a data warehouse.
The basic characteristics of data warehouses and data marts include the following:
· Organized by business dimension or subject. Data are organized by subject—for example, by customer, vendor, product, price level, and region. This arrangement differs from trans actional systems, whereas data are organized by business process, such as order entry, inventory control, and accounts receivable.
· Use online analytical processing. Typically, organizational databases are oriented to ward handling transactions. That is, databases use online transaction processing (OLTP), whereas business transactions are processed online as soon as they occur. The objectives are speed and efficiency, which are critical to a successful Internet-based business opera tion. Data warehouses and data marts, which are designed to support decision makers but not OLTP, use OLTP. Online analytical processing involves the analysis of accumulated data by end users. We consider OLAP in greater detail in Chapter 12.
· Integrated. Data are collected from multiple systems and then integrated around subjects. For example, customer data may be extracted from internal (and external) systems and then integrated around a customer identifier, thereby creating a comprehensive view of the customer.
· Time variant. Data warehouses and data marts maintain historical data (i.e., data that in clude time as a variable). Unlike transactional systems, which maintain only recent data (such as for the last day, week, or month), a warehouse or mart may store years of data. Organizations use historical data to detect deviations, trends, and long-term relationships.
· Nonvolatile. Data warehouses and data marts are nonvolatile—that is, users cannot change or update the data. Therefore, the warehouse or mart reflects history, which, as we just saw, is critical for identifying and analyzing trends. Warehouses and marts are updated, but through IT-controlled load processes rather than by users.
· Multidimensional. Typically, the data warehouse or mart uses a multidimensional data structure. Recall that relational databases store data in two-dimensional tables. In con trast, data warehouses and marts store data in more than two dimensions. For this reason, the data are said to be stored in a multidimensional structure. A common representa tion for this multidimensional structure is the data cube.
The data in data warehouses and marts are organized by business dimensions, which are subjects such as product, geographic area, and time period that represent the edges of the data cube. If you look ahead to Figure 5.6 for an example of a data cube, you see that the product dimension is composed of nuts, screws, bolts, and washers; the geographic area dimension is composed of East, West, and Central; and the time period dimension is composed of 2014, 2015, and 2016. Users can view and analyze data from the perspective of these business dimen sions. This analysis is intuitive because the dimensions are presented in business terms that users can easily understand.
A Generic Data Warehouse Environment
The environment for data warehouses and marts includes the following:
· Source systems that provide data to the warehouse or mart
· Data-integration technology and processes that prepare the data for use
· Different architectures for storing data in an organization’s data warehouse or data marts
138 CHAPTER 5 Data and Knowledge Management
Data Warehouses and Data Marts 137
FIGURE 5.4 Data warehouse framework.
· Different tools and applications for the variety of users. (You will learn about these tools and applications in Chapter 12.)
· Metadata, data quality, and governance processes that ensure that the warehouse or mart meets its purposes
Figure 5.4 depicts a generic data warehouse or data mart environment. Let’s drill down into the component parts.
Source Systems. There is typically some “organizational pain” (i.e., business need) that motivates a firm to develop its BI capabilities. Working backward, this pain leads to information requirements, BI applications, and source system data requirements. The data requirements can range from a single source system, as in the case of a data mart, to hundreds of source systems, as in the case of an enterprisewide data warehouse.
Modern organizations can select from a variety of source systems, including: operational/ transactional systems, enterprise resource planning (ERP) systems, website data, third-party data (e.g., customer demographic data), and more. The trend is to include more types of data (e.g., sensing data from RFID tags). These source systems often use different software packages (e.g., IBM, Oracle) and store data in different formats (e.g., relational, hierarchical).
A common source for the data in data warehouses is the company’s operational databases, which can be relational databases. To differentiate between relational databases and multi dimensional data warehouses and marts, imagine your company manufactures four prod- ucts—nuts, screws, bolts, and washers—and has sold them in three territories—East, West, and Central—for the previous three years—2014, 2015, and 2016. In a relational database, these sales data would resemble Figure 5.5(a) through (c). In a multidimensional database, in contrast, these data would be represented by a three-dimensional matrix (or data cube), as depicted in Figure 5.6. This matrix represents sales dimensioned by products and regions and year. Notice that Figure 5.5(a) presents only sales for 2014. Sales for 2015 and 2016 are presented in Figure 5.5(b) and (c), respectively. Figure 5.7(a) through (c) illustrates the equiva lence between these relational and multidimensional databases.
Unfortunately, many source systems that have been in use for years contain “bad data” (e.g., missing or incorrect data) and are poorly documented. As a result, data-profiling software
FIGURE 5.5 Relational databases.
FIGURE 5.6 Data cube.
should be used at the beginning of a warehousing project to better understand the data. For example, this software can provide statistics on missing data, identify possible primary and foreign keys, and reveal how derived values (e.g., column 3 = column 1 + column 2) are calcu lated. Subject area database specialists (e.g., marketing, human resources) can also assist in understanding and accessing the data in source systems.
Organizations need to address other source systems issues as well. There are often multi ple systems that contain some of the same data and the best system must be selected as the source system. Organizations must also decide how granular (i.e., detailed) the data should be. For example, does the organization need daily sales figures or data at the individual trans action level? The conventional wisdom is that it is best to store data at a highly granular level because someone will likely request the data at some point.
Data Integration. In addition to storing data in their source systems, organizations need to extract the data, transform them, and then load them into a data mart or warehouse. This process is often called ETL, although the term data integration is increasingly being used to reflect the growing number of ways that source system data can be handled. For example, in
FIGURE 5.7 Equivalence between relational and multidimensional databases.
some cases, data are extracted, loaded into a mart or warehouse, and then transformed (i.e., ELT rather than ETL).
Data extraction can be performed either by handwritten code (e.g., SQL queries) or by commercial data-integration software. Most companies employ commercial software. This software makes it relatively easy to specify the tables and attributes in the source systems that are to be used, map and schedule the movement of the data to the target (e.g., a data mart or warehouse), make the required transformations, and ultimately load the data.
140 CHAPTER 5 Data and Knowledge Management
Data Warehouses and Data Marts 141
After the data are extracted, they are transformed to make them more useful. For example, data from different systems may be integrated around a common key, such as a customer iden tification number. Organizations adopt this approach to create a 360-degree view of all of their interactions with their customers. As an example of this process, consider a bank. Customers can engage in a variety of interactions: visiting a branch, banking online, using an ATM, obtain ing a car loan, and more. The systems for these touch points—defined as the numerous ways that organizations interact with customers, such as e-mail, the web, direct contact, and the telephone—are typically independent of one another. To obtain a holistic picture of how cus tomers are using the bank, the bank must integrate the data from the various source systems into a data mart or warehouse.
Other kinds of transformations also take place. For example, format changes to the data may be required, such as using male and female to denote gender, as opposed to 0 and 1 or M and F. Aggregations may be performed, say on sales figures, so that queries can use the sum maries rather than recalculating them each time. Data-cleansing software may be used to clean up the data; for example, eliminating duplicate records for the same customer.
Finally, data are loaded into the warehouse or mart during a specific period known as the “load window.” This window is becoming smaller as companies seek to store ever-fresher data in their warehouses. For this reason, many companies have moved to real-time data warehous ing where data are moved (using data-integration processes) from source systems to the data warehouse or mart almost instantly. For example, within 15 minutes of a purchase at Walmart, the details of the sale have been loaded into a warehouse and are available for analysis.
Storing the Data. A variety of architectures can be used to store decision-support data. The most common architecture is one central enterprise data warehouse, without data marts. Most organizations use this approach, because the data stored in the warehouse are accessed by all users and represent the single version of the truth.
Another architecture is independent data marts. This architecture stores data for a single application or a few applications, such as marketing and finance. Limited thought is given to how the data might be used for other applications or by other functional areas in the organiza tion. This is a very application-centric approach to storing data.
The independent data mart architecture is not particularly effective. Although it may meet a specific organizational need, it does not reflect an enterprisewide approach to data manage ment. Instead, the various organizational units create independent data marts. Not only are these marts expensive to build and maintain, but they often contain inconsistent data. For example, they may have inconsistent data definitions such as: What is a customer? Is a particular individual a potential or current customer? They might also use different source systems (which may have different data for the same item, such as a customer address). Although independent data marts are an organizational reality, larger companies have increasingly moved to data warehouses.
Still another data warehouse architecture is the hub and spoke. This architecture contains a central data warehouse that stores the data plus multiple dependent data marts that source their data from the central repository. Because the marts obtain their data from the central repository, the data in these marts still comprise the single version of the truth for decision- support purposes.
The dependent data marts store the data in a format that is appropriate for how the data will be used and for providing faster response times to queries and applications. As you have learned, users can view and analyze data from the perspective of business dimensions and measures. This analysis is intuitive because the dimensions are in business terms, easily un derstood by users.
Metadata. It is important to maintain data about the data, known as metadata, in the data warehouse. Both the IT personnel who operate and manage the data warehouse and the users who access the data need metadata. IT personnel need information about data sources; database, table, and column names; refresh schedules; and data-usage measures. Users’ needs include data definitions, report and query tools, report distribution information, and contact information for the help desk.
Data Quality. The quality of the data in the warehouse must meet users’ needs. If it does not, users will not trust the data and ultimately will not use it. Most organizations find that the quality of the data in source systems is poor and must be improved before the data can be used in the data warehouse. Some of the data can be improved with data-cleansing software, but the better, long-term solution is to improve the quality at the source system level. This approach requires the business owners of the data to assume responsibility for making any necessary changes to implement this solution.
To illustrate this point, consider the case of a large hotel chain that wanted to conduct tar geted marketing promotions using zip code data it collected from its guests when they checked in. When the company analyzed the zip code data, they discovered that many of the zip codes were 99999. How did this error occur? The answer is that the clerks were not asking customers for their zip codes, but they needed to enter something to complete the registration process. A short-term solution to this problem was to conduct the marketing campaign using city and state data instead of zip codes. The long-term solution was to make certain the clerks entered the actual zip codes. The latter solution required the hotel managers to take the responsibility for making certain their clerks enter the correct data.
Governance. To ensure that BI is meeting their needs, organizations must implement governance to plan and control their BI activities. Governance requires that people, commit tees, and processes be in place. Companies that are effective in BI governance often create a senior-level committee composed of vice presidents and directors who (1) ensure that the business strategies and BI strategies are in alignment, (2) prioritize projects, and (3) allocate re sources. These companies also establish a middle management–level committee that oversees the various projects in the BI portfolio to ensure that these projects are being completed in ac cordance with the company’s objectives. Finally, lower-level operational committees perform tasks such as creating data definitions and identifying and solving data problems. All of these committees rely on the collaboration and contributions of business users and IT personnel.
Users. Once the data are loaded in a data mart or warehouse, they can be accessed. At this point, the organization begins to obtain business value from BI; all of the prior stages constitute creating BI infrastructure.
There are many potential BI users, including IT developers; frontline workers; analysts; in formation workers; managers and executives; and suppliers, customers, and regulators. Some of these users are information producers whose primary role is to create information for other users. IT developers and analysts typically fall into this category. Other users—including man agers and executives—are information consumers, because they use information created by others.
Companies have reported hundreds of successful data-warehousing applications. You can read client success stories and case studies at the websites of vendors such as NCR Corp. ( www
.ncr.com ) and Oracle ( www.oracle.com ). For a more detailed discussion, visit the Data Ware house Institute ( http://tdwi.org ). The benefits of data warehousing include the following:
· End users can access needed data quickly and easily through web browsers because these data are located in one place.
· End users can conduct extensive analysis with data in ways that were not previously possible.
· End users can obtain a consolidated view of organizational data.
These benefits can improve business knowledge, provide competitive advantage, en hance customer service and satisfaction, facilitate decision making, and streamline business processes.
Despite their many benefits, data warehouses have some limitations. First, they can be very expensive to build and to maintain. Second, incorporating data from obsolete mainframe systems can be difficult and expensive. Finally, people in one department might be reluctant to share data with other departments.
142 CHAPTER 5 Data and Knowledge Management
Knowledge Management 143
Before you go on. . .
1. Differentiate between data warehouses and data marts.
2. Describe the characteristics of a data warehouse.
3. What are three possible architectures for data warehouses and data marts in an organization?
Knowledge Management
5.5
As we have noted throughout this text, data and information are critically important organi zational assets. Knowledge is a vital asset as well. Successful managers have always valued and used intellectual assets. These efforts were not systematic, however, and they did not en sure that knowledge was shared and dispersed in a way that benefited the overall organiza tion. Moreover, industry analysts estimate that most of a company’s knowledge assets are not housed in relational databases. Instead, they are dispersed in e-mail, word-processing docu ments, spreadsheets, presentations on individual computers, and in people’s heads. This ar rangement makes it extremely difficult for companies to access and integrate this knowledge. The result frequently is less-effective decision making.
Concepts and Definitions
Knowledge management (KM) is a process that helps organizations manipulate important knowledge that comprises part of the organization’s memory, usually in an unstructured for mat. For an organization to be successful, knowledge, as a form of capital, must exist in a for mat that can be exchanged among persons. It must also be able to grow.
Knowledge. In the information technology context, knowledge is distinct from data and information. As you learned in Chapter 1, data are a collection of facts, measurements, and statistics; information is organized or processed data that are timely and accurate. Knowledge is information that is contextual, relevant, and useful. Simply put, knowledge is information in action. Intellectual capital (or intellectual assets) is another term for knowledge.
To illustrate, a bulletin listing all of the courses offered by your university during one semes ter would be considered data. When you register, you process the data from the bulletin to cre ate your schedule for the semester. Your schedule would be considered information. Awareness of your work schedule, your major, your desired social schedule, and characteristics of differ ent faculty members could be construed as knowledge, because it can affect the way you build your schedule. You see that this awareness is contextual and relevant (to developing an optimal schedule of classes) as well as useful (it can lead to changes in your schedule). The implication is that knowledge has strong experiential and reflective elements that distinguish it from informa tion in a given context. Unlike information, knowledge can be used to solve a problem.
Numerous theories and models classify different types of knowledge. In the next section, we will focus on the distinction between explicit knowledge and tacit knowledge.
Explicit and Tacit Knowledge. Explicit knowledge deals with more objective, ra tional, and technical knowledge. In an organization, explicit knowledge consists of the policies, procedural guides, reports, products, strategies, goals, core competencies, and IT infrastruc ture of the enterprise. In other words, explicit knowledge is the knowledge that has been codi fied (documented) in a form that can be distributed to others or transformed into a process or a strategy. A description of how to process a job application that is documented in a firm’s human resources policy manual is an example of explicit knowledge.
In contrast, tacit knowledge is the cumulative store of subjective or experiential learn ing. In an organization, tacit knowledge consists of an organization’s experiences, insights,
expertise, know-how, trade secrets, skill sets, understanding, and learning. It also includes the organizational culture, which reflects the past and present experiences of the organiza tion’s people and processes, as well as the organization’s prevailing values. Tacit knowledge is generally imprecise and costly to transfer. It is also highly personal. Finally, because it is un structured, it is difficult to formalize or codify, in contrast to explicit knowledge. A salesperson who has worked with particular customers over time and has come to know their needs quite well would possess extensive tacit knowledge. This knowledge is typically not recorded. In fact, it might be difficult for the salesperson to put into writing, even if he or she were willing to share it.
Knowledge Management Systems
The goal of knowledge management is to help an organization make the most productive use of the knowledge it has accumulated. Historically, management information systems have fo cused on capturing, storing, managing, and reporting explicit knowledge. Organizations now realize they need to integrate explicit and tacit knowledge into formal information systems. Knowledge management systems (KMSs) refer to the use of modern information technolo gies—the Internet, intranets, extranets, and databases—to systematize, enhance, and expedite intrafirm and interfirm knowledge management. KMSs are intended to help an organization cope with turnover, rapid change, and downsizing by making the expertise of the organization’s human capital widely accessible. IT’s About Business 5.4 illustrates how Performance Bicycle implemented the Learning Center, a knowledge management system.
Organizations can realize many benefits with KMSs. Most importantly, they make best practices—the most effective and efficient ways of doing things—readily available to a wide range of employees. Enhanced access to best-practice knowledge improves overall organiza tional performance. For example, account managers can now make available their tacit knowl edge about how best to manage large accounts. The organization can then use this knowledge when it trains new account managers. Other benefits include improved customer service, more efficient product development, and improved employee morale and retention.
At the same time, however, implementing effective KMSs presents several challenges. First, employees must be willing to share their personal tacit knowledge. To encourage this behavior, organizations must create a knowledge management culture that rewards employees who add their expertise to the knowledge base. Second, the organization must continually maintain and upgrade its knowledge base. Specifically, it must incorporate new knowledge and delete old, outdated knowledge. Finally, companies must be willing to invest in the resources needed to carry out these operations.
![]()
The KMS Cycle
A functioning KMS follows a cycle that consists of six steps (see Figure 5.8). The reason the system is cyclical is that knowledge is dynamically refined over time. The knowledge in an effective KMS is never finalized because the environment changes over time and knowledge must be updated to reflect these changes. The cycle works as follows:
1. Create knowledge. Knowledge is created as people determine new ways of doing things or develop know-how. Sometimes external knowledge is brought in.
2. Capture knowledge. New knowledge must be identified as valuable and be presented in a reasonable way.
3. Refine knowledge. New knowledge must be placed in context so that it is actionable. This is where tacit qualities (human
FIGURE 5.8 The knowledge management system cycle. insights) must be captured along with explicit facts.
IT’s About Business 5.4
Performance Bicycle Leverages Its Employees’ Knowledge
MKT
Performance Bicycle (PB; www.performancebike.com ) is a lead ing retailer of cycling products. The company has 2,200 employees and more than 100 stores in 20 states. It also has a print catalog and sells more than 10,000 products on its website.
The company hoped the web could increase its sales as part of its business plan. PB knew that its e-commerce site could extend its base beyond its brick-and-mortar stores. To do this, it would need more than just great products.
Performance Bicycle decided to leverage its employees’ pas sion for cycling. Most staff keep bikes at work. By using the staff’s knowledge and enthusiasm, PB could motivate new customers and cement its status as a cycling expert. Significantly, the company recognized that although its employees’ knowledge is extremely valuable, it was also largely untapped. The challenge confronting Performance Bicycle was to capture this knowledge and share it with its customers in an appealing way. PB addressed this goal by developing its Learning Center.
To make its employees’ knowledge available to customers on its website, Performance Bicycle added a knowledge management sys tem, called the Learning Center ( http://learn.performancebicycle
.com ), where staff share their expertise, tips, and tricks through videos, articles, and how-to guides. Key to the Learning Center’s success is its seamless integration with e-commerce, allowing cus tomers to easily find products and the relevant multimedia con tent about them. For example, customers interested in performing maintenance on their bike can view a how-to video and then go directly to the replacement parts they’ll need to order.
Performance Bicycle conducted knowledge-transfer ses sions to obtain the knowledge for the Learning Center. PB has an editorial team that reviews employee-made content, including articles and video guides. When publishing the content to the Learning Center, the editorial team makes links to appropriate pages on the e-commerce site. When new products are added
for sale, the editorial team links back to relevant Learning Center content.
For Performance Bicycle employees and customers alike, cy cling is a lifestyle. Its e-commerce site and Learning Center have helped cement it as a leading cycling authority. The site succeeds in inspiring both veteran and new cyclists, and helps them navigate the otherwise bumpy road of a wide range of products.
And the bottom line? Within just four months of the Learn ing Center launch, traffic on PB’s site tripled. The Learning Center is now responsible for almost half of the company’s direct online sales. Meanwhile, PB has begun to implement the Learning Center as a mobile application to further improve the customer experience. In September 2016, Performance Bicycle gained recognition from Interbike, North America’s biggest bicycle industry trade show. PB was named the Best Omni-Channel Retailer for its seamless in
tegration of its online sales channel and brick-and-mortar stores.
Sources: Compiled from “Performance Bicycle Recognized for Enhancing the Shopping Experience,” PR Newswire, September 26, 2016; A. Dow, “Top Takeaways for Retail from VMworld,” VMware Blogs, September
15, 2015; “Consumer and Retail Companies Must Focus on Distribution and Localization in Emerging Markets,” M-Brain, July 5, 2015; E. Tucker, “Positive Stories about Working in Retail,” Great Place to Work, April 16, 2015; T. Hussein and S. Khan, “Knowledge Management: An Instrument for Implementation in Retail Marketing,” MATRIX Academic International Online Journal of Engineering and Technology, April 2015; “Performance Bike: Architecting a Customer Learning Center,” Sirius Digital Experience, 2015; A. Pickrell, “Putting the ‘Perform’ in Performance Bicycle,” IBM Amplify, 2015;
J. Gregoire, “5 Challenges, Opportunities, and Imperatives for Retailers in 2015,” CPC Strategy, October 8, 2014; “Performance Bicycle,” IBM Smarter Commerce, April 22, 2014; “Performance Bicycle Launches Learning Center,” PR Newswire, September 25, 2013; www.performancebike.com, accessed September 26, 2016.
Questions
1. Describe several ways in which Performance Bicycle incor porates employee knowledge in its customer experience.
2. Is Performance Bicycle capturing and using its employee’s tacit knowledge or explicit knowledge? Explain your answer.
4. Store knowledge. Useful knowledge must then be stored in a reasonable format in a knowl edge repository so that other people in the organization can access it.
5. Manage knowledge. Like a library, the knowledge must be kept current. It must be re viewed regularly to verify that it is relevant and accurate.
6. Disseminate knowledge. Knowledge must be made available in a useful format to anyone in the organization who needs it, anywhere and any time.
Before you go on. . .
1. What is knowledge management?
2. What is the difference between tacit knowledge and explicit knowledge?
3. Describe the knowledge management system cycle.
Appendix: Fundamentals of Relational Database Operations
5.6
There are many operations possible with relational databases. In this section, we discuss three of these operations: query languages, normalization, and joins.
As you have seen in this chapter, a relational database is a collection of interrelated two- dimensional tables, consisting of rows and columns. Each row represents a record, and each column (or field) represents an attribute (or characteristic) of that record. Every record in the database must contain at least one field that uniquely identifies that record so that it can be retrieved, updated, and sorted. This identifier field, or group of fields, is called the primary key. In some cases, locating a particular record requires the use of secondary keys. A secondary key is another field that has some identifying information, but typically does not uniquely identify the record. A foreign key is a field (or group of fields) in one table that matches the primary key value in a row of another table. A foreign key is used to establish and enforce a link between two tables.
These related tables can be joined when they contain common columns. The uniqueness of the primary key tells the DBMS which records are joined with others in related tables. This feature allows users great flexibility in the variety of queries they can make. Despite these fea tures, however, the relational database model has some disadvantages. Because large-scale databases can be composed of many interrelated tables, the overall design can be complex, leading to slow search and access times.
Query Languages
The most commonly performed database operation is searching for information. Structured query language (SQL) is the most popular query language used for interacting with a data base. SQL allows people to perform complicated searches by using relatively simple state ments or key words. Typical key words are SELECT (to choose a desired attribute), FROM (to specify the table or tables to be used), and WHERE (to specify conditions to apply in the query). To understand how SQL works, imagine that a university wants to know the names of stu dents who will graduate cum laude (but not magna or summa cum laude) in May 2017. (Refer to Figure 5.3 in this chapter.) The university IT staff would query the student relational database
with an SQL statement such as
SELECT Student_Name FROM Student_Database
WHERE Grade_Point_Average > = 3.40 and Grade_Point_Average < 3.60.
The SQL query would return John Jones and Juan Rodriguez.
Another way to find information in a database is to use query by example (QBE). In QBE, the user fills out a grid or template—also known as a form—to construct a sample or a descrip tion of the data desired. Users can construct a query quickly and easily by using drag-and-drop features in a DBMS such as Microsoft Access. Conducting queries in this manner is simpler than keying in SQL commands.
Entity–Relationship Modeling
Designers plan and create databases through the process of entity–relationship modeling, using an entity–relationship (ER) diagram. There are many approaches to ER diagramming. You will see one particular approach here, but there are others. The good news is that if you are familiar with one version of ER diagramming, then you will be able to easily adapt to any other version.
148 CHAPTER 5 Data and Knowledge Management
Appendix: Fundamentals of Relational Database Operations 147
ER diagrams consist of entities, attributes, and relationships. To properly identify entities, attributes, and relationships, database designers first iden tify the business rules for the particular data model. Business rules are pre cise descriptions of policies, procedures, or principles in any organization that stores and uses data to generate information. Business rules are derived from a description of an organization’s operations, and help to create and enforce business processes in that organization. Keep in mind that you determine these business rules, not the MIS department.
Entities are pictured in rectangles, and relationships are described on the line between two entities. The attributes for each entity are listed, and the pri mary key is underlined. The data dictionary provides information on each at tribute, such as its name, if it is a key, part of a key, or a nonkey attribute, the type of data expected (alphanumeric, numeric, dates, etc.), and valid values. Data dictionaries can also provide information on why the attribute is needed in the database; which business functions, applications, forms, and reports use the attribute; and how often the attribute should be updated.
ER modeling is valuable because it allows database designers to communi cate with users throughout the organization to ensure that all entities and the relationships among the entities are represented. This process underscores the importance of taking all users into account when designing organizational da tabases. Notice that all entities and relationships in our example are labeled in ways that users can understand.
FIGURE 5.9 Cardinality symbols.
Relationships illustrate an association between entities. The degree of a relationship indicates the number of entities associated with a relationship. A unary relationship exists when an association is maintained within a single entity. A binary relationship exists when two entities are associated. A ternary relationship exists when three entities are associated. In this chapter, we discuss only binary relationships because they are the most common. Entity relationships may be classified as one-to-one, one-to-many, or many-to-many. The term con nectivity describes the relationship classification.
Connectivity and cardinality are established by the business rules of a relationship. Car dinality refers to the maximum number of times an instance of one entity can be associated with an instance in the related entity. Cardinality can be mandatory single, optional single, mandatory many, or optional many. Figure 5.9 displays the cardinality symbols. Note that we have four possible cardinality symbols: mandatory single, optional single, mandatory many, and optional many.
Let’s look at an example from a university. An entity is a person, place, or thing that can be identified in the users’ work environment. For example, consider student registration at a university. Students register for courses, and they also register their cars for parking permits. In this example, STUDENT, PARKING PERMIT, CLASS, and PROFESSOR are entities. Recall that an instance of an entity represents a particular student, parking permit, class, or professor. Therefore, a particular STUDENT (James Smythe, 8023445) is an instance of the STUDENT en tity; a particular parking permit (91778) is an instance of the PARKING PERMIT entity; a particu lar class (76890) is an instance of the CLASS entity; and a particular professor (Margaret Wilson, 390567) is an instance of the PROFESSOR entity.
Entity instances have identifiers, or primary keys, which are attributes (attributes and identifiers are synonymous) that are unique to that entity instance. For example, STUDENT in stances can be identified with Student Identification Number; PARKING PERMIT instances can be identified with Permit Number; CLASS instances can be identified with Class Number; and PROFESSOR instances can be identified with Professor Identification Number.
Entities have attributes, or properties, that describe the entity’s characteristics. In our ex ample, examples of attributes for STUDENT are Student Name and Student Address. Examples of attributes for PARKING PERMIT are Student Identification Number and Car Type. Examples of attributes for CLASS are Class Name, Class Time, and Class Place. Examples of attributes for PROFESSOR are Professor Name and Professor Department. (Note that each course at this university has one professor—no team teaching.)
FIGURE 5.10 One-to-one relationship.
Why is Student Identification Number an attribute of both the STUDENT and PARKING PERMIT entity classes? That is, why do we need the PARKING PERMIT entity class? If you consider all of the interlinked university systems, the PARKING PERMIT en tity class is needed for other applications, such as fee payments, parking tickets, and external links to the state Department of Motor Vehicles.
Let’s consider the three types of binary relationships in our example.
In a one-to-one (1:1) relationship, a single-entity instance of one type is related to a single-entity instance of another type. In our university example, STUDENT–PARKING PERMIT is a 1:1 rela tionship. The business rule at this university represented by this relationship is: Students may register only one car at this univer sity. Of course, students do not have to register a car at all. That is, a student can have only one parking permit but does not need to have one.
Note that the relationship line on the PARKING PERMIT side shows a cardinality of optional single. A student can have, but does not have to have, a parking permit. On the STUDENT side
FIGURE 5.11 One-to-many relationship. of the relationship, only one parking permit can be assigned to one student, resulting in a cardinality of mandatory single. See Figure 5.10.
The second type of relationship, one-to-many (1:M), is represented by the CLASS–PROFES SOR relationship in Figure 5.11. The business rule at this university represented by this rela tionship is: At this university, there is no team teaching. Therefore, each class must have only one professor. On the other hand, professors may teach more than one class. Note that the relationship line on the PROFESSOR side shows a cardinality of mandatory single. In contrast, the relationship line on the CLASS side shows a cardinality of optional many.
The third type of relationship, many-to-many (M:M), is represented by the STUDENT–CLASS relationship. Most database management systems do not support many-to-many relationships. Therefore, we use junction (or bridge) tables, so that we have two one-to-many relationships. The business rule at this university represented by this relationship is: Students can register for one or more classes, and each class can have one or more students (see Figure 5.12). In this example, we create the REGISTRATION table as our junction table. Note that Student ID and Class ID are foreign keys in the REGISTRATION table.
Let’s examine the following relationships:
· The relationship line on the STUDENT side of the STUDENT–REGISTRATION relationship shows a cardinality of optional single.
· The relationship line on the REGISTRATION side of the STUDENT–REGISTRATION relation ship shows a cardinality of optional many.
FIGURE 5.12 Many-to-many relationship.
FIGURE 5.13 Raw data gathered from orders at the pizza shop.
· The relationship line on the CLASS side of the CLASS–REGISTRATION relationship shows a cardinality of optional single.
· The relationship line on the REGISTRATION side of the CLASS–REGISTRATION relationship shows a cardinality of optional many.
Normalization and Joins
To use a relational database management system efficiently and effectively, the data must be analyzed to eliminate redundant data elements. Normalization is a method for analyzing and reducing a relational database to its most streamlined form to ensure minimum redundancy, maximum data integrity, and optimal processing performance. Data normalization is a meth odology for organizing attributes into tables so that redundancy among the nonkey attributes is eliminated. The result of the data normalization process is a properly structured relational database.
Data normalization requires a list of all the attributes that must be incorporated into the database and a list of all of the defining associations, or functional dependencies, among the attributes. Functional dependencies are a means of expressing that the value of one partic ular attribute is associated with a specific single value of another attribute. For example, for a Student Number 05345 at a university, there is exactly one Student Name, John C. Jones, associated with it. That is, Student Number is referred to as the determinant because its value determines the value of the other attribute. We can also say that Student Name is functionally dependent on Student Number.
As an example of normalization, consider a pizza shop. This shop takes orders from customers on a form. Figure 5.13 shows a table of nonnormal ized data gathered by the pizza shop. This table has two records, one for each order being placed. Because there are several pizzas on each order, the or der number and customer information appear in multiple rows. Several at tributes of each record have null values. A null value is an attribute with no data in it. For example, Order Number has four null values. Therefore, this table is not in first normal form. The data drawn from that form is shown in Figure 5.13.
In our example, ORDER, CUSTOMER, and PIZZA are entities. The first step in normalization is to determine the functional dependencies among the attri butes. The functional dependencies in our example are shown in Figure 5.14.
In the normalization process, we will proceed from nonnormalized data, to
first normal form, to second normal form, and then to third normal form. (There FIGURE 5.14 Functional dependencies in pizza
are additional normal forms, but they are beyond the scope of this book.) shop example.
FIGURE 5.15 First normal form for data from pizza shop.
Figure 5.15 demonstrates the data in first normal form. The attributes under consideration are listed in one table and primary keys have been established. Our primary keys are Order Number, Customer ID, and Pizza Code. In first normal form, each ORDER has to repeat the or der number, order date, customer first name, customer last name, customer address, and cus tomer zip code. This data file contains repeating groups and describes multiple entities. That is, this relation has data redundancy, a lack of data integrity, and the flat file would be difficult to use in various applications that the pizza shop might need.
Consider the table in Figure 5.15, and notice the very first column (labeled Order Num ber). This column contains multiple entries for each order—three rows for Order Number 1116 and three rows for Order Number 1117. These multiple rows for an order are called repeating groups. The table in Figure 5.13 also contains multiple entities: ORDER, CUSTOMER, and PIZZA. Therefore, we move on to second normal form.
To produce second normal form, we break the table in Figure 5.15 into smaller tables to eliminate some of its data redundancy. Second normal form does not allow partial functional dependencies. That is, in a table in second normal form, every nonkey attribute must be func tionally dependent on the entire primary key of that table. Figure 5.16 shows the data from the pizza shop in second normal form.
If you examine Figure 5.16, you will see that second normal form has not eliminated all the data redundancy. For example, each Order Number is duplicated three times, as are all customer data. In third normal form, nonkey attributes are not allowed to define other non- key attributes. That is, third normal form does not allow transitive dependencies in which one nonkey attribute is functionally dependent on another. In our example, customer in formation depends both on Customer ID and Order Number. Figure 5.17 shows the data from the pizza shop in third normal form. Third normal form structure has these important points:
· It is completely free of data redundancy.
· All foreign keys appear where needed to link related tables.
Let’s look at the primary and foreign keys for the tables in third normal form:
· The ORDER relation: The primary key is Order Number and the foreign key is Customer ID.
· The CUSTOMER relation: The primary key is Customer ID.
· The PIZZA relation: The primary key is Pizza Code.
· The ORDER–PIZZA relation: The primary key is a composite key, consisting of two foreign keys, Order Number and Pizza Code.
150 CHAPTER 5 Data and Knowledge Management
Appendix: Fundamentals of Relational Database Operations 151
FIGURE 5.16 Second normal form for data from pizza shop.
FIGURE 5.17 Third normal form for data from pizza shop.
152 CHAPTER 5 Data and Knowledge Management
Appendix: Fundamentals of Relational Database Operations 153
FIGURE 5.18 The join process with the tables of third normal form to produce an order.
Now consider an order at the pizza shop. The tables in third normal form can produce the order in the following manner by using the join operation (see Figure 5.18). The join opera tion combines records from two or more tables in a database to obtain information that is located in different tables. In our example, the join operation combines records from the four nor malized tables to produce an ORDER. Here is how the join oper ation works:
· The ORDER relation provides the Order Number (the pri mary key), Order Date, and Total Price.
· The primary key of the ORDER relation (Order Number) provides a link to the ORDER–PIZZA relation (the link num bered 1 in Figure 5.18).
· The ORDER–PIZZA relation supplies the Quantity to ORDER.
· The primary key of the ORDER–PIZZA relation is a com posite key that consists of Order Number and Pizza Code. Therefore, the Pizza Code component of the primary key provides a link to the PIZZA relation (the link numbered 2 in Figure 5.18).
· The PIZZA relation supplies the Pizza Name and Price to ORDER.
· The Customer ID in ORDER (a foreign key) provides a link to the CUSTOMER relation (the link numbered 3 in Figure 5.18).
· The CUSTOMER relation supplies the Customer F Name, Customer L Name, Customer Address, and Zip Code to ORDER.
At the end of this join process, we have a complete ORDER. Normalization is beneficial when maintaining databases over a period of time. One example is the likelihood of having to change the price of each pizza. If the pizza shop increases the price of the Meat Feast from
$12.00 to $12.50, this process is one easy step in Figure 5.18. The price field is changed to $12.50 and the ORDER is automatically updated with the current value of the price.
Before you go on. . .
1. What is structured query language?
2. What is query by example?
3. What is an entity? An attribute? A relationship?
4. Describe one-to-one, one-to-many, and many-to-many relationships.
5. What is the purpose of normalization?
6. Why do we need the join operation?
What’s in IT for me? (Sections 5.1–5.5)
For the Accounting Major
ACCT
The accounting function is intimately concerned with keeping track of the transactions and internal controls of an organization. Mod ern databases enable accountants to perform these functions more effectively. Databases help accountants manage the flood of data
in today’s organizations so that they can keep their firms in compli ance with the standards imposed by Sarbanes–Oxley.
Accountants also play a role in cost, justifying the creation of a knowledge base and then auditing its cost-effectiveness. Also, if you work for a large CPA company that provides management
services or sells knowledge, you will most likely use some of your company’s best practices that are stored in a knowledge base.
FIN For the Finance Major
Financial managers make extensive use of computerized databases that are external to the organization, such as CompuStat or Dow Jones, to obtain financial data on organizations in their industry. They can use these data to determine if their organization meets industry benchmarks in return on investment, cash management, and other financial ratios.
Financial managers, who produce the organization’s financial status reports, are also closely involved with Sarbanes–Oxley. Data bases help these managers comply with the law’s standards.
MKT For the Marketing Major
Databases help marketing managers access data from the organi zation’s marketing transactions, such as customer purchases, to plan targeted marketing campaigns and to evaluate the success of previous campaigns. Knowledge about customers can make the difference between success and failure. In many databases and knowledge bases, the vast majority of information and knowledge concerns customers, products, sales, and marketing. Marketing managers regularly use an organization’s knowledge base, and they often participate in its creation.
POM For the Production/Operations Management Major
Production/operations personnel access organizational data to determine optimum inventory levels for parts in a production pro cess. Past production data enable production/operations manage ment (POM) personnel to determine the optimum configuration for assembly lines. Firms also collect quality data that inform them not only about the quality of finished products but also about qual ity issues with incoming raw materials, production irregularities, shipping and logistics, and after-sale use and maintenance of the product.
Knowledge management is extremely important for run ning complex operations. The accumulated knowledge regarding scheduling, logistics, maintenance, and other functions is very valuable. Innovative ideas are necessary for improving operations and can be supported by knowledge management.
HRM For the Human Resources Management Major
Organizations keep extensive data on employees, including gen der, age, race, current and past job descriptions, and performance evaluations. HR personnel access these data to provide reports to government agencies regarding compliance with federal equal op portunity guidelines. HR managers also use these data to evaluate hiring practices, evaluate salary structures, and manage any dis crimination grievances or lawsuits brought against the firm.
Databases help HR managers provide assistance to all em ployees as companies turn over more and more decisions about healthcare and retirement planning to the employees themselves. The employees can use the databases for help in selecting the opti mal mix among these critical choices.
HR managers also need to use a knowledge base frequently to find out how past cases were handled. Consistency in how employ ees are treated not only is important, but it also protects the com pany against legal actions. Training for building, maintaining, and using the knowledge system is also sometimes the responsibility of the HR department. Finally, the HR department might be responsi ble for compensating employees who contribute their knowledge to the knowledge base.
MIS For the MIS Major
The MIS function manages the organization’s data as well as the databases. MIS database administrators standardize data names by using the data dictionary. This process ensures that all users un derstand which data are in the database. Database personnel also help users access needed data and generate reports with query tools.
For all Business Majors
What’s in IT for me? (Appendix: Section 5.6)
All business majors will have to manage data in their professional work. One way to manage data is through the use of databases and database management systems. First, it is likely that you will need to obtain information from your organization’s databases. You will probably use structured query language to obtain this information. Second, as your organization plans and designs its databases, it will most likely use entity-relationship diagrams. You will provide much
of the input to these ER diagrams. For example, you will describe the entities that you use in your work, the attributes of those enti ties, and the relationships among them. You will also help database designers as they normalize database tables, by describing how the normalized tables relate to each other (e.g., through the use of pri mary and foreign keys). Finally, you will help database designers as they plan their join operations to give you the information that you need when that information is stored in multiple tables.
Summary
1. Discuss ways that common challenges in managing data can be addressed using data governance.
The following are three common challenges in managing data:
· Data are scattered throughout organizations and are collected by many individuals using various methods and devices. These data are frequently stored in numerous servers and locations and in different computing systems, databases, formats, and human and computer languages.
· Data come from multiple sources.
· Information systems that support particular business processes impose unique requirements on data, which results in repetition and conflicts across an organization.
One strategy for implementing data governance is master data management. Master data management provides companies with the ability to store, maintain, exchange, and synchronize a consistent, accurate, and timely “single version of the truth” for the company’s core master data. Master data management manages data gathered from across an organization, manages data from multiple sources, and manages data across business processes in an organization.
2. Discuss the advantages and disadvantages of relational da tabases.
Relational databases allow people to compare information quickly by row or column. Items are also easy to retrieve by finding the point of intersection of a particular row and column. On the other hand, large- scale relational databases can be composed of many interrelated ta bles, making the overall design complex with slow search and access times.
3. Define Big Data and its basic characteristics.
Big Data is composed of high-volume, high-velocity, and high-variety information assets that require new forms of processing to enable en hanced decision making, insight discovery, and process optimization. Big Data has three distinct characteristics, which are volume, velocity, and variety. These characteristics distinguish Big Data from traditional data:
· Volume: Big Data consists of vast quantities of data.
· Velocity: Big Data flows into an organization at incredible speeds.
· Variety: Big Data includes a huge variety of different data in differ ing data formats.
4. Explain the elements necessary to successfully implement and maintain data warehouses.
To successfully implement and maintain a data warehouse, an organ ization must:
· Link source systems that provide data to the warehouse or mart.
· Prepare the necessary data for the data warehouse using data integration technology and processes.
· Decide on an appropriate architecture for storing data in the data warehouse or data mart.
· Select the tools and applications for the variety of organizational users.
· Ensure that metadata, data quality, and governance processes are in place to ensure that the data warehouse or mart meets its purposes.
5. Describe the benefits and challenges of implementing knowledge management systems in organizations.
Organizations can realize many benefits with KMSs, including:
· Best practices are readily available to a wide range of employees.
· Improved customer service.
· More efficient product development.
· Improved employee morale and retention. Challenges to implementing KMSs include:
· Employees must be willing to share their personal tacit knowl edge.
· Organizations must create a knowledge management cul ture that rewards employees who add their expertise to the knowledge base.
· The knowledge base must be continually maintained and updated.
· Companies must be willing to invest in the resources needed to carry out these operations.
6 Understand the processes of querying a relational database, entity-relationship modeling, and normalization and joins.
The most commonly performed database operation is requesting information. Structured query language is the most popular query language used for this operation. SQL allows people to perform com plicated searches by using relatively simple statements or key words. Typical key words are SELECT (to specify a desired attribute), FROM (to specify the table to be used), and WHERE (to specify conditions to apply in the query).
Another way to find information in a database is to use query by example. In QBE, the user fills out a grid or template—also known as a form—to construct a sample or a description of the data desired. Users can construct a query quickly and easily by using drag-and-drop fea tures in a DBMS such as Microsoft Access. Conducting queries in this manner is simpler than keying in SQL commands.
Designers plan and create databases through the process of entity–relationship modeling, using an entity–relationship dia gram. ER diagrams consist of entities, attributes, and relationships. Entities are pictured in boxes, and relationships are represented as diamonds. The attributes for each entity are listed, and the primary key is underlined.
ER modeling is valuable because it allows database designers to communicate with users throughout the organization to ensure that all entities and the relationships among the entities are represented. This process underscores the importance of taking all users into ac count when designing organizational databases. Notice that all enti ties and relationships in our example are labeled in terms that users can understand.
Normalization is a method for analyzing and reducing a relational database to its most streamlined form to ensure minimum redun dancy, maximum data integrity, and optimal processing performance. When data are normalized, attributes in each table depend only on the primary key.
The join operation combines records from two or more tables in a database to produce information that is located in different tables.
Chapter Glossary
attribute Each characteristic or quality of a particular entity.
best practices The most effective and effi cient ways to do things.
Big Data A collection of data so large and complex that it is difficult to manage using tra ditional database management systems.
binary relationship A relationship that exists when two entities are associated.
bit A binary digit—that is, a 0 or a 1.
business rules Precise descriptions of pol icies, procedures, or principles in any orga nization that stores and uses data to generate information.
byte A group of eight bits that represents a single character.
clickstream data Data collected about user behavior and browsing patterns by monitoring users’ activities when they visit a website.
connectivity Describes the classification of a relationship: one-to-one, one-to-many, or many-to-many.
database management system (DBMS) The software program (or group of programs) that provides access to a database.
data dictionary A collection of definitions of data elements; data characteristics that use the data elements; and the individuals, business functions, applications, and reports that use these data elements.
data file (also table) A collection of logically related records.
data governance An approach to managing information across an entire organization.
data mart A low-cost, scaled-down version of a data warehouse that is designed for the end- user needs in a strategic business unit (SBU) or a department.
data model A diagram that represents enti ties in the database and their relationships.
data warehouse A repository of historical data that are organized by subject to support decision makers in the organization.
entity Any person, place, thing, or event of in terest to a user.
entity–relationship (ER) diagram Document that shows data entities and attributes and rela tionships among them.
entity–relationship (ER) modeling The pro cess of designing a database by organizing data entities to be used and identifying the relation ships among them.
explicit knowledge The more objective, ra tional, and technical types of knowledge.
field A characteristic of interest that describes an entity.
foreign key A field (or group of fields) in one table that uniquely identifies a row (or record) of another table.
functional dependency A means of express ing that the value of one particular attribute is associated with, or determines, a specific single value of another attribute.
instance Each row in a relational table, which is a specific, unique representation of the entity.
intellectual capital (or intellectual as sets) Other terms for knowledge.
join operation A database operation that combines records from two or more tables in a database.
knowledge management (KM) A process that helps organizations identify, select, organize, disseminate, transfer, and apply information and expertise that are part of the organization’s memory and that typically reside within the or ganization in an unstructured manner.
knowledge management systems (KMSs) In formation technologies used to systematize, enhance, and expedite intra- and interfirm knowledge management.
master data A set of core data, such as cus tomer, product, employee, vendor, geographic location, and so on, that spans an enterprise’s information systems.
master data management A process that provides companies with the ability to store, maintain, exchange, and synchronize a
consistent, accurate, and timely “single version of the truth” for the company’s core master data.
multidimensional structure Storage of data in more than two dimensions; a common rep resentation is the data cube.
normalization A method for analyzing and re ducing a relational database to its most stream lined form to ensure minimum redundancy, maximum data integrity, and optimal process ing performance.
primary key A field (or attribute) of a record that uniquely identifies that record so that it can be retrieved, updated, and sorted.
query by example To obtain information from a relational database, a user fills out a grid or template—also known as a form—to construct a sample or a description of the data desired.
record A grouping of logically related fields.
relational database model Data model based on the simple concept of tables in order to capitalize on characteristics of rows and col umns of data.
relationships Operators that illustrate an as sociation between two entities.
secondary key A field that has some identify ing information, but typically does not uniquely identify a record with complete accuracy.
structured query language The most popu lar query language for requesting information from a relational database.
table A grouping of logically related records.
tacit knowledge The cumulative store of sub jective or experiential learning, which is highly personal and hard to formalize.
ternary relationship A relationship that ex ists when three entities are associated.
unary relationship A relationship that exists when an association is maintained within a sin gle entity.
unstructured data Data that do not reside in a traditional relational database.
156 CHAPTER 5 Data and Knowledge Management
Discussion Questions
1. Is Big Data really a problem on its own, or are the use, control, and security of the data the true problems? Provide specific examples to support your answer.
2. What are the implications of having incorrect data points in your Big Data? What are the implications of incorrect or duplicated cus tomer data? How valuable are decisions that are based on faulty infor mation derived from incorrect data?
3. Explain the difficulties involved in managing data.
4. What are the problems associated with poor-quality data?
5. What is master data management? What does it have to do with high-quality data?
6. Explain why master data management is so important in compa nies that have multiple data sources.
7. Describe the advantages anddisadvantages of relationaldatabases.
8. Explain why it is important to capture and manage knowledge.
9. Compare and contrast tacit knowledge and explicit knowledge.
10. Draw the entity–relationship diagram for a company that has de partments and employees. In this company, a department must have at least one employee, and company employees may work in only one department.
11. Draw the entity–relationship diagram for library patrons and the process of checking out books.
12. You are working at a doctor’s office. You gather data on the fol lowing entities: PATIENT, PHYSICIAN, PATIENT DIAGNOSIS, and TREAT MENT. Develop a table for the entity, PATIENT VISIT. Decide on the primary keys and/or foreign keys that you want to use for each entity.
Problem-Solving Activities
1. Access various employment websites (e.g., www.monster.com and www.dice.com ) and find several job descriptions for a database administrator. Are the job descriptions similar? What are the salaries offered in these positions?
2. Access the websites of several real estate companies. Find the sites that take you through a step-by-step process for buying a home, that provide virtual reality tours of homes in your price range (say, $200,000 to $250,000) and location, that provide mortgage and interest rate cal culators, and that offer financing for your home. Do the sites require that you register to access their services? Can you request that an e-mail be sent to you when properties in which you might be interested become available? How does the process outlined influence your like lihood of selecting this company for your real estate purchase?
3. It is possible to find many websites that provide demographic in formation. Access several of these sites and see what they offer. Do the sites differ in the types of demographic information they offer? If so, how? Do the sites require a fee for the information they offer? Would demographic information be useful to you if you wanted to start a new business? If so, how and why?
4. Search the web for uses of Big Data in homeland security. Spe cifically, read about the spying by the U.S. National Security Agency (NSA). What role did technology and Big Data play in this questionable practice?
5. Visit the website for HowStuffWorks ( www.howstuffworks.com ), and search for “Big Data: Friend or Foe?” What points does this arti cle present concerning the delicate balance between shared data and customer privacy?
6. Access the websites of IBM ( www.ibm.com ), Sybase ( www.syb ase.com ), and Oracle ( www.oracle.com ), and trace the capabilities of their latest data management products, including web connections.
7. Enter the website of the Gartner Group ( www.gartner.com ). Exam ine the company’s research studies pertaining to data management. Prepare a report on the state of the art.
8. Calculate your personal digital footprint at http://www.emc.com/ digital_universe/downloads/web/personal-ticker.htm .
9. Diagram a knowledge management system cycle for a fictional company that sells customized T-shirts to students.
Chapter Closing Case
Big Data and the Treatment of Cancer
MIS
The Problem
The global statistics on cancer are sobering. Every year, 8 million people die from cancer, and 14 million people discover they have the disease. Approximately $100 billion is spent on cancer drugs
globally. Unfortunately, the majority of cancer treatments are not successful.
Despite years of effort by the medical establishment to persuade doctors and hospitals to embrace electronic medical records (EMRs), oncology data have remained difficult to access and use. (Oncology is the branch of medicine that deals with the study and treatment of cancer.)
Data on a single cancer patient can come from multiple sources, including internists, oncologists, radiologists, surgeons, and labora tory and pathology reports. Even when the data are digitized, they are often in an unstructured format. Rather than being organized in databases, the data are often in multiple, inconsistent formats across different lab reports and records. Making matters worse, much data re main hidden in reports that have been written by hand and scanned, in audio recordings, and in low-resolution PDF files printed from fax ma chines. Finally, incompatible systems and strict privacy regulations— for example, the Health Insurance Portability and Accountability Act, or HIPAA—that govern personal health information make it even more difficult for data to be shared across thousands of oncology practices. Only a small fraction of cancer patient treatment data are be
ing collected systematically. Those data are typically collected from randomized clinical trials, which cover only 4 percent of adult cancer patients.
A Proposed IT Solution
Flatiron Health (Flatiron; www.flatiron.com ) wants to help doctors develop better treatment options for cancer. Founded in 2012, Flatiron essentially fights cancer with organized data. With its OncologyCloud, the company is helping oncologists enhance patient care. The com pany collects, organizes, and standardizes much of the information for the 96 percent of patients not included in clinical trials and then offers those data back to physicians in a format that can be analyzed.
The two Flatiron founders began their startup by visiting 60 can cer centers, speaking directly with experts, and visiting patients with physicians. Working with oncology experts, they decided that the most pressing need in cancer treatment was to organize the massive volumes of clinical data that are scattered in the filing systems of on cology treatment centers throughout the country. They proposed to collect the data—both digital and otherwise—and then organize them, aggregate them, and provide them to physicians, who can use the data to make better decisions about how to treat their patients.
In theory, electronic medical records (EMRs) were supposed to make such data aggregation and integration easier. Unfortunately, those benefits have not totally materialized. In fact, more than 25 per cent of U.S. medical records remain in hard-copy format.
The Flatiron founders spent more than two years building what they call a data model, which is their strategy to organize clinical in formation into categories. Working with a team of physicians, they decided to focus initially on one type of cancer: colon cancer. Using published clinical trials, they extracted more than 350 data categories, including demographics, geographic location, cancer stages, biologi cal markers of disease, and responses to therapies. Then they repeated the process for other forms of cancer.
To automate the process of extracting data from medical records, which can be labor intensive, Flatiron used matching algorithms tar geted at pinpointing values in lab reports. They also utilized natural- language processing to enable computers to read documents and extract data from them. Such systems must be trained. To accomplish this task, Flatiron hired a team of 60 nurses to enter data on 500 pa tients by hand, creating a “training set” that was used to detect errors in data that had been collected automatically. Data collection errors were then fed back into the system as inputs to help improve the auto mated collection process.
The Results
Using Flatiron’s OncologyCloud, oncologists are able to see the most effective therapies for the most patients in similar circumstances. Fur thermore, these physicians are able to evaluate their own treatment
outcomes against those of other specialists across the nation and then quickly correct any deficiencies. The OncologyCloud also highlights cost-effective therapies and wasteful healthcare spending. Finally, the system helps to match patients with suitable clinical trials, hopefully speeding up the development and approval of new medicines.
In 2014, Flatiron acquired Altos Solutions, which developed the first oncology-specific electronic medical record. This acquisition gave Flatiron a larger installed base and closer contact with physicians. By October 2015 Flatiron systems were being used in 210 cancer centers that collectively see about 300,000 new patients every year. Further more, in 2014 Google invested more than $100 million in Flatiron through Google Ventures, the company’s venture capital unit.
In 2015, Flatiron and Guardant Health ( www.guardanthealth
.com ) began to collaborate to enable more effective cancer treatment. Flatiron will provide the structure and all of the clinical trial informa tion for the OncologyCloud. Guardant’s commercially available cancer screening product, Guardant360, will be used to collect data from pa tients’ blood samples in a much more efficient manner than was pre viously possible.
And the bottom line? In 2016, nearly 1.7 million Americans were newly diagnosed with cancer. If oncologists using the OncologyCloud could improve the patient survival rate by 5 percent, they would save tens of thousands of lives every year.
Flatiron’s OncologyCloud does have competition from Intel’s Col laborative Cancer Cloud project. The Intel project takes the approach that all cancer patients should have their genomes sequenced. (The human genome is the complete set of nucleic acid sequence for hu mans, encoded as DNA within the 23 chromosome pairs in cell nuclei and in a small DNA molecule found within individual mitochondria.) Treatments for these patients would then be tailored specifically to their genomes. Intel’s project is making it easier for cancer researchers to pursue this genomic approach, collaborate with one another, share data sets, and proceed to real treatments and possibly cures much faster.
Sources: Compiled from J. Davis, “Can Big Data Help Cure Cancer?” InformationWeek, July 19, 2016; “Flatiron Health Unveils the Next Version of its Oncology Software Suite: OncoCloud,” BusinessWire, June 1, 2016;
“Flatiron Health Raises $175M for Oncology Cloud Software,” HIT Consultant, January 7, 2016; L. Ramsey, “Cancer Treatment Is on the Brink of a Data Revolution,” Business Insider, September 22, 2015; N. Versel, “GuardantHealth, Flatiron Health to Link Genomics, Analytics for Personalized Cancer Care,” MedCityNews, August 19, 2015; C. Magee, “GuardantHealth and Flatiron Health Team Up to Cure Cancer with Big Data,” TechCrunch, August 19, 2015; “Fighting Cancer with Big Data,” The Rambus Blog, August 10, 2015; T. Stephens, “California Initiative to Advance Precision Medicine Funds UC Santa Cruz Pediatric Cancer Project,” University of California at Santa Cruz News Center, August 3, 2015; B. Marr, “How Big Data Is Transforming the Fight Against Cancer,” Forbes, June 28, 2015; “Varian Medical Systems and Flatiron Health
to Develop Next Generation of Cloud-Based Oncology Software,” Flatiron Health Press Release, May 26, 2015; “Foundation Medicine and Flatiron Health Collaborate to Develop First In-Class Data Platform to Accelerate Precision Medicine for Cancer,” Foundation Medicine, December 2, 2014; M. Helft, “Can Big Data Cure Cancer?” Fortune, August 11, 2014; S. Baum, “Flatiron Health Finds Ideal Match with Duke Cancer Care Research Director,” MedCityNews, July 2, 2014; K. Noyes, “Flatiron Health’s Bold Proposition to Fight Cancer with Big Data,” Fortune, June 12, 2014; N. Taylor, “Buzz: Google Ventures Leading
$100M Round in Oncology Big Data Platform,” FierceBioTechIT, May 5, 2014; www.flatiron.com, www.guardanthealth.com, accessed August 26, 2016.
Questions
1. Describe the Big Data issues in this case.
2. How does Flatiron use Big Data in its attempt to improve cancer treatment?
64 CHAPTER 2 Organizational Strategy, Competitive Advantage, and Information Systems
the Oculus Rift, now owned by Facebook; www.oculus.com —to realistically create an artificial experience such as a video game. VR environments can also create a lifelike, real-world experience such as football. As of July 2015, two companies were providing VR experiences for professional, college, and high school football pro grams: STriVR Labs ( http://strivrlabs.com ) and EON Sports ( www
Here is how these experiences work from the perspective of a quarterback. When he puts on the Oculus Rift headset and the head phones, he is standing in his position on the practice field. As he scans the field, he recognizes the defensive alignment, and he observes how his offense is positioned. He turns around, and he sees that his run ning back is waiting for the handoff. A voice calls the play, the ball is snapped, and a play unfolds. As the play progresses, the quarterback can scan the defense to determine the type of coverage. One quarter back noted, “It is like watching film, but you are actually there on the field. I feel like I am actually in the scrimmage.”
The systems offer a fully immersive, 360-degree view for players and coaches as teams run through plays on a practice field, providing simulated bodies with natural body movements. Players can also hear coaches talking as well as the things they would normally hear on the practice field. Staff members spend many hours turning the video into useful virtual reality footage.
The systems gather video from multiple cameras on four-foot tripods placed around the scrimmage on both the offensive and de fensive sides. The cameras capture live plays and content from teams’ practices and then, through their software, produce three-dimensional video for players through an Oculus Rift headset and headphones. The VR technology essentially has football players walking through real-game experiences.
Although the systems work for every player, quarterback was the logical starting point. The systems were initially utilized as a method to train quarterbacks with mental exercises to reinforce actual prac tice repetitions. They quickly expanded for use with other positions, because they are invaluable in improving players’ reaction times and decision making.
STriVR and EON clients include college teams such as Stanford, Auburn, Clemson, Dartmouth, Vanderbilt, Kansas, Mississippi, and UCLA, as well as the National Football League’s Dallas Cowboys and New England Patriots. The first pick in the 2015 NFL draft, Jameis Winston of the Tampa Bay Buccaneers, trained using the EON system. Furthermore, nearly 100 high school football programs are using VR packages.
STriVR and EON have concentrated on building libraries of basic plays for their clients. After shooting video at various practices, the companies deliver the VR footage to the teams within a few weeks. However, in the near future, the companies hope to reduce the turn around time, allowing teams to use VR video tailored to specific game plans.
