An Overview of SaaS – And some privacy questions Based on work by Julie Smith David and Michael T. Lee, sponsored by CABIT and the Society for Information Management

Agenda Gathering for the perfect storm? frustration economyacceptance Stage 1: Introduction to SaaS Stage 2: Privacy Issues

Gathering for the “Perfect SaaS Storm”? the economy

frustration End-user frustration with ERP applications often drives a business' first post- ERP projects. At Amoco's chemical intermediates group, for example, the need to channel SAP R/3 information into more user-friendly applications became apparent as the ERP system was being implemented early last year, says Kerry Given, IT manager for the unit. "Managers found SAP so unfriendly they refused to use it," he says. "Few [of our] people use SAP directly because you have to be an expert." November 30, 1998

the economy frustration acceptance

the economy frustration acceptance

the economy frustration acceptance It’s time to take SaaS seriously! Photo is by LeibDich, available at and used under the CreativeCommons license

Gathering for the perfect storm? Let’s go deeper into SaaS frustration economyacceptance Stage 1: Introduction to SaaS

Supply Chain Representation: Traditional Model Your Company Hardware Company Software Company Software Company PC’s, Servers, Network Devices, … Operating systems, ERP, CRM…

SaaS Company SaaS Company Supply Chain Representation: SaaS Model Your Company Hardware Company Software Company Software Company Servers, Network Devices… Operating systems PCs (with Browsers) ERP, CRM Service Client Company

A Quick Review: SaaS Characteristics Technical – Browser based: Reduced upgrade issues Lower cost hardware – Hardware acquisition, operations, maintenance – Multi-tenant – Agile development Maintenance experience Innovation Strategic – Low initial acquisition costs – Quicker Implementations – Predictable pricing – Reduced support staff needed – Potentially more agile environment with significant innovation

How Multi-Tenancy works Source: Peter Coffee, Salesforce.com

PaaS Company PaaS Company PaaS Model Your Company Hardware Company Software Company Software Company Servers, Network Devices… Operating systems, ERP, CRM… PCs (with Browsers) Service Client Company Native Developers Native Developers Composite Company

PaaS to Preferred Platform Development Efforts Size of Adopting Organization Individual Apps Complex Suites Individuals SmallMid-Tier Large Integ. Apps Niche Suites Small Devel. Major SW Co. Ind- Mid Ind. Leader, Niche SW Software Development Organizations Created with Brian Sommer

Proposition: SaaS is a Disruptive Technology Source: Mann and David, For more, see: Harrigan, K. R Formulating Vertical Integration Strategies The Academy of Management Review 9 (4):15. Rothaermel, F. T., M. A. Hitt, and L. A. Jobe Balancing vertical integration and strategic outsourcing: Effects on product portfolio, product success, and firm performance. Strategic Management Journal 27:

When/Why to Select SaaS (Updated) Source:

New Reasons Commoditization of IT – IT applications are available for almost anything – Leave it to the hands of experts – Comes down to the decisions and how it is used New leverage for knowledge – SaaS can be used to push out legacy data and information to create and distribute knowledge globally at minimal incremental cost Upgrades – Small time window, cost included in subscription – No hardware, software, patches, space requirements – Upgrade process Elastic scalability – Instant – Integratability/Interoperability – Customizable/Programmable Shared infrastructure – Functions are at the metadata level, not at the code level (airline model) – Industrial strength infrastructure, allowing customization at the metadata level

Issues/Challenges

Agenda Gathering for the perfect storm? frustration economyacceptance Stage 1: Introduction to SaaS Stage 2: Privacy Issues

What we already touched on: Source: Prosch, M. and J.S. David Extending the Value Chain to Incorporate Privacy by Design Principles

An integrated “X as a Service” stack Source: Linthicum, D Cloud Computing and SOA Convergence in Your Enterprise: A Step-by-Step Guide. Addison-Wesley Information Technology Series.

With XaaS Proliferation Source: Prosch, M. and J.S. David Extending the Value Chain to Incorporate Privacy by Design Principles

ProgramsGoals Resource Allocations Corporate Culture Fiscal Viability Expectations Compliance Community Involvement Environmental Improvements Economic Benefits Education Support Create a Privacy Culture, Cavoukian, 2008 Privacy Payoff, Cavoukian & Hamilton, 2008 Customer Churnrate, Ponemon 2007 Privacy Cultural Lag Theory, Prosch 2008 FTC Sanctions State Attorney Generals EU Safe Harbor Privacy Policies Chief Privacy Officer Privacy Enhancing Technologies Privacy Audit Privacy Maturity Lifecycle, Prosch 2008 Privacy Payoff, Cavoukian & Hamilton, 2008 Reducing data pollution: Reducing identify theft risk, Unnecessary workplace Monitoring, cyberbullying, etc. Educating customers/employees Rights & obligations in process Allowing constituents a “voice” in privacy design Nehmer & Prosch 2009 Model of Privacy Corporate Responsibility Based on Dillard & Layzell’s 2008 Model

Privacy by Design Principles Respect for User Privacy Visibility and Trans- parency End – to – End Lifecycle End – to – End Lifecycle Positive Sum – Not Zero Sum Positive Sum – Not Zero Sum Privacy Embedded into Design Privacy as the Default Proactive v Reactive Proactive v Reactive

Questions - For Ben!

Please Keep In Touch!

Really? Security? – Compared to what? – Facility/network – Privileges – SAS 70, SysTrust, ISO Availability/Performance? – Operational reporting – Dealing with abnormalities – Uptime reality – Transparency: Dashboards Cost more? – Predictable – Hardware, software, upgrades, recovery, security, space – Up to 5X faster development Integration difficulty? – Proliferation of integratable and customizable applications – Standard development platform – IaaS, PaaS Customizability? – Proliferation of customizable applications – Comprehensive tool sets – Shared infrastructure – Upgrade process Vendor lock in? Survivability? – Proprietary languages/technologies – Switching costs – API’s, ETL tools – How different from ABAP? Source: Peter Coffee, Salesforce.com