1. Information Resource Management
Chapter 13
Information Resource Management

2. Chapter Objectives
To fully appreciate the vulnerability organizations have to full or partial failure of their information systems.
To understand the relevance of information systems and digital content as important corporate resources.
To appreciate the role of information systems planning.
To understand the importance of security and disaster recovery planning for protecting information resources.

3. Hershey’s Big Dud
In 1999 Hershey implemented a $112 million dollar computer system.
System was to automate and modernize everything.
Within 2 months serious problems developed.
Orders were delayed and competitors benefited.
Hershey used “big bang” approach.
Vendors cited complexity of the situation as the reason for system failure.

4. System Failures Examples of System failures. W.L. Gore & Associates
Implemented HR system to tie together payroll, personnel, and benefits.
3.5 million in fees and charges.
Fictional employees could not be deleted from the system.
Whirlpool
E-Bay

5. Corporate Resources I/T should be viewed as a corporate resource.
Organizations need to invest in I/S.
Organizations need to manage their I/S.
Content should be viewed as a corporate resource.
Data needs to be
Captured
Processed
Stored
Communicated

6. Organizational Assets
Employees
Loyal Customers
Capital (money)
Physical Assets
Information systems
Content (data and knowledge)

7. Information Systems Planning
Business Strategy
I/T Strategy
I/T Portfolio
I/S Planning is an on-going activity.
Environmental issues.
Technological changes.

8. Questions for I/S Planning
Where are we? What are we doing?
Where do we want to go? What are our competitors doing? What are customers asking for?
How do we get there; that is what is the role of I/T in enabling the necessary capabilities to delivery what customers want better than the competition?
When will it be done?
Who will do it; do we have the necessary skills and resources internally to deliver what we need?
How much will it cost? Does it make economic sense?

9. Management and I/S Information Systems as perceived by management.
Infrastructure
Transactional
Informational
Strategic (Competitive)

10. Organization of the Information Services Department
What are the information management functions that need to be performed?
Centralized or decentralized
What is the best way to organize the information systems specialist to perform these functions?

11. Cost and Resource Management
Information Systems have
Tangible costs
Intangible costs
Methods to control costs of I/S vary.
Chargeback allows the I/S department to charge business units for services rendered.

12. Typical Responsibilities for an Information Services Department
Developing a comprehensive I/T strategy.
Documenting, operating, and maintaining the existing inventory of corporate hardware, software, and information systems.
Setting standards for telecommunications and installing and maintaining local and wide area networks.
Developing, maintaining, and protecting organizational databases and critical applications.
Evaluating, acquiring, and integrating new hardware and software products.

13. Typical Responsibilities for an Information Services Department
Training and supporting internal customers.
Developing procedures to negotiate with and oversee outside information systems consultants and vendors in the acquisition and development of new information technology and systems.
Facilitating the transfer of technology across organizational units.
Initiating and managing outsourcing vendor and service provider relationships.

14. Disaster Recovery Planning
Disaster recovery plans have become more of a management priority now that more industries are more dependant on data.
Includes all business systems.
Need to identify all critical systems.
Off-site storage is critical.
Some businesses are pursuing business continuity planning, which covers all aspects needed to ensure that the business would be able to operate regardless of the disaster.

15. Process for Planning Off-Site Storage
Analyzing and classifying data.
Reviewing existing backup procedures.
Selecting a storage vendor.
Formalizing the schedules for routine removal of data to storage.

16. Sample Strategies for Backup & Recovery
Strategy
Description
Replacement
Suspend operations or revert to manual systems until new I/S is up and running.
Cold site
An off-site facility without a computer, able to serve as an alternate processing site.
Reciprocal agreement
Two companies with similar systems agree to let the other share their facilities if necessary.
Hot site
A free standing, fully equipped site used by multiple companies.
Redundant system
An identical, fully operational data center, typically in a separate geographical location.

17. When Disaster Strikes Assess damage.
Get communications and application systems operational as soon as possible.
Ensure appropriate employees are located and notified.

18. Systems Security
Companies must protect themselves against natural disasters, vandalism, cyberterrorism, and internal sabotage.
Viruses are a major source of computer systems failures.
Viruses are transmitted electronically.
Antiviral products are available.
Human intelligence is a key component in system security.

19. Common Systems Vulnerabilities
Default software installations:
Operating systems and applications are often installed with extra features that users are unaware of and hence don’t monitor for security flaws.
Accounts with no passwords:
Computer passwords are easy to steal or guess using automate password testing procedures.
Inadequate backups:
Many companies back up data but don’t test to see if the backups are adequate.
Too many open doors:
Computer systems exchange data using connection points known as ports: Some companies leave ports open, creating opportunities for hackers.

20. Common Systems Vulnerabilities
False addresses:
Attackers try to hide their tracks by spoofing the addresses contained in packets of data that they send.
Bad record keeping:
I/S can log most activities but sometimes the record keeping function is not turned on. Logs are critical to discovering what happened in an attack.
Vulnerable web programs:
Common gateway interface programs (CGI scripts) are common in web pages. CGI scripts make it possible for a hacker to manipulate the OS of the server.
attachments:
Common vulnerability is attachments that are executable program files containing viruses.