Consider the Source

Security vs. Flexibility: Finding the Middle Ground for Offshore Captive Delivery Operations

by Dinesh Goel, Partner, ISG

An offshore risk mitigation strategy is essential to achieve the intended objectives of a captive delivery operation’s security program without compromising the confidentiality, integrity and availability of the parent company’s information. Many parents treat their offshore captives as extensions of their business units, rather than just secluded offshore units, and expect the captives to guarantee the same level of security controls and flexibility as the parents.

However, captives often experience challenges with implementing flexibility in access to the IT systems adopted by their parents without customizations to certain protocols such as the use of Internet, access to social networking sites, and access to mass storage devices. These issues can be complex, especially in healthcare or banking where offshore captives have to deal with sensitive and confidential information amid strong regulatory oversight.

Here are the Top 5 areas that must be considered if the parent unit hopes to extend its level of flexibility to an offshore captive environment: 

1. Evaluate the suitability of internal controls for offshore operations. Assess whether the parent’s existing security controls, internal policies and procedures, personnel controls, and physical and network controls are robust enough to be replicated “as is” i.e., without customization for an offshore captive environment. Your assessment will need to clearly delineate what proactive measures or steps need to be taken in case of an unplanned event or deviation. Be cognizant of risk to your organization’s reputation, and have a well-defined risk mitigation plan.
   
   
2. Pay attention to people. Focus on your people and understand the nuances specific to attrition, background verification checks and the use of subcontractors in the captive operations. Understanding the difference in personnel profiles, backgrounds and behavior patterns helps with contrasting those from the parent unit and determining any specific requirements for customizations. For example, you may find that you need to adopt a background verification process more comprehensive than one followed by the parent unit. A rigorous process usually covers areas such as educational background, previous employment, credit status, criminal record and drug screening. Similarly, you should implement stronger controls when using subcontractors in the operations.
   
   
3. Notice the local flavor. Understand the security and flexibility practices adopted by similar companies or captives in your locale. While it may be at odds with what is taken as the norm for the parent, this will provide an objective view of the "as-is" applicability of parent controls in a given offshore captive environment.
   
   
4. Foster a culture of security. Given the rapidly changing security environment and emergence of newer sources of security risk, firms need to move away from assessing the effectiveness of an offshore risk strategy simply by the number of security controls in place. Focus on creating a culture of security where people don’t need to be reminded about security controls but rather understand their relevance and significance and follow them naturally.
   
   
5. Train, train, train. Conduct regular and refresher courses on security and industry-specific security practices. Schedule training by frequency and level. Focus on measuring the effectiveness of your training programs through periodic tests and regular feedback sessions.

The seasoned offshore captive experts at TPI can help you achieve your enterprise sourcing goals through objective advice, knowledge of your industry and deep on-the-ground experience. For more information please email Dinesh Goel or phone +91 98458 93787.

Middle Market Focus: The Journey from Managed Service to the Public Cloud

by Stanton Jones, Vice President and Chief Information Officer, TPI

It’s clear that many organizations with managed infrastructure service agreements are taking a long, hard look at new vendor-hosted cloud Infrastructure as a Service (IaaS) offerings. Promises of faster, cheaper and more flexible are hard to ignore. In fact, when TPI surveyed its clients about which cloud-related services they were evaluating, four of the top five areas were related to IaaS, including virtualization, storage and computing services.

TPI believes that the mid-market is taking the lead in adopting cloud-based infrastructures; however, we also have found that as companies begin to investigate the available offerings they quickly find themselves overwhelmed with the options, which can include private, private-managed and public cloud IaaS services.

The IaaS space is growing and maturing very quickly and TPI views these services as a spectrum of possible solutions, not a “one size fits all” market. Here’s why:

• Making the leap from a traditional, non-virtualized managed service to a vendor-hosted private cloud is typically most influenced by technology considerations: will my applications work in a fully virtualized environment? For most modern applications, the answer is yes; however, for legacy applications or large, transaction-intensive databases, virtualization may not be the right approach and may need to stay where they are in a managed service.
• The considerations for moving from a vendor-hosted private cloud to a public cloud offering usually coalesce around business risk: am I comfortable having my data reside on the same physical hardware as other customers? For most data, a multi-tenant environment is appropriate, but there are some categories of data that require more scrutiny (e.g., intellectual property, personal data). In addition, it’s important to understand your clients’ requirements with their data. While it may be totally acceptable to have your data in a shared environment, your clients may feel otherwise. These applications may need to stay within a private cloud environment.

The small- to middle-market is currently leading the way in the adoption of public cloud services for collaboration and customer relationship management (CRM). As more mission critical lines of business and back office applications migrate to the cloud, understanding the key checkpoints along the managed service-to-public cloud spectrum will continue to grow in importance as well.

The Managed Service-to-Public Cloud Spectrum

 

 

Based on current trends, TPI believes that many mid-market clients will begin to adopt a “hybrid” approach to the cloud, using services along the spectrum, based on technology fit and appetite for risk. Moving further up the spectrum creates significant opportunities to reduce cost and increase speed, but comes at a price: a more standardized technology stack and increased reliance on shared technology infrastructures.

These services can be sourced from multiple providers to maximize flexibility, or can be purchased from a single provider, in order to leverage buying power. Either way, viewing managed services, private cloud and public cloud as a spectrum of available options will allow you to find the right fit based on your business and technology requirements.

TPI’s seasoned transformational sourcing experts can help your company define the right strategy through our experience, objective advice, industry knowledge and depth in all aspects of information technology and business process services. To learn more about how cloud computing can benefit your organization, or to find out more about TPI’s cloud computing strategy offerings, contact Stanton Jones.

Top 5 Market Trends That Will Drive Company Sourcing Agendas in 2011

by Harvey Gluckman, Partner & Managing Director, TPI

It’s that time of year again where we want to provide our perspective on the TPI Top 5 industry trends we’re seeing in the marketplace that should shape many companies’ sourcing agendas in 2011. Based on recent client inquiries for our services, I feel confident that we’ve weathered the 2010 global economic challenges that influenced many CIOs’ IT operational and capital investment decisions. 2011 should be an exciting year — may the source be with you!

1. Cloud Computing — Who’s Gonna' Step Up? The lack of standardization across Cloud commercialization will continue to prevent many larger companies from fully embracing Cloud technologies and promised solutions. After all the hype and promises around Cloud Computing this past year, CIOs in 2011 will need to separate the wheat from the chaff and assess Cloud decisions that are likely to be led by their business units. With the exception of a few Cloud point solutions, Service Providers will have to prove its business relevance or the Cloud theme will evaporate in a slow death. Until the service provider community steps up and resolves the following operational, financial and business risks, market adoption will be confined to small and mid-sized companies unconstrained by legacy platforms: 

Security risks, inadequate governance, inconsistent pricing, inadequate service  levels, alternate source options, network bandwidth (LAN to WAN), service maturity, compliance challenges, privacy issues, audits, consumer contract terms, scope of IP indemnification, integration costs, data portability and data ownership issues

2. Service Integration. The role of “air traffic controller” will become more important as companies increase their use of multi-sourcing delivery strategies within and across corporate support functions. As companies determine the best ways to integrate and manage services (and whether or how to depend on outside providers for some or all of this role), they should have more time and resources to redefine — and achieve — their innovation agendas.
 
3. Social Platforms Upends Customer Centricity. The social software market will continue responding to customers’ demands for flexible environments in which they can create, share and find relevant information. Service integration will be a strong focus for CIOs weaving mobile, tablet and social network platforms into existing “clicks, bricks, rings and knocks” platforms. Companies are likely to target up to 25 percent of their capital budgets to social networking, including significant investments in business intelligence and analytics to combine social networking with more traditional data sources.
 
4. Weak Dollar to Drive Rural Sourcing. More companies will turn to rural locations for nearshoring and onshoring opportunities. This move will not be driven by high U.S. unemployment rates, as you might expect, but by business requirements. The price differential between the U.S. dollar and foreign currencies in low-cost destinations will narrow, making state partnerships attractive for buyers looking to rationalize their IT and BPO operational portfolios.
    
5. Governance Increases In Focus. An increasing number of companies will take advantage of Governance-as-a-Service, relying on expert assistance to manage and maximize their outsourced relationships. Improvements in technology enablement will allow companies to manage their service provider relationships at the enterprise level. And finally, as ever-evolving Cloud solutions continue to be disruptive, companies will focus on re-tooling and re-skilling client governance organizations, helping to mitigate value leakage of their service provider relationships in 2011.

For more information, contact Harvey Gluckman, Partner and Managing Director, TPI.

Move Beyond Basic Security by Addressing Today’s Risk Factors

by Indy Banerjee, Partner, TPI India

Assessing and managing risk comprehensively is the cornerstone of a successful offshoring program. Moving beyond basic security particularly important given the breadth and scale of current global sourcing initiatives that expose businesses to multiple levels of systemic and operational failure. The concern is amplified by the level of sensitive and confidential data and intellectual property accessible to offshore operations, especially in highly regulated verticals such as healthcare and banking. 

Organizations that have extensive sourcing programs with multiple delivery channels must take into account their overall risk exposure from the very beginning. Here are the TPI Top 5 risks that must be addressed for your organization to move beyond basic security to a higher level of “enterprise program assurance:”

1.  Organizational: How strong are your internal policies and procedures, governance processes, personnel, physical and network controls, and global assurance and audit capabilities? Are they customized for global operations?   

2.  Programmatic: Can you meet overall enterprise and customer servicing requirements in a multi-sourced environment and maintain the financial viability of the global program?

3.  Domain: Is dependence on sourcing causing a gradual loss of technology capabilities, operations knowledge and intellectual property in the business unit and creating the need for robust knowledge management frameworks to manage them?

4.  Delivery model: Is the delivery model for business-critical applications and processes robust? Is the delivery footprint sufficient to overcome the risk to a single geography? Are you so dependent on one service provider that its business risk is transferred to you?

5.  Operational: Do you have delivery controls and disaster recovery and business continuity plans that are responsive to a rapidly changing environment including pandemics such as SARS and swine flu, terrorist attacks and mounting regulations?

Protecting your business in today’s environment takes careful planning and follow-though. A comprehensive model program to assess global sourcing risks and build a multi tiered risk management program is a key determinant of the soundness of any global operating model.

TPI’s seasoned strategy and global assessment experts can help you achieve your enterprise sourcing goals through objective advice, knowledge of your industry and deep on-the-ground experience. E-mail Indy Banerjee, Partner, TPI India, or phone him at +91 99456 38222 to learn more about managing risk for your global sourcing programs.

Lost in the Cloud

by Thomas Young, Partner & Managing Director, CIO Services - Infrastructure, TPI

 

The security of stored data is often cited as one of the key obstacles to organizations adopting Cloud Computing. To be sure, the risks are high if a company’s customer records are compromised as a result of being in an unsecure Cloud environment. That issue is enough to give even the most maverick CIOs pause as they consider their technology plans in the coming years.

However, if we look to other technologies that use public infrastructure, the solution for storing data in the Cloud may be right in front of us. The telecommunications industry has for years provided secure voice and data by encrypting communications and dividing them into multiple fragmented streams. The packets are sent on independent routes over unsecure public telephone networks and the Internet and then re-aggregated and decrypted in a secure environment. Something like secure à  unsecure à  secure.

All of this happens every time we log onto our brokerage accounts online and we never think twice about it. Why? Because if the packets were intercepted, they would have to be decrypted and re-aggregated for the voice or data stream to make sense. This is possible, but very difficult to do. 

The same protocols can be used to store sensitive data in the Cloud. Data can be encrypted and divided at the bit-fragment level and stored in multiple, independent and diverse storage arrays.  Each encrypted fragment reveals nothing if intercepted and meaningful information is only revealed if significant clusters of data are decrypted and re-aggregated. Theoretically possible, not likely.

In this architecture, aggregators sit between the application layer and the storage layer and act as an intermediary to the computing platforms that need the data, pushing and pulling these fragments. This is how Google search is architected. The data is read from storage, processed, and rewritten to storage, or something like this: secure à  unsecure à  secure.  Just like in the telecommunications example, the unsecure segment is effectively secure because the data is fragmented and encrypted. 

SNIA (www.snia.org) is working on standards to deploy this kind of technology so that data security will no longer be a barrier to cloud computing adoption. And in the future, when the auditors ask if your customer data is secure, you will be able to say, “Yes, it’s lost in the Cloud.”

Unto the (Data) Breach: A 2008 Topic

Concerns about data privacy are rising in the sourcing industry, and I expect the issue to get a real workout in 2008.

Which is fine. But first a couple of points: From the earliest days of outsourcing there have always been third parties involved in processing client information. More to the point, data breaches can and do happen with in-house operations, too.

Still, the data issue is gaining traction in light of legislation aimed at protecting financial and medical data. Both clients and providers are feeling the heat.

The sourcing industry has already adopted safeguards and best practices to protect information, but the question remains in the mind of many: Does sourcing mitigate or exacerbate data risks?

Companies are calling us seeking advice on the capabilities of service providers to help reduce the perceived risks relating to data protection. At the same time, providers are starting to squirm at contractual terms aimed at allocated damages due to breeches in data security policies.

We shall see whether the sourcing industry is a source of extra risk or solution. But there are two things we already know: Whether data are processed in country or offshore doesn’t matter, so don’t believe in headlines about “outsourcing” as a culprit. And the market can and will play a regulatory role, as it always has, because reputations and bottom lines will suffer if customers suffer.