Monday, February 9, 2009

IT Security Team - Role and Responsibility

This an introspective period in time for IT security departments. Yes, identity theft, malware, and all kinds of online fraud is on the rise, and needs to be stopped. Most of the terms like denial of service, SQL injection, cross-site scripting etc. cause some amount of trepidation among the business teams and also among general IT teams. IT security teams are quick to capitalize on the fear factor and tend to become bureaucracies.

Across the spectrum numerous IT projects have been delayed time and again and one of common causes is the IT security team won't allow certain things. Having strong IT policies is good but if it becomes a hindrance to other IT teams or business teams, that are trying to look at new ways of generating revenues or some cost saving measure, then it is a problem.

You can't have something become, "I SAID SO", wont' cut it any more. The IT security team needs to take a collaborative approach of saying, well this is our policy but let me understand what you want to achieve and more importantly, let me see how I can help you achieve that by adhering as closely as possible to the corporate security policy. The old maxim, "where there is a will there is a way" applies here.

Most of the time the IT security teams won't take collaborative approach is because it could be extra work for them or sometimes they just don't know how to help in new ways. Sometimes they need training or more investigation on how to get something done but yes keep it safe as per the policy.

In this economic climate, collaboration is the key and hopefully the IT security teams start collaborating more and not just be a road block!

Outsourcing and Agile Methodologies

In the CIO magazine (Feb. 1, 2009 issue) article, "Agile at the wheel", Jackie Barretta, the CIO of Con-way talks about going agile. Similarly in the PM Network magazine (Jan. 2009 issue) article, "A closer look: Nationwide mutual insurance co." talks about the company adopting Agile methodologies.

Two major trends in the IT arena definitely encourage the acceptance of Agile methodologies, outsourcing and the current economic malaise. In fact I would argue that the most of the agile methodologies when applied correctly and patiently would yield the most ROI in an outsourced relationship, especially when the developer, support and maintenance, and QA teams are geographically disbursed. One of the primary reason is the business teams such as marketing, finance, customer service, distribution center, supply chain etc. need quick solutions to IT problems they face every day. They cannot afford wait another three months or worse six months for a solution to come around. The current economic conditions are creating additional
stress on the business teams. The environment is filled with uncertainty about sales forecasts, cash flow projections, budget decisions etc. If IT does not raise up to the occasion and really help business teams in a dynamic way, in a matter of few months it could be too late.

The quick "feedback loop" between business teams, business analysts, IT teams needs to happen in a twenty four hour cycle and in a constant manner. If mistakes are not caught up front and quickly great losses can be incurred. The prototyping and iterative methods give business teams to understand what they want and to change course quickly.

The outsourcing vendors should be quick to offer these value added services to the customers. Most often we find that corporations have to bring in external Agile consultants to train their staff and even outsources sometimes on Agile methodologies. I think if the outsourcing vendors offered these services in an integrated fashion, it could be a win-win for both the company purchasing outsourced services and the vendor.

We are witnessing the acceleration of change in the last couple of quarters and only the IT departments that adapt quickly using at least some Agile methodologies stand a chance in the long run. The only thing constant is CHANGE!