Securing Business Operations and Critical Infrastructure: Trusted Technology, Procurement Paradigms, and Cyber Insurance

Transcript of a BriefingsDirect discussion on ways to address supply chain risk in the information technology sector market.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: The Open Group.

Dana Gardner: Hello, and welcome to a special BriefingsDirect thought leadership panel discussion coming to you in conjunction with The Open Group's upcoming conference on July 20, 2015 in Baltimore.

Gardner

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, and I'll be your host and moderator as we explore ways to address supply chain risk in the information technology sector market.

We'll specifically examine how The Open Group Trusted Technology Forum (OTTF) standards and accreditation activities are enhancing the security of global supply chains and improving the integrity of openly available IT products and components.

We'll learn how the age-old practice of insurance is coming to bear on the problem of IT supply-chain risk. By leveraging insurance models, the specter of supply chain disruption and security ills may be significantly reduced.

Attend The Open Group Baltimore 2015
July 20-23, 2015
Register Here

To update us on the work of the OTTF, and explain the workings and benefits of supply-chain insurance, we're joined by our panel of experts. Please join me in welcoming Sally Long, Director of The Open Group Trusted Technology Forum. Welcome, Sally.

Sally Long: Thank you.

Gardner: We're also here with Andras Szakal, Vice President and Chief Technology Officer for IBM U.S. Federal and Chairman of The Open Group Trusted Technology Forum. Welcome back, Andras.

Andras Szakal: Thank you for having me.

Gardner: And Bob Dix joins us. He is Vice President of Global Government Affairs and Public Policy for Juniper Networks and is a member of The Open Group Trusted Technology Forum. Welcome, Bob.

Bob Dix: Thank you for the invitation. Glad to be here.

Gardner: Lastly, we are joined by Dan Reddy, Supply Chain Assurance Specialist, college instructor and Lead of The Open Group Trusted Technology Forum Global Outreach and Standards Harmonization Work Group. Thanks for being with us, Dan.

Dan Reddy: Glad to be here, Dana.

Gardner: Sally, please give us an update on The Open Group Trusted Technology Forum (OTTF) and the supply-chain accreditation process generally. What has been going on?

OTTP standard

Long: For some of you who might not have heard of the O-TTPS, which is the standard, it’s called The Open Trusted Technology Provider™ Standard. The effort started with an initiative in 2009, a roundtable discussion with U.S. government and several ICT vendors, on how to identify trustworthy commercial off-the-shelf (COTS) information and communication technology (ICT), basically driven by the fact that governments were moving away from high assurance customized solution and more and more using COTS ICT.

Long

That ad-hoc group formed under the OTTF and proceeded to deliver a standard and an accreditation program.

The standard really provides a set of best practices to be used throughout the COTS ICT product life cycle. That’s both during in-house development, as well as with outsourced development and manufacturing, including the best practices to use for security in the supply chain, encompassing all phases from design to disposal.

Just to bring you up to speed on just some of the milestones that we've had, we released our 1.0 version of the standard in 2013, launched our accreditation program to help assure conformance to the standard in February 2014, and then in July, we released our 1.1 version of the standard. We have now submitted that version to ISO for approval as a publicly available specification (PAS) and it’s a fast track for ISO.

The PAS is a process for adopting standards developed in other standards development organizations (SDOs), and the O-TTPS has passed the draft ISO ballot. Now, it’s coming up for final ballot.

That should bring folks up to speed, Dana, and let them know where we are today.

Gardner: Is there anything in particular at The Open Group Conference in Baltimore, coming up in July, that pertains to these activities? Is this something that’s going to be more than just discussed? Is there something of a milestone nature here, too?

Long: Monday, July 20, is the Cyber Security Day of the Baltimore Conference. We're going to be meeting in the plenary with many of the U.S. government officials from NIST, GSA, and the Department of Homeland Security. So there is going to be a big plenary discussion on cyber security and supply chain.

We'll also be meeting separately as a member forum, but the whole open track on Monday will be devoted to cyber security and supply chain security.

The one milestone that might coincide is that we're publishing our Chinese translation version of the standard 1.1 and we might be announcing that then. I think that’s about it, Dana.

OTTF background

Gardner: Andras, for the benefit of our listeners and readers who might be new to this concept, perhaps you could fill us in on the background on the types of problems that OTTF initiatives and standards are designed to solve. What’s the problem that we need to address here?

Szakal: That’s a great question. We realized, over the last 5 to 10 years, that the traditional supply-chain management practices -- supply-chain integrity practices, where we were ensuring the integrity of the delivery of a product to the end customer, ensuring that it wasn't tampered with, effectively managing our suppliers to ensure they provided us with quality components -- really had expanded as a result of the adoption of technology. There has been pervasive growth of technology in all aspects of manufacturing, but especially as IT has expanded into the Internet of Things, critical infrastructure and mobile technologies, and now obviously cloud and big data.

Szakal

And as we manufacture those IT products we have to recognize that now we're in a global environment, and manufacturing and sourcing of components occurs worldwide. In some cases, some of these components are even open source or freely available. We're concerned, obviously, about the lineage, but also the practices of how these products are manufactured from a secure engineering perspective, as well as the supply-chain integrity and supply-chain security practices.

What we've recognized here is that the traditional life cycle of supply-chain security and integrity has expanded to include all the way down to the design aspects of the product through sustainment and managing that product over a period of time, from cradle to grave, and disposal of the product to ensure that those components, if they were hardware-based, don't actually end up recycled in a way that they pose a threat to our customers.

Gardner: So it’s as much a lifecycle as it is a procurement issue.

Szakal: Absolutely. When you talk about procurement, you're talking about lifecycle and about mitigating risks to those two different aspects from sourcing and from manufacturing.

So from the customer's perspective, they need to be considering how they actually apply techniques to ensure that they are sourcing from authorized channels, that they are also applying the same techniques that we use for secure engineering when they are doing the integration of their IT infrastructure.

But from a development perspective, it’s ensuring that we're applying secure engineering techniques, that we have a well-defined baseline for our life cycle, and that we're controlling our assets effectively. We understand who our partners are and we're able to score them and ensure that we're tracking their integrity and that we're applying new techniques around secure engineering, like threat analysis and risk analysis to the supply chain.

We're understanding the current risk landscape and applying techniques like vulnerability analysis and runtime protection techniques that would allow us to mitigate many of these risks as we build out our products and manufacture them.

It goes all the way through sustainment. You probably recognize now, most people would, that your products are no longer a shrink-wrap product that you get, install, and it lives for a year or two before you update it. It’s constantly being updated. So to ensure that the integrity and delivery of that update is consistent with the principles that we are trying to espouse is also really important.

Collaborative effort

Gardner: And to that point, no product stands alone. It’s really a result of a collaborative effort, very complex number of systems coming together. Not only are standards necessary, but cooperation among all those players in that ecosystem becomes necessary.

Dan Reddy, how have we done in terms of getting mutual assurance across a supply chain, that all the participants are willing to take part? It seems to me that, if there is a weak link, everyone would benefit by shoring that up. So how do we go beyond the standards? How are we getting cooperation, get all the parties interested in contributing and being part of this?

Reddy: First of all, it’s an evolutionary process, and we're still in the early days of fully communicating what the best practices are, what the standards are, and getting people to understand how that relates to their place in the supply chain.

Reddy

Certainly, the supplier community would benefit by following some common practices so they don’t wind up answering customized survey questions from all of their customers.

That's what's happening today. It's pretty much a one-off situation, where each customer says, "I need to protect my supply chain. Let me go find out what all of my suppliers are doing." The real benefit here is to have the common language of the requirements in our standard and a way to measure it.

So there should be an incentive for the suppliers to take a look at that and say, "I'm tired of answering these individual survey questions. Maybe if I just document my best practices, I can avoid some of the effort that goes along with that individual approach."

Everyone needs to understand that value proposition across the supply chain. Part of what we're trying to do with the Baltimore conference is to talk to some thought leaders and continue to get the word out about the value proposition here.

Gardner: Bob Dix, the government in the U.S., and, of course, across the globe, all the governments, are major purchasers of technology and also have a great stake in security and low risk. What’s been driving some of the government activities? They're also interested in using COTS technology and cutting costs. So what role can governments play in driving some of these activities around the OTTF?

Risk management

Dix: This issue of supply chain assurance and cyber security is all about risk management, and it's a shared responsibility. For too long I think that the government has had a tendency to want to point a finger at the private sector as not sufficiently attending to this matter.

Dix

The fact is, Dana, that many in the private sector make substantial investments in their product integrity program, as Andras was talking about, from product conception, to delivery, to disposal. What’s really important is that when that investment is made and when companies apply the standard the OTTF has put forward, it’s incumbent upon the government to do their part in purchasing from authorized and trusted sources.

In today's world, we still have a culture that's pervasive across the government acquisition community, where decision-making on procurements is often driven by cost and schedule, and product authenticity, assurance, and security are not necessarily a part of that equation. It’s driven in many cases by budgets and other considerations, but nonetheless, we must change that culture to focus to include authenticity and assurance as a part of the decision making process.

Often those acquisitions are made from untrusted and unauthorized sources, which raises the risk of acquiring counterfeit, tainted, or even malicious equipment.

The result of focusing on cost and schedule is often those acquisitions are made from untrusted and unauthorized sources, which raises the risk of acquiring counterfeit, tainted, or even malicious equipment.

Part of the work of the OTTF is to present to all stakeholders, in industry and government alike, that there is a process that can be uniform, as has been stated by Sally and Dan, that can be applied in an environment to raise the bar of authenticity, security, and assurance to improve upon that risk management approach.

Gardner: Sally, we've talked about where you're standing in terms of some progress in your development around these standards and activities. We've heard about the challenges and the need for improvement.

Before we talk about this interesting concept of insurance that would come to bear on -- and perhaps encouraging standardization and giving people more ways to reduce their risk and adhere to best practices -- what do you expect to see in a few years? If things go well and if this is adopted widely and embraced in true good practices, what's the result? What do we expect to see as an insurance improvement?

Powerful impact

Long: The most important and significant aspect of the accreditation program is when you look at the holistic nature of the program and how it could have a very powerful impact if it's widely adopted.

The idea of an accreditation program is that a provider gets accredited for conforming to the best practices. A provider that can get accredited could be an integrator, an OEM, the component suppliers of hardware and software that provide the components to the OEM, and the value-add resellers and distributors.

Every important constituent in that supply chain could be accredited. So not only from a business perspective is it important for governments and commercial customers to look on the Accreditation Registry and see who has been accredited for the integrators they want to work with or for the OEMs they want to work with, but it’s also important and beneficial for OEMs to be able to look at that register and say, "These component suppliers are accredited. So I'll work with them as business partners." It's the same for value-add resellers and distributors.

Attend The Open Group Baltimore 2015
July 20-23, 2015
Register Here

It builds in these real business-market incentives to make the concept work, and in the end, of course, the ultimate goal of having a more secure supply chain and more products with integrity will be achieved.

To me, that is one of the most important aspects that we can reach for, especially if we reach out internationally. What we're starting to see internationally is that localized requirements are cropping up in different countries. What that’s going to mean is that vendors need to meet those different requirements, increasing their cost, and sometimes even there will end up being trade barriers.

Back to what Dan and Bob were saying, we need to look at this global standard and accreditation program that already exists. It's not in development; we've been working on it for five years with consensus from many, many of the major players in the industry and government. So urging global adoption of what already exists and what could work holistically is really an important objective for our next couple of years.

Gardner: It certainty sounds like a win, win, win if everyone can participate, have visibility, and get designated as having followed through on those principles. But as you know and as you mentioned, it’s the marketplace. Economics often drives business behavior. So in addition to a standards process and the definitions being available, what is it about this notion of insurance that might be a parallel market force that would help encourage better practices and ultimately move more companies in this direction?

Let’s start with Dan. Explain to me how cyber insurance, as it pertains to the supply chain, would work.

Early stages

Reddy: It’s an interesting question. The cyber insurance industry is still in the early stages, even though it goes back to the '70s, where crime insurance started applying to outsiders gaining physical access to computer systems. You didn't really see the advent of hacker insurance policies until the late '90s. Then, starting in 2000, some of the first forms of cyber insurance covering first and third party started to appear.

What we're seeing today is primarily related to the breaches that we hear about in the paper everyday, where some organization has been comprised, and sensitive information, like credit card information, is exposed for thousands of customers. The remediation is geared toward the companies that have to pay the claim and sign people up for identity protection. It's pretty cut and dried. That's the wave that the insurance industry is riding right now.

What I see is that as attacks get to be more sophisticated and potentially include attacks on the supply chain, it’s going to represent a whole new area for cyber insurance. Having consistent ways to address supplier-related risk, as well as the other infrastructure related risks that go beyond simple data breach, is going to be where the marketplace has to make an adjustment. Standardization is critical there.

Gardner: Andras, how does this work in conjunction with OTTF? Would insurance companies begin their risk assessment by making sure that participants in the supply chain are already adhering to your standards and seeking accreditation? Then, maybe they would have premiums that would reflect the diligence that companies extend into their supply chains. Maybe you could just explain to me, not just the insurance, but how it would work in conjunction with OTTF, maybe to each’s mutual benefit.

The question is, do you buy a policy, and what’s the balance here between a cyber threat that is in your control, and those aspects of supply chain security which are out of your control.

Szakal: You made a really great point earlier about the economic element that would drive compliance. For us in IBM, the economic element is the ability to prove that we're providing the right assurance that is being specified in the requests for proposals (RFPs), not only in the federal sector, but outside the federal sector in critical infrastructure and finance. We continue to win those opportunities, and that’s driven our compliance, as well as the government policy aspect worldwide.

But from an insurance point of view, insurance comes in two forms. I buy policy insurance in a case where there are risks that are out of my control, and I apply protective measures that are under my control. So in the case of the supply chain, the OTTF is a set of practices that help you gain control and lower the risk of threat in the manufacturing process.

The question is, do you buy a policy, and what’s the balance here between a cyber threat that is in your control, and those aspects of supply chain security which are out of your control. This is with the understanding that there is an infinite number of a resources or revenue that you can apply to allocate to both of these aspects.

There's going to have to be a balance, and it really is going to be case by case, with respect to customers and manufacturers, as to where the loss of potential intellectual property (IP) with insurance, versus applying controls. Those resources are better applied where they actually have control, versus that of policies that are protecting you against things that are out of your control.

For example, you might buy a policy for providing code to a third party, which has high value IP to manufacture a component. You have to share that information with that third-party supplier to actually manufacture that component as part of the overarching product, but with the realization that if that third party is somehow hacked or intruded on and that IP is stolen, you have lost some significant amount of value. That will be an area where insurance would be applicable.

What's working

Gardner: Bob Dix, if insurance comes to bear in conjunction with standards like what the OTTF is developing in supply chain assurance, it seems to me that the insurance providers themselves would be in a position of gathering information for their actuarial decisions and could be a clearing house for what's working and what isn't working.

It would be in their best interest to then share that back into the marketplace in order to reduce the risk. That’s a market-driven, data-driven approach that could benefit everyone. Do you see the advent of insurance as a benefit or accelerant to improvement here?

Dix: It's a tool. This is a conversation that’s been going on in the community for quite some time, the lack of actuarial data for catastrophic losses produced by cyber events, that is impacting some of the rate setting and premium setting by insurance companies, and that has continued to be a challenge.

But from an incentive standpoint, it’s just like in your home. If you have an alarm system, if you have a fence, if you do other kinds of protective measures, your insurance on your homeowners or liability insurance may get a reduction in premium for those actions that you have taken.

As an incentive, the opportunity to have an insurance policy to either transfer or buy down risk can be driven by the type of controls that you have in your environment. The standard that the OTTF has put forward provides guidance about how best to accomplish that. So, there is an opportunity to leverage, as an incentive, the reduction in premiums for insurance to transfer or buy down risk.

The opportunity to have an insurance policy to either transfer or buy down risk can be driven by the type of controls that you have in your environment.

Gardner: It’s interesting, Sally, that the insurance industry could benefit from OTTF, and by having more insurance available in the marketplace, it could encourage more participation and make the standard even more applicable and valuable. So it's interesting to see over time how that plays out.

Any thoughts or comments on the relationship between what you are doing at OTTF and The Open Group and what the private insurance industry is moving toward?

Long: I agree with what everyone has said. It's an up-and-coming field, and there is a lot more focus on it. I hear at every conference I go to, there is a lot more research on cyber security insurance. There is a place for the O-TTPS in terms of buying down risk, as Bob was mentioning.

The other thing that's interesting is the NIST Cybersecurity Framework. That whole paradigm started out with the fact that there would be incentives for those that followed the NIST Cybersecurity Framework - that incentive piece became very hard to pull together, and still is. To my knowledge, there are no incentives yet associated with it. But insurance was one of the ideas they talked about for incentivizing adopters of the CSF.

The other thing that I think came out of one of the presentations that Dan and Larry Clinton will be giving at our Baltimore Conference, is that insurers are looking for simplicity. They don’t want to go into a client’s environment and have them prove that they are doing all of these things required of them or filling out a long checklist.

That’s why, in terms of simplicity, asking for O-TTPS-accredited providers or lowering their rates based on that - would be a very simplistic approach, but again not here yet. As Bob said, it's been talked about a lot for a long time, but I think it is coming to the fore.

Market of interest

Gardner: Dan Reddy, back to you. When there is generally a large addressable market of interest in a product or service, there often rises a commercial means to satisfy that. How can enterprises, the people who are consuming these products, encourage acceptance of these standards, perhaps push for a stronger insurance capability in the marketplace, or also get involved with some of these standards and practices that we have been talking about?

If you're a publicly traded company, you would want to reduce your exposure and be able to claim accreditation and insurance as well. Let’s look at this from the perspective of the enterprise. What should and could they be doing to improve on this?

Reddy: I want to link back to what Sally said about the NIST Cyber Security Framework. What’s been very useful in publishing the Framework is that it gives enterprises a way to talk about their overall operational risk in a consistent fashion.

Cyber insurance is more than just the risk of suppliers. It’s the risk at the enterprise level.

I was at one of the workshops sponsored by NIST where enterprises that had adopted it talked about what they were doing internally in their own enterprises in changing their practices, improving their security, and using the language of the framework to address that.

Yet, when they talked about one aspect of their risk, their supplier risk, they were trying to send the NIST Cybersecurity Framework risk questions to their suppliers, and those questions aren’t really sufficient. They're interesting. You care about the enterprise of your supplier, but you really care about the products of your supplier.

So one of the things that the OTTF did is look at the requirements in our standard related to suppliers and link them specifically to the same operational areas that were included in the NIST Cybersecurity Framework.

This gives the standard enterprise looking at risk, trying to do standard things, a way to use the language of our requirements in the standard and the accreditation program as a form of measurement to see how that aspect of supplier risk would be addressed.

But remember, cyber insurance is more than just the risk of suppliers. It’s the risk at the enterprise level. But the attacks are going to change over time, and we'll go beyond the simple breaches. That’s where the added complexity will be needed.

Gardner: Andras, any suggestions for how enterprises, suppliers, vendors, systems integrators, and now, of course, the cloud services providers, should get involved? Where can they go for more information? What can they do to become part of the solution on this?

International forum

Szakal: Well, they can always become a member of the Trusted Technology Forum, where we have an international forum.

Gardner: I thought you might say that.

Szakal: That’s an obvious one, right? But there are a couple of places where you can go to learn more about this challenge.

One is certainly our website. Download the framework, which was a compendium of best practices, which we gathered as a result of a lot of hard work of sharing in an open, penalty-free environment all of the best practices that the major vendors are employing to mitigate risks to counterfeit and maliciously tainted products, as well as other supply chain risks. I think that’s a good start, understanding the standard.

Then, it's looking at how you might measure the standard against what your practices are currently using the accreditation criteria that we have established.

The only place where you really find solutions, or at least one of the only places that I have seen is in the TTF, embedded in the standard as a set of practices that are very practical to implement.

Other places would be NIST. I believe that it’s 161 that is the current pending standard for protecting supply chain security. There are several really good reports that the Defense Science Board and other organizations have conducted in the past within the federal government space. There are plenty of materials out there, a lot of discussion about challenges.

But I think the only place where you really find solutions, or at least one of the only places that I have seen is in the TTF, embedded in the standard as a set of practices that are very practical to implement.

Gardner: Sally, the same question to you. Where can people go to get involved? What should they perhaps do to get started?

Long: I'd reiterate what Andras said. I'd also point them toward the accreditation website, which is www.opengroup.org/accreditation/o-ttps. And on that accreditation site you can see the policy, standard and supporting docs. We publicize our assessment procedures so you have a good idea of what the assessment process will entail.

The program is based on evidence of conformance as well as a warranty from the applicant. So the assessment procedures being public will allow any organizations thinking about getting accredited to know exactly what they need to do.

As always, we would appreciate any new members, because we'll be evolving the standard and the accreditation program, and it is done by consensus. So if you want a say in that, whether our standard needs to be stronger, weaker, broader, etc., join the forum and help us evolve it.

Impact on business

Gardner: Dan Reddy, when we think about managing these issues, often it falls on the shoulders of IT and their security apparatus, the Chief Information Security Officer perhaps. But it seems that the impact on business is growing. So should other people in the enterprise be thinking about this? I am thinking about procurement or the governance risk and compliance folks. Who else should be involved other than IT in their security apparatus in mitigating the risks as far as IT supply chain activity?

Reddy: You're right that the old model of everything falls on IT is expanding, and now you see issues of enterprise risk and supply chain risk making it up to the boards of directors, who are asking tough questions. That's one reason why boards look at cyber insurance as a way to mitigate some of the risk that they can't control.

They're asking tough questions all the way around, and I think acquisition people do need to understand what are the right questions to ask of technology providers.

They're asking tough questions all the way around, and I think acquisition people do need to understand what are the right questions to ask of technology providers.

To me, this comes back to scalability. This one-off approach of everyone asking questions of each of their vendors just isn't going to make it. The advantage that we have here is that we have a consistent standard, built by consensus, freely available, and it's measurable.

There are a lot of other good documents that talk about supply chain risk and secure engineering, but you can't get a third-party assessment in a straightforward method, and I think that's going to be appealing over time.

Gardner: Bob Dix, last word to you. What do you see happening in the area of government affairs and public policy around these issues? What should we hope for or expect from different governments in creating an atmosphere that improves risk across supply chain?

Dix: A couple things have to happen, Dana. First, we have got to quit blaming victims when we have breaches and compromises and start looking at solutions. The government has a tendency in the United States and in other countries around the world, to look at legislating and trying to pass regulatory measures that impose requirements on industry without a full understanding of what industry is already doing.

In this particular example, the government has had a tendency to take an approach that excludes vendors from being able to participate in federal procurement activities based on a risk level that they determine.

The really great thing about the work of the OTTF and the standard that's being produced is it allows a different way to look at it and instead look at those that are accredited as having met the standard and being able to provide a higher assurance level of authenticity and security around the products and services that they deliver. I think that's a much more productive approach.

Working together

And from a standpoint of public policy, this example on the great work that's being done by industry and government working together globally to be able to deliver the standard provides the government a basis by which they can think about it a little differently.

Instead of just focusing on who they want to exclude, let's look at who actually is delivering the value and meeting the requirements to be a trusted provider. That's a different approach and it's one that we are very proud of in terms of the work of The Open Group and we will continue to work that going forward.

Gardner: I'm afraid we will have to leave it there. We've been exploring ways to address supply chain risk in the information technology sector marketplace, and we've seen how The Open Group Trusted Technology Forum standards and accreditation activities are enhancing the security of global supply chain and improving the integrity of openly available IT products and components. And we have also learned how the age-old practice of insurance is coming to bear on the problem of IT supply chain risk.

Attend The Open Group Baltimore 2015
July 20-23, 2015
Register Here

This special BriefingsDirect thought leadership panel discussion comes to you in conjunction with The Open Group's upcoming conference on July 20, 2015 in Baltimore. It's not too late to register on The Open Group's website or to follow the proceedings online and via Twitter and other social media during the week of the presentation.

So a big thank you to our guests: Sally Long, Director of The Open Group Trusted Technology Forum; Andras Szakal, Vice President and Chief Technology Officer for IBM U.S. Federal and Chairman of The Open Group Trusted Technology Forum; Bob Dix, Vice President of Global Government Affairs and Public Policy for Juniper Networks and a member of The Open Group Trusted Technology Forum, and Dan Reddy, Supply Chain Assurance Specialist, college instructor and Lead of The Open Group Trusted Technology Forum Global Outreach and Standards Harmonization Work Group.

And lastly, a big thank you to our audience for joining us at the special Open Group-sponsored thought leadership panel discussion.

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for these Open Group discussions associated with the July 20 Baltimore Conference. Thanks again for listening, and come back next time.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: The Open Group.

Transcript of a BriefingsDirect discussion on ways to address supply chain risk in the information technology sector market. Copyright The Open Group and Interarbor Solutions, LLC, 2005-2015. All rights reserved.

You may also be interested in:

• Enterprise Architecture Leader John Zachman on Understanding and Leveraging Synergies Among the Major EA Frameworks
• The Open Group Trusted Technology Forum is Leading the Way to Securing Global IT Supply Chains
• Cybersecurity standards: The Open Group explores security and safer supply chains
• Explore synergies among major Enterprise Architecture frameworks with The Open Group
• Health Data Deluge Requires Secure Information Flow Via Standards, Says the Open Group's New Healthcare Director
• The Open Group Amsterdam Conference Panel Delves into How to Best Gain Business Value from Open Platform 3.0
• Healthcare Among Thorniest and Yet Most Opportunistic Use Cases for Boundaryless Information Flow Improvement
• Gaining Dependability Across All Business Activities Requires Standard of Standards to Tame Dynamic Complexity, Says The Open Group CEO
• Big Data success depends on better risk management practices like FAIR, say conference panelists
• Improving signal-to-noise in risk management
• CSC and HP team up to define the new state needed for comprehensive enterprise cybersecurity

How Malaysia’s Bank Simpanan Nasional Implemented a Sweeping Enterprise Content Management System

Transcript of a BriefingsDirect discussion on how a major Asia-Pacific bank advanced document management modernization and increased both employee and customer satisfaction.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: HP.

Dana Gardner: Hello, and welcome to the next edition of the HP Discover Podcast Series. I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing sponsored discussion on IT innovation and how it’s making an impact on people's lives.

Gardner

Our next big data and information governance innovation case study highlights how the National Savings Bank in Malaysia has implemented a sweeping enterprise content management system (ECMS) project. We'll learn how this large community bank has slashed paper use, increased productivity, rationalized storage and documents, and cut security risks, while adhering to compliance requirements.

Here to walk us through the bank’s journey to better information management is Alain Boey, Senior Vice President in the Transformation Management Department at the National Savings Bank in Malaysia. Welcome, Alain.

Alain Boey: Hello.

Gardner: What were the major drivers that led you to seek a comprehensive approach to enterprise content management?

HP Document and records management system
Helps meet regulatory compliance issues
Get more information

Boey: We were trying to standardize a lot of our processes in the bank and, as you know, in the bank itself we used a lot of paper. There are a lot of documents flying around and documents have to be couriered from one place over to our headquarters (HQ) for processing. We have 14 states all across Malaysia, and all these documents have to be couriered on a daily basis over to our HQ in Kuala Lumpur.

Boey

We were trying to see how we can shorten that process itself, so that we can at least be able to give an answer to our customers in the shortest time possible. By putting in an ECMS, we were able to standardize a lot of the processes that involved paper. Then, documents were able to be retrieved easily regardless of where the person is. In terms of processing times, we were able to shorten the processing time from four days to less than a day.

The documents are now scanned and then uploaded to the server, which is easily accessed  by anybody around Malaysia. The whole objective of going in to the ECMS was to improve the entire customer experience, and also to put in best practices involving processes as well as systems. Ultimately, what we want to achieve is to see how we can serve our customer better.

Gardner: Tell us a little bit about your bank. It’s a quite a distributed organization and there are a lot of moving parts to it. I can understand why it would be a challenge to centralize all of your information.

Promote and mobilize savings

Boey: Bank Simpanan Nasional is owned by the Ministry of Finance. We were incorporated in 1974. So we're 40 years old as of December last year. Our objective is to promote and mobilize savings for the entire Malaysia.

We're specially set up by the Ministry of Finance to provide savings and banking opportunities to all Malaysians. Because we're a national bank, we have branches all across Malaysia. We have 402 branches, and these are serviced by our 6,800 employees.

We also have what we call agent banking. We have 5,200 agents who are able to operate on behalf of the bank. BSN, as what we are normally known in Malaysia, has 982 automatic teller machines (ATMs) and 338 cash deposit machines (CDMs) and this is to serve more than 9.5 million customers. In short, we're a diverse bank. We're the only bank that you can find in the remotest parts of Malaysia.

That's why before ECMS came in, it was very challenging. Documents had to be couriered or had to carried from one place to our central office. Because of that, a simple loan application, for instance, could take up to four to five days before it can reach the central office. That created a lot of challenges in trying to satisfy our customers, especially those applying for loans. They want to know the status of their loan application as soon as possible.

Number two, we also had issues in regard to the management of the documents. Documents had to be stored, and there were issues in relation to the access of physical documents themselves. As we all know, real estate prices have gone up, so storing all these physical documents doesn’t make sense for the bank.

We wanted to put in place a system whereby we're able to track the entire lifecycle of the document.

We wanted to see how we could also find a way to remove as many of these physical documents as possible, and also to make the retrieval of the documents easy. We're also trying to put in controls over access of the documents. Physical paper files can be lost while in transit, or can even be lost because they get misplaced, or a file is missing.

We wanted to put in place a system whereby we're able to track the entire lifecycle of the document. The moment the document is scanned, we're able to see the status of the document itself, as well the status of the application and then the entire lifecycle management of the document. That’s pretty much what we wanted to achieve from this whole exercise.

Gardner: Not only do you get a centralized view and more information about each document much quicker, but you also create a much better security and audit trail, and therefore compliance benefits?

Boey: Definitely. Now, we have a better audit trail of document movement. We have better control in terms of the versioning, like who puts in what. We're also able to rollout a consistent taxonomy for all documents. Whatever documents go into ECMS have to follow a certain methodology in taxonomy inference of the naming. So anybody in Malaysia, when they want to access a file, they're able to identify the file by just looking at the name of the file.

Of course, because everything is in soft copy, we have a back-up in terms of the disaster recovery (DR) as well. So, there's no issue, if a document goes missing, in how we access it and how we look for important documents. So, now that we have a proper DR, we're able to retrieve the documents, even if the physical copy is missing.

Primary technologies

Gardner: Alain, tell us how you went about this. What were the primary technologies, processes, and skills that were required to make this happen?

Boey: The journey itself took us about two years. We explored many vendors in the market to look at which available technologies were able to satisfy our requirements. There were a lot of vendors providing document management systems, but we wanted an enterprise-level system so that we're able to use the same system across the entire organization.

We went through a series of vendors and then eventually we decided to go with HP’s Autonomy and also the HP TRIM Records Management System. Of course, there were many solutions that we looked at. It was an open tender, and the evaluation team comprised a combination of business users as well as technical users. Based on the result of this, the evaluators were comfortable with this solution and the technology that was being provided by HP.

Then, during implementation itself, we were able to have better hands-on experience on the HP TRIM software as well as on Autonomy. We found that the software was very flexible. We were able to build workflows together, and they were also able to put in a lot of controls and a lot of parameterized input. That makes usage, as well as maintenance, easy.

Maintenance becomes easier because we don't need to have somebody physically managing the entire lifecycle of the document.

Gardner: When you go to a digital and managed system like this, you also get benefits for archive and back-up and perhaps even reduction in overall storage infrastructure costs. Is there anything about the storage and back-up and archive benefits that also came to play?

Boey: Definitely. Because we're a bank, all the documents that we have have to be backed up. Previously, every document had to be duplicated, so we had two files of it. That made retrieval and storage challenges as well.

Once a soft copy is in, you're able to make multiple copies if you want to, but because we have a DR in place, we're able to replicate the files to our DR. In terms of archival, it's easier because we can follow our standard archiving policy. When it comes to the end of the lifecycle of the document itself, there are proper procedures to manage the expiry of the documents as well as the disposal of the hard copy.

Now that they have the managed soft copy, we're able to track the entire movement, and when it comes to the expiry itself, notifications will remind the users that this document is due for disposal at whatever period of time. The users can then prepare the necessary procedures in regard to disposal of the documents.

HP Document and records management system
Helps meet regulatory compliance issues
Get more information

Maintenance becomes easier because we don't need to have someone physically managing the entire lifecycle of the document. We're leaving it to the system to tell us when what action should be taken for a typical document.

Gardner: Let’s look at some of the results, some of the paybacks that you've achieved as a result of your project. First, I suppose, customer satisfaction is always important. What have you heard from the users, the customers, in terms of how they view this as an improvement? And are there other metrics of success?

User surveys

Boey: We have conducted some surveys with the users in regard to the experience of using the system. Initially, when the system was first rolled out, there were some challenges in the users' options because those were basically changing the way they were used to doing things. Because documents now are all committed electronically, that means physical processes that will have to be eliminated.

There were some challenges from the users in regard to so-called job security, because things were now being replaced by the system itself. We were able to retrain some of these users to other functions. For example, when a document comes in, once the document is scanned it goes into the system, and we need someone to physically eyeball the information.

Previously, someone was preparing the documents for couriering. Now, their new role is basically to eyeball some of this information, to check the consistency, as well as the completeness and the accuracy of the information.

With all of this, we're able to shorten the turnaround time for the loan application and the turnaround time for the commission payment.

Because of this, we're able to see happier customers and users because they are able to see the benefits from using the system.

Sales agents are basically paid by commission. So the faster the loan is approved, for example, the faster they will get the commission. Now, with the system in place, we're able to see shorter turnaround time in terms of the processing. Because of this, the customers are able to get an answer from the bank in the shortest time possible. The customer will then be able to decide if they want to take out the loan with the bank.

With all of this, we're able to shorten the turnaround time for the loan application and the turnaround time for the commission payment, as well as the turnaround time for the feedback to the customers.

Overall, in the three surveys that they have conducted by the bank, the results have been positive. We've seen a higher usage of the system since it has been implemented.

On the customer side, based on the feedback that we have received as well as the surveys that have been done, the customers are happier because they're able to get the answers from the bank sooner.

Previously, we had a lot of drop in customers because the time it took to revert back to them was longer. Now, if an application comes in, it’s submitted on one day, and the customer is able to get a reply in less than 24 hours. So this has increased customers' satisfaction.

Gardner: What about the future? What comes next? Does this capability that you've put in place open up the possibility for other improvements in your infrastructure and documented information management, perhaps some sort of analysis capability or search in other higher order functions around business intelligence?

Robust system

Boey: In doing the implementation, the HP team helped us build some of these applications and helped us put in the applications for some of the departments. Moving forward, we're rolling out to all the other departments in the bank, all of the back offices, and these are going to done by our own team. So it shows the robustness of the system that the team is able to pick up the knowledge of the system and then to roll it out.

Now, with all of this information that we have, we're also looking at the analytics surrounding the data, the data that we have received. We're looking to see how we can further improve the customers' experience based on the information that we have in the system.

We're trying to shorten the entire processing time as much as possible, now that we have better management and information on the processing time.

We're also trying to see, based on the information that we have, whether we're able to better understand our users' behavior. Sometimes, our sales agents are quite smart in playing along with their sales target, like what it’s going to be for this month or is this going to be for next month. So we are trying to get a better understanding of our user’s behavior through the information in BSN itself.

We're also trying to see, based on the information that we have, whether we're able to understand our user’s behavior better.

And also similarly for the customers, based on the analytics surrounding the customers and the information in the system, we are also exploring better products and services to best satisfy our customers’ expectations.

Gardner: If you have an opportunity to instruct someone who is starting out on a similar project, what lessons have you learned? What advice might you offer to those who are beginning a comprehensive ECMS project?

Boey: Look at the bigger picture. There are a lot of document management systems, but if you're looking for an ECMS, you need to identify your objectives. If your objective is just to scan a document, then probably an ECMS will not work.

But if your objective is to look at improving the return on investment (ROI), improving the entire costumer experience, putting in better control on the document lifecycle -- then an ECMS would work for you.

Also, explore what's available in the market in terms of the solution and get to know the vendors, the solution providers, well so that you have a better understanding of the technology, and you have a better knowledge of the roadmap of the technology. Then, you're able to plan your future, your three-year plans or your five-year business plans based on the roadmap of the solution.

Gardner: I'm afraid we will have to leave it there. We've been learning about how the National Savings Bank in Malaysia has implemented a sweeping Enterprise Content Management System.

HP Document and records management system
Helps meet regulatory compliance issues
Get more information

So join me please in thanking our guest, Alain Boey, Senior Vice President in the Transformation Management Department at the National Savings Bank in Malaysia. Thanks so much.

Boey: Thank you.

Gardner: I would also like to thank our audience for joining this big data and information governance innovation case study discussion.

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host for this ongoing series of HP-sponsored discussions. Thanks again for joining, and come back next time.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: HP.

Transcript of a BriefingsDirect discussion on how a major bank advanced document management modernization and increased employee and customer satisfaction. Copyright Interarbor Solutions, LLC, 2005-2015. All rights reserved.

You may also be interested in:

• Redcentric Uses Advanced Configuration Database to Focus Massive Merger Across Multiple Networks
• HP at Discover delivers the industry's first open, hybrid, ecosystem-wide cloud architecture
• How Tableau Software and Big Data Come Together: Strong Visualization Embedded on an Agile Analytics Engine
• Big Data Helps Conservation International Proactively Respond to Species Threat in Tropical Forests
• How Globe Testing helps startups make the leap to cloud- and mobile-first development
• GoodData analytics developers on what they look for in a big data platform
• ITIL-ITSM tagteam boosts Mexican ISP INFOTEC's operations quality
• Novel consumer retail behavior analysis from InfoScout relies on HP Vertica big data chops
• IT Operations Modernization Helps Energy Powerhouse Exelon Acquire Businesses
• ECommerce portal Avito uses big data to master rapid fraud detection
• How a Hackathon Approach Juices Innovation on Big Data Applications for Thomson Reuters
• How Waste Management Builds a Powerful Services Contiunuum Across Operations, Infrastructure, Development, and IT Processes
• GSN Games hits top prize using big data to uncover deep insights into gamer preferences

Ariba’s Digital Handshake Helps Caesars Drive Diversity Across its Supply Chain

Transcript of a BriefingsDirect discussion on how diverse buyers and sellers are using the Ariba Network to connect and collaborate in today’s digital economy.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: Ariba, an SAP company.

Dana Gardner: Hello, and welcome to a special BriefingsDirect Podcast series, coming to you from the recent 2015 Ariba LIVE Conference in Las Vegas.

Gardner

We're here to explore the future of business commerce. We'll learn how innovative companies are tapping into business networks to harness the power of communities, to discover, connect and collaborate with peers and partners across the street -- or around the world.

Not only are these leaders better managing their spend in buyer/seller interactions, they're also gleaning insights and intelligence to learn from the past, capitalize on the present, and chart an effective course for the future, all in real-time from a single platform.

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of Ariba-sponsored BriefingsDirect discussions.

Our next innovator case study focuses on Caesars Entertainment Corp. and how they're transforming supplier discovery in collaboration using cloud-based services and open business networks.

We’ll learn from Caesars how they drive an increase in diversity across their supply chain, and how that’s been accomplished using Ariba Discovery. We’ll hear first-hand how one supplier, M & R Distribution Services, has benefited from such supplier visibility.

Please join me now in welcoming our guests, Jessica Rosman, Director of Supplier Diversity and Sustainability at Caesars Entertainment based in Las Vegas. Welcome Jessica.

Jessica Rosman: Hi, thanks.

Gardner: And we're here also with Quentin McCorvey, Sr., President and COO of M&R Distribution Services, based in Cleveland. Welcome.

Quentin McCorvey, Sr.: Thank you.

Gardner: What are some of the more difficult aspects of finding the right supplier for the right job under the right circumstances?

Wider network

Rosman: Oftentimes, our portfolio managers look into their natural networks of suppliers we’ve already used or suppliers who have contacted us, but that can be limiting. Having a wider network or using the Discovery tool on Ariba has allowed us to open up to millions of different suppliers that we haven’t met before and who we might want to do business with us.

Rosman

Additionally, we do numerous outreach events into the communities in which we operate, so we can find top suppliers and include them in our supply chain.

Gardner: What sort of supplier requirements are there, and has that been changing over the years? Is there a moving target for this?

Rosman: For Caesars, it really depends on the category or commodity that we're searching for. Certain commodities may require larger supply chains or more integrated processes than others. But for all of our suppliers, we're looking for quality, service, and price. That may also include requirements around insurance, delivery time, or other needs to meet those three areas.

Gardner: People are familiar with the Caesars’ name, but your organization includes a lot more. Tell us about the breadth and scope of your company.

Rosman: Caesars Entertainment is the largest globally diversified casino network. We're also the home of Horseshoe, Harrah’s, Total Rewards, Paris, Rio, and obviously, the most famous, Caesars Palace in Las Vegas.

Gardner: Quentin, tell us a little bit about M&R and why getting the visibility from folks like Caesars has been a good thing for you?

McCorvey

McCorvey: M&R Distribution Services, my company, was established in 2008 by my partner Joe Reccord and myself. I came out of banking and had experience and a background of 12 years in banking. My partner has been in the distribution business for over 20 years as a market leader in a regional distribution company. We're primarily focused on distributing products such as disposable gloves. Most maintenance, repair, and operations (MRO) product lines are in our portfolio, as well as personal protective equipment and trash liners.

You asked how this has been important for us or how Caesars’ relationship has been important for us. It has been very important, because, as Jessica said, we found each other through some of their outreach events that they have in the community.

It was through a National Minority Supplier Development Council. My company is a nationally certified minority business. With this networking event and through a matchmaking event, I found someone on Jessica’s team, Bridget Carter, and learned a little bit more about Caesars and the opportunities that happened within Caesars. Then, through further connections, we had some opportunities that led to a strong relationship.

Gardner: What is it about making these connections between buyer and seller that’s easier today? What’s changed in the past several years?

It's about relationships

Rosman: Technology has changed, but some things haven’t changed. At the end of the day, business is about relationships. To start that relationship, there are new ways that we can meet different businesses by doing outreach and having the Ariba Discovery tool, where we can team up buyers and sellers through using Naics codes, UnPsc codes, or other types of codes. Using those, we can find those who want to sell and those who want to buy.

But part of it is the same as it has always been, which is about having that face-to-face connection, knowing that there is a potential relationship and feeling comfortable that that business will deliver on the quality, the service, and the need for the internal customer that there always has been.

Gardner: As to your title, Supplier Diversity and Sustainability, how important is that? How did that come about and what are your goals?

Rosman: Caesars Entertainment has a code of commitment. Our code of commitment is our code that says that we have a responsibility to the community, to the environment, to our customers, and to our employees to be the best that we can be. Under that code of commitment and in line with it is our Supplier Diversity Program. Our Supplier Diversity Program sits within our sourcing office, but also has a dotted line into the Diversity Department overall.

We are in unique areas across the country. When we do outreach within the community, in part it’s because in order for our businesses to grow, it’s important that we find community and local business partners that can meet the 24-hour, seven-days-a-week business that we have.

It’s different than other business types that have a delivery on Monday and don’t need it again until next week. That outreach has allowed us to find small, medium-size, and large businesses that are minority-owned, women-owned, veteran-owned, and other diverse businesses that can meet those needs.

Gardner: Quentin, tell me a bit about how long you’ve been working with Caesars? Is this strictly in Ohio with some of their properties there? Is it expanded across the company? Have you got a beachhead that’s then expanded? What’s the nature of the business you have?

While I didn’t win that opportunity, what I did win was the entrée into a relationship with Caesars.

McCorvey: We initially got engaged with Caesars, as I mentioned, through an outreach program, and through that, an opportunity came up for me to bid on a project with Caesars. Because I had bid on that project, I had to get connected to the Ariba Network. While I didn’t win that opportunity, what I did win was the entrée into a relationship with Caesars. Jessica talked about how a relationship is important, and for minority business, clearly, it’s really about relationship development.

As a minority-owned company, I'm not looking for handout. I'm looking for handshake, an opportunity to earn the business of a customer. I have to prove myself in being able to produce tier 1 pricing capacity and helping in solving pains within the supply chain network. Even with not getting this opportunity, I continued having conversations with Caesars and continued to develop the relationship.

Caesars has a mentoring program, which I was involved in and had the pleasure to become a part of. Through that mentoring program, I was able to sit down with Caesars and discuss certain goals that I wanted to accomplish, not only with my business personally, but also with the business opportunity with Caesars.

Some of those things included meeting the category managers in the categories where I was supplying into the organization and really understanding how to grow my key performance indicators (KPIs), not only directly, but also with Caesars and some of the other opportunities that are there.

Mentoring program

Through this mentoring program, we began to work on the relationship. I began to meet other people within the supply chain more regionally, as well as the national folks -- from Jessica and her team to up and down and across the Caesars organization. That’s been a very important process for me.

That's how we started out. I've gotten, and I'm going to get, opportunities through the mentoring program to start serving the company regionally. There are casinos in Ohio. My primary markets are servicing the Ohio casinos. Then, moving out of the region is a goal, ultimately growing into being a national supplier with all 52 properties within Caesars casinos.

Gardner: How important have Ariba Discovery and the Ariba Network been for you? How did you get on it? Was it easy? And where else have you been able to extend this visibility?

I actually won a couple of opportunities through the system and through the Ariba Network.

McCorvey: I got into the Ariba Network accidentally on purpose. On purpose because I had an opportunity to bid on a national contract with Caesars. When I had that opportunity, I got an invite from the buyer to sign up into Ariba. So I had to put my profile in there in order to bid on the opportunity that was available to me.

I did that, and it was a quick turnaround on the bid. I spent all of my time trying to figure out how to get through this, how to get my profile updated, and how to get the bid engaged.

I didn’t really know that much about the network and how connected the matches were to opportunities. I started seeing alerts and I started seeing, direct opportunities that really connected with my business. Through that, I said let me investigate a little bit further. And when I did, I began to look at some other opportunities. I actually won a couple of opportunities through the system and through the Ariba Network.

When I say "accidentally and on purpose," I guess it was fortuitous that we had this opportunity to bid. Even though it wasn't a win directly with that opportunity, it was a win for me and my company.

Gardner: Jessica, how about from the buyer side at Caesars, using the network, having the data, the insights, and the visibility. Has that added more value to your process? Obviously, you’ve got a certain specialization, but is there a more general value that you're seeing over time?

Rosman: We've used Ariba Network for a quite a while now. We started off with request for proposal (RFP) or the sourcing phase or module. We extended to the contracting phase or module and then we eventually went to the procure-to-pay.

We've seen a plethora of Ariba services, each one adding and building upon prior Ariba services that we had used. In all of those areas, it’s beneficial, because the lessons learned from a past RFP are archived and you can go back in and find RFPs that were used in the past.

When we're mentoring suppliers, especially within our Supplier Diversity Program, talking to minority or women suppliers, it helps us to know what some of the contract managers might be asking, or a little bit more about the categories. We don't pull the entire RFP. We don’t share all of those pieces, but unique items that might be applicable to future questionnaires. That goes all the way through to the procure to pay (P2P). It keeps it easy in one place and it archives the data for us.

Real standardization

Gardner: It sounds like you have a real standardization about how you are going about these things. Is that fair to say?

Rosman: Yes, I believe it is. Our sourcing team has evolved throughout this process to a category-driven leadership approach, and Ariba has been an integral part of that.

Gardner: Any thoughts or recommendations with 20/20 hindsight now for other organizations that are looking for specific requirements in the suppliers that they're targeting?

Rosman: As we continue to grow, Ariba also continues to grow in this area of supplier diversity. Using Ariba Discovery has also helped us when we're trying to find minority women or vendors in unique industries.

An example of that is also in Ohio. We were looking to find a women-owned or minority-owned company in that region that sells carbon dioxide. We put it into Ariba Discovery assuming that we wouldn’t find anybody that we hadn’t already met through our outreach events.

When you're looking for hard-to-reach vendors and looking for that opportunity and connection, it just takes it one step further.

We had done very extensive outreach events in the community and talked to more than 300 local vendors and yet we still were able to do find some. When you're looking for hard-to-reach vendors and looking for that opportunity and connection, it just takes it one step further.

Gardner: Quentin, I imagine that, as a business owner, you're curious about what new business opportunities are available. Has the visibility within the Ariba environment, seeing what alerts come across, seeing what the bids are about, led you to pursue other business opportunities and lines of business within your company? Has it helped you grow?

McCorvey: It has definitely helped us to grow. When I initially looked at the Ariba Network, I saw it as a procurement platform. But for me it's actually more of a supply chain accelerator, and I say that because as with any good business what's important is deal flow, how you get projects and opportunities in the pipeline.

Ariba has been a minimal level of inputs with a maximum level of outputs. So as a company and as a smaller growing company, you’re constantly looking at ways to grow opportunities, to grow market share. Do you invest $20,000, $30,000, $40,000 in a B2B website? Do you engage in Google Analytics? Do you put sales executives in other parts of the country to begin to grow?

Those are all the decisions you have to make every day with a limited amount of resources, because you really want to put that into growing your company. Ariba has has been able to do that. I don't necessarily have to have a larger sales team or some of the other things out there. I can begin to look at opportunities where I can grow my company in other markets. I can service those markets. It also gives me access to other Fortune 100 and 200 companies that I don't necessarily have the access to, to begin to look at.

A lot of ideas

What's important for me is to get a lot of ideas. Jessica talked a little bit about the archived RFPs. But really mining through those archived RFPs, I can see what companies are looking for, what their RFPs have been about, when are their sales cycles coming up again, when can I begin to look at those opportunities and target those opportunities, who are the purchasing and procurement managers that’s managing those lines.

That’s tough data to find. It’s tough to be able to find out who, for example, is procuring resins for a company. You can Google over their website, you can search for it, and you can’t find it, but you will never find that opportunity. It really, really closes down the sales cycle loop for me and gives me maximum value.

Gardner: Well, we're here at Ariba LIVE, and there's lots of news being made. We're hearing about integrated services for travel and expenses. We’re seeing more emphasis on the user experience, end-to-end processes that would end up in a mobile environment or any number of environments.

What's of interest to you? Where do you see yourselves taking advantage of some of these new technological and process innovations?

Rosman: One of the areas that's most interesting is learning about how to implement Ariba within your internal team and externally. We've done a great job of it within Supplier Diversity Program, but how do we roll that out further amongst our entire supply chain? The takeaway is how can we train internally and train externally to find results using Ariba?

It's worth spending some time really understanding how Ariba works and what are the components there within the system.

Gardner: Quentin, any thoughts about what’s of interest to you and then perhaps words of advice you could give other companies that are trying to improve their business using a business network?

McCorvey: Jessica hit on it again. Technology is really driving the market. My partner, who has been in the business for 25 years, often tells a story about how when he first started out. He left home every day with a pocket full of quarters and a pager. That day is gone. This is not your father's Oldsmobile. We really had to begin to leverage technology in a different way.

As a distributor, I'm looking at, and have been typically looking at, the sales side. How can I look at opportunities here? But what’s also been important for me to see and really learn is that I can look at it on the buy side. How can I not only find other manufacturing partners to begin to drive more cost out of my supply chain and even be more competitive in my business and my business environment.

Relative to advice for other customers, other people or other suppliers who are using the network, it's worth spending some time really understanding how Ariba works and what are the components there within the system. Ariba has some very knowledgeable account executives who work directly with you. You need to spend some time with your account executive to make sure that you update your profile to the point where you can get maximum amount of exposures to the maximum amount of hits.

To reiterate what I said before, it’s important to not only look at to the opportunities that are available to you, but closed opportunities, and see where you can begin to look at opportunities, and see if there are other business ideas or business partnerships that you can develop through the Ariba Network.

Gardner: Well, great. I am afraid we will have to leave it there. We've been learning about how supplier, discovery, and collaboration using cloud-based services and business networks helps to identify suppliers with specific qualifications and it’s also helping the seller organizations grow their business dramatically. So a big thanks to our guests.

We've been here with Jessica Rosman, Director of Supplier Diversity and Sustainability at Caesars Entertainment, and Quentin McCorvey, Sr., President and COO of M&R Distribution Services.

And a big thank you too to our audience for joining this special podcast coming to you from the recent 2015 Ariba LIVE Conference in Las Vegas.

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of Ariba-sponsored BriefingsDirect discussions. Thanks again for listening and come back next time.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: Ariba, an SAP company.

Transcript of a BriefingsDirect discussion on how diverse buyers and sellers are using the Ariba Network to connect and collaborate in today’s digital economy. Copyright Interarbor Solutions, LLC, 2005-2015. All rights reserved.

You may also be interested in:

• Winning the B2B Commerce Game: What Sales Organizations Should Do Differently
• Detecting and Eradicating Slavery and Other Labor Risks Across Global Supply Chains through Business Networks
• Ariba elevates business user experience with improved mobile apps and interfaces
• Networks: The new model for B2B business, a panel discussion
• Big Data Meets the Supply Chain -- SAP's Supplier InfoNet and Ariba Network Enable Companies to Predict and Manage Supplier Risk
• Ariba's Product Roadmap for 2014 Points to Instant, Integrated and Data-Rich Business Cloud Services
• Modern supply chains — How innovative sellers engage customers in entirely new ways
• Arlington Computer Products Simplifies and Speeds its Billing and Payments Using New AribaPay
• The Future of Business Success Hinges on How Well Innovation Drives Supply Chain and Procurement Advantages
• Workforce of the Future -- and Why Preparing Means Rethinking Human Resources Now
• Spot buying automated by Ariba gives start-up KooZoo a means to shop more efficiently
• Combining big data and cloud capabilities for ecommerce matches buyers and sellers like never before

Redcentric Uses Advanced Configuration Database to Focus Massive Merger Across Multiple Networks

Transcript of a BriefingsDirect discussion on the necessity of planning in attempting to merge data and systems across disparate operations.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: HP.

Dana Gardner: Hello, and welcome to the next edition of the HP Discover Podcast Series. I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing sponsored discussion on IT innovation and how it’s making an impact on people's lives.

Gardner

Once again, we're focusing on how companies are adapting to the new style of IT to improve IT performance, gain new insights and deliver better user experiences, as well as better overall business results.

Our next innovation case study interview explores how Redcentric PLC in the UK has tackled a major network management project due to a business merger. We'll hear how Redcentric used advanced configuration database approaches from HP to scale some 10,000 devices across two disparate companies and managed them into a single system.

To learn more about how two major networks became merged successfully, we're joined by Edward Jackson, Operational System Support Manager at Redcentric in Harrogate, UK. Welcome to BriefingsDirect, Edward.

Edward Jackson: Hello.

Gardner: Tell us a little bit about your company and this merger. What two companies came together, and how did that prove to be a complicated matter when it comes to network management?

Enable your network to enable your business  
Download the brochure
Maintain an efficient, secure network

Jackson: The two companies coming together were InTechnology and Redcentric. Redcentric bought InTechnology in 2013. Effectively, they were reasonably separate in terms of their setup. Redcentric had three separate organizations, they had already acquired Maxima and Hot Chilli. And the requirement was to move their network devices and ITSM platform base onto the HP monitoring and ITSM platforms in InTechnology.

It’s an ongoing process, but it’s well on the way and we've been pretty successful so far in doing that.

Gardner: And what kind of companies are these? Tell us about your organization, the business, rather than just the IT?

Jackson

Jackson: We're a managed service providers (MSPs), voice, data, storage, networks, and cloud. You name it, and we pretty much deliver it and sell it as part of our managed portfolio..

Gardner: So being good at IT is not just good for you internally; it's really part and parcel of your business.

Jackson: It's critical. We have to deliver it and we have to manage it as well. So it's 100 percent critical to the business.

Gardner: Tell us how you go about something like this, Edward, when you have a big merger, when you have all these different, disparate devices that support networks. How do you tackle that? How do you start the process?

Data cleansing

Jackson: The first phase is to look at the data and see what we've got and then start to do some data cleansing. We had to migrate data from three service desks to the InTechnology network, and to the InTechnology ITSM system. You need to look at all the service contracts. You need to also look at all the individual components that make up those contracts, and effectively all the configuration items (CIs), and then your looking at a rather large migration project.

Initially, we started to migrate the customer and the contact information. Then, slowly, we started to re-provision devices from the Redcentric side to the InTechnology Managed Services (IMS) network and load it into our HP management platforms.

We currently manage over 11,000 devices. They are from multiple types of vendors and technologies. InTechnology was pretty much a Cisco shop, whereas at Redcentric, we're looking at things like Palo Alto, Brocade, Citrix load balancers and other different types of solutions. So it's everything from session border controllers down to access points.

It was a relatively challenging time in terms of being able to look at the different types of technology and then be able to manage those. Also, we've automated incidents from Operations Manager to Service Manager and then notifying customers directly that there is a potential issue ontheir service. So it's been a rather large piece of work.

Gardner: Was there anything in hindsight that you did at InTechnology vis-à-vis the data about your network and devices that made this easier? Did Redcentric have that same benefit of that solid database, the configuration information? In doing this, what did you wish you had done, or someone else had done, better before that would have made it easier to accomplish?

It was a relatively challenging time in terms of being able to look at the different types of technology and then be able to manage those.

Jackson: Unfortunately, the data on the Redcentric side of the business wasn’t quite as clean as it was on the InTechnology side. It was held in lots of differnet sources, from network shared drives to Wiki pages. It all had to be collated. Redcentric had another three service desks. We had to extract all the data out of them as well. The service desks didn’t really contain any CI information either. So we had to collate together the CI information along with the contacts and customers.

It was a rather mammoth task. Then, we had to load it into our CRM tool, which then has a direct connection automatically using Web Services and into Service Manager. So it initially creates organizations and contacts.

We had a template for our CIs. If they were a server CI or a network CI, it would be added to a spreadsheet, and would use HP Connect-IT to load into Service Manager. It basically automatically created CIs against the customer and the contacts that were already loaded by our CRM tool.

Gardner: Is there anything now moving forward as a combined company, or in the process of becoming increasingly combined, that these due diligence efforts around network management and configuration management will allow you to do?

Perhaps you're able to drive more services into your marketplace for your customers or make modernization moves towards perhaps software-defined networking or other trends that are afoot. So now that you are into this, you are doing your due diligence, how does that set you up to move forward?

New opportunity

Jackson: It opens up a new sphere of opportunity. We were pretty much a Cisco shop, but now we have obviously opened up to a lot more elements and technologies that we actively manage.

We have a lot of software-based type of firewalls and load balancers that we didn’t previously have -- session border controllers, etc and voice products that we didn’t deliver previously -- that we can deliver now due to the fact that we've opened up the network to be able to monitor and manage pretty much anything.

Gardner: Any words of advice for other organizations that may have been resisting making these moves. You were forced to do it across the board with the merger. Do you have any advice that you would offer in terms of doing network management and modernization sooner rather than later, other than the fact that people might just think good enough is good enough, or if it's not broken, don’t fix it?

Jackson: When you're looking at a challenge like this, you have to make sure you do your due diligence first. It’s down to planning, an "if you fail to plan, you plan to fail" kind of thing, and it’s very true.

Enable your network to enable your business 
Download the brochure
Maintain an efficient, secure network

You need to get all the information. You need to make sure that you normalize it and sanitize it before you load it. The cliché is garbage in, garbage out, so there’s no point in putting bad information into a system once again.

We have a good set of clean data now across the board. We literally have 150,000 CIs in our CMDB. So it’s not an insignificant CMDB by any stretch of the imagination. And we know that the data from the Redcentric side of the business is now clean and accurate.

Gardner: How about proving this to the business? For MSPs it might not be as critical, but for other enterprises, this might be a bit more of a challenge to translate these technical benefits into financial or economic benefits to their leadership. Any thoughts about metrics of success that you've been able to define that would fit into a return on investment (ROI) or more of an economic model? How do you translate network management proficiency into dollars and cents or pounds or euros?

Jackson: It’s pretty difficult to quantify in a monetary sense. Probably the best way of quantifying the success of the project has been the actual level of support that customers have been given and the level of satisfaction that the customers now have. They're very, very happy with the level of support that we have now achieving due to Redcentrics ITSM and business service management (BSM) systems. I think, going forward, it will only increase the level of support that we can provide our customers.

As I said, It's quite difficult to quantify in a monetary sense. However, when churn rates are now as low as 4 percent, you can basically say that you're doing something good.

Fundamental to the business

In terms of things like the CIs themselves, the CI is fundamental to the business, because it describes the whole of the service, all the services that we offer our customers. If that’s not right, then the support that we give the customer can’t be right either.

You need to give the guys on support the kind of information they need to be able to support the service. Customer satisfaction is ever increasing in terms of what we are able to offer the migrated customers.

Gardner: How about feedback from your help desk, your support, and remediation of people. Do they find that with this data in place, with it cleansed, and with it complete that they're able to identify where problems exist perhaps better, faster, and easier. Do they recognize whether there is a network problem or a workload support problem, the whole help desk benefit. Anything to offer there?

The CI is fundamental to the business, because it describes the whole of the service, all the services that we offer our customers. If that’s not right, then the support that we give the customer can’t be right either.

Jackson: About 80 percent of the tickets raised in the organization are raised through our management platform, monitoring and performance capacity monitoring. We can pretty much identify within a couple of minutes where the network error is. This all translates into tickets being auto raised in our service management platform.

Additionally, within a few minutes of an outage or incident we can have an affected customer list prepared. We have fields that are defined in Service Manager CI’s that will actually give us information regarding what devices are affected and what they are connected to in terms of an end to end service.

We run a customer report against this, and it will give you a list of customers, a list of key contacts and primary contacts. You can convert this into an email. So for a network outage, within a few minutes we can email the customer, create an incident, create related interactions to that incident, and the customer is notified that there is an issue.

Gardner: That’s the sort of brand reinforcement and service quality that many organizations are seeking. So that's enviable, I'm sure.

Is there any products or updates that could make your job even easier going forward?

Jackson: We're looking at a couple of things. One of them is HP Propel, which is a piece of software that you can hook into pretty much anything you really want. For example, if you have a few disparate service desks, you can have a veneer over the top. They'll look all the same to the customers. They'll have like an identical GUI, but the technology behind it could be very different.

Enable your network to enable your business  
Download the brochure
Maintain an efficient, secure network

It gives you the ability then to hook into anything, such as HP Operations Orchestration, Service Manager, Knowledge Management, or even Smart Analytics, which is another area that we are quite keen on looking at. I think that’s going to revolutionize the service desk. It would be very, very beneficial forRedcentric..

There are also things like data mining. This would be beneficial and also help the auto creation of knowledge articles going forward and giving remedial action to incidents and interactions.

Gardner: Very good. I'm afraid we will have to leave it there. We've been learning about how Redcentric has used advanced configuration database approaches from HP to scale thousands of devices across two disparate networks and create a single entity due to a merger and an acquisition.

I'd like to thank our guest, Edward Jackson, Operational System Support Manager at Redcentric in the UK. Thanks so much, Edward.

Jackson: Thank you.

Gardner: And thank you to our audience for joining this special new style of IT discussion. We've explored and discovered solid evidence from early enterprise adopters of how big data changes everything, for IT, for businesses, for governments, and as well as for you and me, and we've seen how even in the realm of network management big data and analytics is a huge topic.

I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your host for this ongoing series of HP-sponsored discussions. Thanks again for listening and come back next time.

Listen to the podcast. Find it on iTunes. Get the mobile app for iOS or Android. Download the transcript. Sponsor: HP.

Transcript of a BriefingsDirect discussion on the necessity of planning in attempting to merge data and systems across disparate operations. Copyright Interarbor Solutions, LLC, 2005-2015. All rights reserved.

You may also be interested:

• HP at Discover delivers the industry's first open, hybrid, ecosystem-wide cloud architecture
• How Tableau Software and Big Data Come Together: Strong Visualization Embedded on an Agile Analytics Engine
• Big Data Helps Conservation International Proactively Respond to Species Threat in Tropical Forests
• How Globe Testing helps startups make the leap to cloud- and mobile-first development
• GoodData analytics developers on what they look for in a big data platform
• ITIL-ITSM tagteam boosts Mexican ISP INFOTEC's operations quality
• Novel consumer retail behavior analysis from InfoScout relies on HP Vertica big data chops
• IT Operations Modernization Helps Energy Powerhouse Exelon Acquire Businesses
• ECommerce portal Avito uses big data to master rapid fraud detection
• How a Hackathon Approach Juices Innovation on Big Data Applications for Thomson Reuters
• How Waste Management Builds a Powerful Services Contiunuum Across Operations, Infrastructure, Development, and IT Processes
• GSN Games hits top prize using big data to uncover deep insights into gamer preferences
• Hybrid cloud models demand more infrastructure standardization, says global service provider Steria