Information Technology Infrastructure for Bilfinger Deutsche Babcock Middle East FZE - Case Study Example

INFORMATION TECHNOLOGY INFRASTRUCTURE FOR BILFINGER DEUTSCHE BABCOCK MIDDLE EAST FZE Number Date INTRODUCTION Bifinger Deutsche Babcock Middle East is a manufacturing company located in the heart of Middle East. The company started in 1968 with the manufacturer of the first steam power plant to the United Arab Emirates and advanced with the operation from Unit 1 to 6 at Umm Al Nar Power Plant in Abu Dhabi. Since then the company has grow to become one of the reputable forces in the Middle East with impressive portfolio of projects in power, water, oil and gas industries. Its partners include some of the big players such as ADNOC, GASCO, ADGAS, DUBAL, and FERTIL in United Arab Emirates and QAPCO IN Qatar, MEW and ALBA in Bahrain, KNPC in Kuwait, ARAMCO in Saudi Arabia, and ONGC in India. In the Middle East, BDB is one of the leading service providers in gas, power, water and chemical industries providing maintenance, rehabilitation, construction, O&M and lifecycle services (Boudreau, 2008). It has an asset base of over £500 million and order intake of £58 million. It has over 1300 employees operating from Saudi Arabia, United Emirates and Kuwait. It parent company Bilfinger Power Systems GmbH AS AT 2012 had over 10,000 employees and an order intake of £1.178 million For it to operate more effectively and serve a wide base of clients, BDB realized that it requires a network that will facilitate seamless communication between its diverse locations without compromising security of its resources. It has a number of departments including sales with 300 employees while other 900 employees are spread across Finance, Operations, Human Resources, Marketing, production and corporate office in 10 offices in United Arab Emirates. BDB network consist of a backbone, campus, data center, branch/WAN and Ethernet edge. Of late, it has reported a number of vulnerabilities and security breaches in its networks. Due to recent security breaches in the campus network BDB took a major step in 2012 and deployed a secure network provided sufficient security for its operations. Remote access will allow telecommuting employees to access to the main office resources without being necessarily being there. Security is a major concern for remote access and should be treated as such during network design process. CASE STUDY Because of the demands for seamless network access for remote and in-house users as well as security of internal resources, BDB contracted the services of a technology contractor to analyze the business needs and recommend a company-wide solution. The contractor recommended the deployment of a IPSec-based VPN and the process of planning the implementation started in February 2012. Traditionally, VPN is the preferred network for remote and home users. VPN is a combination of software and hardware components that permits employees, telecommuters, business partners and remote business branches to utilize the same company resources as those in the headquarters through a secure private connection with a host network. When implemented, the company employees all over the globe will access the company resources through virtual private connections deployed across the internet. BDB had a backbone network that connects different LANs and sub-networks in its infrastructure. The backbone was connected with a wide area network to cover all the Middle East region and Asia. However due to network performance and network congestion, BDB fails to realize full potential with the network. It had an option of implementing a WAN or an enterprise network. However cost considerations, security and performance remains the major challenge. A VPN would guarantee network access via the internet meaning that remote users would log in to the company’s resources via the internet. VPN provides a host of upsides in an organization. Its implementation in BDB guarantees security as well as performance. VPN connects via Internet to the outside world securing the internet traffic and the corporate assets of the organization. Most of the VPN networks are encrypted so that computers and other devices communicate with them through encrypted channels. Employees in all the branches were able to access the network resources such as files, applications, and printers through local area networks without compromising on the security and privacy. The LANs were connected to the WAN, and the VPN to concentrate all the servers and other networked resources among them all ((CCIE.), Comparing, Designing, And Deploying Vpns, 2006). INFRASTRUCTURAL CHALLENGES FACED BY BIFINGER DEUTSCHE BABCOCK MIDDLE EAST PRIOR TO IMPLEMNTATION OF A SOLUTION The success of corporate business lies in the corporate network. The efficiency of a corporate network in support traditional business determinants such as voice and data together with additional trends such as videoconferencing dictates how far the business in its quest for regional and global dominance. BDB lacks an effective and unified system of communication between all its branches. The following are the particular problems: Remote employees do not have a mechanism of accessing company resources at the headquarters. They have to travel to the headquarters in order to access the resources. External partners and remote users post their data to a web server outside the corporate network. There is a custom file-movement application that retrieves documents posted through HTTPS but is susceptible to attacks. Security issues have been reported frequently and it might impact the reputation of BD. The company is worried that persistent attacks might lead to unauthorized access of confidential information such as copyrights, designs and R&D data (John Ward, 2007). The third issue reported in the company is high overhead costs in managing employee’s movement from one location to the other as they deliver their mandate. The company would like a solution that will allow remote collaboration thereby reducing them to lock in to company SOLUTION A VPN were set to support remote and protected access to the corporate office networks via internet. A remote user with a need to access company data would first log into the company network via public ISP. Once the connection is established, the remote client can communicate with internal company systems in the same way as when logging in as a local host ((CCIE.), Comparing, Designing, and Deploying VPNs, 2013). One provision for BDB was for the network to be segregated such that finance and accounting department’s information and files cannot be accessed by every company employee. This provision is well provided for when configuring the VPN. Through controlled access, VPN were configured to limit access to some subnets of the network while allowing others. IMPLEMENTATION Implementation of VPN in BDB was centered on Windows Server 2012. Windows Server 2012 is the latest of Windows server having been introduced in September 2012. Its biggest characteristics are its innovative user interface, powerful remote management tools, Active Directory Domain Controllers and DFS Namespace and DFS Replication features. Windows Server 2012 is available in four SKUs, Windows Server 2012 DataCenter, Windows Server 2012 Standard, Essentials and Foundation. . BDB set a single application server located in Abu Dhabi and deployed using centralized application deployment architecture. These results were high degree of economies of scale attained through consolidation of key resources in a centralized location. BDB built an application centre in Taweelah UAE to host business critical operations using enterprise-class servers. This allowed remote and local users to access the services and applications equally and efficiently. Servers were installed on enterprise-class machines in proximity with the application centre to act as gateway for the users and applications running on companies are computing systems. Headquarters in Abu Dhabi were architecturally linked with Kuwait, Barhain and Qatar branches so as to achieve seamless communication. This configuration of core IT services consolidated BDB’s computing power, thereby, reducing the number of application servers that aligned with the limited IT infrastructure and staff. Administrative overheads were eradicated in this way, as a single server was in use rather than establishment of cluster of servers in every branch or location. DNS configuration Configuring DNS is one of the basic steps in setting up a VPN in BDB. Configuring DNS was done as well as other important features such as Active Directory, server roles among others. DNS configuration for BDB is proposed to be http://(branchname)/BDB.org. A domain name need was specified to serve as the name of the forest. If the name of server is BDB server, the domain name became SERVER- BDB.SE. IPv6 name resolution mechanism is adopted to provision the server address on the VPN client side either using DNS-based or Windows-based mechanisms. IP addressing was allocated to the DNS-based servers on the VPN client side using static configuration. However, a dynamic technique was also considered so that handshake can be dynamically allocated through IKEv2-based virtual reconnection (Hooper, 2012). Active Directory Controls Implementation of active directories on Windows Server 2012 VPN have solved all these issues as network administrators have enhanced capacity to monitor all the network components including remote users, mobile users, on-site access and printer sharing. Active directories are top-to-bottom hierarchical model that comprise of a forest at the top. The forest comprises of all computing resources utilized by an organization for day to day operation. Just below the forest are domains which comprises of all the organizational elements unto which users and their resources are grouped. In the context of BDB, these are the departmental units (sales, production, R$D, marketing) in the three locations, Abu Dhabi, Taweelah and out of the country locations. Three domains are derived from BDB network, Abu Dhabi, Taweelah and out of country locations consecutively.VPN deployment in Windows Server 2012 introduces three technologies that make it easy to manage active domains. DFS Namespace This is a technique where a network administrator arranges publicly shared folders on different servers into a single logical entity viewable to users as single folder with multiple subfolders.  Windows server 2012 has introduced Windows Powershell cdmlets for management of DFS namespace ((CCIE.), Comparing, Designing, and Deploying VPNs, 2013). The namespace contains millions of files sourced from different servers and locations. It operates in such a manner that when a user searches for a file in the namespace, DFS namespace locates the file in their source server and directs the user to that suffer to retrieve it.  For remote users, namespace has site awareness functionality that learns websites accessed from and direct personnel to where the company resources are through Direct Access. DFS Replication Replication is a phenomenon that involves efficient multiplication of folders in multiple locations and sites. The advantage with replication mechanism is that it delivers data uniformity across the entire organization. Any changes made at a single location are repeated across all servers hence it is recommended that backup be conducted on a single point of entry probable at the headquarters in Abu Dhabi ((CCIE.), Comparing, Designing, and Deploying VPNs, 2013). When a file’s content is changed slightly, DFS automatically detects the changes and updates only the changed contents through Remote Differential Compression method. Windows Server 2012 has a data duplication mechanism that functions in parallel with DFS duplication by saving storage requirements without affect it. Human resource personnel who, for instance, who adds, delete, or modify employee particulars will have all the changes effected in all the servers without exhausting storage needs or DFS functionality. There is no loss of data when one server fails since Windows Server 2012 creates fault tolerance on other servers such that even if the server is dysfunctional, files located in virtual namespaces as well as those on the networks are unaffected. Through Remote Differential Compression, bandwidth lag is eliminated. Servers located on a single branch appear local to those branches while the rest appear to users at their locations in the same manner.  In order to conserve bandwidth, altered data is only replicated while the rest maintains in their states (Hooper, 2012). In respect to BDB, geographically based domain with two master domains is created. One will serve Abu Dhabi while the other will handle remote users. Taweelah will connect to the Abu Dhabi headquarters. BDB has two namespaces, BDB.com and BDB.net. Local domains located in Abu Dhabi use BDB.net while an international domain uses BDB.com. The top level placeholder domain is Abu Dhabi.BDB.com and controls domain user accounts, corporate resources and groups. Network traffic generated by AD replication from the forest top should be replicated without impacting on bandwidth. Thus, routers were configured together with DNS, domain controllers and configuring registry keys. Fig. 1 AD DS tree (Hooper, 2012) Group Policy Group file policy in Windows Server 2012 based VPN is achieved through Group Policy Preferences. The configurations are handled by the network administrator and assigns computer resources to users. Remote users are assigned a group policy such that they can only access the network by logging through their groups. Group policies are managed by administrators and accessed via Group Policy and Group Policy Preferences in an Active Directory Domain Service in the Group Policy Management Console.   Windows Server 2012 based VPN provide additional features under group policy such as event logging and policy caching.  Event logging is an analytical tool that includes information on the duration of sign in while policy caching updates the policy version stored in the local store from the domain controller such that in case of regular log-ins, the most recent downloadable policy is processed. This saves time for accessing policies in asynchronous modes (James F. Broder, 2011). File sharing As outlined above, file sharing is achieved via DFS replication and namespace. These two techniques also provide a mechanism to back up data in a redundant manner. ACHIEVING BUSINESS OBJECTIVES THROUGH TECHNOLOGY INFRASTRUCTURE Remote access increases worker productivity and reduce costs associated with travelling. BDB employees and managers will access network resources remotely via intranet-based and extranet-based virtual private networks. Intranet-based access is applicable to users located internally and will access files and other resources located on computers in the company (Alex Shneyderman, 2003). Users are now able to access everything just as when they are in their offices provided there is internet connection. The most beneficial groups of employees are those in sales, marketing and finance, research and development and planning. They can virtually work from anywhere. This is beneficial for the company and the employees. First, there is flexibility and employees can work on the go thereby increasing productivity. Second, research, development and design team can collaborate from diverse locations. Those in Abu Dhabi can access and collaborate with those in Bahrain, Saudi Arabia and other locations (R. Kelly Rainer, 2010). Security of BDB’s data, information and those of its clients is the fundamental to its continuity. Security is a superior factor for an organization such as BDB. The security of its patterns, designs, employee data, financial information and marketing techniques is crucial to continuance of business and prosperity. Security has been achieved by implementing Windows Server-based VPN. Windows Server 2012 comes with a Network Access Protection functionality to control health certificates of the organization’s IPsec peer authentication intranet tunnels. NAP is controlled by the Health Registration Authority which issues certificates with a System Health Object Identifier after satisfying all the policies. NAP health checks selects the users that are allowed into the network and those that are denied via Remote Access Setup Wizard. Extranet-based connections are applicable for remote and telecommuting users who are always on the move and require BDB resources to execute their functions effectively. Extranet-based resources are extended to groups projects where personnel working on a project are located at different locations of the continent (Shah, 2013).  For, instance, BDB staff involved in product research, development and design could liaise with their counterparts engaged in production and sale representations based outside the country. Before a user’s is authenticated to a VPN network, credentials are exchanged based on administrator provided information. Administrators have a role of defining group object policies based on user’s needs and priorities. Telecommuting personnel such as sales representatives will have their communication equipments installed with security patches, antimalware programs and other custom-made applications to deter security threats. Configuration of forward facing IP addresses together with access privileges are provided via Direct Access functionalities in GPO ((CCIE.), Comparing, Designing, And Deploying Vpns, 2011). TIMELINE The solution plan involved cooperation from all parties and shareholders to ensure that the expectations of all parties are agreed upon. Planning and installation plan is represented in the table below Timeline Activity Team February 2012 Appoint implementation team Executive management, line managers and project manager March 2012 Involve users to determine project plan Project manager April – August 2012 Source for vendor and purchase necessary materials Project manager, executives and project managers September –December 2012 Installation and implementation Project team and vendor Jan –April 2013 Testing and support Vendor and project team RESULTS AND CHALLENGES AND FEEDBACK Results from the implementation of a VPN in BD indicate that the organization took the right decisions. Remote access is guaranteed meaning that employees can work from whichever location they desire. Network security is also enhanced as strong authentication tools are in place to guard unauthorized access. Employees and management are all elated that they can access their working resources from whichever they are and function normally. Their motivation to work is high. Results from the six months of operation from initial installation also indicate that operational and maintenance costs have significantly reduced. Currently they are saving up to 45% from their normal charge. Information from the company detailed the following results: Challenges Implementing VPN is a complicated process with significant problems in fielding certificate-based authentication. There is lack of interoperability as Microsoft and other players have town tailor made PKI clients. It required that only Microsoft conversant implementing team be employed. Second, there was an issue that since VPN is independent of the transport network internet might not be reliable enough to provide scalable bandwidth. Likewise, if bottlenecks exist between VPN nodes communication and the security of company data and information might suffer (Hooper, 2012). Another challenge is about management of VPN’s. Most vendors provide a client/server GUI for administration. However, at the implementation time, in-house IT personnel were not competent enough to administer over it, delegating the responsibility to the vendor instead as they underwent training. LESSONS LEARNED A VPN take advantage of existing organizational infrastructure like internet to deliver worldwide availability to employees. Network access is safeguarded via encryption while users are tunneled into the system isolated from the internet. VPN’s can save organizations up to 60% of costs over personal networks and commercial modem banks. VPN’s are naturally becoming an extension of the internet. However, it is not a fit all package. Small organizations with less than 500 employees pays less to set and use it while large corporation like BDB which require additional security will require sizeable investment and customization. It is always advisable to use a VPN that is scaled to the needs of the organization. The rule of the thumb is to conduct an in-depth analysis to determine the current needs as well as long-term investment options. RECOMMENDATION BDB was driven by the need to acquire remote access for its geographically-diverse employees as well as costs savings and a more secure network. It has successfully implemented and tested the VPN network and already reaping the benefits. It is recommended that BDB constantly review its service level agreement with the vendor to ensure that it benefit fully from the system. As the organization grows, the best solution will always be the one that can provide worldwide connectivity without compromising security and performance. BDB is advised to review its needs from time to time to best reach the decision to outsource or implement their own systems. References (CCIE.), M. L. (2006). Comparing, Designing, And Deploying Vpns. Adobe Press. (CCIE.), M. L. (2011). Comparing, Designing, And Deploying Vpns. Adobe Press. (CCIE.), M. L. (2013). Comparing, Designing, and Deploying VPNs. Adobe Press. Alex Shneyderman, A. C. (2003). Mobile VPN: Delivering Advanced Services in Next Generation Wireless Systems. John Wiley & Sons. Boudreau, M.-C. A. (2008). Green IS: Building sus- tainable business practices.” Information Systems:. A Global Text . Hooper, H. (2012). CCNP Security VPN 642-648 Official Cert Guide. Cisco Press. James F. Broder, G. T. (2011). Risk Analysis and the Security Survey. Elsevier. John Ward, J. P. (2007). Strategic Planning for Information Systems. John Wiley & Sons. R. Kelly Rainer, C. G. (2010). Introduction to Information Systems: Enabling and Transforming Business. John Wiley & Sons. Shah, Z. H. (2013). Windows Server 2012 Hyper-V: Deploying the Hyper-V Enterprise Server Virtualization Platform. Packt Publishing Ltd. APPENDICES JOURNAL ENTRY This is an opportunity to present my knowledge and expertise in IT infrastructure and use it solve organizational problems. Organizations face a lot of operational, management or logistical issues a result of lack of sufficient capital to deploy better technologies or solutions or as a result of the way in which those solutions are deployed. One particular organization that I studied is Bifinger Deutsche Babcock Middle East. BDB Middle East is a regional provider of construction, maintenance, rehabilitation and O&M services in gas, chemical, water and oil industries. It is due to lack of an cost-effective and efficient network that it was motivated to implement VPN in 2013. From my analysis, I realized that BDB has gained immensely from the implementation of this system. The challenges to the implementation process ranged from the maturity of VPN’s over internets to management skills and knowledge for in-house employees to lack of a standardized framework between VPN and other communication protocols. JOURNAL ENTRY In this project I explored Virtual Private Network as a solution to Bifinger Deutsche Babcock Middle East’s availability, security and costs issues. VPN as an infrastructural solution to problems frequently exhibited by organizations should be approached and implemented following industries best practices. In the process of implementing it, Bifinger Deutsche Babcock Middle East conducted an organizational-wide user needs analysis to validate the suitability of the system. I realized in my research that the needs of the users were fully meet since they could now access the company’s network and share files from wherever they are based so long as they were able to establish internet connectivity. Though I reported some challenges as a result of the technology itself and the implementation process adopted, they were far less pronounced to endanger the organizational data or that of its employees. In conclusion, Bifinger Deutsche Babcock Middle East choice and implementation of VPN was a good move and one that guaranteed ROI. JOURNAL ENTRY This is an opportunity to demonstrate what I have learned in class by considering a large enterprise and exploring some of the infrastructural technologies they have adopted over time to improve their performance and competitive edge. First, and using a case study approach, I explored Bifinger Deutsche Babcock Middle East in terms of the problems it had before the adoption of the technology and the benefits derived afterwards. The company required to establish a global connecting network that seamlessly brought together all its employees and stakeholders for competitive collaboration. After initial analysis, I realized that Bifinger Deutsche Babcock Middle East business undertaking is complex and required constant communication with the headquarters in Abu Dhabi. A viable network for them was a Virtual Private Network. In my opinion, it has always been difficult to quantify the tangible benefits of a technological solution in a company, but for Bifinger Deutsche Babcock Middle East VPN, SMART results were obtained. Employees could now connect seamless and collaborate in construction, rehabilitation, O&M and maintenance of water, oil, power and chemical sectors from wherever locations they were based at. JOURNAL ENTRY This is a project that tested my comprehension of the contents learned in the course and the ability to apply it to real life applications. Virtual Private Network is a subset of IT infrastructure that we already studied during the course. The applicability of this knowledge to operational life of organizations is captured in Bifinger Deutsche Babcock Middle East case study. In the research, I have studied the infrastructural composition of BDB and analyzed the reason for adopting the technology. I talked about: Problems faced by BDB in serving Middle East energy, water and power industry How the problems are inhibiting growth and expansion to other parts of the world The steps taken by BD in addressing the issues including the timeline of the project The challenges faced by Bifinger Deutsche Babcock Middle East in deploying the infrastructure I also recommended the best techniques for leveraging the infrastructure to achieve better results and return on investments. BDB should manage VPN in an effective way by training its personnel and administrators and providing upgrades and updates frequently. Read More