Maroochy Water Services - Knowledge Management - Case Study Example

Knowledge and its Management: A Case Study of Maroochy Water Services Name: University: Course Title: Instructor: Date: Knowledge and its Management: A Case Study of Maroochy Water Services 1.0 Introduction The current economy is tied to how well an organisation manages knowledge within her possession and reach. Bhatt (2000, p.16) observes that knowledge is a combination of ideas, rules, procedures and information. The hallmark of all these process is meaning making out of the available information. This calls for development of a system that can help in managing knowledge as intangible assets that acts as integral competitive strategy. Additionally, Gavrilova and Andreeva (2012, p.523) notes that a huge portion of knowledge and experience in various institutions is owned by employees and not the employer. This equally calls for an approach of how best to tap them. On the same breadth, Herschel, Nemati and Steiger (2001, p.107) indicates that if this information is not well tapped, they can be used against the organisation as a sabotage or counter competitive strategy. This is critical in information technology that requires security measures to safe guard the integrity of the systems. The aim of this case study essay is to outline concept of knowledge in principle and substantiate what it implies in practice. In this regard, the discourse assess knowledge management situation in the chosen organisation and how knowledge management system can be used to address the same situation by examining the knowledge needs and pinpointing knowledge sources. In contextualising this expose, the paper utilises the cases study of Maroochy Water Services as reported by Abrams and Weiss (2008) which as result of their inability to manage knowledge within their reach suffered massive interference as result of intentional attack by a knowledgeable person who was a disgruntled individual out to settle score with her company which was contracted by the water company on their industrial control system. their inability to manage knowledge greatly relates to their inability to effective adopt security measures developed by National Institute of Standards Technology (NIST) on Industrial Control System (ICS). 2.0 Knowledge and Knowledge Management System Concept There are various theories that seek to examine the application of information and knowledge by business organisations in order to implement their business strategies and edge out competitors. Knowledge-based theory of an organisation or firm is one of the significant information system theories that seek to explain how data, information and knowledge are applicable and useful in the operations of a business organisation. According to the knowledge-based theory of an organisation, knowledge is a significant and strategic resource that determines an organisation’s ability to gain competitive advantage and register superior business performance. This is because an organisation’s knowledge resources are usually embedded in the business culture, policies, operations, identity, systems and human resources of an organisation. This complexity makes extremely difficult to imitate an organization’s knowledge based resources (fsc.yorku.ca, 2010). An organisation’s data generate information and knowledge which are essential knowledge assets in an organization (Muzzucato, 2006, p.305). It is through technology or rather information systems that organisation generates information from data that are from an organisation’s knowledge-based and intellectual assets. The management component arises when organisations are in the potion of generating value from the knowledge assets. It focuses on codifying data from employees, business partners, clients and sharing the information within and without an organisation with the main aim of devising best practices in an organisation. However, not all information is valuable to an organisation and thus organisations should determine what information qualifies their organizational and business strategy needs. Knowledge is the fundamental understanding, insight and practical know-how that enable human beings to intelligently function. This knowledge transforms into manifestations such as a business practice, strategy formulation and technology within organisations and firms. These transformations generate expertise when appropriately used and results into employee and business organization effectiveness hence competitive advantage and superior business performance as compared to those of their competitors (Bagshaw, 2000, p.179). The process of KM encompasses people, process, technology and the organisational structure. Therefore, it is more and not a mere provision of technological solutions (Fink and Ploder, 2009, p.37). The basis of knowledge management system is on information transfer and sharing. Blomkvist (2012, p.904) she notes that “knowledge transfer enhances value by combining the knowledge residing in different geographical locations and enables better use of portioned and fragmented development in the organisation”. This kind of transfer enables organisations to mutually learn from each other either depending on the relationship they have with each other. The same context of discussion is applicable to Maroochy Water Services which utilises Industrial Control System and National Institute of Standards Technology which develops security standards for the same. From this perspective, collaboration, content management, organisational behavioural science and technologies become important (Herschel and Jones, 2005, p.45). 3.0 Knowledge Management Situation at Maroochy Water Services Information communication technology is emerging as one of the critical economic mainstay of a country due to the shift in concepts of doing business from restricted geographical location that demands physical presence to a more ubiquitous approach that is done on real time basis (Fong, 2003, p.149). Industrial Control System is integral in the operations of companies. These protocols allow them to automatically control operations using information technology thus, being in position to deliver services and or goods effectively and a reduced operating cost. The same is applicable to Maroochy Water Services that relied on Supervisory Control and Data Acquisition which is radio-controlled sewage equipment (Abrams and Weiss, 2008, p.2). In this regard, data integrity becomes critical in terms of commands and access. However, as seen as the case of the case study company, organisations might not have internal capacity to implement such projects and thus, contracting or outsourcing becomes necessary. In event of such arrangements, information sharing becomes critical among the parties and other stakeholders in regards to numerous factors like maintenance, ethical use and security among others. However, this is not the case in the scenario experienced Maroochy Water Services. To outline the knowledge management situation in the organisation, this section will examine the knowledge, knowledge gap in the organisation, knowledge need, knowledge source, the use of the knowledge, the actors involved in the management of that knowledge and how Special Publication (SP) 800-53 (Recommended Security Controls for Federal Information Systems) if it was followed would have helped in reducing the impact of the attack. 3.1 The Knowledge, Knowledge need and its use The knowledge in this context can be approached from two perspectives (operating system and the need to secure that operating system). The first is the SCADA an automatic operating system that the Council uses to manage their sewerage system. This knowledge is owned by the Maroochy Water Company. However, the Contracted Company (Watertech Boden ) and the employees who developed and installed it are equally privy to it. The SCADA system is at the core of the knowledge since it the one that controls the operations of the sewer system since it controls the pumping through radio frequencies whereby it receives command prompts from a central control centre on when to start and stop pumping. In managing this kind of knowledge it was prudent to place high levels of restriction so as to guarantee the integrity of the system and reduce possible attack since it is the core of the company operations. Consequently, this gives rise to the knowledge of how to counteract of minimise attacks as developed by NIST and the need to share such information. The second set of knowledge under this context is how to deal with attacks that might arise from outside or inside the organisation. For instance, the policy outlines how to deal with attacks that might arise from disgruntled employees or how third party contracted to supply Industrial Control System can be obliged to keep the documents secrets and at the same time oblige their contracted employees about the same. NIST has outlined guidelines on appropriate safeguards and counter measures for federal ICS such as Supervisory Control and Data Acquisition (SCADA) which equally can be applied by the private sector (Abrams and Weiss, 2008, p.2). To create a vivid picture on the said knowledge, Abrams and Weiss (2008, p.4) lists the security control classes, families and identifiers. These include factors like access control, audit & accountability, awareness training, contingency planning, risk assessment, system & communication protection and system & information integrity. 3.2 Knowledge Gap at Maroochy Water Services From Dunford’s (2000, p.296) conceptualisation, KM comprises of six functions. These include acquisition of knowledge by gathering, synthesizing and interpreting the information. The second step is indexing of the same through conceptualization schemes. The third step is filtering whereby the indexed information is screened in regards to its importance to the organisation. The fourth stage is to link the various sets of information so as to make sense. The fifth is to distribute it and lastly application of the distributed information by various agents. From this framework, the knowledge gap exists in this organisation right from the first step to the sixth one. the same is affirmed by Wiig (2003, p.7) who notes that KM entails “a process where a person receives information about a situation, indentifies what it is about, finds a way to deal with it, deals with it and ascertains that it is done satisfactorily”. The rationale for this argument is based on the fact that they do not display any of those parameters in their engagements. The knowledge management situation that Maroochy Water Services is embroiled in is inability to develop a close working rapport with relevant stakeholders like National Institute of Standards Technology so that they can share critical information such as Special Publication (SP) 800-53 (Recommended Security Controls for Federal Information Systems) which outlines how contracting Federal Companies and private entities can address minimum security controls for their organisational information systems based on the FIPS 199 (Abrams and Weiss, 2008, p.2). The rationale behind this argument is based that the company and its contractor did not have response plan/ emergence preparedness plan to counteract attack on their system by knowledgeable employees of from outside interference thus, reducing their system integrity. In a nutshell, the gap is as result of failure to network with other critical sources of knowledge on securing industrial control systems integrity. The irony on the same is that this policy was existence before they experienced the hacking of their system. 3.3 Knowledge Source and Actors Involved in its Management Knowledge source can be internal and external in nature Petruzzelli, Albino and Carbonara (2009, p.309) observes that co-localization of firms in same area enhance exchange of technological information. Nevertheless, they postulate that it has been proven that knowledge from external sources is equally important and this calls for development of links as in the case of Maroochy, Watertech and NIST. As already acknowledged, there are two sets of knowledge in regard to this context. Thus, the knowledge source would be categorised in to two. The first knowledge source relates to SCADA which is developed by Hunter Watertech Company for application by Maroochy Water Company. The second knowledge source is from NIST that hast provided framework on how such systems can be secured. The first actor that is involved in management of this by offering information on how to secure ICS is NIST. There are specific policy guidelines that would have categorically applied to the Maroochy Water Service and Vitek Boden context. These include policy and procedures that advocates that all organisations should have cyber policy and procedures such as AC-18 Wireless Access Restriction. However, the opposite is true for Maroochy. The second is personnel security which should restrict third party on haphazardly changing employees. If this kind of agreement was in place between Maroochy and Hunter Watertech Boden experience would have not occurred. Thirdly, there was lack of awareness and training. The employees didn’t know what to do in the event SCADA malfunctioned (Abrams and Weiss, 2008, p.9-11). Thus, the guideline developed by NIST had reach materials strategies or risk reduction plan in relation to attack on SCADA. The other subset of actor that is involed in managing of these pieces of knowledge is Maroochy and Hunter Watertech. This stems from the fact that one is the developer and the other is the custodian and user of the same. The rationale for justifying this statement is based on their level of engagement during the investigation stage and sense-making period after the massive failures were noticed and Boden arrested. For instance, Mr. Yager an employee the council’s technical staff gave evidence on the inconsistency on login details and command prompts he observed during the attack. In the same breadth, Mr. Lewer an engineer specializing on installation of computerised sewerage system of Hunter Watertech verified that the massages sent by Boden were from PDS Compact Computers (Abrams and Weiss, 2008, p.6). 4.0 Conclusion The ultimate target of this discourse was to examine the concept of knowledge management in principle and outline what it implies in reality. In this regard the paper explored three integral factors in relation to the case study. The first is the knowledge in the cases study which were established to be two.st relates to SCADA and the second one is on how to secure the same system. Secondly, the paper examines what these knowledge are used for and found out that the earlier is sunned as an application system that controls the operations of computerised sewerage system and the later outlines how these systems should be secured through risk reduction strategies. The last factor examined is the actors in the context of ‘creator’, ‘owner’, ‘user’ and ‘custodian’. The paper established that the creators of this knowledge are Hunter Watertech and NIST. The owners are Maroochy Water Company on behalf of the Local Council and NIST. The user is Maroochy and the custodians are Water Company on behalf of the Local Council and NIST. References Abrams, M. and Weiss, J. (2008). Malicious control system cyber security attack case study- Maroochy Water Services, Australia. Available at: http://csrc.nist.gov/groups/SMA/fisma/ics/documents/Maroochy-Water-Services-Case- Study_report.pdf. Bagshaw, M. (2000). Why knowledge management is here to stay. Industrial and Commercial Training, 32 (5): 179-182. Bhatt, D. G. (2000). Organising knowledge in the knowledge development cycle. Journal of Knowledge Management, 4 (1): 15-26. Blomkvist, K. (2012). Knowledge management in MNCs: the importance of subsidiary transfer performance. Journal of Knowledge Management, 16 (6): 904-918. Dunford, R. (2000). Key challenges in the search for the effective management of knowledge in management consulting firms. Journal of Knowledge Management, 4 (4): 295-302. Fink, K. and Ploder, C. (2009). Balanced system for knowledge process management in SMEs. Journal of Enterprise Information Management, 22 (1/2): 36-50. Fong, M. W. L. In the virtual world in Khosrow-pour, M. ed. (2003). Information technology and organization: trends, issues, challenges and solutions. Hershey, PA: Idea Group Publishing fsc.yorku.ca. (2010). Knowledge-Based Theory of the Firm. Available at: http://www.fsc.yorku.ca/york/istheory/wiki/index.php/Knowledge- based_theory_of_the_firm. Gavrilova, T. and Andreeva, T. (2012). Knowledge elicitation techniques in a knowledge management context. Journal of Knowledge Management, 16 (4): 523-537. Herschel, T. R. and Jones, E. N. (2005). Knowledge management and business intelligence: the importance of integration. Journal of Knowledge Management, 9 (4): 45-55. Herschel, T. R., Nemati, H. and Steiger, D. (2001). Tacit and explicit knowledge conversion: knowledge exchange protocols. Journal of Knowledge Management, 5 (1): 107-116. Muzzucato, M. (2006). Strategy for Business: A Reader. London: Sage Publications Ltd. No. 1, pp. 13-36. Petruzzelli, M.A., Albino, V. and Carbonara, N. (2009). External knowledge sources and proximity. Journal of Knowledge Management, 13 (5): 301-318. Wiig, M. K. (2003). A knowledge model for situation-handling. Journal of Knowledge Management, 7 (5): 6-24. Read More