Network Management - Assignment Example

Case Study ProPrint PLC Brief Introduction ProPrint PLC, is a company engaged in providing full-service colour printing. It operates nationally and currently employs staff with diverse needs. It has recently installed a Kurashiki five colour press which forms a major capital investment for its future growth. ProPrint intends to add additional services: 1. Turn the concepts and copy provided by art directors into a form that is ready to go to press. 2. Commission and co-ordinate the work of specialist agencies in the production of print-ready materials. 3. Move into electronic publishing and multimedia work. The CEO. Ian Kruger is aware that the company must invest and exploit IT in order to remain competitive and to expand its customer base. In addition to that he wants to invest in staff to bring them to the required IT level with appropriate training. Major problems in general Despite the fact that the company has been using computer-based systems for over 20 years it still faces the problems mentioned below: There does not appear to be a comprehensive IT strategy in place with emphasis on driving the business forward and creating a positive impact on the bottom line. This is reflected in the current network architecture, which is somewhat piecemeal reflecting a 'fire-fighting' approach in its design. The management has often been rather slow in developing an IT Strategy for training staff, preferring to 'buy-in' packaged solutions and assemble them in 'building block' fashion. In Kreuger, ProPrint Plc has a 'champion for change' who appears to be adept at obtaining sufficient funding for hardware, software and training. If this is done in the context of the organisation's long term strategy for developing a broader range of services, then it may be possible to win over resistant managers - such as Sheila Lawson - and even to enthuse John Tricker to become proactive. Ironically the complacent or averse attitudes of senior managers echo the underlying core difficulty here, this is a learning resistant organisation. The company has identified 3 main areas of concern in key areas of its operation: 1. customer services, 2. production and 3. quality. However, we consider this approach to be too insular. The company should also consider the impact of its decisions relating to the architecture of its network, on such matters as supply chain management and intranets/internets for internal, B2C and B2B networking. (Verisign) This will become increasingly important as ProPrint Plc expands its range of operations and services. Ultimately its network architecture should be focused on facilitating information exchange for both internal and external users - staff, customers and suppliers. Current and Proposed Future Network Architecture Hardware The organisation currently has 22 servers and 46 workstations as follows: Current Proposed Location S W S W Sales & Marketing 0 6 2 6 Graphic Design Agency 6 5 6 5 Purchasing 0 1 1 1 Studio 5 5 5 5 Transport 0 1 1 1 Production 4 20 4 20 Information Systems 5 2 5 2 Personnel 0 1 1 1 Finance 2 5 2 5 22 46 27 46 S - Servers W - Workstations PC workstations on each desk are an expensive and unnecessary investment by ProPrint - thin clients and a policy of hot desking would be more appropriate to inculcating a culture of using IT to better reflect the fact that IT is there to facilitate production, rather than a means in itself. One would expect the PMS to be at least replicated off-site given that it is mission-critical. Operating Systems The organisation uses a mixture of MacIntosh, Unix (specifically for the CorpVarion PMS) and Windows. This has led to issues of interoperability as the organisation requires the data from the Unix-based PMS to produce management reports in Windows-based applications. The proposed system would be to have one operating system, say Windows running all over or there must be middlewares to communicate across diverse platforms. Mission Critical Application - the PMS The CorpVarion PMS was initially purchased in order to help monitor and control the increasingly complex work in the press room and 'inform the other management functions'. The software was configured by the CEO - but it is not clear whether he had been adequately trained to do so, or indeed whether the software can be configured to meet the organisation's current and future anticipated requirements. Although the PMS seems to be a key application it is poorly understood by staff. Staff does not appreciate for example the importance of data integrity and the possible impact of mis-recording their activities across the business. It appears that the PMS does not have any fail-safes built in, therefore it is urgent that staffs are apprised of the various ways in which they can reduce data entry errors. Failure to address this will lead to increasing costs, and ultimately reduced margins. Data from the PMS is required across the organisation. This should be investigated as a first step as it is more cost-effective than seeking to tweak other non-Unix applications to produce the reports or purchase a new application. Training All Staff have Windows based training, but it appears that no-one other than the CEO has experience with Unix. Assuming that the organisation keeps its current Unix-based PMS then we would recommend that CorpVarion be approached to provide bespoke training on the system - particularly in relation to data extraction for reporting purposes. Further, CorpVarion could be approached to automate the data extraction process for the various reports that the CEO is currently obtaining manually. Current Issues by Department and their proposed solutions Overview As stated earlier the major problem identified at ProPrint is the Unix-based PMS. There are interoperability and data extraction issues, as well as data integrity issues. There are obvious solutions here: a) provide bespoke training to each department and automate the data extraction and reporting requirements for each department or b) replace the current PMS with a Wintel version which meets the organisation's needs In determining which route to take, the organisation will need to have a panoramic view of how it intends to move forward in the forthcoming years. CorpVarion should also be given the opportunity to explain if and how it's revised products will play a role in ProPrint's corporate IT strategy and concerns of interoperability. The Purchasing Department The current system cannot forecast the demand for paper and card. Whilst we do not recommend a particular product it is clear that the solution is workflow software with forecasting capability in order to forecast supply and demand based upon usage. Training will be key here, as the staff need to understand the importance of data integrity and how to check for abnormalities. There is also a requirement for data interchange and connectivity, wired or wireless between the relevant software applications. The Transport Department We are told that the Transport Department uses MS Excel in order to schedule jobs. They need to connect to other departments to receive input and produce reports thus helping in fastening up the entire process. That can be made possible by connecting through ODBC database connectivity feature in MS Excel to other databases. The Finance Department The Finance Department's main concern is data integrity and interoperability between the Microsoft ProFin Accounting package and the PMS. This has severe impact on the ability of the management team to determine profitability. We also note that invoices are manually prepared using a word processing package. Manual preparation of invoices is not time or cost effective, and makes data collation and reporting tedious. We need to establish what information the PMS holds that Finance require and how best to extract it. We will also have to work closely with a Microsoft Solutions Provider to determine which format ProFin can import data. Ultimately we would be seeking to automate the extraction and importation of data between the applications. In the event that the two systems are incompatible, then we would strongly recommend that ProPrint make an executive decision to replace the Accounting package with software which can make use of the data held in the PMS. Whilst there will be an additional training overhead there is little to choose between accounting packages as they tend to be programmed to suit the legal/accounting requirements of the day. It is not clear whether ProFin has an invoicing module - but most alternatives do. We do not anticipate that the learning curve would be particularly steep. The Personnel Department This department maintains staff records, employment contracts and general correspondence in paper-form and the manager is IT adverse. Keeping track of 85 staff members and ensuring that the information held on them conforms with legislation is time consuming. There also seems to be a question mark over current procedures. These will need to be audited for legal compliance and time/motion effectiveness. There is a strong, established business case for implementing a Human Resource Management (HRM) solution. We recommend in the first instance arranging demonstrations of HRM applications, focusing on those with simplistic user interfaces (given that IT is not currently used) and which are configurable so that we can ensure that they closely emulate the manual workflow used in the department at present. This approach will improve user acceptance and compliance with the application. The Customer Services Department This department has identified a need for a Customer Relationship Management application (CRM). This will allow it to capture details of all contact with prospective and existing clients without compromising productivity. Particular advantage of CRM applications is in-built audit trails which will allow the Manager to identify who modified an entry. The better applications also include workflow, so that a particular matter can be escalated to a more senior or experienced member of staff. CRM when used creatively can assist in customer retention. However, what a CRM application cannot do is remove the anxiety of staff that they will be 'blamed' if something goes wrong. This is a 'cultural' matter which IT can only exacerbate. We are therefore concerned that staff will not fully utilise the application as it will be harder for them to cover their tracks. The 'blame' culture will have to be addressed by management. Production Department The Sales team are rightly concerned that the time taken to manually cost a job is losing the organisation business. A networked application which incorporates the business rules for deriving a quotation would be more time/cost effective. The use of 4 separate applications in order to produce the Work Schedule will require careful consideration. There is too much margin for error, particularly since we know that the data in the PMS is unreliable. It is not clear how each application is being used. We will need to establish data requirements, business rules and the workflow with a view to automating this procedure. This will then make alterations faster and less reliant on the expertise of an individual. Works - Studio, Press-room, and Bindery This department is the only one which does not use Wintel hardware/software - it relies on the Apple Macintosh platform. There seem to be two issues in this department. The first is the requirement for data on quality and performance which can be turned into useful information. The second is a training issue - staff cannot be relied upon to enter data correctly. The training issue should be addressed first, as staff are compromising the validity of data on the network and inadvertently reducing margins and lowering productivity. Again CorpVarion could be consulted to determine whether it is possible to build in further checks and balances within their application, but ultimately the cheapest work around is for the staff to understand the impact of their actions. With regard to the need for reports, the Manager will have to work closely with a Systems Analyst in order to determine the content and format of the reports. Securing the Network - Information Assurance Before making any alterations to the network, we must first ensure that we have a clearly outlined and easily understood network security policy which takes into account physical security, access controls/rights and data transmission - particularly in view of the need to communicate with external clients, partners and suppliers. "Defence in Depth is a practical strategy for achieving Information Assurance in today's highly networked environments. It is a "best practices" strategy in that it relies on the intelligent application of techniques and technologies that exist today. The strategy recommends a balance between the protection capability and cost, performance, and operational considerations." [National Security Agency] In putting together a Defense in Depth security policy one must consider the characteristics of one's adversary, the motivation behind an attack and the class of attack. An adversary may be anyone from a competitor to a hacker. Classes of attack include passive or active monitoring of communications, identity theft or close-in attacks. Besides deliberate attacks there may also be inadvertent attacks on the system, such as fire, flood, power outages - and most frequently - user error. Information Assurance is achieved when information and information systems are protected against such attacks through the application of security services such as: Availability, Integrity, Authentication, Confidentiality, and Non-Repudiation. The application of these services should be based on the Protect, Detect, and React paradigm. This means that in addition to incorporating protection mechanisms, organizations need to expect attacks and include attack detection tools and procedures that allow them to react to and recover from these attacks. No system is perfectly secure, and it has been argued that no system needs to be. To achieve Information Assurance focus must be balanced on three elements: People, Technology and Operations. "Security goals have their own contradictions because confidentiality, integrity, privacy, accountability, and recovery often conflict fundamentally. For example, accountability requires a strong audit trail and end-user authentication, which conflicts with privacy needs for user anonymity." (Sandhu 2004, page 3) The deployed infrastructure needs to be able to detect intrusions and to analyze and correlate the results and react accordingly. This infrastructure should help the IT staff to answer questions such as: Am I under attack Who is the source What is the target Who else is under attack What are my options Exploiting the Network to Improve Communication For the reasons identified above, we recommend that the network be adapted in the following way: Recommendations ProPrint Plc should employ a Systems Analyst with strong business skills, preferably in the print production sector ,in order to oversee the Systems Development Life Cycle. ProPrint PLC need to clarify precisely what management functions they wish the PMS application to support and in what ways. It is crucial to involve CorpVarion at this stage as they are best placed to determine whether the application has the capacity required. Below is a network diagram of a proposed system and its various penetrations. Proposed Graphic Design Agency systems Proposed Sales & Marketing systems References Arvato Systems Production Management System - For More detail see: http://www.arvato-systems.com/page/en/solutions/media/print/printing/production/pms/index.html Benton R, 2005: Case Study in Information Security- Securing the Enterprise, Sans Institute Defense in Depth: A practical strategy for achieving Information Assurance in today's DTI Information Security Breaches Survey 2004 Fahey S, 2004: Implementing Defense In-Depth at the Department Level, SANS Institute Highly networked environments. National Security Agency. Available from: www.nsa2.www.conxion.com/support/guides/sd-1.pdf Sandhu R, 2003: Good-Enough Security - Toward a Pragmatic Business-Driven Discipline, IEEE Computer Society The SANS Top 20 Internet Security Vulnerabilities - http://www.sans.org/top20/ Verisign. (n.d.): (1) Building an E-Commerce Trust Infrastructure: SSL Certificates and Online Payment Services. (2) E-Commerce Solutions Available from: http://www.verisign.com/Resources/Free_Guides_and_Trials/index.html White, CM. 2007: Data Communications and Computer Networks - A Business User's Approach. 4th Edition. Thomson Course Technology. Canada. Read More