Burton Group Identity Blog

NCR Leaves Dayton: It's About Time

Blogger: Kevin Kampman

Last week I was at the Novell Analyst Briefing in Waltham, the type of event where intellectual competitors are on their best (if somewhat restrained) behavior. It’s an event where we find things to discuss that aren’t contentious and that don’t reveal what we are really thinking. We save that for later.

At the dinner reception, I shared a conversation with a fellow analyst about other companies we knew. Since I live near Dayton and once worked for NCR, we had a nice chat about former CEOs, in particular, Charles Exley. She recalled that he was one of the last “true gentlemen” and how she was impressed about his collection of antique timepieces in his New York office. The passing of the hours was notable, in that the chimes all went off together.

Upon my return, I learned that NCR has decided to pull up its Dayton roots after 125 years and move everything to Georgia. Following upon the demise of several automotive facilities in the area, this is not good news. But, it was a long time coming and not without indication. Many former NCR employees believe it was the ill-fated 1990’s acquisition and divestiture of the company by AT&T that signaled the end.

I learned many things at NCR, among them: Managers do not speak “IT”, politics run rampant, and nice guys finish last. The Governor of Ohio and Mayor of Dayton both cited inaccessibility of NCR CEO Bill Nuti as part of the problem. He didn’t come to Dayton; they didn’t visit him in New York. Lesson learned: “There’s your sign”. It’s obvious that Georgia did a better job than Ohio of communicating with NCR about its future needs than its legacy. For that reason, NCR is moving on. 

In our recent role management customer inquiry project, Ian Glazer and I interviewed many companies and heard over and over about how important communications and governance are to project success. We’ll be discussing this at Burton Group’s Catalyst Conference in San Diego. In the meantime, if you aren’t having effective conversations with management, remember that silence may not be golden.

Green bar paper, death decks, and process improvement

Blogger: Kevin Kampman

In my speaking engagements, I've learned that I sometimes refer to experiences that make no sense to younger folks in the audience. For example, I once spoke about a military data breach where physical, paper records about veterans were removed from an archive facility. I teasingly referred to the "green bar" records as the media that was stolen. I learned later from a participant in the audience that about half of the people there had never seen a report printed on paper with those printed green bars (a feature designed to improve readability). A dinosaur, it seems.

I've learned to keep this in mind when I address an audience, and in fact, use it as a way to gauge their experience. A term I used last week to refer to a security threat was "death deck", a term that hearkens back to the days when computers read programming instructions from something known as a "tab card". It seems that a programmer about to lose his job left a script in place that would destroy data on the computers at a lending institution, delete the OS, and shut the serves down. Fortunately his script was discovered beforehand, and he is now being prosecuted. In olden days, this sort of script was referred to as a death deck. The only difference between then and now is the media employed.  Only two people out of 50 had heard the term, or would admit to it.

Subsequent to my speech, I met with a company who had been trying for a number of years to get an identity management initiative off the ground. There were many people in the room; all there looking for magic insights about how to achieve efficiency, demonstrate return on investment, and achieve compliance. A basic issue they cited is that it takes three weeks for new hires to get assigned to resources; in the meantime the new hires sweep floors. While this may seem like a provisioning problem, we've also come to understand that there may be something more fundamental at work here: Poor business processes.

When I started in the IT industry, one of my first jobs was designing business forms. You might not know what that is, but essentially forms were (and are) a way to design and implement a business process. A good forms design demonstrated the process essentials, demonstrated workflows, and captured the associated attributes and decision artifacts. Designing a form required a good understanding of its application. During the analysis effort, more efficient alternatives often became apparent. As with any automation effort, a good form could not make up for a bad process. It could, however, help to point one out.

In the organization with apparent IdM challenges, the audience was mostly IT folks. No one from the business or human resources community was present for our meeting. Given their difficulty in justifying their initiative, or even finding the right problem to solve, I think it is important to point out that IdM doesn't operate in a vacuum. It is integrally related to business processes and procedures, and this alignment can't be discounted. The point of this is that IdM efforts must always demonstrate business alignment. On the other hand, if the organization has process challenges, they shouldn't look to IdM to solve them. Proper process design and flow are essential to the success of any initiative, regardless of the technology we employ to implement it.

Something’s aMISs: Identity MIS-management

Blogger: Kevin Kampman

In a conversation with one of our subscribers last week, we heard about an unintended consequence of an identity management (IdM) initiative. After putting all of the people with associations to the enterprise into the Human Resource Management System (HRMS), the executives of the organization got the mistaken impression that there were more employees on the payroll than they anticipated. This was a result of classification issues, but it gave the IdM initiative a bad name.

In this case, the data was correct, just not organized to tell the right story. There were more people working for the organization than expected; not all of them were employees. This is a useful metric, and it’s unfortunate that the reporting system took the blame. It is a possible case of “shooting the messenger”. This organization needed to look at the overall picture, not just one number. In an upcoming report, analysts Gerry Gebel and Lori Rowland will address the issues associated with managing identities who aren’t employees.

In a case of “doing more with less”, however, we’ve also discovered that this kind of information can be used for fraudulent purposes. B. Ramalinga Raju, the founder and chairman of Satyam Computer Services, an Indian information services outsourcing firm, reportedly confessed to padding the company’s employee count by nearly 10,000 people and then directing those payroll funds for personal gain, according to the New York Times. As a provider to some very large companies, Satyam will be scrutinized for possibly charging those customers for phantom resources.

Whenever we architect solutions, we focus on what they are intended to do. If you’ve ever seen a string used to open the drawer on a cash register, however, you know it’s likely that someone is running two sets of books. There’s always someone looking for a way to compromise the system. For example, imagine if a company received a tax concession in return for creating more jobs in a community. Unless someone watched the overall headcount, they could lay off staff, hire replacements and claim to meet hiring expectations.

IdM solutions can tell the right story to those willing to listen. It is the responsibility of the entire IdM community to listen to business management, to regulators, and to shareholders, and anticipate that the questions they’ll ask can be answered accurately. The biggest risk to IT is in not understanding and promoting the real value and benefits that IdM brings to the enterprise. A possible outcome of the Satyam situation is that there will be more scrutiny of IdM and HRMS solutions. We should be prepared for additional controls and accountability, as well as tighter coupling between the all of the systems that deal with identity information. IdM should provide transparency, that is, effective information to whoever is pulling the strings.  

Sometimes you just HAVE to see if it’s really HOT…

Blogger: Kevin Kampman

Yesterday I read an advisory that the trend to offshore general and administrative functions such as IT and HR will continue. Finding the most effective way to provide well-understood capabilities that are not core to the business is a legitimate choice; the devil is in the terms “well-understood” and “core to the business”.

For identity management, the consumer world is being viewed as growth territory. Over the holidays I discovered that poor internal identity processes conditions are bleeding into the consumer space.

My first inkling of this came when we agreed to move from standard cable service to the “new, high speed” service. We agreed to this based on a telemarketing call, in which the salesperson told us they’d turn it on right away. I didn’t associate this change with the new network device that arrived several weeks later. I just plugged that in and returned the old one. All the lights came on, everything seemed to work, and we thought nothing more about it. Until a few days later, when things stopped working.

When I called the support line, they said everything looked OK and said I’d need to speak to a local representative. That resulting in my being placed into a support queue, which indicated that there was an outage and that technicians had been dispatched. OK, no problem, I hung up and we went about our holiday shopping and wrapping.

The next day, things still didn’t work, so I called again. The technician said there was nothing wrong with the service, and passed me on to national support. National support said our account had been deactivated, and that I’d need to speak to a local support desk. I had a bad feeling about what was coming next.

The initial contact with support confirmed that we’d been deactivated, based on the device change. The technician tested the connection and asked if I knew someone with an Illinois address. No, but it turns out that the new network device was registered to them, not to me. Turns out that they tie customer identity to a MAC address, and mine had gone away. Hmmm. Can anyone say “provisioning?”

The technician had to escalate the call. After another hour on hold in the support queue, I spoke to a young lady who found three problems to fix. One required reregistering the device, the second involved reactivating our account, the third involved removing the old service and initiating the new one. This took another 15 minutes. What impressed me the most was how she kept thanking me for my patience. I imagine I was an exception, but I knew this was going to be ugly going in.

Bringing it to a close, this experience highlights a problem that offshoring won’t fix. First of all, if you don’t have a good process in place, it is not likely that moving the process overseas will make it better. Second, as we’ve identified time and time again, provisioning doesn’t fix your process shortcomings, either. Mixing the customer into the process is as likely to damage brand value as to improve service if the overall program isn’t worked out well in advance.
.
To cap off this rant, I also discovered a potential security problem with one of my mobile devices. I let the carrier know about this before Christmas via their support page, and finally heard back from them in January. The message asked me to call a toll free number; the support technician didn’t have a telephone.

When I called the number, the technician I reached couldn’t match the supplied case number to any of their support systems. I could exchange email with the first technician, who insisted the case number was valid (but who didn’t have a phone), and talk with another, who couldn’t make the reference number work. Hmmm… Can you say Catch 22? 

This experience highlights that identity is not the only area where process and system integration is lacking. If business processes aren’t well understood, and organizations push them off to providers who are less invested in a successful outcome, the result may very well have a negative impact on the core business. The opportunity here is for companies to clarify, organize, and perhaps simplify operational processes. It is not realistic to expect offshoring to make things better in the absence of an understanding of core responsibilities.