Mod II
Content
Information System
Information System in Organization
Management Level
Top Management
Decision Type
Strategic Decision
Information Type
Unstructured Information Semi Structured Information Structured Information
Middle Management Low level Management
Tactical Decision
Operation Decision
Types of Computer based Information System
Information System
Transaction Processing System (TPS)
Level Of Management
Low level Management
Management Information System (MIS)
Decision Support System Executive Information System / Executive Support System (EIS / ESS) Office Automation System (OAS) Group Decision Support System (GDSS)
Middle Level Management
Top Management Top Management All level of management Top Management
Office Automation System
Office Automation is the use of technology to help people do their jobs better & faster. OR The use of computer, micro electronics & telecommunications to help to produce, store, obtain & send information in the form of pictures, words or numbers, more reliably, quickly and economically.
Types of Office Automation Systems
1. Document management systems 2. Message handling systems 3. Teleconferencing systems
Document Management System
1. Word Processing
– Word processing software lets you create, edit, store, retrieve, and print a text document.
2. Desktop Publishing
– Desktop publishing (DTP) enables you to produce welldesigned pages that combine charts and graphics with text and headlines in a variety off typefaces, it lets you to do all this at your desk, without a ruler, pen or paste. – Desktop publishing is software which involve using a microcomputer, mouse, scanner, laser or Ink Jet printer, for mixing text,, and graphics to produce high quality output for commercial printing.
Document Management System
3. Image Processing System
– Image processing system is also called electronic image management system, allow users to electronically capture, store, process, and retrieve images of documents. These documents may include text, numeric data, handwriting, graphics and photographs.
Message Handling System
1. 2. 3. 4. 5. 6. 7. 8. 9. Telex Fax Teletext Videotext Electronic Mail Voicemail EDI (Electronic Data Interchange) EFT (Electronic Fund Transfer) Bulletin Boards
Teleconferencing Systems
1. 2. 3. 4. Audio Conferencing Video Conferencing Computer Conferencing Telecommuting
Transaction Processing System
• A Transaction Processing System (TPS) is a type of information system that collects, stores, modifies and retrieves the data transactions of an enterprise. • Transaction processing systems offer enterprises the means to rapidly process transactions to ensure the smooth flow of data and the progression of processes throughout the enterprise.
Batch Schematic
Data entry of accumulated transactions
Input (batched)
Output
On-line Schematic
Terminal Terminal Terminal
Output
Terminal
Immediate processing of each transaction
Terminal Terminal
Types of TPS
• Batch Processing: Batch processing is a resource-saving transaction type that stores data for processing at pre-defined times. Batch processing is useful for enterprises that need to process large amounts of data using limited resources. • Real Time Processing: A system whereby each transaction is processed immediately, without the delay of accumulating transactions into a batch. Its primary factor is speed.
Transaction Processing Qualifiers
Transaction Processing must have the ACID test 1. Atomicity: Atomicity means that a transaction is either completed in full or not at all 2. Consistency: TPS systems exist within a set of operating rules (or integrity constraints). 3. Isolation: Transactions must appear to take place in isolation. 4. Durability: Once transactions are completed they cannot be undone.
Data entry & input
Processing
Documents & reports
Internally generated transactions: • shipped orders • purchase orders • employee time cards Externally generated transactions: • customer orders • vendor invoices • customer payments Database update: • customer orders • inventory • purchase orders • customers • suppliers Database
Documents: • pick list • cheques to vendors • receiving notices • paycheques Operational reports: • finished product inventory status • raw materials; packing materials; spare parts; inventory status
Data Processing Activities Common to TPSs
• A transaction processing cycle
• • • • • • Data collection Data editing Data correction Data manipulation Data storage Document production
Original data Data collection Data edit
Data correction
Data manipulation
Data storage Document production
Management Information System
Information system at middle and lower level of an organization that serve the functions of planning, controlling, and decision making by providing routine summary and exception reports. OR A management Information system (MIS) is an information system that provides predefined types of information to management.
Components of MIS
1. 2. 3. Hardware Input and output devices constitute the hardware components of MIS Software The programs and applications that convert data into machinereadable language are known as software Procedures Procedures are sets of rules or guidelines, which an organization establishes for the use of a computer-based information system Personnel The computer experts, managers, users, analysts, programmers, database managers, and many other computer professionals who utilize the computer-based information systems are the personnel in a management information system
4.
Properties of Management Information System:
• Support structured and semi structured decisions, primarily at the middle and lower level management • Management Information system (MIS) is intended principally to assist middle level management. It helps them with tactical decisions. It enables them to spot trends and get an overview of current business activities. • Provide fixed types of reports in an established format • Management Information system (MIS) are relatively inflexible • The information requirements of users are normally known and stable
Cont…
• Often hardcopy reports • Usually require a formal run schedule • Management Information system (MIS) generally aid in decision making using past and present data • Management information system (MIS) rely on existing corporate data and data flows • Usually consists of internal operational data rather then data about the external environment • More concerned with data about the past than data relating to the future • Often oriented to summary and exception reporting
Documents & Reports by Management Information System:
a. Scheduled Reports: Scheduled reports also called periodic reports are those that are issued periodically i.e. hourly, daily, weekly, monthly, quarterly, or annually. Examples of such reports are daily production report and monthly performance report. These types of reports can be used either for planning or control purposes. b. Exception Reports: Exception reports are issued when something unusual takes place that require the attention of management. For instance, an expense overrun would likely trigger the generation of an exception report or an inventory report that lists only those items that number fewer than 10 in stock. Exception reports are used primarily for control purposes.
Cont…
c. Demand Reports: Demand reports are generated when someone with authority request information in response to an unscheduled demand. An executive asking for a financial report or director finance order a credit background report of an unknown customer who want to place a large order. d. Summary Reports: Summary reports show totals and trends. An example would be a report showing total sales by office, by product, by salesperson, of overall total sales.
Decision Support System
• Decision Support systems are computer based information systems that provide interactive information support to managers and business professionals during the decision-making process.
• Decision support systems use the following to support the making of semi-structured business decisions – Analytical models – Specialized databases – A decision-maker’s own insights and judgments – An interactive, computer-based modeling process
Types of DSS
• Communication-driven DSS Most communications-driven DSSs are targeted at internal teams, including partners. Its purpose are to help conduct a meeting, or for users to collaborate. The most common technology used to deploy the DSS is a web or client server. Examples: chats and instant messaging software, online collaboration and net-meeting systems. • Data-driven DSS Most data-driven DSSs are targeted at managers, staff and also product/service suppliers. It is used to query a database or data warehouse to seek specific answers for specific purposes. It is deployed via a main frame system, client/server link, or via the web. Examples: computer-based databases that have a query system to check (including the incorporation of data to add value to existing databases).
Cont…
• Document-driven DSS Document-driven DSSs are more common, targeted at a broad base of user groups. The purpose of such a DSS is to search web pages and find documents on a specific set of keywords or search terms. The usual technology used to set up such DSSs are via the web or a client/server system. • Knowledge-driven DSS: Knowledge-driven DSSs or 'knowledgebase' as they are known, are a catch-all category covering a broad range of systems covering users within the organization setting it up, but may also include others interacting with the organization - for example, consumers of a business. It is essentially used to provide management advice or to choose products/services. The typical deployment technology used to set up such systems could be client/server systems, the web, or software running on standalone PCs.
Cont…
• Model-driven DSS Model-driven DSSs are complex systems that help analyze decisions or choose between different options. These are used by managers and staff members of a business, or people who interact with the organization, for a number of purposes depending on how the model is set up - scheduling, decision analyses etc. These DSSs can be deployed via software/hardware in stand-alone PCs, client/server systems, or the web.
Components of DSS
• Database Used for query and analysis Current or historical data from number of applications or groups May be small database or large data warehouse • User interface Often a Web interface • Software system With models, data mining, other analytical tools
Overview of DSS
Cont..
• Model:
Abstract representation that illustrates components or relationships of phenomenon; may be physical, mathematical, or verbal model
1. Statistical model : A statistical model helps establish
relationships, such as relating product sales to differences in age, income or other factors.
2. Optimization models : Optimization models determine
optimal resource allocation to maximize or minimize specific variables such as cost and time.
Cont…
3. Forecasting models: Forecasting models are used to forecast future conditions, such as sales, given a range of historical data. 4. Sensitivity analysis models: Sensitivity analysis models ask “what if” questions to determine the impact of changes in one or more factors.
Characteristics of DSS
• They support unstructured decision making. • DSS provide support for decisions and problems whose solutions can't be specified in advance. • Support decision making at top levels of management. • Provide fast response. • Provide high degree of user control and interaction. • Flexibility in specifying output requirements.
Cont…
• DSS offer users flexibility, adaptability, and quick response. • They are flexible enough to respond to the changing needs of decision makers. • DSS operate with little or no assistance from professional programmers. • Ease of use and ease of development for non professionals.
Geographic Information System
• Geographic Information System (GIS) is a collection of computer hardware, software and geographic data used to analyze and display geographically referenced information. • GIS is a decision support system designed specifically to analyze spatial information. • Spatial information is any information that can be shown in map from such as roads, the path of hurricane, sewer system etc.
• With its capabilities for spatial analysis, GIS can reveal hidden patterns and relationships between data that aren’t readily apparent in spreadsheets or statistical packages. • GIS is a data driven DSS • Example of GIS Software: GRASS (Open source), AutoDesk & ESRI
Application of GIS
• Earthquake Mapping • Market Research • Demographics, health research & census data
Web-based customer decisionsupport systems (CDSS):
• Support decision-making process of existing or potential customer
• Use Web information resources and capabilities for interactivity and personalization to help users select products and services • E.g., search engines, intelligent agents, online catalogs, Web directories, newsgroup discussions, other tools • Automobile companies that use CDSS to allow Web site visitors to configure desired car • Financial services companies with Web-based assetmanagement tools for customers
Group Decision Support System (GDSS)
• An interactive, computer-based system that facilitates solution of unstructured problems by a set of decision-makers working together as a group. It aids groups, especially groups of managers, in analyzing problem situations and in performing group decision making tasks. • Each participant has a computer terminal from which they interact with the rest of the group. The computers are networked so that each individual's screen is private, but the information they enter is displayed anonymously on a public screen.
Cont..
• Four configuration of group members are :
– Group members in one room operating on network with common display screen to share the display for all members. GDSS process is transparent. – Group members sit at their respective location and use their desktop and LAN to interact with other members. GDSS process is not as transparent as previous case.
Cont..
• Group members are in different cities and they come together
Process of GDSS
A typical GDSS session includes four phases: 1. Idea Generation 2. Idea Consolidation 3. Idea Evaluation 4. Implementation Planning
Advantages of GDSS
• Anonymity – drive out fear leading to better decisions from a diverse hierarchy of decision makers • Parallel Communication – eliminate monopolizing providing increased participation, better decisions • Automated record keeping – no need to take notes, they’re automatically recorded • Ability for virtual meetings – only need hardware, software and people connected • Portability - Can be set up to be portable… laptop • Global Potential - People can be connected across the world • No need for a computer guru – although some basic experience is a must
Disadvantages of GDSS
• Cost –infrastructure costs to provide the hardware software/room/network connectivity can be very expensive and • Security – especially true when companies rent the facilities for GDSS; also, the facilitator may be a lower-level employee who may leak information to peers • Technical Failure – power loss, loss of connectivity, relies heavily on bandwidth and LAN/WAN infrastructure – properly setup system should minimize this risk • Keyboarding Skills – reduced participation may result due to frustration • Training – learning curve is present for users, varies by situation • Perception of messages – lack of verbal communication could lead to misinterpretation
Expert System
• Expert System – is an information system application that captures the knowledge or expertise of a specialist and then simulates the “thinking” of that expert for those with less or no expertise. • Expert System are also called knowledge based systems or artificial intelligence based systems
Components of Expert System
a. Knowledge Base:
• At the center of any Expert System their is knowledge base, which contains specific facts about the expert area and rules that the Expert System will use to make decisions based on those facts.
b. Inference Engine:
• The engine inference is the portion of the Expert System that performs reasoning by using the contents of the knowledge base in a particular sequence. During the consultation, the inference engine examines the rules of the knowledge base one at a time, and when rule condition is true the specified action is taken. In Expert Systems terminology, the rule is fixed when the action is taken.
Cont..
• Two main methods have been devised for the inference engine to use in examining the rules: forward reasoning and reverse reasoning. 1. Forward Reasoning:
Forward reasoning is also called forward chaining; the rules are examined one after another in a certain order. The order might be the sequence in which the rules were entered into the rule set, or it might be some other sequence specified by the user. As each rule is examined, the Expert Systems attempt to evaluate whether the condition is true or false. For example, a medical expert system may be used to examine a patient's symptoms and provide a diagnosis. Based on these symptoms, the expert system might locate several diseases that the patient may have.
Cont..
2. Reverse Reasoning: Reverse reasoning is also called backward chaining; the inference engine selects a rule and regards it as a problem to be solved. Such procedures are often called goal driven inferential processes. For example, the expert system might be given the goal to "find the symptoms of this disease" and would work back from there, asking questions as necessary to. confirm. c. User Interface: Users often interact with the Expert Systems through a user interface. In most cases, the Expert Systems prompt (asks) the user to supply information about the problem and the user types in the requested data. The data entered are examined by the inference engine and compared to the facts, rules, and the relationships in the knowledge base. This examination and comparison process results in the system continuing to prompt the user for more information until the system has enough data about the current problem so that it can reach a conclusion.
Application of Expert System
Expert systems are especially important to organizations that rely on people who possess specialized knowledge of some problem domain, especially if this knowledge and experience cannot be easily transferred. Artificial intelligence methods and techniques have been applied to a broad range of problems. • MYCIN, was created to help physicians diagnose and treat bacterial infections
Cont…
• Expert systems have been used to analyze geophysical data in our search for petroleum and metal deposits (e.g., PROSPECTOR). • Used by the investments, banking, and telecommunications industries. • They are essential in robotics, natural language processing, theorem proving, and the intelligent retrieval of information from databases.
Advantages of Expert System To The Firm:
a. Better Performance For The Firm:
As the firm's managers extend their problem solving abilities through use of Expert Systems, the firm's control mechanism is improved. The firm is better able to meet its objectives.
b. Maintain Control Over The Firm's Knowledge:
Expert Systems afford the opportunity of making the experienced employee's knowledge more available to newer, less experienced employees and of keeping that knowledge in the firm longer, even after the employees have left.
Disadvantages of Expert Systems
a. The Knowledge Engineering Bottleneck:
The enormous time and efforts required extracting the expert's knowledge and translating it into IF/THEN rules upon which an expert system is based.
b. The Programming Bottleneck:
Programming the system and maintaining the code is very difficult.
c. The Learning Problem
d. Judgment Problem
Executive Information / Support System
• An Executive Support System ("ESS") is designed to help senior management make strategic decisions. It gathers, analyses and summarizes the key internal and external information used in the business. • Address nonroutine decisions requiring judgment, evaluation, and insight • Example: ESS that provides minute-to-minute view of firm’s financial performance as measured by working capital, accounts receivable, accounts payable, cash flow, and inventory • A good way to think about an ESS is to imagine the senior management team in an aircraft cockpit - with the instrument panel showing them the status of all the key business activities. ESS typically involve lots of data analysis and modeling tools such as "what-if" analysis to help strategic decision-making.
Model of Executive Information System
Executive Information System
• Balanced scorecard method:
• Measures outcomes on four dimensions: • Financial • Business process • Customer • Learning & growth • Key performance indicators (KPIs) measure each
dimension
• In developing an ESS, first concern is for senior executives and consultants to develop scorecard and then to automate flow of information for each KPI
Relationship between different IS
ESS
MIS
DSS
KWS/ OAS
TPS
55
TPS is a major producer of information for other systems
A Framework for Computerized Decision Analysis
56
Comparison of DSSs and MISs
Module 3
Enterprise Information System
E-Commerce & E-Business
E-Commerce
• The buying and selling of products or services over electronic systems.
• The use of commerce in this way, draws innovations in electronic funds transfer, supply chain management, Internet marketing, online transaction processing, electronic data interchange (EDI), inventory management systems, and automated data collection systems.
• Eg: Credit card transactions where approval is granted online
E-Business
• The utilization of information and communication technologies (ICT) in
support of all the activities of business.
• E-business is a term that has a broader definition of EC that includes servicing customers, collaborating with business partners, and conducting electronic
transactions within an organization, as
well as buying and selling.
E-Business
• Commerce constitutes the exchange of products and
services between businesses, groups and individuals and
can be seen as one of the essential activities of any
business.
• Electronic business focuses on the use of ICT to enable the
external activities and relationships of the business with
individuals, groups and other businesses
Major types of EC (by transaction)
• B2B, where both the buyer and seller are business organizations • B2C, where the sellers are organizations and the buyers are consumers
• C2C, where both parties are consumers
• C2B, where consumers make their need for a product known and suppliers compete to provide the product • G2C, where the Government provides services to its citizens • m-commerce, where EC is done in a wireless environment
Enterprise Systems
• Enterprise systems (also called enterprise wide systems) are systems or processes that involve the entire enterprise or major portions of it. Some Examples; • SCM • ERP • CRM • KM • PRM • DSS
Supply Chain Management (SCM)
Supply Chain Management
• A supply chain includes all activities that influence the flow of materials, information, payments, people, and services from suppliers to the company. • The supply chain includes the organizations and the processes
that create and deliver products, information, and services to
the end customer. • Through successful coordination of all of these parts, SCM will help the organization obtain and sustain a competitive advantage.
Supply Chain Management
Major Components of Supply Chain
• Vendors (Producing organization) • Manufacturing centers • Logisticians • Internal distribution centers • Distributors • Wholesalers.
These players fit into one of the three segments, upstream
(sourcing and procurement), internal (manufacturing, assembly, packaging), and downstream (distribution).
Major Components of Supply Chain
• An extended supply chain is a supply chain that incorporates the organization’s value system. Included in the extended supply chain are the suppliers, warehousing, distribution, and other business partners.
Module IV
Information System Security
Threats to Information Security
• A threat to an information resource is any danger to which a system may be exposed. • The exposure of an information resources is the harm, loss or damage that can result if a threat compromises that resource. • A system’s vulnerability is the possibility that the system will suffer harm by a threat. • Risk is the likelihood that a threat will occur. • Information system controls are the procedures, devices, or software aimed at preventing a compromise to the system.
Unintentional Threats
• Human errors can occur in the design of the hardware and/or information system. • An error can also occur in programming, testing, data collection, data entry, authorization and procedures. • Human error contribute to more than 50% of control and securityrelated problems in organizations.
Unintentional Threats
• Environmental hazards include earthquakes, severe storms, floods, power failures or strong fluctuations, fires (most common hazard), explosions,
…etc.
• Computer system failures can occur as the result of poor manufacturing or
defective materials.
Intentional Threats
• Typically, criminal in nature. • Cybercrimes are fraudulent activities committed using computers and communications networks, particularly the Internet.
Intentional Threats
• Hacker. An outside person who has penetrated a computer system, usually with no criminal intent.
• Cracker. A malicious hacker.
• Social engineering. Computer criminals or corporate spies get around security systems by building an inappropriate trust relationship with insiders.
Espionage or Trespass
• The act of gaining access to the information an organization is trying to protect by an unauthorized individual. • Industrial espionage occurs in areas where researching information about the competition goes beyond the legal limits. • Governments practice industrial espionage against companies in various countries.
• Shoulder surfing is looking at a computer monitor or ATM screen over another person’s shoulder.
System Vulnerability
• A universal vulnerability is a state in a computing system which either: allows an attacker to execute commands as another user; allows an attacker to access data that is contrary to the access restrictions for that data; allows an attacker to pose as another entity; or allows an attacker to
conduct a denial of service.
System Vulnerability
• An exposure is a state in a computing system (or set of systems) which is not a universal vulnerability, but either: allows an attacker to conduct information gathering activities; allows an attacker to hide activities; includes a capability that behaves as expected, but can be easily compromised; is a primary point of entry that an attacker may attempt to use to gain access to the system or data; and is considered a problem according to some reasonable security policy.
Protecting Privacy
• Privacy. The right to be left alone and to be free of unreasonable personal
intrusions.
• Two rules have been followed fairly closely in past court decision in many countries:
– The right of privacy is not absolutes. Privacy must be balanced against
the needs of society – The public’s right to know is superior to the individual’s right of privacy. • Electronic Surveillance. The tracking of people‘s activities, online or offline, with the aid of computers.
Protecting Privacy
• Information on Internet Bulletin Boards and Newsgroups. Electronic
discussions such as chat rooms appear on Internet, within corporate
intranets, and on blogs. • A blog (Weblog) is an informal, personal journal that is frequently
updated and intended for general public reading.
• Privacy Codes and Policies. An organization’s guidelines with respect to protecting the privacy of customers, clients, and employees.
Information Extortion
• When an attacker or formerly trusted employee steal
information from a computer system and then demands
compensation for its return or an agreement not to
disclose it.
Sabotage or Vandalism
• A popular type of online vandalism is hacktivist or cyberactivist activities. • Hacktivist or cyberactivist use technology for high-tech civil disobedience to protest operations, policies, or actions of an individual, an organization, or a government agency. • Cyber war. War in which a country’s information systems could be paralyzed from a massive attack by destructive software.
• Theft is the illegal taking of property that belongs to another individual or organization.
Identity Theft
• Crime in which someone uses the personal information of others, usually obtained from the Internet, to create a false identity and then commits fraud.
• Fastest growing white-collar crime.
• Biggest problem is restoring victim’s damaged credit rating.
How a virus works
Corporate Security Plan - Protecting
Defense Strategy - Controls
Public Key Infrastructure
Controls
• Controls evaluation. Identifies security deficiencies and calculates the
costs of implementing adequate control measures.
• General controls. Established to protect the system regardless of their application.
– Physical controls. Physical protection of computer facilities and
resources. – Access controls. Restriction of unauthorized user access to computer resources; use biometrics and passwords controls for user identification.
Controls (Continued)
• Communications (networks) controls. To protect the movement of data across networks and include border security controls, authentication and authorization. – Firewalls. System that enforces access-control policy between two networks. – Encryption. Process of converting an original message into a
form that cannot be read by anyone except the intended
receiver.
Controls (Continued)
• All encryption systems use a key. • Symmetric encryption. Sender and the recipient use the same key. • Public-key encryption. Uses two different keys: a public key and a private key. • Certificate authority. Asserts that each computer is identified
accurately and provides the public keys to each computer.
Controls (Continued)
• Virtual Private Networking. Uses the Internet to carry information within a company and among business partners
but with increased security by uses of encryption,
authentication and access control. • Application controls. Controls that protect specific applications and include: input, processing and output controls.
IS Auditing
• Information systems auditing. Independent or unbiased observers
task to ensure that information systems work properly.
• Types of Auditors and Audits – Audit. Examination of information systems, their inputs, outputs and processing. – Internal. Performed by corporate internal auditors.
– External. Reviews internal audit as well as the inputs,
processing and outputs of information systems.
IS Auditing Procedure
• Auditing around the computer means verifying processing by
checking for known outputs or specific inputs.
• Auditing through the computer means inputs, outputs and processing are checked. • Auditing with the computer means using a combination of client data, auditor software, and client and auditor hardware.
Protecting Information Resources
• Risk. The probability that a threat will impact an information
resource.
• Risk management. To identify, control and minimize the impact of threats. • Risk analysis. To assess the value of each asset being protected, estimate the probability it might be compromised,
and compare the probable costs of it being compromised with
the cost of protecting it.
Protecting Information Resources
• Risk mitigation is when the organization takes concrete actions against risk. It has two functions: – (1) implement controls to prevent identified threats from
occurring, and
– (2) developing a means of recovery should the threat become a reality.
Risk Mitigation Strategies
• Risk Acceptance. Accept the potential risk, continue operating with no controls, and absorb any damages that occur. • Risk limitation. Limit the risk by implementing controls that
minimize the impact of threat.
• Risk transference. Transfer the risk by using other means to compensate for the loss, such as purchasing insurance.
Disaster Recovery Planning
• Disaster recovery. The chain of events linking planning to protection to recovery, disaster recovery plan. • Disaster avoidance. Oriented towards prevention,
uninterrupted power supply (UPS).
• Hot sites. External data center that is fully configured and has copies of the organization’s data and programs.
Managerial Issues
What is the business value of IT security and control?
Why are these legal obligations? How important is IT security to management IT security and internal control must be implemented top-down
Enterprise e-Business Systems
Learning Objectives
• Identify the following aspects of customer relationship management (CRM), enterprise resource management (ERP), and supply chain (SCM) mgt systems:
– Business processes supported – Customer and business value provided – Potential challenges and trends
100
Customer Relationship Management (CRM): The Business Focus
Customer Relationship Management
• Provides customer-facing employees with a single, complete view of every customer at every touch point and across all channels • Provides the customer with a single, complete view of the company and its extended channels
102
Customer Relationship Management (continued)
• CRM..
– Integrates and automates many of the customer serving processes – Creates an IT framework of Web-enabled software & databases that integrates these processes with the rest of the company’s business operations
103
Customer Relationship Management (continued)
104
Customer Relationship Management (continued)
105
Customer Relationship Management (continued)
• Benefits and Challenges
– Allows a business to identify its best customers – Makes possible real-time customization & personalization of products & services based on customer wants, needs, buying habits, & life cycles
106
Customer Relationship Management (continued)
• Benefits and Challenges (continued)
– Enables a company to provide a consistent customer service experience
• Failures
– Due to lack of understanding & preparation. – CRM is not a silver bullet
107
Customer Relationship Management (continued)
• Trends
– Operational CRM – Analytical CRM – Collaborative CRM – Portal-based CRM
108
Enterprise Resource Planning (ERP): The Business Backbone
Enterprise Resource Planning
• Serves as a cross-functional enterprise backbone that integrates & automates many internal business processes and information systems • Helps companies gain the efficiency, agility, & responsiveness needed to succeed today
110
Enterprise Resource Planning (continued)
• Gives a company an integrated real-time view of its core business processes • ERP software suites typically consist of integrated modules of…
– – – – – Manufacturing Distribution Sales Accounting Human Resource Management
111
Enterprise Resource Planning (continued)
• Benefits
– Quality and efficiency
• Helps improve the quality and efficiency of customer service, production, & distribution by creating a framework for integrating and improving internal business processes
– Decreased Costs
• Reductions in transaction processing costs and hardware, software, and IT support staff
112
Enterprise Resource Planning (continued)
• Benefits
– Decision support
• Provides cross-functional information on business performance to assist managers in making better decisions
– Enterprise agility
• Results in more flexible organizational structures, managerial responsibilities, and work roles
113
Enterprise Resource Planning (continued)
• Challenges
– Costs of ERP
• The costs and risks of failure in implementing a new ERP system are substantial.
114
Enterprise Resource Planning (continued)
115
Enterprise Resource Planning (continued)
• Causes of ERP failures
– Underestimating the complexity of the planning, development, and training required – Failure to involve affected employees in the planning & development phases and change management programs – Trying to do too much, too fast – Insufficient training – Believing everything the software vendors and/or consultants say
116
Enterprise Resource Planning (continued)
• Trends
– Flexible ERP – Web-enabled ERP – Interenterprise ERP – E-Business Suites
117
Supply Chain Management: The Business Network
Supply Chain Management
• A cross-functional interenterprise system that uses IT to help support & manage the links between some of a company’s key business processes and those of its suppliers, customers, & business partners. • Goal is to create a fast, efficient, & low-cost network of business relationships.
119
Supply Chain Management (continued)
120
What do supply chain management (SCM) tools do?
Supply
Supply Chain Management Definition
chain management tools enable managers to make informed business decisions about the operation of their supply chain
chain management tools facilitate planning and production scheduling based on known business constraints
121
Supply
Supply Chain Management Overview
SCM capacity constraints
Managing a supply chain would be easy if we had unlimited resources
“How do I decide what to do on which piece of equipment, and when?”
Can only drill one piece of metal at a time
-- OR --
Computer processing and storage capacity not infinite
Supply Chain Manager
122
SCM Tools levels
Supply Chain Elements SCM Service Offering
Strategic Planning
Network Design Demand Planning Supply Planning Production Planning
Tactical Planning Warehouse Management Transportation Management Order Management Operational Planning Inventory Management Event Management
• Supply Chain Planning services configure operations to best meet projected demand levels • The planning horizon ranges from developing a long term strategic outlook to developing a short term tactical production schedule
Weeks / Months
Real time / Minutes
Hours / Days
Quarters
Years
Supply Chain Planning Tools
Supply Chain Execution Tools
Source: BAH
Supply Chain Execution services monitor and control production operations They provide real time tracking and alert 123 notification
Supply Chain Planning Process
Demand Planning
Network Design
Design where to place production facilities and optimize the end to end chain Construct alternate flow scenarios that incorporate associated constraints
Anticipate demand based on historical trends and current conditions Perform what if analysis - highlight the impact of changing demand drivers
Production Planning
Production Scheduling
Supply Planning Balances unconstrained demand against high level supply chain constraints Reflect order priority and due dates
Decompose the supply plan into sub assembly / production needs by site Balance production capacity across sites
Optimize processing flows, sequence, and timing Produce a finite capacity production schedule
Planning Years Horizon
Quarters
Weeks / Months
Hours / Days
124
Supply Chain Execution Process
Inventory Management
Warehouse
Transportation
Order Management
Management
Management
Record customer orders and track status from receipt to final delivery Direct efficient response to orders with dynamic cost / benefit analysis of options
Streamline information movement and provide tight inventory control Inventories replenished using kanban, min-max, or reorder point
Optimization and management of warehouse processes
Optimize and track outbound and inbound shipping
Event Management
Monitor and manage critical planning and event information Broadcast alert notification and present response alternatives based on pre determined business rules
125
I2 >master production schedule
Source: i2 Technologies
126
SCM vendors
• Although each of the vendors claim to provide an end to end solution, they actually fall into two distinct camps
• First are the ERP vendors who provide a strong solution for integrating the data environment and providing visibility • Second are the SCM vendors who provide robust optimization solutions • In combination, with an ERP vendor providing the data environment and a SCM vendor providing the optimization solution, you can achieve a very elegant solution
Leading SCM Vendors
ERP Focused
Oracle SAP JD Edwards Peoplesoft Invensys / Baan
SCM Focused
i2 Manugistics Aspentech Logility
Source: Gartner
127
Supply Chain Management (continued)
• Benefits and Challenges
– Can provide faster, more accurate
• • • • • order processing, reductions in inventory levels, quicker time to market, lower transaction and materials costs, & strategic relationships with suppliers
128
Supply Chain Management (continued)
• Problem causes
– Lack of proper demand planning knowledge, tools, and guidelines – Inaccurate or overoptimistic demand forecasts – Inaccurate production, inventory, and other business data – Lack of adequate collaboration
129
Supply Chain Management (continued)
• Trends
130
Mitsubishi Motor Sales
• Multivendor CRM system • Benefits to a business and its customers of a CRM system like Mitsubishi’s • Mitsubishi’s modular approach to acquiring and installing CRM system
– Prevention of large scale failures
131
Agilent Technologies & Russ Berrie
• Failures in implementing ERP systems • Causes of the major failure of Agilent’s ERP implementation • Russ Berrie
132
TaylorMade Golf & HON Industries
• Moving business information systems with suppliers and distributors to the Web resulted in dramatic business benefits
133
H-P, Eastman Chemical, & Others
• What is the business value to Eastman Chemical and W.W. Grainger of their initiatives to help their suppliers and customers do business online? • Why are many small suppliers reluctant to do business online with their large customers? • What can be done to encourage small suppliers to get online?
134
Wal-Mart & Mattel
• Wal-Mart as “the best supply chain operator of all time”? • What can other businesses learn from the experiences of Wal-Mart and Mattel that could improve their supply chain performance?
135
Information System in Organization
Management Level
Top Management
Decision Type
Strategic Decision
Information Type
Unstructured Information Semi Structured Information Structured Information
Middle Management Low level Management
Tactical Decision
Operation Decision
Types of Computer based Information System
Information System
Transaction Processing System (TPS)
Level Of Management
Low level Management
Management Information System (MIS)
Decision Support System Executive Information System / Executive Support System (EIS / ESS) Office Automation System (OAS) Group Decision Support System (GDSS)
Middle Level Management
Top Management Top Management All level of management Top Management
Office Automation System
Office Automation is the use of technology to help people do their jobs better & faster. OR The use of computer, micro electronics & telecommunications to help to produce, store, obtain & send information in the form of pictures, words or numbers, more reliably, quickly and economically.
Types of Office Automation Systems
1. Document management systems 2. Message handling systems 3. Teleconferencing systems
Document Management System
1. Word Processing
– Word processing software lets you create, edit, store, retrieve, and print a text document.
2. Desktop Publishing
– Desktop publishing (DTP) enables you to produce welldesigned pages that combine charts and graphics with text and headlines in a variety off typefaces, it lets you to do all this at your desk, without a ruler, pen or paste. – Desktop publishing is software which involve using a microcomputer, mouse, scanner, laser or Ink Jet printer, for mixing text,, and graphics to produce high quality output for commercial printing.
Document Management System
3. Image Processing System
– Image processing system is also called electronic image management system, allow users to electronically capture, store, process, and retrieve images of documents. These documents may include text, numeric data, handwriting, graphics and photographs.
Message Handling System
1. 2. 3. 4. 5. 6. 7. 8. 9. Telex Fax Teletext Videotext Electronic Mail Voicemail EDI (Electronic Data Interchange) EFT (Electronic Fund Transfer) Bulletin Boards
Teleconferencing Systems
1. 2. 3. 4. Audio Conferencing Video Conferencing Computer Conferencing Telecommuting
Transaction Processing System
• A Transaction Processing System (TPS) is a type of information system that collects, stores, modifies and retrieves the data transactions of an enterprise. • Transaction processing systems offer enterprises the means to rapidly process transactions to ensure the smooth flow of data and the progression of processes throughout the enterprise.
Batch Schematic
Data entry of accumulated transactions
Input (batched)
Output
On-line Schematic
Terminal Terminal Terminal
Output
Terminal
Immediate processing of each transaction
Terminal Terminal
Types of TPS
• Batch Processing: Batch processing is a resource-saving transaction type that stores data for processing at pre-defined times. Batch processing is useful for enterprises that need to process large amounts of data using limited resources. • Real Time Processing: A system whereby each transaction is processed immediately, without the delay of accumulating transactions into a batch. Its primary factor is speed.
Transaction Processing Qualifiers
Transaction Processing must have the ACID test 1. Atomicity: Atomicity means that a transaction is either completed in full or not at all 2. Consistency: TPS systems exist within a set of operating rules (or integrity constraints). 3. Isolation: Transactions must appear to take place in isolation. 4. Durability: Once transactions are completed they cannot be undone.
Data entry & input
Processing
Documents & reports
Internally generated transactions: • shipped orders • purchase orders • employee time cards Externally generated transactions: • customer orders • vendor invoices • customer payments Database update: • customer orders • inventory • purchase orders • customers • suppliers Database
Documents: • pick list • cheques to vendors • receiving notices • paycheques Operational reports: • finished product inventory status • raw materials; packing materials; spare parts; inventory status
Data Processing Activities Common to TPSs
• A transaction processing cycle
• • • • • • Data collection Data editing Data correction Data manipulation Data storage Document production
Original data Data collection Data edit
Data correction
Data manipulation
Data storage Document production
Management Information System
Information system at middle and lower level of an organization that serve the functions of planning, controlling, and decision making by providing routine summary and exception reports. OR A management Information system (MIS) is an information system that provides predefined types of information to management.
Components of MIS
1. 2. 3. Hardware Input and output devices constitute the hardware components of MIS Software The programs and applications that convert data into machinereadable language are known as software Procedures Procedures are sets of rules or guidelines, which an organization establishes for the use of a computer-based information system Personnel The computer experts, managers, users, analysts, programmers, database managers, and many other computer professionals who utilize the computer-based information systems are the personnel in a management information system
4.
Properties of Management Information System:
• Support structured and semi structured decisions, primarily at the middle and lower level management • Management Information system (MIS) is intended principally to assist middle level management. It helps them with tactical decisions. It enables them to spot trends and get an overview of current business activities. • Provide fixed types of reports in an established format • Management Information system (MIS) are relatively inflexible • The information requirements of users are normally known and stable
Cont…
• Often hardcopy reports • Usually require a formal run schedule • Management Information system (MIS) generally aid in decision making using past and present data • Management information system (MIS) rely on existing corporate data and data flows • Usually consists of internal operational data rather then data about the external environment • More concerned with data about the past than data relating to the future • Often oriented to summary and exception reporting
Documents & Reports by Management Information System:
a. Scheduled Reports: Scheduled reports also called periodic reports are those that are issued periodically i.e. hourly, daily, weekly, monthly, quarterly, or annually. Examples of such reports are daily production report and monthly performance report. These types of reports can be used either for planning or control purposes. b. Exception Reports: Exception reports are issued when something unusual takes place that require the attention of management. For instance, an expense overrun would likely trigger the generation of an exception report or an inventory report that lists only those items that number fewer than 10 in stock. Exception reports are used primarily for control purposes.
Cont…
c. Demand Reports: Demand reports are generated when someone with authority request information in response to an unscheduled demand. An executive asking for a financial report or director finance order a credit background report of an unknown customer who want to place a large order. d. Summary Reports: Summary reports show totals and trends. An example would be a report showing total sales by office, by product, by salesperson, of overall total sales.
Decision Support System
• Decision Support systems are computer based information systems that provide interactive information support to managers and business professionals during the decision-making process.
• Decision support systems use the following to support the making of semi-structured business decisions – Analytical models – Specialized databases – A decision-maker’s own insights and judgments – An interactive, computer-based modeling process
Types of DSS
• Communication-driven DSS Most communications-driven DSSs are targeted at internal teams, including partners. Its purpose are to help conduct a meeting, or for users to collaborate. The most common technology used to deploy the DSS is a web or client server. Examples: chats and instant messaging software, online collaboration and net-meeting systems. • Data-driven DSS Most data-driven DSSs are targeted at managers, staff and also product/service suppliers. It is used to query a database or data warehouse to seek specific answers for specific purposes. It is deployed via a main frame system, client/server link, or via the web. Examples: computer-based databases that have a query system to check (including the incorporation of data to add value to existing databases).
Cont…
• Document-driven DSS Document-driven DSSs are more common, targeted at a broad base of user groups. The purpose of such a DSS is to search web pages and find documents on a specific set of keywords or search terms. The usual technology used to set up such DSSs are via the web or a client/server system. • Knowledge-driven DSS: Knowledge-driven DSSs or 'knowledgebase' as they are known, are a catch-all category covering a broad range of systems covering users within the organization setting it up, but may also include others interacting with the organization - for example, consumers of a business. It is essentially used to provide management advice or to choose products/services. The typical deployment technology used to set up such systems could be client/server systems, the web, or software running on standalone PCs.
Cont…
• Model-driven DSS Model-driven DSSs are complex systems that help analyze decisions or choose between different options. These are used by managers and staff members of a business, or people who interact with the organization, for a number of purposes depending on how the model is set up - scheduling, decision analyses etc. These DSSs can be deployed via software/hardware in stand-alone PCs, client/server systems, or the web.
Components of DSS
• Database Used for query and analysis Current or historical data from number of applications or groups May be small database or large data warehouse • User interface Often a Web interface • Software system With models, data mining, other analytical tools
Overview of DSS
Cont..
• Model:
Abstract representation that illustrates components or relationships of phenomenon; may be physical, mathematical, or verbal model
1. Statistical model : A statistical model helps establish
relationships, such as relating product sales to differences in age, income or other factors.
2. Optimization models : Optimization models determine
optimal resource allocation to maximize or minimize specific variables such as cost and time.
Cont…
3. Forecasting models: Forecasting models are used to forecast future conditions, such as sales, given a range of historical data. 4. Sensitivity analysis models: Sensitivity analysis models ask “what if” questions to determine the impact of changes in one or more factors.
Characteristics of DSS
• They support unstructured decision making. • DSS provide support for decisions and problems whose solutions can't be specified in advance. • Support decision making at top levels of management. • Provide fast response. • Provide high degree of user control and interaction. • Flexibility in specifying output requirements.
Cont…
• DSS offer users flexibility, adaptability, and quick response. • They are flexible enough to respond to the changing needs of decision makers. • DSS operate with little or no assistance from professional programmers. • Ease of use and ease of development for non professionals.
Geographic Information System
• Geographic Information System (GIS) is a collection of computer hardware, software and geographic data used to analyze and display geographically referenced information. • GIS is a decision support system designed specifically to analyze spatial information. • Spatial information is any information that can be shown in map from such as roads, the path of hurricane, sewer system etc.
• With its capabilities for spatial analysis, GIS can reveal hidden patterns and relationships between data that aren’t readily apparent in spreadsheets or statistical packages. • GIS is a data driven DSS • Example of GIS Software: GRASS (Open source), AutoDesk & ESRI
Application of GIS
• Earthquake Mapping • Market Research • Demographics, health research & census data
Web-based customer decisionsupport systems (CDSS):
• Support decision-making process of existing or potential customer
• Use Web information resources and capabilities for interactivity and personalization to help users select products and services • E.g., search engines, intelligent agents, online catalogs, Web directories, newsgroup discussions, other tools • Automobile companies that use CDSS to allow Web site visitors to configure desired car • Financial services companies with Web-based assetmanagement tools for customers
Group Decision Support System (GDSS)
• An interactive, computer-based system that facilitates solution of unstructured problems by a set of decision-makers working together as a group. It aids groups, especially groups of managers, in analyzing problem situations and in performing group decision making tasks. • Each participant has a computer terminal from which they interact with the rest of the group. The computers are networked so that each individual's screen is private, but the information they enter is displayed anonymously on a public screen.
Cont..
• Four configuration of group members are :
– Group members in one room operating on network with common display screen to share the display for all members. GDSS process is transparent. – Group members sit at their respective location and use their desktop and LAN to interact with other members. GDSS process is not as transparent as previous case.
Cont..
• Group members are in different cities and they come together
Process of GDSS
A typical GDSS session includes four phases: 1. Idea Generation 2. Idea Consolidation 3. Idea Evaluation 4. Implementation Planning
Advantages of GDSS
• Anonymity – drive out fear leading to better decisions from a diverse hierarchy of decision makers • Parallel Communication – eliminate monopolizing providing increased participation, better decisions • Automated record keeping – no need to take notes, they’re automatically recorded • Ability for virtual meetings – only need hardware, software and people connected • Portability - Can be set up to be portable… laptop • Global Potential - People can be connected across the world • No need for a computer guru – although some basic experience is a must
Disadvantages of GDSS
• Cost –infrastructure costs to provide the hardware software/room/network connectivity can be very expensive and • Security – especially true when companies rent the facilities for GDSS; also, the facilitator may be a lower-level employee who may leak information to peers • Technical Failure – power loss, loss of connectivity, relies heavily on bandwidth and LAN/WAN infrastructure – properly setup system should minimize this risk • Keyboarding Skills – reduced participation may result due to frustration • Training – learning curve is present for users, varies by situation • Perception of messages – lack of verbal communication could lead to misinterpretation
Expert System
• Expert System – is an information system application that captures the knowledge or expertise of a specialist and then simulates the “thinking” of that expert for those with less or no expertise. • Expert System are also called knowledge based systems or artificial intelligence based systems
Components of Expert System
a. Knowledge Base:
• At the center of any Expert System their is knowledge base, which contains specific facts about the expert area and rules that the Expert System will use to make decisions based on those facts.
b. Inference Engine:
• The engine inference is the portion of the Expert System that performs reasoning by using the contents of the knowledge base in a particular sequence. During the consultation, the inference engine examines the rules of the knowledge base one at a time, and when rule condition is true the specified action is taken. In Expert Systems terminology, the rule is fixed when the action is taken.
Cont..
• Two main methods have been devised for the inference engine to use in examining the rules: forward reasoning and reverse reasoning. 1. Forward Reasoning:
Forward reasoning is also called forward chaining; the rules are examined one after another in a certain order. The order might be the sequence in which the rules were entered into the rule set, or it might be some other sequence specified by the user. As each rule is examined, the Expert Systems attempt to evaluate whether the condition is true or false. For example, a medical expert system may be used to examine a patient's symptoms and provide a diagnosis. Based on these symptoms, the expert system might locate several diseases that the patient may have.
Cont..
2. Reverse Reasoning: Reverse reasoning is also called backward chaining; the inference engine selects a rule and regards it as a problem to be solved. Such procedures are often called goal driven inferential processes. For example, the expert system might be given the goal to "find the symptoms of this disease" and would work back from there, asking questions as necessary to. confirm. c. User Interface: Users often interact with the Expert Systems through a user interface. In most cases, the Expert Systems prompt (asks) the user to supply information about the problem and the user types in the requested data. The data entered are examined by the inference engine and compared to the facts, rules, and the relationships in the knowledge base. This examination and comparison process results in the system continuing to prompt the user for more information until the system has enough data about the current problem so that it can reach a conclusion.
Application of Expert System
Expert systems are especially important to organizations that rely on people who possess specialized knowledge of some problem domain, especially if this knowledge and experience cannot be easily transferred. Artificial intelligence methods and techniques have been applied to a broad range of problems. • MYCIN, was created to help physicians diagnose and treat bacterial infections
Cont…
• Expert systems have been used to analyze geophysical data in our search for petroleum and metal deposits (e.g., PROSPECTOR). • Used by the investments, banking, and telecommunications industries. • They are essential in robotics, natural language processing, theorem proving, and the intelligent retrieval of information from databases.
Advantages of Expert System To The Firm:
a. Better Performance For The Firm:
As the firm's managers extend their problem solving abilities through use of Expert Systems, the firm's control mechanism is improved. The firm is better able to meet its objectives.
b. Maintain Control Over The Firm's Knowledge:
Expert Systems afford the opportunity of making the experienced employee's knowledge more available to newer, less experienced employees and of keeping that knowledge in the firm longer, even after the employees have left.
Disadvantages of Expert Systems
a. The Knowledge Engineering Bottleneck:
The enormous time and efforts required extracting the expert's knowledge and translating it into IF/THEN rules upon which an expert system is based.
b. The Programming Bottleneck:
Programming the system and maintaining the code is very difficult.
c. The Learning Problem
d. Judgment Problem
Executive Information / Support System
• An Executive Support System ("ESS") is designed to help senior management make strategic decisions. It gathers, analyses and summarizes the key internal and external information used in the business. • Address nonroutine decisions requiring judgment, evaluation, and insight • Example: ESS that provides minute-to-minute view of firm’s financial performance as measured by working capital, accounts receivable, accounts payable, cash flow, and inventory • A good way to think about an ESS is to imagine the senior management team in an aircraft cockpit - with the instrument panel showing them the status of all the key business activities. ESS typically involve lots of data analysis and modeling tools such as "what-if" analysis to help strategic decision-making.
Model of Executive Information System
Executive Information System
• Balanced scorecard method:
• Measures outcomes on four dimensions: • Financial • Business process • Customer • Learning & growth • Key performance indicators (KPIs) measure each
dimension
• In developing an ESS, first concern is for senior executives and consultants to develop scorecard and then to automate flow of information for each KPI
Relationship between different IS
ESS
MIS
DSS
KWS/ OAS
TPS
55
TPS is a major producer of information for other systems
A Framework for Computerized Decision Analysis
56
Comparison of DSSs and MISs
Module 3
Enterprise Information System
E-Commerce & E-Business
E-Commerce
• The buying and selling of products or services over electronic systems.
• The use of commerce in this way, draws innovations in electronic funds transfer, supply chain management, Internet marketing, online transaction processing, electronic data interchange (EDI), inventory management systems, and automated data collection systems.
• Eg: Credit card transactions where approval is granted online
E-Business
• The utilization of information and communication technologies (ICT) in
support of all the activities of business.
• E-business is a term that has a broader definition of EC that includes servicing customers, collaborating with business partners, and conducting electronic
transactions within an organization, as
well as buying and selling.
E-Business
• Commerce constitutes the exchange of products and
services between businesses, groups and individuals and
can be seen as one of the essential activities of any
business.
• Electronic business focuses on the use of ICT to enable the
external activities and relationships of the business with
individuals, groups and other businesses
Major types of EC (by transaction)
• B2B, where both the buyer and seller are business organizations • B2C, where the sellers are organizations and the buyers are consumers
• C2C, where both parties are consumers
• C2B, where consumers make their need for a product known and suppliers compete to provide the product • G2C, where the Government provides services to its citizens • m-commerce, where EC is done in a wireless environment
Enterprise Systems
• Enterprise systems (also called enterprise wide systems) are systems or processes that involve the entire enterprise or major portions of it. Some Examples; • SCM • ERP • CRM • KM • PRM • DSS
Supply Chain Management (SCM)
Supply Chain Management
• A supply chain includes all activities that influence the flow of materials, information, payments, people, and services from suppliers to the company. • The supply chain includes the organizations and the processes
that create and deliver products, information, and services to
the end customer. • Through successful coordination of all of these parts, SCM will help the organization obtain and sustain a competitive advantage.
Supply Chain Management
Major Components of Supply Chain
• Vendors (Producing organization) • Manufacturing centers • Logisticians • Internal distribution centers • Distributors • Wholesalers.
These players fit into one of the three segments, upstream
(sourcing and procurement), internal (manufacturing, assembly, packaging), and downstream (distribution).
Major Components of Supply Chain
• An extended supply chain is a supply chain that incorporates the organization’s value system. Included in the extended supply chain are the suppliers, warehousing, distribution, and other business partners.
Module IV
Information System Security
Threats to Information Security
• A threat to an information resource is any danger to which a system may be exposed. • The exposure of an information resources is the harm, loss or damage that can result if a threat compromises that resource. • A system’s vulnerability is the possibility that the system will suffer harm by a threat. • Risk is the likelihood that a threat will occur. • Information system controls are the procedures, devices, or software aimed at preventing a compromise to the system.
Unintentional Threats
• Human errors can occur in the design of the hardware and/or information system. • An error can also occur in programming, testing, data collection, data entry, authorization and procedures. • Human error contribute to more than 50% of control and securityrelated problems in organizations.
Unintentional Threats
• Environmental hazards include earthquakes, severe storms, floods, power failures or strong fluctuations, fires (most common hazard), explosions,
…etc.
• Computer system failures can occur as the result of poor manufacturing or
defective materials.
Intentional Threats
• Typically, criminal in nature. • Cybercrimes are fraudulent activities committed using computers and communications networks, particularly the Internet.
Intentional Threats
• Hacker. An outside person who has penetrated a computer system, usually with no criminal intent.
• Cracker. A malicious hacker.
• Social engineering. Computer criminals or corporate spies get around security systems by building an inappropriate trust relationship with insiders.
Espionage or Trespass
• The act of gaining access to the information an organization is trying to protect by an unauthorized individual. • Industrial espionage occurs in areas where researching information about the competition goes beyond the legal limits. • Governments practice industrial espionage against companies in various countries.
• Shoulder surfing is looking at a computer monitor or ATM screen over another person’s shoulder.
System Vulnerability
• A universal vulnerability is a state in a computing system which either: allows an attacker to execute commands as another user; allows an attacker to access data that is contrary to the access restrictions for that data; allows an attacker to pose as another entity; or allows an attacker to
conduct a denial of service.
System Vulnerability
• An exposure is a state in a computing system (or set of systems) which is not a universal vulnerability, but either: allows an attacker to conduct information gathering activities; allows an attacker to hide activities; includes a capability that behaves as expected, but can be easily compromised; is a primary point of entry that an attacker may attempt to use to gain access to the system or data; and is considered a problem according to some reasonable security policy.
Protecting Privacy
• Privacy. The right to be left alone and to be free of unreasonable personal
intrusions.
• Two rules have been followed fairly closely in past court decision in many countries:
– The right of privacy is not absolutes. Privacy must be balanced against
the needs of society – The public’s right to know is superior to the individual’s right of privacy. • Electronic Surveillance. The tracking of people‘s activities, online or offline, with the aid of computers.
Protecting Privacy
• Information on Internet Bulletin Boards and Newsgroups. Electronic
discussions such as chat rooms appear on Internet, within corporate
intranets, and on blogs. • A blog (Weblog) is an informal, personal journal that is frequently
updated and intended for general public reading.
• Privacy Codes and Policies. An organization’s guidelines with respect to protecting the privacy of customers, clients, and employees.
Information Extortion
• When an attacker or formerly trusted employee steal
information from a computer system and then demands
compensation for its return or an agreement not to
disclose it.
Sabotage or Vandalism
• A popular type of online vandalism is hacktivist or cyberactivist activities. • Hacktivist or cyberactivist use technology for high-tech civil disobedience to protest operations, policies, or actions of an individual, an organization, or a government agency. • Cyber war. War in which a country’s information systems could be paralyzed from a massive attack by destructive software.
• Theft is the illegal taking of property that belongs to another individual or organization.
Identity Theft
• Crime in which someone uses the personal information of others, usually obtained from the Internet, to create a false identity and then commits fraud.
• Fastest growing white-collar crime.
• Biggest problem is restoring victim’s damaged credit rating.
How a virus works
Corporate Security Plan - Protecting
Defense Strategy - Controls
Public Key Infrastructure
Controls
• Controls evaluation. Identifies security deficiencies and calculates the
costs of implementing adequate control measures.
• General controls. Established to protect the system regardless of their application.
– Physical controls. Physical protection of computer facilities and
resources. – Access controls. Restriction of unauthorized user access to computer resources; use biometrics and passwords controls for user identification.
Controls (Continued)
• Communications (networks) controls. To protect the movement of data across networks and include border security controls, authentication and authorization. – Firewalls. System that enforces access-control policy between two networks. – Encryption. Process of converting an original message into a
form that cannot be read by anyone except the intended
receiver.
Controls (Continued)
• All encryption systems use a key. • Symmetric encryption. Sender and the recipient use the same key. • Public-key encryption. Uses two different keys: a public key and a private key. • Certificate authority. Asserts that each computer is identified
accurately and provides the public keys to each computer.
Controls (Continued)
• Virtual Private Networking. Uses the Internet to carry information within a company and among business partners
but with increased security by uses of encryption,
authentication and access control. • Application controls. Controls that protect specific applications and include: input, processing and output controls.
IS Auditing
• Information systems auditing. Independent or unbiased observers
task to ensure that information systems work properly.
• Types of Auditors and Audits – Audit. Examination of information systems, their inputs, outputs and processing. – Internal. Performed by corporate internal auditors.
– External. Reviews internal audit as well as the inputs,
processing and outputs of information systems.
IS Auditing Procedure
• Auditing around the computer means verifying processing by
checking for known outputs or specific inputs.
• Auditing through the computer means inputs, outputs and processing are checked. • Auditing with the computer means using a combination of client data, auditor software, and client and auditor hardware.
Protecting Information Resources
• Risk. The probability that a threat will impact an information
resource.
• Risk management. To identify, control and minimize the impact of threats. • Risk analysis. To assess the value of each asset being protected, estimate the probability it might be compromised,
and compare the probable costs of it being compromised with
the cost of protecting it.
Protecting Information Resources
• Risk mitigation is when the organization takes concrete actions against risk. It has two functions: – (1) implement controls to prevent identified threats from
occurring, and
– (2) developing a means of recovery should the threat become a reality.
Risk Mitigation Strategies
• Risk Acceptance. Accept the potential risk, continue operating with no controls, and absorb any damages that occur. • Risk limitation. Limit the risk by implementing controls that
minimize the impact of threat.
• Risk transference. Transfer the risk by using other means to compensate for the loss, such as purchasing insurance.
Disaster Recovery Planning
• Disaster recovery. The chain of events linking planning to protection to recovery, disaster recovery plan. • Disaster avoidance. Oriented towards prevention,
uninterrupted power supply (UPS).
• Hot sites. External data center that is fully configured and has copies of the organization’s data and programs.
Managerial Issues
What is the business value of IT security and control?
Why are these legal obligations? How important is IT security to management IT security and internal control must be implemented top-down
Enterprise e-Business Systems
Learning Objectives
• Identify the following aspects of customer relationship management (CRM), enterprise resource management (ERP), and supply chain (SCM) mgt systems:
– Business processes supported – Customer and business value provided – Potential challenges and trends
100
Customer Relationship Management (CRM): The Business Focus
Customer Relationship Management
• Provides customer-facing employees with a single, complete view of every customer at every touch point and across all channels • Provides the customer with a single, complete view of the company and its extended channels
102
Customer Relationship Management (continued)
• CRM..
– Integrates and automates many of the customer serving processes – Creates an IT framework of Web-enabled software & databases that integrates these processes with the rest of the company’s business operations
103
Customer Relationship Management (continued)
104
Customer Relationship Management (continued)
105
Customer Relationship Management (continued)
• Benefits and Challenges
– Allows a business to identify its best customers – Makes possible real-time customization & personalization of products & services based on customer wants, needs, buying habits, & life cycles
106
Customer Relationship Management (continued)
• Benefits and Challenges (continued)
– Enables a company to provide a consistent customer service experience
• Failures
– Due to lack of understanding & preparation. – CRM is not a silver bullet
107
Customer Relationship Management (continued)
• Trends
– Operational CRM – Analytical CRM – Collaborative CRM – Portal-based CRM
108
Enterprise Resource Planning (ERP): The Business Backbone
Enterprise Resource Planning
• Serves as a cross-functional enterprise backbone that integrates & automates many internal business processes and information systems • Helps companies gain the efficiency, agility, & responsiveness needed to succeed today
110
Enterprise Resource Planning (continued)
• Gives a company an integrated real-time view of its core business processes • ERP software suites typically consist of integrated modules of…
– – – – – Manufacturing Distribution Sales Accounting Human Resource Management
111
Enterprise Resource Planning (continued)
• Benefits
– Quality and efficiency
• Helps improve the quality and efficiency of customer service, production, & distribution by creating a framework for integrating and improving internal business processes
– Decreased Costs
• Reductions in transaction processing costs and hardware, software, and IT support staff
112
Enterprise Resource Planning (continued)
• Benefits
– Decision support
• Provides cross-functional information on business performance to assist managers in making better decisions
– Enterprise agility
• Results in more flexible organizational structures, managerial responsibilities, and work roles
113
Enterprise Resource Planning (continued)
• Challenges
– Costs of ERP
• The costs and risks of failure in implementing a new ERP system are substantial.
114
Enterprise Resource Planning (continued)
115
Enterprise Resource Planning (continued)
• Causes of ERP failures
– Underestimating the complexity of the planning, development, and training required – Failure to involve affected employees in the planning & development phases and change management programs – Trying to do too much, too fast – Insufficient training – Believing everything the software vendors and/or consultants say
116
Enterprise Resource Planning (continued)
• Trends
– Flexible ERP – Web-enabled ERP – Interenterprise ERP – E-Business Suites
117
Supply Chain Management: The Business Network
Supply Chain Management
• A cross-functional interenterprise system that uses IT to help support & manage the links between some of a company’s key business processes and those of its suppliers, customers, & business partners. • Goal is to create a fast, efficient, & low-cost network of business relationships.
119
Supply Chain Management (continued)
120
What do supply chain management (SCM) tools do?
Supply
Supply Chain Management Definition
chain management tools enable managers to make informed business decisions about the operation of their supply chain
chain management tools facilitate planning and production scheduling based on known business constraints
121
Supply
Supply Chain Management Overview
SCM capacity constraints
Managing a supply chain would be easy if we had unlimited resources
“How do I decide what to do on which piece of equipment, and when?”
Can only drill one piece of metal at a time
-- OR --
Computer processing and storage capacity not infinite
Supply Chain Manager
122
SCM Tools levels
Supply Chain Elements SCM Service Offering
Strategic Planning
Network Design Demand Planning Supply Planning Production Planning
Tactical Planning Warehouse Management Transportation Management Order Management Operational Planning Inventory Management Event Management
• Supply Chain Planning services configure operations to best meet projected demand levels • The planning horizon ranges from developing a long term strategic outlook to developing a short term tactical production schedule
Weeks / Months
Real time / Minutes
Hours / Days
Quarters
Years
Supply Chain Planning Tools
Supply Chain Execution Tools
Source: BAH
Supply Chain Execution services monitor and control production operations They provide real time tracking and alert 123 notification
Supply Chain Planning Process
Demand Planning
Network Design
Design where to place production facilities and optimize the end to end chain Construct alternate flow scenarios that incorporate associated constraints
Anticipate demand based on historical trends and current conditions Perform what if analysis - highlight the impact of changing demand drivers
Production Planning
Production Scheduling
Supply Planning Balances unconstrained demand against high level supply chain constraints Reflect order priority and due dates
Decompose the supply plan into sub assembly / production needs by site Balance production capacity across sites
Optimize processing flows, sequence, and timing Produce a finite capacity production schedule
Planning Years Horizon
Quarters
Weeks / Months
Hours / Days
124
Supply Chain Execution Process
Inventory Management
Warehouse
Transportation
Order Management
Management
Management
Record customer orders and track status from receipt to final delivery Direct efficient response to orders with dynamic cost / benefit analysis of options
Streamline information movement and provide tight inventory control Inventories replenished using kanban, min-max, or reorder point
Optimization and management of warehouse processes
Optimize and track outbound and inbound shipping
Event Management
Monitor and manage critical planning and event information Broadcast alert notification and present response alternatives based on pre determined business rules
125
I2 >master production schedule
Source: i2 Technologies
126
SCM vendors
• Although each of the vendors claim to provide an end to end solution, they actually fall into two distinct camps
• First are the ERP vendors who provide a strong solution for integrating the data environment and providing visibility • Second are the SCM vendors who provide robust optimization solutions • In combination, with an ERP vendor providing the data environment and a SCM vendor providing the optimization solution, you can achieve a very elegant solution
Leading SCM Vendors
ERP Focused
Oracle SAP JD Edwards Peoplesoft Invensys / Baan
SCM Focused
i2 Manugistics Aspentech Logility
Source: Gartner
127
Supply Chain Management (continued)
• Benefits and Challenges
– Can provide faster, more accurate
• • • • • order processing, reductions in inventory levels, quicker time to market, lower transaction and materials costs, & strategic relationships with suppliers
128
Supply Chain Management (continued)
• Problem causes
– Lack of proper demand planning knowledge, tools, and guidelines – Inaccurate or overoptimistic demand forecasts – Inaccurate production, inventory, and other business data – Lack of adequate collaboration
129
Supply Chain Management (continued)
• Trends
130
Mitsubishi Motor Sales
• Multivendor CRM system • Benefits to a business and its customers of a CRM system like Mitsubishi’s • Mitsubishi’s modular approach to acquiring and installing CRM system
– Prevention of large scale failures
131
Agilent Technologies & Russ Berrie
• Failures in implementing ERP systems • Causes of the major failure of Agilent’s ERP implementation • Russ Berrie
132
TaylorMade Golf & HON Industries
• Moving business information systems with suppliers and distributors to the Web resulted in dramatic business benefits
133
H-P, Eastman Chemical, & Others
• What is the business value to Eastman Chemical and W.W. Grainger of their initiatives to help their suppliers and customers do business online? • Why are many small suppliers reluctant to do business online with their large customers? • What can be done to encourage small suppliers to get online?
134
Wal-Mart & Mattel
• Wal-Mart as “the best supply chain operator of all time”? • What can other businesses learn from the experiences of Wal-Mart and Mattel that could improve their supply chain performance?
135
