Category: Security

Win of £6 million to research Digital Interfacing.

Dr Will Venters2 Comments

I am pleased to form part of a team, with computer science colleagues at UCL, Imperial and QMUL, who have been awarded a EPSRC programme grant for over £6 million to research the interfacing of digital systems. The overall research programme (titled Interface reasoning for interacting systems (IRIS)) aims to research the correct functioning of digital interfaces from technical, social, managerial and organisational perspectives – with my focus being on these latter three topics. Commercial partners involved in the programme include Amazon Web Services (UK), BT, Facebook (International), and Hewlett Packard.

Better understanding the effective management of interfacing is vital as companies and individuals harness new digital innovations and integrate them digitally within their processes and practices. Many digital innovations including the Internet of Things, SmartCities, Platforms and Artificial Intelligence, involve a myriad of systems owned and operated by a myriad of different companies which become tightly coupled together through their digital interfaces (e.g. though APIs and cloud computing). Yet little is known about how the organisations involved in such innovations define such digital interfaces, how they evolve, and in particular what organisational or management commitments are embedded within them.

The research project will formally start in January 2018, with recruitment for a post-doctoral researcher here the LSE starting shortly afterwards. The project will run until December 2023.

http://gow.epsrc.ac.uk/NGBOViewGrant.aspx?GrantRef=EP/R006865/1 

The text below provides a more academic introduction of the project.

Within the field of management, “interfaces” are of significant interest[1]; defining organisational boundaries which differentiate “insiders” and “outsiders” and providing connections across these boundaries. Interfaces are thus more broadly defined than engineered logical or digital interfaces as traditional conceived. Yet this broader understanding, in which digital interfaces are considered “boundary resources” for organisations (Eaton et al. 2015; Ghazawneh and Henfridsson 2013), is increasingly important since large-scale composite distributed organisations are emerging from the digital interfacing of organisational entities (e.g. through the growth of cloud computing[2] and the use of APIs). Within these organisational arrangements digital interfaces instantiate, represent, uphold and negotiate boundaries and separations. We therefore need to extend academic understanding of the digital interfaces between digital systems, and connect it to the social, economic and managerial boundaries and connections they create for organisations and society.

 1         Research Challenges

There is considerable research interest in boundaries within management and information systems. The internet allowed organisations to transform value-chains by digitally connecting with customers and suppliers; by harnessing cloud provided digital services (Venters and Whitley 2012); and by transforming physical products into digitally connected services (e.g. IoT – Internet of Things) (Porter and Heppelmann 2014). This transforms organisations leading to organisational arrangements whose defining characteristic is their constitution out of complex information technologies stretched across space and time, and defined by interconnections (Monteiro et al. 2014) (e.g. Netflix or Uber). Termed “cloud corporations” (Willcocks et al. 2014) such organisations evolve and change and challenge managerial and organisational assumptions of boundedness, stability, and even stable motivation of boundaries(Monteiro et al. 2014). Yet such boundary resources are poorly understood as are the wider ‘service ecosystem’ they form part of (Barros and Dumas 2006; Fishenden and Thompson 2013). There is a paucity of research on the specifics of the interface within such service ecosystems.

Consider for example Adur and Worthing[3] (a UK local council) harnessing (through Methods Consulting – a programme collaborator) Salesforce.com, Braintree Payments and MATSSoft for their services (Thompson and Venters 2015). Their value-chain leverages this extended digital supply chain such that the council is, to a significant extent, constituted from these services and must continually evolve its business, technology and management in the face of interface evolution of these components. This, it is argued, will instigate “profound changes in the ways that firms organise for innovation in the future”(Yoo et al. 2010). Reasoning about the interfaces by which such “cloud-corporations” emerge is however lacking. While sophisticated mathematical tools exist for systems modelling (Collinson et al. 2012) such tools are poorly adopted in practice. A significant focus then of this programme of work will be to seek to drive innovation in interface reasoning and systems modelling into tools for business leaders to apply in reasoning about the interfaces they are exploiting within their organisations. Further as new technologies emerge (e.g. block-chains and Machine Learning) and become available as services through interfaces so reasoning about the managerial, contractual and organisational challenges, and about the systemic nature of interfaces, is necessary. We will therefore research how computer science understanding of interfaces might be useful in understanding the social, managerial and organisational boundary.

The significance of researching interfaces as “boundary resources” has been recognised (Ghazawneh and Henfridsson 2013; Hanseth and Bygstad 2015; Yoo et al. 2010) particularly in studying software platforms whereby (Eaton et al. 2015) they are negotiated over time. These authors acknowledge we lack a coherent methodological framework for examining such boundaries – the gap we will ultimately address.

2        Scientific Approaches

This research is exploratory drawing on theoretical lenses from information systems, management and sociology as well as computer science. First we will systematically evaluate a range of theories and management ideas and evaluate their appropriateness for researching different forms of interfaces. Two specific theoretical lenses we consider within this exploratory research and application are:

Control and Coordination: Harnessing an interface cedes control for an action to a third party and devises mechanisms for control and defines boundaries. We will therefore seek to understand control and coordination in interfaces, and to devise mechanisms by which managers may better understand how they control or are controlled by interface design. This extends Venters previous work (Whitley et al. 2014) and links to ideas of control whereby interfaces are socially interpreted and significant in driving algorithmic agency and culture. This research will contribute to understanding platforms (de Reuver et al. 2017; Gawer and Cusumano 2002) whereby an interface provider is often dominant (e.g. Apple provides iOS to App developers) in providing boundary conditions for control (Eaton et al. 2015) though their boundary resources (Ghazawneh and Henfridsson 2013). This understanding will, we hope, complement and extend the resource focused modelling of control within distributed systems logic.

Temporality, emergence and evolution: Within commercial settings interfaces regularly change. This project will evaluate the relationships between evolutionary change across multiple interfaces, contexts of use, and organisational goals. Interfaces enable resources to be decoupled and recoupled generating new possibilities and increasing the liquidity of resources within value production. Exploring how interface verification alters resource liquidity may be an important avenue of study, drawing upon service dominant logic (Bardhan et al. 2010) to better understand interface consumption. Exploring how organisations can verify evolving and changing interfaces in a timely manner is an important research question for the wider research programme.

We will seek to explore the inter-organisational architectures which emerge through ecosystems: The prevalence of digital interfaces has allowed a unbundling of enterprise software from vertically integrated technology stacks (Chang and Gurbaxani 2012; Hagel and Singer 1999) towards widely distributed flat architectures spanning multiple global supplier networks (Friedman 2005; Susarla et al. 2010). Tracing and understanding this change in terms of enterprise architecture, and its impact on interfaces is relevant.

2         References

Bardhan, I., Demirkan, H., Kannan, O., and Kauffman, R. 2010. “Special Issue: Information Systems in Services,” Journal of Management Information Systems (26:4), pp. 5-12.

Barros, A. P., and Dumas, M. 2006. “The Rise of Web Service Ecosystems,” IT Professional (8:5), pp. 31-37.

Chang, Y. B., and Gurbaxani, V. 2012. “Information Technology Outsourcing, Knowledge Transfer, and Firm Productivity: An Empirical Analysis,” MIS quarterly (36:4), pp. 1043-1053.

Collinson, M., Monahan, B., and Pym, D. J. 2012. A Discipline of Mathematical Systems Modelling. College Publications.

de Reuver, M., Sorensen, C., and Basole, R. C. 2017. “The Digital Platform,” Journal of Information Technology (Forthcoming).

Eaton, B., Elaluf-Calderwood, S., Sørensen, C., and Yoo, Y. 2015. “Distributed Tuning of Boundary Resources: The Case of Apple’s  Ios Service System,” MIS Quarterly (39:1), pp. 217-243.

Fishenden, J., and Thompson, M. 2013. “Digital Government, Open Architecture, and Innovation: Why Public Sector It Will Never Be the Same Again,” Journal of Public Administration, Research, and Theory (23:4), pp. 977-104.

Friedman, T. 2005. The World Is Flat: A Brief History of the Globalized World in the 21st Century. London: Allen Lane.

Gawer, A., and Cusumano, M. 2002. Platform Leadership. Boston,MA: Harvard Business School Press.

Ghazawneh, A., and Henfridsson, O. 2013. “Balancing Platform Control and External Contribution in Third-Party Development: The Boundary Resources Model,” Information Systems Journal (23:2), pp. 173-192.

Hagel, J., and Singer, M. 1999. “Unbundling the Corporation,” Harvard business review (77), pp. 133-144.

Hanseth, O., and Bygstad, B. 2015. “Flexible Generification: Ict Standardization Strategies and Service Innovation in Health Care,” European Journal of Information Systems (24:6), pp. 654-663.

Monteiro, E., Pollock, N., and Williams, R. 2014. “Innovation in Information Infrastructures: Introduction to the Special Issue,” Journal of the Association for Information Systems (15:4), p. I.

Porter, M., and Heppelmann, J. 2014. “How Smart, Connected Products Are Transforming Competition,” Harvard Business Review).

Susarla, A., Barua, A., and Whinston, A. B. 2010. “Multitask Agency, Modular Architecture, and Task Disaggregation in Saas,” Journal of Management Information Systems (26:4), pp. 87-118.

Thompson, M., and Venters, W. 2015. “The Red Queen Hypothesis: Exploring Dynamic Service Ecosystems,” in: 4th Innovation in Information Infrastructures (III) Workshop, P. Constantinides (ed.). Warwick, UK.

Venters, W., and Whitley, E. 2012. “A Critical Review of Cloud Computing: Researching Desires and Realities,” Journal of Information Technology (27:3), pp. 179-197.

Whitley, E., Willcocks, L., and Venters, W. 2014. “Privacy and Security in the Cloud: A Review of Guidance and Responses,” Journal of Information technology and information management).

Willcocks, L., Venters, W., and Whitley, E. 2014. Moving to the  Cloud Corporation. Basingstoke: Palgrave Macmillan.

Yoo, Y., Henfridsson, O., and Lyytinen, K. 2010. “The New Organizing Logic of Digital Innovation: An Agenda for Information Systems Research,” Information Systems Research (21:4), pp. 724-735.

[1] E.g. The Academy of Management (AoM) conference theme for 2017 is “at the Interface” (premier global academic conference in management) and defines interfaces in these terms.

[2] Willcocks, L., W. Venters and E. Whitley (2014). Moving To The Cloud Corporation. Basingstoke, Palgrave Macmillan.

[3] https://www.publictechnology.net/articles/features/adur-and-worthing%E2%80%99s-journey-%E2%80%98government-platform%E2%80%99

 

Photo (cc) foto1897 with thanks!

Netskope’s approach to Shadow IT security.

Dr Will VentersLeave a comment

On Wednesday last week I attended “Cloud Expo Europe” at London’s Excel centre. One of particularly interesting product was Netskope (also a finalists in the UK Cloud Awards) who are addressing the challenge of ShadowIT – employees use of cloud-services which are not sanctioned by the corporate IT departments.

According to Accenture (2013) “78% of cloud procurement comes from Strategic Business Units (SBUs), and only 28% from centralized IT functions”. Without some form of control the data-protection and compliance challenges of this can prove a huge. Users are also poorly skilled in making rational decisions about the safety of company data and products like Netskope address this by examining fire-wall logs or running Proxy servers and providing an easy interface so IT departments can enforce cloud access policies. The product analyses users’ access patterns and sends alerts, encrypts content on upload, blocks cloud transactions and quarantines content for review by Legal or IT. It essentially monitors and stops employees doing anything risky.

For me, the value of this product is the database of different cloud services with detailed information as to their safety and compliance. The product is however also really frustrating. At its heart is the assumption that the job of the IT professional is to monitor, control and police employees. This puts IT in opposition to the other business functions. Why couldn’t this product have instead started from a different assumption – that employees are, mostly, just trying to do their work as efficiently as possible. While a few are bad, most are just ignorant to the risks. Netskope would have been fantastic if it instead helped reduce this ignorance rather than policing users’ failures.  Had it provided an employee-portal to allow employees to evaluate cloud services prior to adoption it would have promoted the effective use of them, and allowed users to make rational decisions on their adoption. The IT department would be in a facilitation role rather than a policing role, and employees would feel in control (rather than in fear). The safety would be just the same (with Netskope policing policy) but with users feeling part of that effort. Productivity gains might also be achieved as users are freed to try using new valuable IT services knowing they were doing it safely and with management approval.

This isn’t to criticise Netskope for what it does do – but to call upon new approaches to thinking about the role of IT and the CIO in this cloud-future.

My interview for the Financial Times on Cloud Regulation…

Dr Will VentersLeave a comment

Follow this link for the video an interview I did for the Financial Times on regulation of cloud computing:

Understanding Cloud Computing – Financial Times.

 

BBC News – Microsoft ‘must release’ data held on Dublin server

Dr Will VentersLeave a comment

The following news article – reported on the BBC but repeated elsewhere – is perhaps the most important issue for cloud computing today (particularly in the consumer space). Our post-Snowden world is being shaped by legal arguments in the USA which have profound implications for the use of global cloud services. If Microsoft is forced to hand over data from its Dublin data-centers then companies concerned about the US gaining access to their data will have to avoid US companies entirely. Watch this space!

BBC News – Microsoft ‘must release’ data held on Dublin server.

The 7 deadly sins of cloud computing – ComputerworldUK.com

Dr Will VentersLeave a comment

A thoughtful article which addresses a road less travelled than the usual hysteria type articles on cloud security…

The 7 deadly sins of cloud computing – ComputerworldUK.com.

Our Fifth Report is out – Management implications of the Cloud

Dr Will VentersLeave a comment

The fifth report in our Cloud Computing series for Accenture has just been published. This report looks at the impact Cloud Computing will have on the management of the IT function, and thus the skills needed by all involved in the IT industry. The report begins by analysing the impact Cloud might have in comparison to existing outsourcing project. It considers the core-capabilities which must be retained in a “cloud future”, considering how these capabilities might be managed, and the role of systems integrators in managing the Cloud.

Please use the comments form to give us feedback!

Cloud and the future of Business 5 – Management .

Experts warn of growth of ‘shadow IT’ use outside IT department control – 6/28/2011 – Computer Weekly

Dr Will VentersLeave a comment

Experts warn of growth of ‘shadow IT’ use outside IT department control – 6/28/2011 – Computer Weekly.

 

The key points in this article reflect findings we made in our research – that certain groups within organisations are circumventing IT policy by exploiting smart-phones and various devices to provide innovative services to the enterprise – but against the IT policy of the enterprise. Responding to this challenge is a key concern.

Second Report is here! The Challenges of Cloud.

Dr Will VentersLeave a comment

http://outsourcingunit.org/publications/Cloudreport2_Challenges.pdf

 
In this second (of five) reports for Accenture on Cloud Computing we explore the challenges faced by firms.



Unlike other reports we do not dwell on technologically deterministic problems alone (security being one example). Instead we extend this discussion to include issues such as institutional lock-in. Such lock-in occurs when an organisations adoption of a SaaS can lead their users to become quickly locked into the ongoing development strategy of that SaaS whether it aligns with the organisations strategic aims or not. It is hard to get users who like a SaaS to stop using it if it aligns with their desires and aims even if it is against overall company objectives.

We also discuss Service Level Agreements – discussing why the challenges are not what people believe. The key is understanding the challenge of multi-tenancy for a service provider.

Enjoy!

 

Our 2nd Report: Meeting the challenges of cloud computing – Accenture Outlook

Dr Will VentersLeave a comment

http://www.accenture.com/SiteCollectionDocuments/PDF/Accenture-Outlook-Meeting-the-challenges-of-cloud-computing.pdf

Our second Accenture report on Cloud Computing is about to be published!  As a taster the above link takes you to a short synopsis (Published in the Accenture Outlook Points of View series). I will post a link to the full report when it is out.

While in danger of providing a summary on a summary, this second report builds on our first “Promise of Cloud Computing”  report to analyse the challenges faced by a move to cloud. We identify the following key challenges:

Challenge #1: Safeguarding data security

Challenge #2: Managing the contractual relationship

Challenge #3: Dealing with lock-in

Challenge #4: Managing the cloud

Once you read the paper I would love to hear your views – please use the add comments link at the bottom of this section (its quite small!) or email me directly on w.venters@lse.ac.uk

I would also suggest you also review the whole report when it is out – much of the important detail is missing from this shorter synopses.

Cloud Computing – it’s so ‘80s.

Dr Will Venters7 Comments

For Vint Cerf[1], the father of the internet, Cloud Computing represents a return to the days of the mainframe where service-bureaus rented their machines by the hour to companies who used them for payroll and other similar tasks. Such comparisons focus on the architectural similarities between centralised mainframes and Cloud computing – cheaply connecting to an expensive resource “as a service” through a network. But cloud is more about the provision of “low-cost” computing (albeit in bulk through data-centres) at even lower costs in the cloud. A better analogy that the mainframe then is the introduction of the humble micro-computer and the revolution it brought to corporate computing in the early 1980s.

When micros were launched many companies operated using mini or mainframe computers which were cumbersome, expensive and needed specialist IT staff to manage them[1]. Like Cloud Computing today, when compared with these existing computers the new micros offered ease of use, low cost and apparently low risk which appealed to business executives seeking to cut costs, or SMEs unable to afford mini’s or mainframes[2]. Usage exploded and in the period from the launch of the IBM PC in 1981 to 1984 the proportion of companies using PCs increased dramatically from 8% to 100% [3] as the cost and opportunity of the micro became apparent. Again, as with the cloud[4], these micros were marketed directly to business executives rather than IT staff, and were accompanied by a narrative that they would enable companies to dispense of heavy mainframes and the IT department for many tasks –doing them quicker and more effectively. Surveys from that time suggested accessibility, speed of implementation, response-time, independence and self-development were the major advantage of the PC over the mainframe[5] –  easily recognisable in the hyperbole surrounding cloud services today. Indeed Nicholas Carr’s current pronouncement of the End of Corporate IT[6] would probably have resonated well in the early 1980s when the micro looked set to replace the need for corporate IT. Indeed in 1980 over half the companies in a sample claimed no IT department involvement in the acquisition of PCs[3].

But problems emerged from the wholesale uncontrolled adoption of the Micro, and by 1984 only 2% of those sampled did not involve the IT department in PC acquisition[3]. The proliferation of PCs meant that in 1980 as many as 32% of IT managers were unable to estimate the proportion of PC within their company[3], and few could provide any useful support for those who had purchased them.

Micros ultimately proved cheap individually but expensive on-mass[2] as their use exploded and new applications for them were discovered. In addition to the increased use IT professionals worried about the lack of documentation (and thus poor opportunity for maintenance), poor data management strategies, and security issues[7]. New applications proved incompatible with others (“the time-bomb of incompatibility”[2]), and different system platforms (e.g. CP/M, UNIX, MS-DOS, OS/2, Atari, Apple …) led to redundancy and communication difficulties between services and to the failure of many apparently unstoppable software providers –household names such as Lotus, Digital-Research, WordStar and Visi and dBase[8].

Ultimately it was the IT department which brought sense to these machines and began to connect them together for useful work using compatible applications – with the emergence of companies such as Novell and Microsoft to bring order to the chaos[8].

Drawing lessons from this history for Cloud Computing are useful. The strategic involvement of IT services departments is clearly required. Such involvement should focus not on the current cost-saving benefits of the cloud, but on the strategic management of a potentially escalating use of Cloud services within the firm. IT services must get involved in the narrative surrounding the cloud – ensuring their message is neither overly negative (and thus appearing to have a vested interest in the status quo) nor overly optimistic as potential problems exist. Either way the lessons of the microcomputer are relevant again today.  Indeed Keen and Woodman argued in 1984 that companies needed the following four strategies for the Micro:

1)      “Coordination rather than control of the introduction.

2)      Focusing on the longer-term technical architecture for the company’s overall computing resources, with personal computers as one component.

3)      Defining codes for good practice that adapt the proven disciplines of the [IT industry] into the new context.

4)      Emphasis on systematic business justification, even of the ‘soft’ and unquantifiable benefits that are often a major incentive for and payoff of using personal computers” [2]

It would be wise for companies contemplating a move to the cloud to consider this advice carefully – replacing personal-computer with Cloud-computing throughout.

(c)2011 Will Venters, London School of Economics. 

[1]            P. Ceruzzi, A History of Modern Computing. Cambridge,MA: MIT Press, 2002.

[2]            P. G. W. Keen and L. Woodman, “What to do with all those micros: First make them part of the team,” Harvard Business Review, vol. 62, pp. 142-150, 1984.

[3]            T. Guimaraes and V. Ramanujam, “Personal Computing Trends and Problems: An Empirical Study,” MIS Quarterly, vol. 10, pp. 179-187, 1986.

[4]            M. Benioff and C. Adler, Behind the Cloud – the untold story of how salesforce.com went from idea to billion-dollar company and revolutionized and industry. San Francisco,CA: Jossey-Bass, 2009.

[5]           D. Lee, “Usage Patterns and Sources of Assitance for Personal Computer Users,” MIS Quarterly, vol. 10, pp. 313-325, 1986.

[6]            N. Carr, “The End of Corporate Computing,” MIT Sloan Management Review, vol. 46, pp. 67-73, 2005.

[7]            D. Benson, “A field study of End User Computing: Findings and Issues,” MIS Quarterly, vol. 7, pp. 35-45, 1983.

[8]            M. Campbell-Kelly, From Airline Reservations to Sonic the Hedgehog: A history of the software industry. Cambridge,MA: MIT Press, 2003.