Model-Based Mitigation of Availability Risks

The assessment and mitigation of risks related to the availability of the IT infrastructure is becoming increasingly important in modern organizations. Unfortunately, present standards for Risk Assessment and Mitigation show limitations when evaluating and mitigating availability risks. This is due to the fact that they do not fully consider the dependencies between the constituents of an IT infrastructure that are paramount in large enterprises. These dependencies make the technical problem of assessing availability issues very challenging. In this paper we define a method and a tool for carrying out a Risk Mitigation activity which allows to assess the global impact of a set of risks and to choose the best set of countermeasures to cope with them. To this end, the presence of a tool is necessary due to the high complexity of the assessment problem. Our approach can be integrated in present Risk Management methodologies (e.g. COBIT) to provide a more precise Risk Mitigation activity. We substantiate the viability of this approach by showing that most of the input required by the tool is available as part of a standard business continuity plan, and/or by performing a common tool-assisted Risk Management

Developing an inter-enterprise alignment maturity model: research challenges and solutions

Business-IT alignment is pervasive today, as organizations strive to achieve competitive advantage. Like in other areas, e.g., software development, maintenance and IT services, there are maturity models to assess such alignment. Those models, however, do not specifically address the aspects needed for achieving alignment between business and IT in inter-enterprise settings. In this paper, we present the challenges we face in the development of an inter-enterprise alignment maturity model, as well as the current solutions to counter these problems

Determinants of the implied volatility function on the Italian Stock Market.

This paper describes the implied volatility function computed from options on the Italian stock market index between 1995 and 1998 and tries to find out potential explanatory variables. We find that the typical smirk observed for S&P500 stock index characterizes also Mib30 stock index. When potential determinants are investigated by a linear Granger Causality test, the important role played by option's time to expiration, transacted volumes and historical volatility is detected. A possible proxy of portfolio insurance activity does poorly in explaining the observed pattern. Further analysis shows that the dynamic interrelation between the implied volatility function and some determinants could be, to a certain extent, non-linear.

A cost estimate maturity benchmark method to support early concept design decision-making: a case study application to the small modular nuclear reactor

Constructing large Nuclear Power Plants (NPPs) is synonymous with significant cost and schedule uncertainty. Innovative Small Modular Reactors (SMRs) have been identified as a way of increasing certainty of delivery, whilst also maintaining a competitive Life Cycle Cost (LCC). Previous research into the cost of SMRs has focused on the economics of a design from the perspective of an owner or investor. There is a significant gap in the literature associated with cost estimating SMRs at the early concept development stage from the perspective of a reactor developer. Early design stage cost estimates are inherently uncertain. Design teams, therefore, need to make decisions that will achieve a cost competitive product by considering uncertainty. Existing cost uncertainty analysis methods lack standardisation in their application, often relying on the subjective assessment of experts. The central argument presented in this research is that the SMR vendor can make more effective decisions related to achieving cost certainty by understanding the drivers of knowledge uncertainty associated with early design stage cost estimates. This thesis describes research spanning the concept design phase of the UK SMR development programme. The research investigation is divided into two distinct phases. The first phase identifies the requirements for cost information from the perspective of the SMR vendor through interviews, a participatory case study investigation and surveys. Limited access to cost information means that early design cost assessment is highly subjective. Cost uncertainty analysis should provide decision makers with an understanding of the level of confidence associated with the estimate. A survey investigating how cost information is interpreted revealed that providing more granular detail about cost uncertainty would support the design team with additional rationale for selecting a design option. The main requirement identified from phase 1 of the research is the need for a standardised method to identify how sources of cost uncertainty influence the maturity of the estimate at each stage of the design development process. The second phase of the research involved a participatory research approach where the Acceptable Cost Uncertainty Benchmark Assessment (ACUBA) method was developed and then implemented retrospectively on the case study cost data. The ACUBA method uses a qualitative measure to assess the quality and impact of engineering definition, manufacturing process knowledge and supply chain knowledge on the cost estimate confidence. The maturity rating is then assessed against a benchmark to determine the acceptability of the estimate uncertainty range. Focus groups were carried out in the vendor organisation to investigate whether the design team could clarify their reasoning for decisions related to reducing cost uncertainty when given insight into the sources of cost uncertainty. The rationale for a decision is found to be clearer using the ACUBA method compared with existing cost uncertainty analysis methods used by the case study organisation. This research has led to the development of a novel method which standardises and improves the communication of cost information across different functions within a design team. By establishing a benchmark acceptable level of cost maturity for a decision, the cost maturity metric can be employed to measure the performance of the SMR development programme towards achieving product cost maturity. In addition, the ACUBA method supports the more effective allocation of limited resources available at the early design stage, by identifying design activities which could lead to an acceptable cost maturity.</div

Linking benefits to maturity models

Many organizations today need to deliver more complex products and services in a better, faster, and cheaper way. The business problems that some companies address require enterprise-wide solutions that call for an integrated approach and an effective management of organizational resources to achieve business objectives with an acceptable level of risk. A maturity model is a process improvement approach that provides organizations with the essential elements of effective change. It can be used to guide process improvement across a project, a division, or an entire organization. Maturity models help integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide benchmark for appraising current processes outcomes. The benefits management approach emerges as a complement to traditional management practices and proposes a continuous mapping of benefits, implementing and monitoring intermediate results. Benefits management reinforces the distinction between project results and business benefits. Based on a case study the authors show how a set of business objectives can be obtained from identifying, structuring and monitoring business benefits, supported by information technology enablers and organizational transformations, and as a result of a certain maturity level. The authors also state that the main focus of an investment success lies not only in technology implementation, but mainly in changes in organizational performance and business efficiency by means of improved processes and modifications in the way the work is done. We emphasize that the integration between a Maturity Model and a Benefits Management approach can increase the effectiveness of projects, programs or portfolios outcomes. Besides, this linkage can also improve decision-makers confidence that the investments done match the desired maturity stages and will then, with more probability, collect more value for businessesinfo:eu-repo/semantics/publishedVersio

Vulnerability Identification Errors in Security Risk Assessments

At present, companies rely on information technology systems to achieve their business objectives, making them vulnerable to cybersecurity threats. Information security risk assessments help organisations to identify their risks and vulnerabilities. An accurate identification of risks and vulnerabilities is a challenge, because the input data is uncertain. So-called ’vulnerability identification errors‘ can occur if false positive vulnerabilities are identified, or if vulnerabilities remain unidentified (false negatives). ‘Accurate identification’ in this context means that all vulnerabilities identified do indeed pose a risk of a security breach for the organisation. An experiment performed with German IT security professionals in 2011 confirmed that vulnerability identification errors do occur in practice. In particular, false positive vulnerabilities were identified by participants. In information security (IS) risk assessments, security experts analyze the organisation’s assets in order to identify vulnerabilities. Methods such as brainstorming, checklists, scenario-analysis, impact-analysis, and cause-analysis (ISO, 2009b) are used to identify vulnerabilities. These methods use uncertain input data for vulnerability identification, because the probabilities, effects and losses of vulnerabilities cannot be determined exactly (Fenz and Ekelhart, 2011). Furthermore, business security needs are not considered properly; the security checklists and standards used to identify vulnerabilities do not consider company-specific security requirements (Siponen and Willison, 2009). In addition, the intentional behaviour of an attacker when exploiting vulnerabilities for malicious purposes further increases the uncertainty, because predicting human behaviour is not just about existing vulnerabilities and their consequences (Pieters and Consoli, 2009), rather than preparing for future attacks. As a result, current approaches determine risks and vulnerabilities under a high degree of uncertainty, which can lead to errors. This thesis proposes an approach to resolve vulnerability identification errors using security requirements and business process models. Security requirements represent the business security needs and determine whether any given vulnerability is a security risk for the business. Information assets’ security requirements are evaluated in the context of the business process model, in order to determine whether security functions are implemented and operating correctly. Systems, personnel and physical parts of business processes, as well as IT processes, are considered in the security requirement evaluation, and this approach is validated in three steps. Firstly, the systematic procedure is compared to two best-practice approaches. Secondly, the risk result accuracy is compared to a best-practice risk-assessment approach, as applied to several real-world examples within an insurance company. Thirdly, the capability to determine risk more accurately by using business processes and security requirements is tested in a quasi-experiment, using security professionals. This thesis demonstrates that risk assessment methods can benefit from explicit evaluation of security requirements in the business context during risk identification, in order to resolve vulnerability identification errors and to provide a criterion for security

Enacting product-service business models: the role of lean thinking

As competitively tendering for work is becoming increasingly difficult, and with profit margins reducing, UK construction companies are looking to differentiate their offering to clients. Safely delivering on time, within budget and to the required quality standard is no longer a differentiator in a market where clients are demanding increased value, building information modelling and life cycle provision. Construction companies are therefore looking to extend their activities into business consulting, financing and operational services, which will provide new sources of revenue in addition to their core production activities. This holistic service should provide solutions that meet their client s business needs, not just their building needs, ultimately resulting in long-standing relationships that over time yield a more predictable, long-term return. Over half of the top 20 UK construction companies, by turnover, have stated their intent to provide solutions to their clients - the case study organisation in which this research has been carried out is one of those companies. Part of a group of companies, the case study company, Shepherd Construction Ltd (SCL), has a vision to deliver integrated solutions to their clients, with the ultimate aim being that companies across the group can pool their expertise and deliver a service offering unique to the industry. Existing literature states the characteristics that integrated solutions providers need to possess, and proposes models for how an organisation needs to structure itself to deliver a service. However, the applicability of these models to SCL was unknown, and along with current literature on how to enact the transition pathway being vague, highlighted an area for investigation. Since the aim of integrated solutions provision is the delivery of a service to the client that adds value, it was proposed that lean thinking could provide a means of enacting the P-S transition: the starting point for lean thinking is value (Womack & Jones, 2003). Lean thinking principles (Womack & Jones, 2003) state that value needs to flow through the value stream the series of actions that transform inputs into the completed output raising the further proposition that flow is required through the stages of the integrated solutions lifecycle (the value stream) in order to successfully deliver all aspects of the client s value proposition, i.e. the desired solution. As a long established main-contractor, or product provider, SCL s challenge to transition from products-to-services was set against a backdrop of inconsistent performance and loss of continuity of service at crucial pinch-points in the delivery process. The action research carried out therefore sought to understand these problems and develop practices based on lean thinking that could be implemented in the company to enable consistent delivery of integrated solutions, i.e. enable the products-to-service transition, and in doing so provide the basis for the wider group vision. An abductive approach was taken to the research strategy; the experiences of the participants involved in the changes prompted by the action research process were used to inform the development of new theories and practices, and evaluate them once implemented. The methods used for collecting data and accounting for the experiences of people in the company included observation, both participant and non-participant, semi-structured interviews and analysis of company records. The research findings show that lean thinking has a role to play in enabling an organisation to transition from the provision of products to services. Standard processes and tools, based on lean thinking and developed through the action research framework, are shown to be the basis for consistent and repeatable performance within the phases of the integrated solutions lifecycle. Flow of information through and between phases of the lifecycle is then shown to be essential to ensuring the client s value proposition is realised and information is not lost during the transitions between lifecycle phases. The operational framework for service delivery , one of the practices developed, itself a form of standardised work, draws on lean thinking to provide a structured, yet flexible, means of developing a plan for service delivery that is focused on the client and ensuring the client s definition of value flows through the integrated solutions value stream and is therefore continually understood, and ultimately delivered, by the whole team as the project progresses. The practices developed through the research the standard company management system, operational framework for service delivery , service delivery plan and maturity assessment are shown to have improved consistency and company performance, and to have contributed to improved customer satisfaction (the ultimate aim of delivering a service) such that the company is starting to be perceived in the marketplace as an integrated solutions provider. This research also contributes to existing theory by evidencing that the transition pathway from products-to-services isn t as smooth as current literature portrays. In trying to implement current models in a construction setting, the products-to-service transition has been problematised and deficiencies in existing characteristics and models identified. Along with showing that lean thinking provides a theoretical framework for enacting the products-to-service transition, the hybrid model of the integrated solutions lifecycle developed, along with the maturity assessment, provide new theoretical insights, such as the need for feedback loops between all phases of the lifecycle