What are the types and levels of information?

Information is generally classified as follows: Suitable controls need to be applied for protecting the information.

A.

Restricted Information

Information should be classified as Restricted when the unauthorized disclosure, alteration or destruction of that data could cause a significant level of risk to the Organization or its stakeholders (eg Directors, employees, clients, (including patients for Healthcare) and service providers). Examples of Restricted Information include data protected by state or federal privacy regulations and data protected by confidentiality agreements. The highest level of security controls should be applied to Restricted Information.

B.

Private Data

Information should be classified as Private when the unauthorized disclosure, alteration or destruction of that data could result in a moderate level of risk to the Organization or its stakeholders. By default, all Institutional Data that is not explicitly classified as Restricted or Public data should be treated as Private data. A reasonable level of security controls should be applied to Private Information.

C.

Public Data

Information should be classified as Public when the unauthorized disclosure, alteration or destruction of that data would results in little or no risk to the Organization or its stakeholders. Examples of Public data include press releases, Product and service brochures and research publications. While little or no controls are required to protect the confidentiality of Public data, some level of control is required to prevent unauthorized modification or destruction of Public Information.

In another context, Information may also be classified as Strategic, Tactical and Operational. Each of these may have the above sub classifications, i.e, Restricted, Private or Public .

Good luck !!

You may like to visit my website Anil Oberai, C.E.O of Oberai IT Consultancy/ to view my daily articles on Information security & Project management.

Impact on IT organizations, when their employees form a welfare union

IT is a people and knowledge based industry. All employees are matured and educated. Normally, welfare 'unions' are not popular in IT Industry, but even if they are, Management needs to take them into confidence on important matters.. the Union’s welfare measures should be genuine, and the management should recognize them as an extension of the HR. In case of non genuine demands or measures which affect the growth of a company, management should reason it out with the welfare unions that this is going to hinder the growth of the company, and all employees.

After all, welfare of employees is the company’s prerogative, and it should take the welfare unions as a helping hand in genuine measures.

I am an IT Consultant with over 2 decades experience in IT Industry, providing help in areas of Information Security, Project Management, and Process Excellence. For more information, Pl contact me through my website

Anil Oberai, C.E.O of Oberai IT Consultancy

What are the job prospects after a  CAPM certification?

There are 2 aspects of Project Management… The “what” of it and the “how” of it.

CAPM course will tell you the “ what “ of it, the “how” is what the employers are really interested in, so you must get experience in Project management (maybe initially as a Assistant PM or a Senior TL, handling a Team, reporting, Estimation and Costs and Activities monitoring) .

I am sure with above guidelines and focussing on the “how” part of PM , you will be able to successfully apply for the “what” part of PM gained through CAPM course and be successful .

Good luck !!

I am an IT Consultant with over 2 decades experience in IT Industry, providing help in areas of Information Security, Project Management, and Process Excellence. For more information, Pl contact me through my website

https://aniloberai.bogspot.in/

Does ITIL help a sales/presales person?

Does ITIL help a sales/presales person?

Yes, I feel ITIL helps a sales / pre sales person 

The objective should be clear - is the person involved in sales of a company working in the domain where the efficiency of IT services is important for its Top line or Bottom line (read Profitability) ? or Is it that he is trying to change his career to another company where business is run on IT ? or is it that he has heard from somewhere that ITIL is helping in career growth? In all these cases, if a Sales person knows about ITIL, it is going to help him.

For a sales person in FMCG or Financial services or general Administration, it is not going to be of use . The size of organization also matters - for Micro and small enterprises, it will serve as a good understanding exercise, but your organization may not have budget or Time to implement it .

Now that we are clear of the objective, I would like to describe what ITIL is all about :

1. Service Design
2. Service Transition
3. Service Operation
4. Strategy for Improvement of Service

The last thing I would like to advice Sales people is :

a.Getting the objective clear

b.Plan a goal for yourself that after knowledge of ITIL , how is ITIL is important in your career? what are you going to achieve with this knowledge? Qualify organizations from your funnel, into those which could be benefitted with ITIL from their Strengths and weaknesses and then move ahead..

c. You should like selling services

Please remember that not every organization can go in for ITIL , even if they appreciate it initially.

Good Luck !!

I am an IT Consultant with over 2 decades experience in IT Industry, providing help in areas of Information Security, Project Management, and Process Excellence. For more information, Pl contact me through my website https://aniloberai.blogspot.in/

86 Views

How good is ITIL certification for freshers in IT industry?

ITIL certification is for practitioners , not only a subject in a course. So get some practical experience first, for at least 2–3 years, on IT enabled services support environment, get first hand exposure of incident management, change management , could be relocating of servers and Communication, Internet Infrastructure , put a measurement system in place of the incidents observed and time taken to repair, see and understand the token based fault alert system in place , or put one in place in your organization , then go in for ITIL certification . After the certification put the measurement system in place again, and I am sure you and your management will be very happy with the results , I can assure you !!

That will really help you and understand the terms in ITIL (there are plenty in this library of IT infrastructure .

That is my advise to all freshers.

Good luck,

I am an IT Consultant providing help in areas of Information Security, Project Management, and Process Excellence. For more information, Pl contact me through my website https://aniloberai.blogspot.in/

What is the benefit of a Project Management course?

What is the benefit of a Project Management course?

A Project Management course can be very beneficial from following view points :

1. To the employee - a classroom workshop with an experienced instructor is going to tell you the “How” part of project implementation. You will learn the terms, their meaning and applications, the stages, the role of the stakeholders involved, and also learn new tools in the process.
2. To the employers - they will have the knowledge, tools and techniques to effectively manage projects. Their Projects will be better managed within the scope of work, resources, Quality and time .
3. For IT practitioners, Agile is the way to go these days, so I would recommend doing a Agile Project management course - To the people who are having a non IT background, wanting to go into IT projects management, you should start with doing a beginners course , then get some experience working as a Assistant Project Manager or a Team Lead, then do the Professional course . Experienced non IT professionals can also do course by PMI.
4. 2 things are very important which I always emphasize - do what you like doing, and not because everyone is doing it, and ; get some real experience in Project management (maybe even in an Ad hoc or single project “planned" manner) , before doing a certification (which is next step after the course on PM) . This way learning would be good, you will learn out of your mistakes, and work around them effectively .
5. To Senior Project managers- get some training on strategy , soft skills and presentation skills - you can do it yourself out of vast e-learning and online tutorials available.

Good luck !!

You may like to visit my website Anil Oberai, C.E.O of Oberai IT Consultancy/ to view my daily articles on Project management.

What should be my next goal after having 6 years of IT Experience?

What should be my next goal after having 6 years of IT Experience?

In this rapidly changing IT industry, this Question is there in every professionals mind, what should be my goal after 5–6 years !

My advice is , in these 6 years of IT experience , what is it which you liked the best?

a. Are you good at development ? Can you quickly develop an algorithm and a program, given the requirements ? Which software tools are you good at? Are they in demand as of now ? Then my advice would be to go in for a Course in Project management, Agile or Scrum which is in demand today, get some process management and leadership training, apply for a Project manager’s position . (Start initially as a Assistant Project manager, do your study and certification alongside the job).

b. Are you good at Design, Architecture, and have good knowledge and workex of the current Object and service oriented architectures, then plan to be a good Lead software architect - it could be a migration to e-commerce from client server architecture, which will be good experience and job satisfaction for you. Here, you may or may not have a team with you. You could go in for a diploma in e-commerce.

c. Are you good at Testing, then you should go in for QA Training certificate programs which can also include actual hands on training and certification in tools like Load runner or Rational . Here you are expected to lead a Team, so you should have Leadership and soft skills training as well. You can apply for a Testing Head position with a team under you.

d. If you have done a MBA in IT , and have interest in doing business analysis and presentations and managing a Product through its life cycle, then Product Management is a good option for you, You may or may not have a team under you, but this is an excellent interface between the sales and development teams .

I could go on and on, and discuss about other areas like Information security, ERP, Sales and business development, Business process migration , Supply chain, CRM etc. but let me end here for current context.

All above positions are in great demand now and so it does not matter what you chose, the goal should be of your liking !!

Good luck !!

This article is written by Mr. Anil Oberai, C.E.O of OberaiITConsultancy, with more than 2 decades of experience in managing and Consulting for IT Projects. To know more, Pl visit  https://aniloberai.blogspot.in/

FINANCIAL ASPECTS OF INFORMATION SECURITY INVESTMENTS

FINANCIAL ASPECTS OF INFORMATION SECURITY INVESTMENTS

Information security - the safeguarding of computer systems and the integrity, Confidentiality, and availability of the data they contain - has long been recognized as a critical issue. Two current trends indicate that its importance is growing.

First, the integration of computers into more and more aspects of modern life continues. Second, cyber-attacks, or breaches of information security, appear to be increasing in frequency, and few observers are willing to ignore the possibility that future attacks could have much more severe consequences than what has been observed to date.

The core issue, in all types of organizations, is whether we devote enough resources to information security Part of the answer must come from Financial analysis. What are the Costs  of security breaches? How frequently can attacks be expected? Can these factors be quantified precisely, so that business firms and their Boards can determine the optimal amount to spend on information security and measure the effectiveness of that spending?

Financial analysis

1.      Return due to investment in security

Return  is expressed as the net gain divided by the investment.

In the simplest of terms:

(TOTAL AMOUNT GAINED)−(AMOUNT invested)/( AMOUNT invested)

2.      annual loss expectancy

Annual Loss expectancy is expressed in the following form:

Sum of (Harmful outcomes x Impact in Rs. or $ x Frequency of outcome)

We calculate the Loss expectancy with Security controls and Annual loss without security controls in place.

3.      TOTAL AMOUNT GAINED = benefit = sum of annual loss expectancy

 = annual loss expectancy without sec control− annual loss expectancy with sec control

In addition, there are other parameters which can be calculated and presented to the board to justify the financial needs for Information security investments.

The above article has been written by Mr Anil Oberai, who is an IT Consultant. He has over 2 decades of experience specializing in areas of Information Security, Project Management, and Process Excellence. You may contact him through his Mob+91-9899124880 (New Delhi) or visit his website https://aniloberai.blogspot.in/

Role of a Information Security architect

Role of a Information Security architect 

Information Security Architect plays a key role, as part of the existing Information Security team, to support a number of the company’s new (& transformation) programs.

He is responsible for leading the security solution design for various projects, whilst translating the domain architecture principles into practical steps while assessing architectural designs against security policy, ensuring risks are anticipated and mitigation plans are put in place and suggest such changes as necessary.

To do this, it is essential to keep up with new challenges and threats to the security industry. Additionally it will be expected that he should apply knowledge of current industry security solutions and align these trends to the programs, the business and IT issues.

Reporting to the Head of IT (depends on Organization size and structure), a Security architect will ultimately be responsible for spearheading the overall security architecture from the strategy through to the delivery and maybe even leading a small team.

Further key responsibilities for this role could include the following, depending on the size of the organization & its requirements

• Threat management and Incident response investigation.
• Design, implementation, review and maintenance of technical security controls.
• Manage the development and growth of all technical security controls across networks and applications.
• Understand and track emerging threats and technologies and their potential threat to the organisation
• Lead the solution architecture function and project teams working on cyber security initiatives
• Interface with internal security departments and liaise with external security experts
• Clearly communicate security and risk issues to both technical and non-technical stakeholders

On the whole he will be expected to enhance the security roadmap of existing systems requiring transformation as well as the new Projects.

I am an IT Consultant providing help in areas of Information Security, Project Management, and Process Excellence. For more information, Pl contact me through my website Anil Oberai, C.E.O of Oberai IT Consultancy

What to do if your friends receive email messages from your email id & name, to transfer some money into a unknown persons account ?

What to do if your friends receive email messages from your email id & name, to transfer some money into a unknown persons account ?

I saw this urgent message today from a friend's Facebook page : 

I am producing here as general awareness is important . while flagging out names and identities of persons to save their identities as case is under investigation.

“Hi All, Please go thru this msg seriously as it happened with me two days before and I want each one of you to be aware of it”

“My name is abc and I have a factory in bbb,  My accounts head hhh received a mail from my email ID saying that I need to transfer some urgent money to a person. So please send the details which are required to transfer the money. He thought that since this mail has come from me, immediately sent a standard format which asks for details like name, account number and bank details. He did not have any doubt since the mail was addressed to him with his name hhh and my full name – ABC was mentioned in the signature in the mail (my email ID is abc@mailserver.domain.in and no one can know my full name just from my email ID) 

Within 10 minutes he got a reply giving all the details and asking for an amount of Rs RRR to be transferred. The money was to be transferred to someone by name of NAME having his accounts in kkk bank, ccc branch. Since the mail came from my email ID, my accounts head did not have any doubt, but before transferring the money he called me to find out if this money needed to be transferred from my personal account or company account. I was shocked to know as I had not sent any such mail. That time I was in factory only. I immediately rushed to his seat and to my horror there were mails from my ID. I checked on the server if someone had hacked my password and was sending mails directly from server. But there was no mail being sent from the server.

I immediately contacted my IT consultant who handles our website and when he checked he found out that these mails were coming from some other email ID from Africa, but what was seen on the screen was my ID. 

To investigate further I sent one of my accounts person to kkk bank ccc branch to find out about this account in which payment had to be transferred. They informed that this is about a month old account and many such transactions have taken place where money is coming and going out from this account. They also told that this type of fraud is specially happening with people who are in exports import business as their mails go throughout the world thru different servers. 

I decided to inform this episode to our association President – Mr GGG and on his advice we have even informed the Police. He has promised to pursue this matter and get the account blocked of that person NAME in kkk bank and also further investigate to find out the culprit. 

What surprises me is that the hackers knew that I am the person who is the decision maker in our company and hhh is our accounts head. We have more than nn email IDs in our company. It means that the hacker would have gone thru all these mails to figure out who are the right persons whose ID he can use to get this money.

I would request all of you to be cautious of sending online payment requests by email and if you are sending then put a system in place where there is a double check through phone.”

An examination of the case suggests that it could be an insider’s job. Someone who may have known abc and hhh the acounts head. The fraudster was an expert and used name aliases in email (unfortunately this is very easy to do in email.. you can change the senders name and id -- what appears to the recipient). But immediately on seeing the subject of transfer money to NAME  you should have checked the details of the email.. that’s how your IT Consultant found out and through reverse DNS he could see the email was from an IP address in Africa with of course the alias names of abc and hhh.. the insider could be a person working in the email service provider, the bank or even in abc’s office. But One thing you can try to pre-empt this kind of problem in enabling the 2 factor authentication. I am an IT Consultant providing help in areas of Info Security, Project Management, and Process Excellence. I have helped clients in such kind of frauds - Pl contact me through my website https://aniloberai.blogspot.in/

What are the precautions of things to do when you are joining new company as a Project Manager?

What are the precautions of things to do when you are joining new company as a Project Manager?

There are certain expectations of Sr. management, and Team Members from a new joinee designate Project Manager.

Expectations differ from Company to company, the ones which are large sized, viz. ones which are start ups or medium sized , whether they are a software driven company, a civil construction or real estate company, or a company into EPC, (Engg. Procurement, Commissioning) etc. Every company needs Project Managers but their culture and expectations are quite different.

A large software services or Products company has already a number of Project Managers on board, so you will report first to the HR, they will tune you in their orientation program of 2–3 days into the company ‘s operations. A start up on the other hand may or may not have 1 or 2 PMs on board and their expectations are very high about the PM, that he will bring a sea change and desired results and even revenue to the company in shortest time. Here, HR may not be there, so you will report directly to the CEO or one of Directors on the board. It is here that you will feel lost initially, as the Director’s and CEO’s thinking may be in business terms and everybody may not be aware of the reason why you were recruited in first place.

One thing is clear, where ever you join, a PM is a Leadership position with people having following expectations, which you should be able to meet or exceed in the first week itself after joining :

1. Leadership – Project Managers need excellent communication and negotiation skills and must be confident relating to and working with a wide range of people. It’s particularly important to understand the strategic needs of the business to deliver the project’s desired outcomes.
2. Problem-solving – Savvy Project Managers should be able to identify risks, manage expectations, and allocate limited resources to deliver a quality project that meets the business’s needs.
3. Adaptable – should be comfortable with change, and flexible to the project’s needs, Project Managers are great multi-taskers.
4. Highly organised – Strong and accurate time and financial management skills and processes so that Project Managers can keep an eye on the big picture while also ensuring the small details are taken care of.
5. Technical – Should have strong domain knowledge of the Project they are managing, and the fact that you are working with highly skilled technical teams means that you require experience in a variety of technical platforms and methodologies including PMP, CMMI, Agile or SCRUM. Invest in Training and gathering knowledge around you.

Nevertheless, a PM should always look positive, think positive and do positive, from day one, that is what the management wants.

So, get going and Good Luck !!

To know more about us and read my articles, Please visit my website ABOUT US

How is a Project Manager rated ?

How is a Project Manager rated ?

In my opinion, Project Manager’s rating works in 2 ways .

a. For small to medium sized projects with quick deliverables and small teams :

Project managers earn 100 points for completing a project. But if the project isn't completed on time, the project manager gets points deducted from his score—say two points for every week the project is late.

Similarly, if the project comes in over budget or is implemented with defects, the project manager loses points—such as a half a point for each defect found within 60 days of the project going live or half a point for each one percent the project went over budget.

Project size is also taken into consideration according to its number of function points.

Organizations can subtract more or fewer points from a project manager's score depending on which elements of project success (e.g. time, budget and quality) they wish to emphasize. For instance, if an organization prizes speed over quality, and if a project manager misses the go-live date, the project manager could be deducted five points for each week the project was late instead of two.

Above has been adopted from the Zaitz’s methodology. Though Zaitz's methodology is focused on objective metrics, it takes into consideration stretch goals, such as early delivery of projects and technical productivity (getting more done with fewer resources or for less money), and soft skills .

For example, if project managers complete their projects ahead of time or under budget, they can earn bonus points (especially if quality is not compromised.)

b. For the larger Projects where Requirements play an important role and need to be frozen before Project implementation

I feel the CMMI has rightly mentioned the KPAs which are of a function or organization but largely driven by a passionate Project Manager’s leadership .

Level 2 (Managed ) organization

Requirements management

Project Planning

Project Monitoring and Control

Supplier Agreement Management

Measurement and Analysis

Process and Product Quality Assurance

Configuration Management

Level 3 - Defined Organization

Requirements Development

Technical Solution

Product Integration

Verification

Validation

Risk Management

Decision Analysis and Resolution

Integrated Project Management

Organizational Process Focus

Organizational Training

Project Manager’s role is changing rapidly and a Rating system can be evolved after knowing the Organization’s background, its products and services, culture and SWOT of the organization in the competitive environment of Time to market its products and/or services. For details Pl contact Anil Oberai, who has more than 2 decades experience in Project Management, Consulting, Business Process Excellence and Be-Spoke consultancy. Visit http://aniloberai.blogspot.in/

Why does executive management refuse to function as a project sensor?

Top (Executive) Management is interested in getting the job done at the lowest cost, in the quickest time, with minimum number of resources (yes, they cost money !!). They want all aspects of scope to be covered and with least number of problems from the end product .

A Project Manager on the other hand, is concerned with the triple constraints of Scope of work, Time, and cost. Quality (or Performance) becomes the fourth constraint . He has to work within these constraints called as Triple constraint triangle.

The time constraint refers to the amount of time available to complete a project. The cost constraint refers to the budgeted amount available for the project. The scope constraint refers to what must be done to produce the project's end result. These three constraints are often competing constraints- increased scope typically means increased time and increased cost, a tight time constraint could mean increased costs and reduced scope, and a tight budget could mean increased time and reduced scope.

A Project Manager has to do three things - communicate, communicate, communicate to the stake holders (starting from Top Management to Team Members) the vision ( & status) of the Project. He can not do the project in isolation . A person designated as Project Sponsor is the Executive management Representative who normally gets the Project funding done.. ensure that a Sponsor is there and take him into confidence on Project Management and reporting. Top management have their other problems , so do not burden them (or even the sponsor) with micro management .. only major issues or issues affecting the Triple constraints described above and you get going , man.

Good Luck !!

To know more about us and read my articles, Please visit my website ABOUT US