Best practices, ITIL, SOA - still only buzzwords to many organisations. ACN talks to an IT manager who is implementing all three: Zaki Sabbagh, CIO at Zamil Industry Investment Company (ZIIC), and asks him what the real business benefits of standardisation are.
Arabian Computer News
Can you give an outline of how your IT department works with the rest of the business, and the work you're doing on standardisation?
For us, we are one IT organisation, which supports 13 business units. We have one data centre, one organisation, we have integrated networks, standardised processes based on ITIL, we have SLAs between us and our business units. We have implemented most of the monitoring processes like availability management, change management, incident management - all the deliverables, the delivery and support processes.
It's about discipline at the end of the day - without having these, we wouldn't be able to monitor and benchmark our performance for every business unit, and make targets for them.
It's a culture change - this is the only difficult area of it. You need to push people to act in a disciplined way, and go with the life-cycle of any process. What simplifies things is the automation - when these processes are governed by an automated tool, this will simplify the implementation of it. This is what we have done - for example with the change management.
Is there a specific return on these standardisation efforts, in terms of reduced cost or other returns?
We are going through a transformation process to be a profit centre; so far, out of 13 business units, we are three profit centres and ten recovery cost centres. The profit centres are companies we acquired recently or a sister company that we're giving support through an outsourcing model. In these cases the return is very clear, because we give them a certain cost per service - this is the price of workplace management, the price of email, and so on. We have identified internally the costs of these services to us.
For the areas we provide for internally as a recovery centre, the RoI has been identified in the strategic planning. For example, we're working on two areas: we support existing services, and try to improve them; and we also manage new projects. For new projects we identify the potential RoI coming out of these projects for the business unit, such as improving performance, or quality or production or revenue. This is monitored by the strategic planning process.
What advice would you give to other organisations which are starting out on this process?
Not to waste a lot of time, but to go and apply best practices straight away. ITIL is very flexible - it's not a bible, to be implemented as-is. It's a set of processes that should be mapped to suit the organisation, and then to be modified to a certain extent, based on the organisation's needs.
What makes things easy now, is that all these processes are fully integrated with the three components of IT - people, processes and technology. The full cycle is now supported by so many vendors - this will help in achieving the full integration.
So now these processes can be integrated with the infrastructure management - this is a huge area which is being addressed across the region - the proactive support of the infrastructure.
This is also one of the key trends I'm seeing in the region - huge projects are going on in this area. And it is now easy to implement, because it is easy to integrate with other processes, such as impact management, prediction management, optimisation, configuration management, SLA - the list goes on.
What is the day-to-day impact of implementing these processes?
Most organisations cannot now afford to have any downtime, depending on the SLAs they have. The enterprise sector cannot afford email downtime, or spam, or to be hacked or have another security breach. In order to avoid these problems, you have to manage your infrastructure proactively, in order to predict the problem before it happens, and take action to improve your availability - this is what infrastructure management means.
These areas are currently ad-hoc for many enterprises - if the server stops they upgrade it; if the hard disk is full, they add another; if the performance is slow they replace something. But these are all handled to the degradation of the service. I don't remember in the last three years, I don't remember any downtime in ZIIC's email service - you can consider this an achievement, as we cannot afford to have any downtime, or security breaches in our services - these are mission-critical services.
This is absolutely down to the approach we take towards managing IT - it's a business continuity issue. To reach the business layer, in terms of applications, there are six or seven layers before the business application layer - you have infrastructure, network, security, and so on. That's why you'll see a trend to see hosted services in the region.
Why are so many enterprises using hosted services? It relieves them of a lot of hassle, in order to ensure the availability of IT services. To do it themselves requires a lot of investment in the data centre - in electricity, air conditioning, redundancy, backup. These are all unseen issues to the business - they don't know about it, and they don't see it directly. It requires a lot of focus and investment for an enterprise to maintain its own infrastructure.
There have been a number of reports which suggest enterprises are resistant to managed services: do you think that organisations in KSA and the Middle East are ready for these services?
There are three issues. First, there is no proper infrastructure in the region, in terms of connectivity. Second, these services in the region are not governed by any local laws - you cannot go to the court and say ‘this company failed to support me'. It's all personal agreements. The big providers are taking advantage of this coming into the region - they have their brand name, and they're trusted. They know people will come to them and not to smaller local companies. Third, there are security issues - people always feel it is a security issue whenever they move data. And fourth, there is a cultural issue - this requires education. Now, I've seen this issue improving a great deal in the Middle East.
There is also a lot of infrastructure work going on in Saudi Arabia - in one year's time, I think we will have an excellent infrastructure here, whether it is through WiMax, or fibre-optics or Wi-Fi or whatever technology.
For the past three or four years, we have seen a lot of very big projects in KSA, and I think it's about time - within the next year or two years - for these to be fully completed.
The technology is improving a great deal - there has been a lot of standardisation recently - but the complexity of technology is increasing. Therefore, you see that companies coming into the region, they don't want to spend two or three years establishing a full IT setup - instead they will go to a hosting service, to host their applications.
I don't see this yet here in Saudi Arabia much, but there's a lot of discussion. There's a cultural change - two or three years from now, hosting will be much more reasonable in Saudi Arabia.
There's been a lot of confusion about the value of SOA, or even what SOA is - do you think enterprises here are now getting their heads around SOA, and seeing the value of it?
SOA is not something new - it's ten years' old. But now it's an additional burden on IT, even if you go to the technical level - one more layer to be managed, to be added to on the in-house applications or the enterprise applications. But at the same time, this will really facilitate the mapping of a business process, and how it works within the application itself.
For instance we have a huge SOA project being rolled out to integrate all our factories across the world - Saudi Arabia, Ras Al Khaimah, Vietnam, Egypt, India.
We have already had the proof-of-concept - and without an SOA model we wouldn't be able to develop these integration models.
SOA is about simplifying the integration - it is definitely something that will change the way programs and computer systems are developed, compared to what we had in the last 30 years. Everything - every development and application - is SOA-enabled. In the future you will see companies running Oracle financials, integrating manufacturing suites, along with Siebel CRM, with SAP business intelligence - all fully integrated. Why? Because there are now standards to allow software to integrate with other systems.
With the rise in popularity of hosting services, how do you see the current trend towards large data centre deployments?
Companies which are in need of disaster recovery solutions - it's a waste of money for them to build another data centre. Instead they should be looking at using a hosted service - otherwise it's duplicate money, duplicate effort, and poor utilisation. So in the DR area, not investing in a data centre is a much better option.
Companies such as banks, however, cannot put their financial data - their main data centre - into some external hosting service. They may consider hosting for DR, but not their main systems.
Organisations which are directly linked to the national economy, such as Saudi Aramco - they cannot afford the risk of going to an external service, and they don't want it. They don't have a problem with money to invest in IT, and it's a national issue.
But when it comes to areas such as manufacturing - our sector - it can be different. We have 45 area offices around the world, and we are implementing CRM for one of the companies. I told the business: ‘I cannot host a CRM for you and make it available 24x7, with the existing infrastructure and existing investment'. So we went to an on-demand CRM on the web - this has reduced the risk and reduce the investment for us.
For certain services, such as ERP, we cannot have them hosted somewhere else - it is a core system. But for CRM, we cannot provide 24x7 support, 24x7 monitoring for the database growth. If you go to the US, part of the service agreement for hosted services is, for example, that transactions will be processed within ten seconds. If it goes beyond ten seconds, the transaction is free of charge.
So this requires a lot of management, and investment in services and technology, to achieve this result.
So will the data centre boom last, or will more enterprises move towards hosting?
For SMEs, they will definitely not be using data centres - hosted services make a lot more sense for them.
We have invested a lot of money in our security - for example we block more than a million spam emails a month, as well as a lot of hacking activity. We are opening a factory in Ras Al Khaimah - in order to achieve the same level of security at the new site, we would have to spend a lot of money. So we are hosting the site's email here in Saudi Arabia and delivering it to a local server in the UAE, through a secure link.
At the same time, we will see a lot of companies investing heavily in their data centres - it's going in both ways, with some big data centre implementations on one side, and hosting on the other.