Security considerations in portfolio project management software for e-government

¶ … initiatives require bold solutions, and the Abu Dhabi Plan for 2030 represents an excellent opportunity to provide timely and cost-effective solutions that will help achieve the visionary goals of the Government's leadership, past and present. The Plan requires the Urban Planning Council to oversee the management of the Plan and ensure it remains on schedule and on budget. Beyond these fundamental needs, a number of other priorities have been incorporated into the overall Plan, making project management a particularly challenging enterprise. Moreover, because of the sensitivity of the performance data that is involved, it is vitally important that collaboration between affected stakeholders remains secure. Conventional approaches such as telephonic, postal or emailed exchanges are all vulnerable to delay and misinterpretation at best and compromise by others at worst. Therefore, the secure communications network envisioned in this study represents a useful framework in which to provide key stakeholders with access to the information they need when they need it, as well as providing varying levels of access to the system depending on specific user credentials and requirements. A summary of the research and important findings are presented in the concluding chapter, together with recommendations for future studies.

Table of Contents

Chapter 1: Introduction

Statement of the Problem

Purpose of Study

Importance of Study

Objectives of the Study

Scope of Study

Rationale of Study

Overview of Study

Chapter 2: Review of Related Literature

Chapter 3: Methodology

Data Collection

Calculations

Technical Information

Chapter 4: Results

Failure Analysis

Safety Analysis

Chapter 5: Discussion

Chapter 6: Conclusion, Recommendations and Future Research Suggestions

Table 1. Types of information security attacks

Table 2. Identifying relevant project performance metrics for the secure communications network

Table 3. Representative commercial software applications for PPM secure collaboration and data sharing

Table 4. Components of the solution's System Security Plan

Table 5. Risk assessment of Abu Dhabi's information technology resources

List of Figures

Figure 1. Conceptual design of the capital district looking southeast in Plan 2030

Figure 2. Project flow pursuant to Plan Abu Dhabi 2030: Urban Structure

Framework Plan

Security Considerations in Portfolio Project Management Software for e-Government Applications

Chapter 1: Introduction

Recently, the Government of Abu Dhabi announced its ambitious Plan Abu Dhabi 2030: Urban Structure Framework Plan, representing a comprehensive plan for the development of the city of Abu Dhabi in coming years. This overarching plan is intended to guide the planning and decision-making process for policymakers for the coming decades. In addition, the Government of Abu Dhabi also announced the establishment of a new Urban Planning Council that is tasked with the oversight of the plan's implementation as well as the additional development of the corresponding urban planning policy (Plan Abu Dhabi 2030, 2010). The promotional literature for the plan states that the initiative was created in response to the vision of His Highness Sheikh Khalifa bin Zayed Al Nahyan, President of the UAE and Ruler of Abu Dhabi, based on the need to continue the achievement of the grand design originated by the late Sheikh Zayed bin Sultan Al Nahyan as well as to respond to the needs of the dynamic Abu Dhabi in its expanding role as a global capital city (Plan Abu Dhabi 2030, 2010). The Plan contains ten policy statements that contain relevant specifications for a wide range of specific project performance measures, including land uses, building heights and transportation plans; these ten policy statements articulate the Government's goals for the entire metropolitan area of Abu Dhabi pursuant to the Plan. By 2030, the Plan projects the city's population to increase to more than 3,000,000 residents. In response to this growth, the Plan also includes provisions for expanded new areas of Emirati housing that are based on traditional family structures of local communities; in addition, a wide range of housing alternatives at differing price ranges is being integrated as a priority for the Plan as shown in Figure __ below (Plan Abu Dhabi 2030, 2010).

Figure 1. Conceptual design of the capital district looking southeast in Plan 2030

Source: Urban Structure Framework Plan, 2010 at http://gsec.abudhabi.ae/Sites/GSEC/Content/EN/PDF/Publications/plan-abu-dhabi-mandate-and-executive-summary, property=pdf.pdf

The ambitious plans articulated in Plan 2030 are being implemented during a period in the city's development that is also characterized by significant events in the marketplace that may introduce some constraints to progress or otherwise affect the management of the project. For example, in his description of the Plan, Williams emphasizes that, "Being a net lender rather than a borrower has enabled Abu Dhabi to cushion its economy against the global recession. Despite all these great fundamentals to show Abu Dhabi as the perfect place to invest, there will be the worry amongst property investors that it will jump on the bandwagon, creating an over-supply of property and little thought to its development plan" (2009, p. 30). On the one hand, the Plan was formulated in large part to respond to these marketplace forces. In this regard, Williams notes that, "Dubai has experienced an over-supply of property, causing prices to freefall in a recession whilst its citizens can do nothing but sit in traffic on Sheikh Zayed road and watch. Investors will be cautious that they are not caught out again; because Abu Dhabi helped fund a large part of Dubai's construction boom, though, they have sat back and made notes as the skyscrapers penetrated the clouds. The result has been the creation of Plan Abu Dhabi 2030, a grand master plan dictating the development of Abu Dhabi city in considerable detail" (Williams, 2009, p. 30). On the other hand, though, even the bold vision articulated in the Plan may not be adequate to meet the city's current, short- and long-term needs. For example, Williams adds that, "Despite projections that the population of Abu Dhabi will rise from more than one million to more than three million by 2030, the city of Abu Dhabi is being built to incorporate expected demand; however, developers cannot build fast enough to meet demands of the current growing population, never mind those that are expected to call Abu Dhabi their home in 2030" (2009, p. 30). The high priority assigned by the Central Government to the Plan's success is also made clear by this authority: "Developments are restricted, making over-supply virtually impossible. Developers do not have a free rein of where and how much to build, the plans are meticulous, building work remains on schedule no matter the global economy. Furthermore, $200 billion is being spent to ensure the infrastructure is built first" (Williams, 2009). Given the enormity of the investments that are involved, it is important to identify opportunities to facilitate the management of the project. Therefore, to realize the goals of Plan Abu Dhabi 2030: Urban Structure Framework Plan, though, it is vitally important for the project's leadership and engineering teams to have access to a collaborative project management system that ensures sufficient information security, a need that directly relates to the issue considered in this study which is discussed further below.

Statement of the Problem

The project idea consists of enhancement unified portfolio management software with project management application for all Abu Dhabi government entities that will address the relevant security issues that are involved. Although these security considerations differ from stakeholder to stakeholder, a good example of what types of sensitive information is involved concerns the budgetary data used for Portfolio Project Management applications. In this case, at the beginning of every year Department of Finance (DOF) issue yearly budget for all Abu Dhabi government upon their needs to fund their projects on the plan for each year. Before issuing the budget each government propose their project to the Executive Council in order to study the projects and approve its budget upon the need of Abu Dhabi Government. (Note: Entities on the government propose their projects on papers and electronic copy on CD that means no security of the information especially if it's military information). Once the idea is approved by the Executive Council the case will be forwarded to the Department of Finance (DOF) in order to issue the budget. After that Executive Council & Department of Finance (DOF) they follow the project statues by asking the owner of the project to submit reports about the project statues.

Purpose of Study

Upon what we had described about the manual work we want to build unified software and secure it to help Abu Dhabi government representative by Executive Council to study the projects, follow up them through one system by one click. However it helps them saving money from waste. For example Abu Dhabi municipality is working on AL Salam Street, they build the infrastructure and they specify their needs from the equipment; at the same time Etisalat would like to connect Fiber Cable on that area. Instead of waiting to complete AL Salam Street to be done from work, Etisalat will be working in parallel with municipality without crash the infrastructure again. Also using the same material; by building this technology we allow the decision maker to see the requirement from each project and decide on the right decision, saving money, time and effort. The following diagram represents the structure of the idea.

Figure 2. Project flow pursuant to Plan Abu Dhabi 2030: Urban Structure Framework Plan

Objectives of the Study

The overarching objective of this study is to build a solid portfolio management application that connects all the local governments of Abu Dhabi emirates in ways that will allow them to collaborate on various projects pursuant to Plan Abu Dhabi 2030 through one unified system from their offices without wasting time on face-to-face meetings, as well as introducing the potential for the leaking of information through channels that provide the opportunity for unauthorized access. This objective also include the need to develop a solid it security infrastructure by building strategies, recruiting qualified staff, implementing the latest technologies and best practices as identified in the research.

The study was guided by the following specific objectives:

1. Achieve cost effectiveness once the portfolio management software is applied to the needs of the Abu Dhabi Government;

2. Identify how much the solution will save in terms of time, money, and efforts if it is applied;

3. Determine how the initiative will affect the utilization of existing resources;

4. Identify optimum approaches for ensuring the project is updated regularly and monitored with regards to its budget; and,

5. The risks the will inevitably be faced.

Importance of Study

Information security has become one of the most important and challenging issues facing today's organizations. With pervasive use of technology and widespread connectedness to the global environment, organizations increasingly have become exposed to numerous and varied threats (Rotvold, 2008). Information security is the process and techniques of protecting information, data, system infrastructures, networks, and so forth. It protects its availability, privacy and integrity from any unwanted habits from any malicious actions by accessing to stored information on computer databases has increased greatly. A lot of companies and industries store business information and individual information on computer than ever before. Much of the information stored is highly confidential and not for public viewing. That means data are more valued than the money. All the businesses are fully dependent on information especially Military, Governments (E-Government), Banks, etc. Most of the information nowadays is now gathered, analyzed, processed and stored on database computers. That information exchanged and transmitted across networks through LAN (Local Area Network) and WAN (Wide Area Network) to other computers.

Scope of Study

The core principles of Information Security are: Confidentiality, Integrity and Availability. Confidentiality, Integrity, Availability, Authenticity, Risk management is the main concept of securing any it infrastructure (portfolio for Abu Dhabi government). Also we should include Incident response plans

Rationale of Study

According to Essex (2005), a wide range of increasingly sophisticated project management tools have been introduced in recent years and these project management tools and their corresponding analytical methodologies have transformed the manner in which large projects are managed today. In almost every way, information technology has influenced project management or has the ability to do so if approached in thoughtful ways. The field of collaborative software solutions has identified a number of different approaches that can be used for these purposes, with a secure intranet representing one of the more common and cost-effective alternatives that are available. In this environment, the need security in these collaborative communications networks directly relates to the criticality and sensitivity of the information that is introduced on the network. Therefore, it is important to ensure that the collaborative project management environment remains secure from the start and throughout its administration.

Overview of Study

This paper used a six-chapter format; chapter one introduced the topic under consideration, a statement of the problem, the purpose and importance of the study, as well as its scope and rationale. Chapter two provides a critical review of the relevant and peer-reviewed literature, and chapter three presents the study's methodology, a description of the study approach, the data-gathering method and the database of study consulted. Chapter four presents the research results, including failure and safety analyses. Chapter 5 provides a discussion of the research and chapter 6 presents the study's conclusion and recommendations for directions in future study.

Chapter 2: Review of Related Literature

Sniffing Attack

Packet sniffing refers to the technique of copying each packet as it flows across the network. Conceptually it is similar to wiretapping, and is usually initiated by internal users.

Spoofing

Pretending to be someone you're not by re-configuring a network address to make it appear that you're at a different address (mail spoofing), pretending to be somebody else's machine (IP spoofing) or pretending to be somebody else's Web site (Web spoofing).

'Man-in-the-Middle' Attack

Usually achieved by attaching a virtually invisible window that remains open as other sites are visited. With the help of this window, the intruder captures all the information sent to other Web sites (e.g. passwords, account numbers, Web pages).

Denial-of-Service (DOS) Attacks

These render target systems inaccessible to legitimate users. In a typical DOS attack, hackers flood companies' Web servers and communication links with an SYN/ACK (synchronize/acknowledge) packet, temporarily preventing access. Such attacks can pose serious problems for companies whose very business depends on the ability to serve customers on the Web.

Suppression of Audit Trails

An insider or outsider changes the system settings and turns off the audit trail.

Back Door/Trap Door

A hole in the system's security deliberately left in place by designers or maintainers. The motivation for such holes is not always sinister; some operating systems, for example, come out of the box with privileged accounts intended to be used only by field service technicians or the vendor's maintenance programmers.

Stealing File Backups

Stolen file backups violate the concept of confidentiality. Recovering data from an altered file backup causes you to lose the integrity of the data completely.

Exploiting Known Operating System/Application Software Weaknesses

Whether Unix, Linux or NT, each operating system has well-known weaknesses. If the software is not updated regularly with the most recent software patch, the potential to lose system security and data integrity exists.

Buffer Overflows

This type of attack deliberately enters more data than a program was written to handle. By "overflowing" the region of memory set aside to accept it, the extra data overwrites another region of memory meant to hold some of the program's instructions. The values introduced become new instructions, giving the attacker control of the target computer.

Malicious Corruption/Destruction of Data/Logic Bombs

A code surreptitiously inserted into an application or operating system that causes it to perform a destructive or security-compromising activity whenever specified conditions are met (e.g. The Y2K problem).

Collaborative Misuse of System Privileges

Users with different system privileges act together to eliminate the existing security system.

Exploiting Trust Relationships and Social Engineering

The hacker plays on people's generally trusting nature and their natural instinct to help others do their jobs (e.g., using telephone or e-mail, a colleague who lost his/her password asks the assistance of the help desk).

Password Guessing and Cracking

A password cracker is any program that can decrypt passwords or otherwise disable password protection. The most common methods are the brute force and dictionary attacks. The brute force attack is used when there is no additional information on the password, so the attacker tries all possible combinations -- one-character, two characters, etc. A long and mixed-character password significantly decreases brute force speed. If crackers know that the password contains a certain word, they may use the dictionary attack instead -- where only words from the computer's dictionary are tested as password candidates. The most powerful attack is the "rule-based attack." In this case, crackers know that a password consists of the word and a one or two-digit number. They write the rule so the program generates only suitable passwords (e.g. user25, password23, etc.

Viruses

Malicious programs designed to spread and replicate from computer to computer through telecommunication links, or shared computer diskettes and files.

Trojan Horses

A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive.

Worms

A program that replicates itself as a separate entity is called a "worm," not a virus. A worm may also be a Trojan horse if it disguises itself as something useful or amusing to persuade you to execute it.

Source: Elifoglu, 2002, p. 68

As the costs of software security breaches become more apparent, there has been a greater interest in developing and implementing solutions for different aspects of the problem in recent years (Hahn & Layne-Farrar, 2006). For example, following the terrorist attacks of September 11, 2001, the information technology community has been actively involved in developing secure collaborative online networking environments for governments around the world, particularly with a focus on how to prosecute the global war on terrorism and the threats to information security these forces represents. The results of a study by Hahn and Layne-Farrar (2006) identified the following security considerations for information technology initiatives for e-government and related applications:

1. Software security problems come in many different shapes and sizes; therefore, the appropriate solutions will depend on the nature of the problem.

2. Although attacks are becoming more common, the available data does not clearly establish that each aspect of software security poses a significant problem in terms of the damages inflicted by a breach. Some problems impose large costs on different groups, both in preventive and corrective costs. Other problems appear to function as more of a nuisance.

3. Contrary to the prevailing view that market failures in the provision of software security are serious, some software users, particularly businesses, may face fairly strong incentives to take reasonable precautions. In response to this demand, several innovative market-based solutions have emerged to address a number of software security problems.

4. Although some of the regulatory proposals for addressing security may be worth considering, most would require modification to ensure they do more good than harm. Moreover, broad interventionist proposals are difficult to justify given our findings about market-led responses. Instead, the best role for the government would be to encourage the collection of more detailed data used to better inform policymakers on the need for specific actions. Furthermore, government agencies should seek to optimize their own security (Hahn & Layne-Farrar, 2006, p. 283).

Project managers assigned PPM responsibilities must ensure that it security threats and vulnerabilities are identified early on during the design phases because the costs required to implement effective security controls and practices during the early stages of project development are much less than those involved when the system is already in place. Moreover, ensuring adherence to security-based software development practices will help avoid deficiencies, instead of implementing them after the solution is implemented (Mentz, King, Thong, Leo & Mataev, 2005).

Beyond the foregoing, other factors that must be taken into account during the design and implementation phases of the PPM initiative include the need to incorporate adequate security control baseline into all phases of system development, operations, maintenance, and disposal (Mentz et al., 2005). According to this authority, "Including information system security early in the SDLC for an information system will usually result in less expensive and more effective security than adding security to an operational system. NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle, presents a framework for incorporating security into all phases of the SDLC process, from definition to disposal" (Mentz et al., 2005 p. 37).

Although the secure collaborative communications network that forms the solution envisioned in this study could assume a number of configurations, most if not all of the features that are needed are provided by an intranet. Based on an expansion of operating protocols that were developed for Internet applications, Intranets are becoming increasingly commonplace in organizations of all sizes and types (Milner, 2000). According to this authority, intranets can provide the level of security required for the solution: "In what is now commonly referred to as the internal information and knowledge engine of all types of organisations, networked across offices, locations and, in some instances, national boundaries. Properly constructed, it should offer, at appropriate levels of security clearance, a way of empowering an employee to navigate the most suitable, and value-adding path through the organization's operating structures, information holdings and knowledge base" (Milner, 2000, p. 112). Given the numerous users and their different clearance levels to the network, a secure intranet represents a useful alternative for the Plan's needs. In this regard, Proctor and Vu emphasize that, "Intranet technologies better enable users to obtain the information they want from the technology, instead of waiting for the information to be placed in front of them. Equally, intranets better enable users to push information, via the use of technology, instead of relying on the other, less efficient, less reliable models of communication" (2005, p. 542).

Moreover, a secure intranet avoids many of the vulnerability problems that are inextricably associated with any network that relies on the Internet. As Proctor and Vu point out, "Furthermore, when access is only internal, a company has the potential for better control of information security than that of paper documents. Intranets hold great promise for organizational learning, for along with nonlinear flow of knowledge, intranets enable real-time exchanges of knowledge that users have the ability to shape to meet their working and information needs" (2005, p. 542). Most importantly, perhaps, is the ability of a secure intranet to allow users to identify new ways to use the system to better achieve their respective organizational goals (Proctor & Vu, 2005).

With regards to the security features available for intranets, there are several alternatives and levels of protection that are available that are specifically designed for the public sector, with the most commonly used approach being a "firewall," a feature that has received considerable public sector use (Milner, 2000). In fact, firewall security measures are being used to support the Government Secure Intranet (GSI) project in the UK that is intended to improve the distribution of internal information within the public sector (Milner, 2000). According to this authority, "Defined as a 'powerful network security tool consisting of hardware and software that allow organizational access to Internet resources whilst prohibiting unwanted incursions from the Internet into your organization, a firewall is also a flexible security tool which can be applied selectively, if so desired, allowing easy external access to areas where this is held not to be problematic or indeed is seen as positively desirable, while permitting security and protection to be provided to other more sensitive areas of operation" (Milner, 2000, p. 37). Finally, another security-related issue that should be considered throughout the developmental phases of the solution includes the need to identify what type of encryption should be used for the various types of data that may be shared within the network (Milner, 2000). This aspect also introduces new training considerations and the need for ongoing oversight to ensure that established security protocols are followed by all network users.

Chapter 3: Methodology

Data Collection

The data needed for this study was collected from public and university libraries, as well as reliable online resource services such as Questia as well as relevant governmental online resources. Data collection proceeded in a step-wise fashion, focusing first on general issues related to a centralized "one-stop-one-click" secure communications network that would satisfy the needs of the vision articulated for the city of Abu Dhabi by 2030 in the Government's Plan and then proceeding to examine the specific communications needs for this initiative and where this information could be obtained and these issues are discussed further below.

Calculations

A preliminary analysis of the affected current stakeholders with a demonstrated or potential need for access to the secure communications network is needed to make some informed projections concerning the scope of the project. For this purpose, the matrix developed in Table 2 below could be used to perform the calculations necessary to identify relevant stakeholders and their corresponding project performance metrics.

Table 2

Identifying relevant project performance metrics for the secure communications network

Stakeholder

Responsibility

Possible Performance Metric(s)

Urban Planning Council: Current membership includes:

His Highness Sheikh Mohammed Bin Zayed Al Nahyan

Crown Prince of Abu Dhabi, Chairman of the Executive Council,

Chairman of the Abu Dhabi Urban Planning Council

His Excellency Khaldoon Khalifa Al Mubarak

Chairman of the Executive Affairs Authority,

Deputy Chairman of the Urban Planning Council

His Excellency Sheikh Sultan Bin Tahnoon Al Nahyan

Chairman of Abu Dhabi Tourism Authority

His Excellency Mohammed Ahmad Al Bawardi

Secretary General of the Abu Dhabi Executive Council

His Excellency Dr. Jouan Salem Al Dhaheri

Chairman of Abu Dhabi Department of Municipal Affairs

His Excellency Nasser Ahmed Al Suweidi

Chairman of Abu Dhabi Department of Planning and Economy

His Excellency Abdulla Rashid Al Otaiba

Chairman of Abu Dhabi Department of Transport

His Excellency Majid Al Mansouri

Secretary General of Environment Agency, Abu Dhabi

In addition, most of these stakeholders also oversee several other departments that will be affected by the Plan and will have differing responsibilities for performance measures.

Tasked with optimizing the city's development through a 25-year program of urban evolution. Pursuant to this responsibility, the Council is required to ensure that the Plan remains environmentally sound, protects cultural assets, while fostering Arab/Muslim-based communities that enjoy well designed architectural spaces. This general mission can be measured in a number of ways, including the possible performance metrics shown in the column to the right; other metrics could be added or supplemented as the need is identified and added to the PPM database.

1. Budget adherence;

2. Overall schedule performance;

3. Level of resident citizen participation.

4. Efficiency of operations.

5. Effectiveness of oversight.

6. Effectiveness of environmental initiatives.

Government Entities: It is reasonable to suggest that virtually all Abu Dhabi Government entities will become involved to some extent as the Plan progresses, but some of the current entities that will play an important role in the progress of the Plan include:

1. Abu Dhabi Authority for Culture & Heritage;

2. Abu Dhabi Chamber of Commerce & Industry;

3. Abu Dhabi Council for Economic Development;

4. Abu Dhabi Customs Administration;

5. Abu Dhabi Educational Zone; and,

6. Abu Dhabi Food Control Authority (to name just a few).

The overall responsibility for these performance metrics is the Central Government. The Government entities that fall under their purview will all have different -- and unique -- access needs to the secure communications network, but the general performance metrics described in the column to the right could be used to identify the types of data needed for the PPM analysis and specific quantifiable performance metrics could then be formulated for these measures. In addition, this step could be used to identify those individuals the agency wants to have access to the solution, and at what level(s). Password and username assignments could then be made for authentication purposes; standard protocols will be used to ensure these authentication tools remain secure and fresh by having users change their settings from time to time and other precautions as appropriate.

1. How responsive is the entity in providing requested data (either routine or special requests);

2. How accurate is the data that is provided?

3. Do managers provide timely feedback concerning the relevance and/or cost effectiveness of the metrics being used?

4. Schedule compliance.

5. Budget adherence.

Plan 2030 Project Management and Professional Team: Besides key leaders from the Central Government, this team is also comprised of numerous consultants and advisors from Canada, France, the United States Australia and Lebanon.

A portfolio management process is highly cross-functional and typically led by the senior operations manager. It is a comparative, scenario-based process intended to drive resolution of constraints and priority conflicts. It serves to validate that plans and tactics employed are consistent and achievable. The iterative / scenario-based method can be challenging to manage. Hundreds of different scenarios might exist. Subject matter experts might be better able to analyze alternatives than functional managers. For efficiency, one would prefer to decentralize analysis, with conflicts resolved centrally. Most project tradeoffs are straightforward and can be made in a rapid manner; however, some represent boundary conditions or cross-group constraints that require a focused, efficient and rapid resolution method. This is where senior management attention should be most valuable (Seider, 2006).

For each iteration, projects must re-establish their value and importance relative to every other existing or proposed new project. The model forces a project prioritization to take place. Getting multiple product-line managers or business-unit general managers to agree on a business-wide prioritization is challenging, but, once done, proves highly valuable to the organization. While the process is being executed, it is intense and consuming. Because the process evaluates the entire portfolio, it can involve many in middle management and subject matter experts (Seider, 2006).

Metrics would evaluate optimal intervals for project evaluation. Generally, the process should be run at regular intervals-biannually for some companies, quarterly for others. The need for efficiency is particularly important the more frequently it runs (Seider, 2006).

Plan 2030 contractors and subcontractor (potentially thousands of affected stakeholders)

Contractor- and subcontractor- specific

Contractor- and subcontractor- specific

Technical Information

There are a number of commercial PPM software applications that are available that could potentially satisfy the needs of the secure communications network solution envisioned herein, including those described further in Table 3 below.

Table 3

Representative commercial software applications for PPM secure collaboration and data sharing

Vendor/Web site

Product Name/Description

Key Attributes

Pacific Edge:

http://www.serena.com / company / news/pr/spr_10202006. html

Pacific Edge Mariner, the Company's flagship product that began shipping in October 2005, combines portfolio, project, resource, demand, and financial management into an integrated decision-support framework for an organization's PPM initiative. As a powerful and practical-to-adopt solution, Mariner's capabilities can be configured to an organization's specific levels of it process maturity. As it organizations mature, more advanced Mariner capabilities can be enabled to drive additional value from their PPM initiatives.

This top-down approach of portfolio management, if well-integrated with detailed, bottom-up project data, can help ensure that investments achieve business alignment (Essex, 2005). Also contains tools for identifying business goals and evaluating project portfolios by their contributions toward those goals (Essex, 2005).

Niku Corp.:

http://www.ca.com / us/public-sector-ppm.aspx

Company offers public sector-specific PPM packages that also contain tools for identifying business goals and evaluating project portfolios by their contributions toward those goals (Essex, 2005).

The public sector PPM package has the following key attributes:

1. Increase alignment of investments with mission;

2. Better forecast resource needs and budget funds accordingly; and,

3. Accelerate delivery of government compliance reports.

ProSight Inc.:

http://www.2020software.com/products/Primavera _Systems_ProSight.asp

Primavera ProSight has been built specifically for proposing, planning and controlling portfolio investments, ranging from it projects to capital programs, in a collaborative manner. Capabilities of this Primavera software include portfolio management, decision-support graphics, what-if scenarios, dependencies, proven scalability, secured access, automatic alerts, integrated detailed planning and collect investment ideas.

This package also contains tools for identifying business goals and evaluating project portfolios by their contributions toward those goals (Essex, 2005).

The technical information needed for the PPM analysis of the solution's progress would therefore depend on the selection of the software package and would be obtained from the vendor as part of the contractual negotiations for support and consultation.

Chapter 4: Results

Failure Analysis

Given the supply chain nightmares that could erupt at any time that would disrupt the progress of the solution envisioned herein -- and by extension -- the progress of the Plan for 2030, the potential for failure in varying degrees exists along the entire continuum of the project's management. Beyond the two extremes of minimal disruption to catastrophic failure, there also exists a broad range of security implications that cannot be quantified in strictly economic terms. As noted above, several priorities were established to gauge the success of the secure communications network solution envisioned herein, with these priorities being used for the first part of the corresponding failure analysis with regards to how well the solution addresses the following:

1. Achieve cost effectiveness once the portfolio management software is applied to the needs of the Abu Dhabi Government;

2. Identify how much the solution will save in terms of time, money, and efforts if it is applied;

3. Determine how the initiative will affect the utilization of existing resources;

4. Identify optimum approaches for ensuring the project is updated regularly and monitored with regards to its budget; and,

5. The risks the will be faced.

The second part of the failure analysis concerns the economic impact of this initiative which is projected in Table 4 below.

Table 4

Projected economic impact of the solution

Area

Description

Metrics

Projection

How does project portfolio management software reduce project costs and/or improve Return on Investment (ROI)?

1. Provides a centralized forum for collaboration among key stakeholders.

2. Maintains focus on budget and schedule.

1. Time-cost of stakeholders involved (X).

2. Time spent using the solution rather than existing communication methods.

Although the salary levels of the top government leadership and other key stakeholders (X) are proprietary and confidential and are therefore not readily available, depending on how much time each stakeholder invests in using the collaborative forum (Y), this figure could easily run into the tens of millions of dollars as illustrated in Table 5 below.

How does securing information for project portfolio management detect from cost and increase productivity or value of information?

Progress reports from project managers and feedback from key government officials are frequently classified; compromise of this data is not easily quantifiable but could threaten project progress or otherwise detract from productivity.

Varies

Varies

How does project portfolio management software improve efficiency and utilization of resources?

Project portfolio management software will help improve work efficiency and allow completion of the project on or before scheduled with a concomitant increase in contractor/subcontractor profit levels (X) and the potential cost of such additional profits to the Government (Y).

This calculation would depend on how much faster the project was completed with the solution (months or possibly years) compared to how long it would require without the solution based on the following metrics:

1. Additional profits to project contractors / subcontractors for project completion on or before schedule (X).

2. Potential cost to Government (Y).

Varies

Table 5

Projected Costs Savings of Solution for Plan for 2030

Users

Time/Cost

Years of Use

Total Potential Savings

(Estimate)

Present Day-2030

Subtotal

Total

Key Ministry Officials

$1,000,000

19

$19,000,000

Contractors

$750,000

19

$14,250,000

Subcontractors

$500,000

19

$9,500,000

$42,750,000

Assuming a total cost of design and implementation of the solution envisioned herein of $2,500,000, the potential return on investment could amount to $40,250,000, depending on the respective salary and benefits levels of the ministry officials involved in the project and the corresponding compensation rates of the other key stakeholders.

Safety Analysis

The foregoing failure analysis will be supplemented by an ongoing safety analysis of the project including the issues that emerge during implementation and subsequent administration. For this purpose, the PPM's Project Portfolio Life Span (PPLS) analytical approach will be used. This model consists of five-phased elements as follows:

1. Identification of needs and opportunities (effective governance);

2. Selection of the best combinations of projects (the portfolios);

3. Planning and execution of the projects (project management);

4. Product launch (acceptance and deployment of deliverables); and,

5. Realization of benefits (efficient operational usage) (Wideman, 2006).

These five metrics can be applied to aggregate performance data to target deficiencies in project management in terms of budget, scheduling, or the other measures being used to gauge performance, in order to identify opportunities for improvement in the communications system and trend any performance issues or security breaches that may have comprised the integrity of the network. These five metrics will be integrated into an overall system security plan for the solution that specifies the specific security risks that are involved as well as the required levels of access that will be needed for the various users of the secure communications one-click network. According to Mentz et al. (2005), a typical system security plan (SSP) establishes relevant access parameters based the potential level of impact (Low, Moderate, High) for each of the security objectives of confidentiality, integrity, and availability of federal information and information systems. In addition, the SSP should clearly set forth the various procedures that will be followed to test the security measures that are in place and to document these findings (Mentz et al., 2005). These are also essential elements in order to have the solution certified by accreditation organizations (Mentz et al., 2005).

The SSP for the solution will include the following components described in Table 6 below:

Table 6

Components of the solution's System Security Plan

SSP Component

Description

System Boundary Summary

Describes what constitutes the system for the purposes of the SSP.

IT System Security Categorization and Sensitivity

The System Security Categorization classifies the system as a Major Application or a General Support system. The Security Sensitivity identifies the potential level of impact as Low (limited impact), Moderate (serious impact), or High (severe or catastrophic impact) for confidentiality, integrity, and availability of federal information and information systems. The categorization and sensitivity determines the minimum management, operational, and technical security controls required for information and information systems.

Configuration Management Approach

Develop the approach for managing change over the development and production life cycle of the system -- application and operating system software, configuration settings, interfaces, and hardware. Note: A security risk assessment differs greatly from a project risk assessment. A security risk assessment assesses the security risks to the information system itself whereas a project risk assessment assesses the project risks.

Contingency and Disaster Recovery Approach

Prepare an approach for responding to man-made or natural incidents or disasters.

Preliminary Security Risk Assessment.

The basic assessment of the confidentiality, integrity, and availability risks that help determine what security controls are necessary to protect the information contained in this information system

Source: Mentz et al., 2005

In addition, relevant precautions and controls that are conventionally used for the security of information technology initiatives including requisite policies, procedures, or mechanisms of hardware or software that can minimize or eliminate potential vulnerabilities and threat events will need to be developed at the organization-specific level (Andress, 2003). According to Andress (2003), for project management purposes, threats are defined as events that can be reasonably expected to be imminent that holds the potential to cause damage or loss to an information technology network system, with six basic components of risk being specifically related to supporting information and technology resources as shown in Table 7 below:

Table 7

Risk assessment of Abu Dhabi's information technology resources

Type of Threat

Description

Threat agent (intentional/unintentional acts)

The threat agent risk element relates specifically to human-caused or technology-based threat events, such as the accidental cutting of a critical underground power or communications line or the intentional launch of a cyber attack. The threat is the human element or the specific technological resource that causes loss.

Exposure factor

This risk metric provides a percentage measure of potential loss-up to 100% of the value of the asset.

ingle-loss exposure value (asset value x exposure factor)

This risk metric presents the expected monetary cost of a threat event. For example, an earthquake might destroy critical information technology and communications resources, thereby preventing an organization from billing its clients for perhaps weeks-until replacement resources can be established-even though the necessary information might remain intact. Financial losses from a single event could be devastating. Alternatively, the threat of operational errors costing individually from hundreds to a few thousands of dollars-none devastating or even individually significant-might occur many times a year with a significant total annual cost and loss of operational efficiency.

Frequency (annualized rate of occurrence)

Threats can occur with great frequency, rarely, or anywhere in between. Seemingly minor operational threats can occur many times every year, adding up to a substantial loss. Potentially devastating threats-such as a 100-year flood, a fire, or a hack who destroys critical files-might occur only rarely. Annualizing threat frequency allows you to address the economic consequences of threat events in a sound fiscal manner, much as actuarial data for insurance enables insurance companies to provide valuable, and profitable, services to their clients.

Probability of loss (annualized)

Probability of loss is the chance or likelihood of expected monetary loss attributable to a threat event. For example, loss to operational error might extend from a 10% chance of losing $10 million annually to a 1% chance of losing $1 billion annually, provided the right combinations of conditions are met. Note that there is little utility in developing the probability of threat events for anything other than relatively rare occurrences. The probable monetary loss can be useful in budgeting.

Annualized loss expectancy (annual rate of occurrence x single-loss exposure)

T he simplest expression of annualized loss expectancy is derived from threat frequency multiplied by single-loss exposure. For example, given an annual rate of occurrence of 10% and a single-loss exposure of $10 million, the expected loss annually is 10% -- and (0.1) x $10 million = $1 million. This value is central in the cost-benefit analysis of risk mitigation and in assuring proportionality in resources allocated to information security.

Source: Andress, 2003, p. 28

Chapter 5: Discussion

In any environment, ambitious visions require ambitious responses, but these responses must also be thoughtful and well crafted in order to provide the outcomes needed for success. This is certainly the case with the stated goals of the Government of Abu Dhabi and their vision for the city's future over the next decade and a half. The secure but accessible communications network envisioned in this study provides a viable solution to a wide range of constraints and obstacles that go hand in hand with any complex project. The research was consistent in emphasizing that one of the keys to successful uses of Portfolio Project Management was selecting projects that were most appropriate and amenable to its use. The project envisioned by the Government of Abu Dhabi is a textbook example of such an appropriate project, given its wide ranging but not atypical secure communication needs.

While it was beyond the scope of this study, it is reasonable to suggest that the Government, like governments around the world, have their own specialized security measures in place that also provide many -- if not all -- of the features provided by this solution. Nevertheless, the research indicated that there was no "one-stop" secure online resource for agency managers who need updated data as well as top-level governmental officials who rely on timely performance data to ensure the project remains on time and on budget. Therefore, given the scope and enormity of the resources that are involved in this overall enterprise, the PPM also represents a useful tool for ensuring that the secure communications network envisioned herein remains on time and on budget. For instance, these points are also made by Essex who notes that, "Besides portfolio management, networked collaboration tools-Web portals, messaging and groupware-are arguably the biggest technology trend to hit it project management. Improved team collaboration remains critical to the success of it project management. Armed with numbers that can show executives the total picture of it projects and committed resources, it departments now are better equipped to succeed not only by managing themselves better, but by setting realistic performance expectations for others in the organization" (2005, p. 37).

No matter how expensive and state-of -- the art the it resources may be, and no matter how conscientious the software engineers and program managers are in their duties, the potential for security breaches remains (Kolb & Abdullah, 2009). Therefore, an important consideration in deploying the solution is a comprehensive training module that can be delivered in various formats, including workshops, seminars, a self-paced Web-based program, CD/DVDs, and so forth. This training module will provide opportunities for new users to experiment with the system to determine how things work and look, and what they can expect from its use. Paramount throughout this training, though, is the need to promote security awareness at all levels. In this regard, Kolb and Abdullah report that:

While possessing the latest hardware, software, and security controls in an it environment, it is still possible for any organization to be subjected to a security breach. A Security Awareness program is one of the layers of defense in an organization's information security architecture. Such an awareness program must consist of surveying the audience and conducting training sessions to educate end-users. Additionally, monthly newsletters, posters, calendars and other such tools can be used for continuous awareness. Metrics must be developed to measure the effectiveness of the security awareness program (Kolb & Abdullah, 2009)

These authorities also recommend that third-party providers should be used to help evaluate the effectiveness of the security measures that are used in secure collaborative networking environment such as the solution envisioned herein (Kolb & Abdullah, 2009). These third-party evaluations can also help determine how well users of the network are complying with relevant security policies and procedures (Lineberry, 2007). Finally, to help develop an organizational culture that keeps the need for security foremost in its mindset, motivational tools such as security-awareness posters for the workplace and incentive rewards that would be awarded to those network users who identify security flaws or can otherwise contribute to the efficiency of the PPM.

Chapter 6: Summary, Conclusions and Future Research Suggestions

Summary

The focus of this study was a secure communications network solution that could facilitate the management and oversight of the Government of Abu Dhabi's Plan for 2030. The stakeholders who are involved in this massive enterprise are affected in several ways, including the need to share information on a real-time basis but in ways that ensure it remains restricted to those who have appropriate clearance and a need to know, as well as being able to access relevant management reports that show their progress and can help them fine-tune their allocation of resources where they are needed the most. The implementation and administration of the Plan will require the best communications response available, and there will be an ongoing need for reevaluation of the solution's effectiveness and its performance over time. Like with other communications tools, though, experience will help identify opportunities for improvement, but there is an overarching requirement for any communications solution to be as secure as possible in the highly vulnerable environment that exists for any communications network.

The research clearly showed that the Urban Planning Council, as well as the numerous other governmental agencies and private vendors with a need to share data can take advantage of the one-stop secure collaborative resource represented by this solution. This solution is also consistent with the stated goals that were articulated by the Government with regards to the vision of His Highness Sheikh Khalifa bin Zayed Al Nahyan, President of the UAE and Ruler of Abu Dhabi as a way to fulfill this ambitious vision founded on the grand design that was developed by the late Sheikh Zayed bin Sultan Al Nahyan. This solution is also congruent with the requirements of the Plan as it applies to helping Abu Dhabi become the leading global capital city that is envisioned by its leadership.

Conclusion

The secure communications network solution described in this study represents a valuable tool that can help achieve the vision of the Government leadership in highly cost-effective ways that keeps security at the forefront of its functionality. There are literally thousands of potential stakeholders who will have varying degrees of involvement with the Plan, and many of these will either be required to provide input into the PPM system or use the results of the performance analyses that it generates to fine-tune their allocation of resources. There are some profound training, transition and cost considerations involved in the solution, though, that will require careful oversight to ensure that, like the Plan itself, the project remains on time and on budget. Because of the importance -- and potential sensitivity of the information being exchanged, though, security considerations should not only be integrated into the solution early on, there is a need for close collaboration with project administrators concerning how the authentication process is accomplished. Therefore, taken together, it is clear that a standardized approach to administering the security procedures needed to implement and operate the solution will also be required.

Finally, given the high level of multinational participation in the Plan, language preferences of the individual users, types of languages needed, and the potential impact that using different language might have on the security measures used. In other words, just because a security measure protects data in English, the same security measures might not function as effectively -- or at all -- unless careful attention is given to the translation and consistency of the operatives used for these purposes. Therefore, the impact of these issues on the security measures used should be included as part of the implementation and administration of the solution envisioned herein.

Future Research Suggestions

1. Further research should be conducted to develop metrics for measuring the need and effectiveness of security assessment programs for similar e-government applications.

2. What security considerations are the most important for PPM analyses?

3. How does a secure one-click communications network facilitate project management?

4. How does a secure one-click communications network hinder project management?

Can a set of best practices be discerned from the international experience with other secure one-click communications network implementations and administration?

5. References

Andress, a. (2003). Surviving security: How to integrate people, process, and technology.

Boca Raton, FL: Auerbach.

Bhimani, a. (2003). Management accounting in the digital economy. Oxford: Oxford University

Press.

Cooper, R.G., Edgett, S.J. & Kleinschmidt, E.J. (1998). Portfolio management for new products. Cambridge, MA: Perseus Books.

Elifoglu, I.H. (2002). Navigating the 'information super highway': How accountants can help

clients assess and control the risks of Internet-based e-commerce. Review of Business,

23(1), 67-69.

Essex, D.E. (2005, October). In search of ROI. PM Network, 19(10), 46-47.

Hahn, R.W. & Layne-Farrar, a. (2006). The law and economics of software security. Harvard Journal of Law & Public Policy, 30(1), 283-285.

Kolb, N. & Abdullah, F. (2009). Developing an information security awareness program for a non-profit organization. International Management Review, 5(2), 103-104.

Lineberry, S. (2007). The human element: The weakest link in information security. Journal of Accountancy, 204(5), 44-45.

Mentz, G., King, B., Thong, C., Leo, D. & Mataev, M. (2005, November 18). Project management guide. International Project Management Commission. Retrieved from http://www.projectmanagementcertification.org/managernotes/_printable.html.

Proctor, R.W. & Vu, K.L. (2005). Handbook of human factors in Web design. Mahwah, NJ:

Lawrence Erlbaum Associates.

Rotvold, G. (2008, November/December). How to create a security culture in your organization.

Information Management Journal, 42(6), 32-33.

Seider, R. (2006). Optimizing project portfolios. Research Technology Management, 49(5), 43-

44.

Wideman, H.A. (2006, August 17). Project Portfolio Management: A practical guide to selecting projects, managing portfolios and maximizing benefits. Vancouver, BC:

AEW Services.

Williams, D. (2009, October 1). Property market is entering relatively mature stage. The Birmingham Post, 30.

Approve the project from the executive council after discussing the project value for Abu Dhabi government and what the value will be added, its priority, required budget to be finance. After all those criteria evaluated, executive council follow up the project statues.